0

I need to fuzz a communication between a client-server application written in Java. Already set up a MITM (burp), so I am able to see every request. The request body is a soap-xml document where some keys are exchanged. I would like to fuzz the request header and the request body also, where the keys are placed. What would be the best choice? Is there any fuzzer which is suited more to request header or to the xml body fuzzing? Is there any preferred libary/fuzzer for fuzzing Java?

2

I would look at using the Intruder in Burp Suite.

Capture an initial request using the proxy, send it to the intruder then you can mark your fuzzing candidates including headers enter image description here

Configure your list of payloads that would like to fuzz with and launch the attack enter image description here

as you can see, we have replaced the headers and can see the responses

enter image description here

  • Well, yes I know this option. I am more interested in a scenario, where you know the product and the communication, so you are able to reproduce the protocol also. Therefore, it is possible to send crafted(fuzzed) requests to the server. – r0bag Jun 8 '17 at 13:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.