How to make wfuzz perform a request to retrieve CSRF token to include in the main request?
I've previously used
patator, which includes the options
before_fgrep for performing a request to extract e.g. a CSRF token to include in the main request.
However, I cannot find such options in
wfuzz, although it's said to be much more flexible and support any aspect of web fuzzing.
How can I make a request, extract data from it, and include the data in the main request?
wfuzz to brute-force username/password not protected by a CSRF token.
wfuzz.py -c -z file,users.txt -z file,pass.txt — sc 200 http://www.site.com/log.asp?user=FUZZ&pass=FUZ2Z