3

I have a web application I am wanting to fuzz. It consists of a lot of REST webservice gets/puts. I have been considering using Sulley Fuzzing Framework or its successor boofuzz.

Since the jsessionid and/or other authentication cookies change for each time the user logs into the application what is the best way to handle logging into the application and then to grab the necessary cookies.

Can I then add them as s_static parts of my sully/boo session?

Any tips / pointers to documentation would be helpful. Also if there is a better tool to use I would consider it as well.

Thanks

Improve this question
1
  • 2
    If you need help with particular frameworks it would be nice if you could link them. In general, why don't you just write a script that performs the authentication and feeds the session cookie into your fuzzer?
    – Arminius
    May 9, 2017 at 2:36

1 Answer 1

Reset to default
0

As you asked for other tools, here's a vote for the (amazing) Python Requests library. It makes writing your own tools way easier than it used to be. Writing automated logins is dead easy.

Improve this answer
1
  • I have been working with requeststoday and it is pretty simple
    – dnraikes
    May 9, 2017 at 21:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .