devbox
空白诗007
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

Afuzz：一款功能强大的自动化Web路径模糊测试工具

作者：空白诗007 | 2024-07-08 18:49:47

赞

踩

afuzz

关于Afuzz

Afuzz是一款功能强大的自动化Web路径模糊测试工具，该工具专为Web安全专家和漏洞奖励Hunter设计，可以帮助我们以自动化的形式扫描和收集目标Web应用程序中的页面、语言和相关统计分析等数据。

功能介绍

1、Afuzz可以通过自动化的形式检测目标Web应用程序所使用的开发语言；

2、使用黑名单过滤无效页面；

3、使用白名单寻找漏洞奖励Hunter感兴趣的页面内容；

4、过滤页面中的随机内容；

5、以多种方式判断404错误页面；

6、扫描完成后执行统计数据分析，并生成最终的结果；

7、支持HTTP2；

工具安装

由于该工具基于Python开发，因此我们首先需要在本地设备上安装并配置好Python环境。接下来，广大研究人员可以直接使用下列命令将该项目源码克隆至本地：

git clone https://github.com/rapiddns/Afuzz.git

然后切换到项目目录中，使用pip工具和项目提供的requirements.txt文件安装该工具所需的其他依赖组件：

cd Afuzz

pip install -r requirements.txt

依赖组件安装完成后，执行下列安装脚本即可：

python setup.py install

除此之外，我们还可以直接使用pip工具安装Afuzz：

pip install afuzz

工具选项

参数解释

-h, --help             显示工具帮助信息和退出

  -u URL, --url URL      设置目标URL

  -o OUTPUT, --output OUTPUT

                        输出文件路径

  -e EXTENSIONS, --extensions EXTENSIONS

                        扩展列表，逗号分隔 (例如: php,aspx,jsp)

  -t THREAD, --thread THREAD

                        线程数量

  -d DEPTH, --depth DEPTH

                        最大递归深度

  -w WORDLIST, --wordlist WORDLIST

                        字典文件路径

  -f, --fullpath           完整路径

  -p PROXY, --proxy PROXY

                        代理, (例如:http://127.0.0.1:8080)

工具运行

使用命令

afuzz -u https://target
afuzz -e php,html,js,json -u https://target
afuzz -e php,html,js -u https://target -d 3

多线程使用

afuzz -e aspx,jsp,php,htm,js,bak,zip,txt,xml -u https://target -t 50

工具运行样例

afuzz -u http://testphp.vulnweb.com -t 30

扫描结果

数据表

  1. +---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
  2.  
  3. |                                                                                    http://testphp.vulnweb.com/                                                                                    |
  4.  
  5. +-----------------------------+---------------------+--------+-----------------------------------+-----------------------+--------+--------------------------+-------+-------+-----------+----------+
  6.  
  7. |            target           |         path        | status |              redirect             |         title         | length |       content-type       | lines | words |    type   |   mark   |
  8.  
  9. +-----------------------------+---------------------+--------+-----------------------------------+-----------------------+--------+--------------------------+-------+-------+-----------+----------+
  10.  
  11. | http://testphp.vulnweb.com/ | .idea/workspace.xml |  200   |                                   |                       | 12437  |         text/xml         |  217  |  774  |   check   |          |
  12.  
  13. | http://testphp.vulnweb.com/ |        admin        |  301   | http://testphp.vulnweb.com/admin/ | 301 Moved Permanently |  169   |        text/html         |   8   |   11  |   folder  |   30x    |
  14.  
  15. | http://testphp.vulnweb.com/ |      login.php      |  200   |                                   |       login page      |  5009  |        text/html         |  120  |  432  |   check   |          |
  16.  
  17. | http://testphp.vulnweb.com/ |     .idea/.name     |  200   |                                   |                       |   6    | application/octet-stream |   1   |   1   |   check   |          |
  18.  
  19. | http://testphp.vulnweb.com/ |    .idea/vcs.xml    |  200   |                                   |                       |  173   |         text/xml         |   8   |   13  |   check   |          |
  20.  
  21. | http://testphp.vulnweb.com/ |        .idea/       |  200   |                                   |    Index of /.idea/   |  937   |        text/html         |   14  |   46  | whitelist | index of |
  22.  
  23. | http://testphp.vulnweb.com/ |       cgi-bin/      |  403   |                                   |     403 Forbidden     |  276   |        text/html         |   10  |   28  |   folder  |   403    |
  24.  
  25. | http://testphp.vulnweb.com/ | .idea/encodings.xml |  200   |                                   |                       |  171   |         text/xml         |   6   |   11  |   check   |          |
  26.  
  27. | http://testphp.vulnweb.com/ |      search.php     |  200   |                                   |         search        |  4218  |        text/html         |  104  |  364  |   check   |          |
  28.  
  29. | http://testphp.vulnweb.com/ |     product.php     |  200   |                                   |    picture details    |  4576  |        text/html         |  111  |  377  |   check   |          |
  30.  
  31. | http://testphp.vulnweb.com/ |        admin/       |  200   |                                   |    Index of /admin/   |  248   |        text/html         |   8   |   16  | whitelist | index of |
  32.  
  33. | http://testphp.vulnweb.com/ |        .idea        |  301   | http://testphp.vulnweb.com/.idea/ | 301 Moved Permanently |  169   |        text/html         |   8   |   11  |   folder  |   30x    |
  34.  
  35. +-----------------------------+---------------------+--------+-----------------------------------+-----------------------+--------+--------------------------+-------+-------+-----------+----------+```

