Skip to main content

59. Web Application Fuzzing: Finding Hidden Bugs

Fuzzing is a technique that sends unexpected input to an application to discover vulnerabilities, hidden endpoints, and edge cases. This guide covers practical fuzzing techniques for web security testing and CTF competitions.

What Is Web Fuzzing?​

Web fuzzing is the process of automatically sending input variations to a web application and analyzing the following:

  • Hidden directories and files
  • Injection vulnerabilities
  • Authentication bypasses
  • Parameter pollution
  • Rate-limiting issues

Unlike manual testing, fuzzing can test thousands of payloads in minutes.

Essential Fuzzing Tools​

ffuf - Fast Web Fuzzer​

A modern choice optimized for directory brute forcing and parameter discovery:

# Directory fuzzing
ffuf -w wordlist.txt -u https://target.com/FUZZ

# Virtual-host discovery
ffuf -w vhosts.txt -u https://target.com -H "Host: FUZZ.target.com"

# Parameter fuzzing
ffuf -w params.txt -u https://target.com?FUZZ=test

# POST-data fuzzing
ffuf -w payloads.txt -u https://target.com/api -X POST -d "user=FUZZ"

Key features: fast multithreading, response matching/filtering, multiple wordlists, and various output formats.

wfuzz - General-Purpose Fuzzing Tool​

A versatile tool useful for complex fuzzing:

# Multiple injection points
wfuzz -w users.txt -w passwords.txt http://target.com/login?user=FUZZ&pass=FUZ2Z

# Filter by response code
wfuzz -w wordlist.txt --hc 404 http://target.com/FUZZ

Practical Fuzzing Techniques​

Directory and File Discovery​

Start with common wordlists from SecLists or Dirbuster:

# Common files
ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt \
     -u https://target.com/FUZZ \
     -mc 200,301,302,403

# Backup files
ffuf -w /usr/share/seclists/Discovery/Web-Content/backup-files.txt \
     -u https://target.com/FUZZ \
     -e .bak,.old,.backup,.swp

Tip: Fuzzing extensions with -e .php,.html,.txt,.zip often finds hidden resources.

Parameter Pollution​

Test how the application handles duplicate parameters:

# Test parameter precedence
curl "https://target.com/api?id=1&id=2&id=3"

# Array-style parameters
curl "https://target.com/api?user[]=admin&user[]=guest"

Unexpected behavior can occur when the application treats the first, last, or all parameter values differently.

Authentication-Bypass Fuzzing​

Test authentication mechanisms:

# Username enumeration
ffuf -w usernames.txt -u https://target.com/login \
     -X POST -d "username=FUZZ&password=test" \
     -fr "Invalid username"

# SQL injection patterns
wfuzz -w /usr/share/seclists/Fuzzing/SQLi/quick-SQLi.txt \
      -u https://target.com/login \
      -d "username=admin&password=FUZZ"

Filter by response differences: size (-fs), line count (-fl), word count (-fw), and regular expression (-fr).

Header Fuzzing​

Test injection points in HTTP headers:

# User-Agent fuzzing
ffuf -w payloads.txt -u https://target.com -H "User-Agent: FUZZ"

# X-Forwarded-For bypass
ffuf -w ips.txt -u https://admin.target.com \
     -H "X-Forwarded-For: FUZZ" -mc 200

Many applications trust headers such as X-Forwarded-For, X-Real-IP, and X-Original-URL for access control.

Building Effective Wordlists​

Extract keywords from the target site:

# Extract unique words through spidering
cewl https://target.com -d 2 -m 5 -w wordlist.txt

# Combine multiple sources
cat wordlist1.txt wordlist2.txt | sort -u > combined.txt

Build wordlists from reconnaissance:

  • Technology stack (Laravel → routes, api, admin)
  • Domain (finance → payment, transaction, account)
  • Framework patterns (Django → api/v1, admin/, static/)

Fuzzing Strategy​

Progressive Fuzzing​

1. Quick scan - Small wordlist (1k–5k entries) 2. Medium scan - Targeted wordlist (10k–50k) 3. Deep scan - Large comprehensive list (100k+)

Start quickly, then dig deeper based on what you discover.

Response Analysis​

Look beyond status codes:

  • Size anomalies - A different response size may indicate success
  • Timing attacks - A slower response may indicate a database query
  • Error messages - Stack traces reveal technical details
  • Redirect chains - A 302 → 200 sequence may indicate a successful bypass

Rate-Limit Awareness​

Prevent IP blocking:

# Add a delay
ffuf -w wordlist.txt -u https://target.com/FUZZ -p 0.5

# Use proxy rotation
ffuf -w wordlist.txt -u https://target.com/FUZZ -x http://proxy:8080

Common CTF Fuzzing Patterns​

Hidden admin panels - Fuzz /admin, /panel, /dashboard, /manager Backup files - .bak, .old, .swp, .save, ~ Configuration files - .env, .git/config, wp-config.php, web.config API versions - /api/v1, /api/v2, /api/internal Debug endpoints - /debug, /test, /dev, /staging

Quick CTF Script​

#!/bin/bash
TARGET=$1
echo "[+] Quick directory fuzzing"
ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt \
     -u $TARGET/FUZZ -mc 200,301,302,403 -t 50

echo "[+] Checking backup files"
ffuf -w /usr/share/seclists/Discovery/Web-Content/backup-files.txt \
     -u $TARGET/FUZZ -mc 200 -t 50

Fuzzing Best Practices​

Start with reconnaissance - Understand the target before fuzzing Filter noise - Reduce false positives with response size/content filters Test locally first - Understand application behavior before real testing Stay in scope - Fuzz only targets for which you have authorization Document discoveries - Keep logs of successful payloads

Closing Thoughts​

Fuzzing transforms manual testing into automated discovery. Mastering these tools and techniques lets you find hidden vulnerabilities faster, whether in CTF challenges or real security assessments.

Start with directory fuzzing, progress to parameter testing, and always analyze responses carefully. The difference between a 404 and a 403 may be the key to your next bug discovery.

Happy fuzzing!