0

How to make wfuzz perform a request to retrieve CSRF token to include in the main request?

I've previously used patator, which includes the options before_url and before_fgrep for performing a request to extract e.g. a CSRF token to include in the main request.

However, I cannot find such options in wfuzz, although it's said to be much more flexible and support any aspect of web fuzzing.

How can I make a request, extract data from it, and include the data in the main request?

Example: use wfuzz to brute-force username/password not protected by a CSRF token.

wfuzz.py -c -z file,users.txt -z file,pass.txt — sc 200 http://www.site.com/log.asp?user=FUZZ&pass=FUZ2Z

https://securitybytes.io/wfuzz-using-the-web-brute-forcer-1bf8890db2f

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.