JSON格式数据

  1. {
  2.  
  3.     "result": [
  4.  
  5.         {
  6.  
  7.             "target": "http://testphp.vulnweb.com/",
  8.  
  9.             "path": ".idea/workspace.xml",
  10.  
  11.             "status": 200,
  12.  
  13.             "redirect": "",
  14.  
  15.             "title": "",
  16.  
  17.             "length": 12437,
  18.  
  19.             "content_type": "text/xml",
  20.  
  21.             "lines": 217,
  22.  
  23.             "words": 774,
  24.  
  25.             "type": "check",
  26.  
  27.             "mark": "",
  28.  
  29.             "subdomain": "testphp.vulnweb.com",
  30.  
  31.             "depth": 0,
  32.  
  33.             "url": "http://testphp.vulnweb.com/.idea/workspace.xml"
  34.  
  35.         },
  36.  
  37.         {
  38.  
  39.             "target": "http://testphp.vulnweb.com/",
  40.  
  41.             "path": "admin",
  42.  
  43.             "status": 301,
  44.  
  45.             "redirect": "http://testphp.vulnweb.com/admin/",
  46.  
  47.             "title": "301 Moved Permanently",
  48.  
  49.             "length": 169,
  50.  
  51.             "content_type": "text/html",
  52.  
  53.             "lines": 8,
  54.  
  55.             "words": 11,
  56.  
  57.             "type": "folder",
  58.  
  59.             "mark": "30x",
  60.  
  61.             "subdomain": "testphp.vulnweb.com",
  62.  
  63.             "depth": 0,
  64.  
  65.             "url": "http://testphp.vulnweb.com/admin"
  66.  
  67.         },
  68.  
  69.         {
  70.  
  71.             "target": "http://testphp.vulnweb.com/",
  72.  
  73.             "path": "login.php",
  74.  
  75.             "status": 200,
  76.  
  77.             "redirect": "",
  78.  
  79.             "title": "login page",
  80.  
  81.             "length": 5009,
  82.  
  83.             "content_type": "text/html",
  84.  
  85.             "lines": 120,
  86.  
  87.             "words": 432,
  88.  
  89.             "type": "check",
  90.  
  91.             "mark": "",
  92.  
  93.             "subdomain": "testphp.vulnweb.com",
  94.  
  95.             "depth": 0,
  96.  
  97.             "url": "http://testphp.vulnweb.com/login.php"
  98.  
  99.         },
  100.  
  101.         {
  102.  
  103.             "target": "http://testphp.vulnweb.com/",
  104.  
  105.             "path": ".idea/.name",
  106.  
  107.             "status": 200,
  108.  
  109.             "redirect": "",
  110.  
  111.             "title": "",
  112.  
  113.             "length": 6,
  114.  
  115.             "content_type": "application/octet-stream",
  116.  
  117.             "lines": 1,
  118.  
  119.             "words": 1,
  120.  
  121.             "type": "check",
  122.  
  123.             "mark": "",
  124.  
  125.             "subdomain": "testphp.vulnweb.com",
  126.  
  127.             "depth": 0,
  128.  
  129.             "url": "http://testphp.vulnweb.com/.idea/.name"
  130.  
  131.         },
  132.  
  133.         {
  134.  
  135.             "target": "http://testphp.vulnweb.com/",
  136.  
  137.             "path": ".idea/vcs.xml",
  138.  
  139.             "status": 200,
  140.  
  141.             "redirect": "",
  142.  
  143.             "title": "",
  144.  
  145.             "length": 173,
  146.  
  147.             "content_type": "text/xml",
  148.  
  149.             "lines": 8,
  150.  
  151.             "words": 13,
  152.  
  153.             "type": "check",
  154.  
  155.             "mark": "",
  156.  
  157.             "subdomain": "testphp.vulnweb.com",
  158.  
  159.             "depth": 0,
  160.  
  161.             "url": "http://testphp.vulnweb.com/.idea/vcs.xml"
  162.  
  163.         },
  164.  
  165.         {
  166.  
  167.             "target": "http://testphp.vulnweb.com/",
  168.  
  169.             "path": ".idea/",
  170.  
  171.             "status": 200,
  172.  
  173.             "redirect": "",
  174.  
  175.             "title": "Index of /.idea/",
  176.  
  177.             "length": 937,
  178.  
  179.             "content_type": "text/html",
  180.  
  181.             "lines": 14,
  182.  
  183.             "words": 46,
  184.  
  185.             "type": "whitelist",
  186.  
  187.             "mark": "index of",
  188.  
  189.             "subdomain": "testphp.vulnweb.com",
  190.  
  191.             "depth": 0,
  192.  
  193.             "url": "http://testphp.vulnweb.com/.idea/"
  194.  
  195.         },
  196.  
  197.         {
  198.  
  199.             "target": "http://testphp.vulnweb.com/",
  200.  
  201.             "path": "cgi-bin/",
  202.  
  203.             "status": 403,
  204.  
  205.             "redirect": "",
  206.  
  207.             "title": "403 Forbidden",
  208.  
  209.             "length": 276,
  210.  
  211.             "content_type": "text/html",
  212.  
  213.             "lines": 10,
  214.  
  215.             "words": 28,
  216.  
  217.             "type": "folder",
  218.  
  219.             "mark": "403",
  220.  
  221.             "subdomain": "testphp.vulnweb.com",
  222.  
  223.             "depth": 0,
  224.  
  225.             "url": "http://testphp.vulnweb.com/cgi-bin/"
  226.  
  227.         },
  228.  
  229.         {
  230.  
  231.             "target": "http://testphp.vulnweb.com/",
  232.  
  233.             "path": ".idea/encodings.xml",
  234.  
  235.             "status": 200,
  236.  
  237.             "redirect": "",
  238.  
  239.             "title": "",
  240.  
  241.             "length": 171,
  242.  
  243.             "content_type": "text/xml",
  244.  
  245.             "lines": 6,
  246.  
  247.             "words": 11,
  248.  
  249.             "type": "check",
  250.  
  251.             "mark": "",
  252.  
  253.             "subdomain": "testphp.vulnweb.com",
  254.  
  255.             "depth": 0,
  256.  
  257.             "url": "http://testphp.vulnweb.com/.idea/encodings.xml"
  258.  
  259.         },
  260.  
  261.         {
  262.  
  263.             "target": "http://testphp.vulnweb.com/",
  264.  
  265.             "path": "search.php",
  266.  
  267.             "status": 200,
  268.  
  269.             "redirect": "",
  270.  
  271.             "title": "search",
  272.  
  273.             "length": 4218,
  274.  
  275.             "content_type": "text/html",
  276.  
  277.             "lines": 104,
  278.  
  279.             "words": 364,
  280.  
  281.             "type": "check",
  282.  
  283.             "mark": "",
  284.  
  285.             "subdomain": "testphp.vulnweb.com",
  286.  
  287.             "depth": 0,
  288.  
  289.             "url": "http://testphp.vulnweb.com/search.php"
  290.  
  291.         },
  292.  
  293.         {
  294.  
  295.             "target": "http://testphp.vulnweb.com/",
  296.  
  297.             "path": "product.php",
  298.  
  299.             "status": 200,
  300.  
  301.             "redirect": "",
  302.  
  303.             "title": "picture details",
  304.  
  305.             "length": 4576,
  306.  
  307.             "content_type": "text/html",
  308.  
  309.             "lines": 111,
  310.  
  311.             "words": 377,
  312.  
  313.             "type": "check",
  314.  
  315.             "mark": "",
  316.  
  317.             "subdomain": "testphp.vulnweb.com",
  318.  
  319.             "depth": 0,
  320.  
  321.             "url": "http://testphp.vulnweb.com/product.php"
  322.  
  323.         },
  324.  
  325.         {
  326.  
  327.             "target": "http://testphp.vulnweb.com/",
  328.  
  329.             "path": "admin/",
  330.  
  331.             "status": 200,
  332.  
  333.             "redirect": "",
  334.  
  335.             "title": "Index of /admin/",
  336.  
  337.             "length": 248,
  338.  
  339.             "content_type": "text/html",
  340.  
  341.             "lines": 8,
  342.  
  343.             "words": 16,
  344.  
  345.             "type": "whitelist",
  346.  
  347.             "mark": "index of",
  348.  
  349.             "subdomain": "testphp.vulnweb.com",
  350.  
  351.             "depth": 0,
  352.  
  353.             "url": "http://testphp.vulnweb.com/admin/"
  354.  
  355.         },
  356.  
  357.         {
  358.  
  359.             "target": "http://testphp.vulnweb.com/",
  360.  
  361.             "path": ".idea",
  362.  
  363.             "status": 301,
  364.  
  365.             "redirect": "http://testphp.vulnweb.com/.idea/",
  366.  
  367.             "title": "301 Moved Permanently",
  368.  
  369.             "length": 169,
  370.  
  371.             "content_type": "text/html",
  372.  
  373.             "lines": 8,
  374.  
  375.             "words": 11,
  376.  
  377.             "type": "folder",
  378.  
  379.             "mark": "30x",
  380.  
  381.             "subdomain": "testphp.vulnweb.com",
  382.  
  383.             "depth": 0,
  384.  
  385.             "url": "http://testphp.vulnweb.com/.idea"
  386.  
  387.         }
  388.  
  389.     ],
  390.  
  391.     "total": 12,
  392.  
  393.     "target": "http://testphp.vulnweb.com/"
  394.  
  395. }

字典（重要）

1、Afuzz所使用的字典是一个text文本文件，每一个路径单独每一行；

2、关于后缀，Afuzz会使用-e参数提供的后缀替换%EXT%关键词，如果没设置-e的话，则使用默认值；

3、我们可以基于域名来生成字典，Afuzz可以使用主机替换%subdomain%，使用根域名替换%rootdomain%，使用子域名替换%sub%，使用域名替换%domain%；

使用样例

普通后缀：

index.%EXT%

设置asp和aspx后缀将生成下列字典：

index

index.asp

index.aspx

主机：

%subdomain%.%ext%

%sub%.bak

%domain%.zip

%rootdomain%.zip

传递https://test-www.hackerone.com和php后缀将生成下列字典：

test-www.hackerone.com.php

test-www.zip

test.zip

www.zip

testwww.zip

hackerone.zip

hackerone.com.zip

项目地址

Afuzz：【GitHub传送门】

参考链接

https://github.com/xmendez/wfuzz

https://github.com/s0md3v/Arjun

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/空白诗007/article/detail/799782
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号