Practical Security Automation and Testing

Step 2– fuzz testing with sign-in

The basic use of Wfuzz testing with sign-in is shown as follows:

wfuzz -c -z file,name.csv -z file,pass.csv -f Wfuzz_report.html,html -d "userName=FUZZ&password=FUZ2Z&_csrf=" http://nodegoat.herokuapp.com/login

Here is the explanation of how each option is used in our case:

Options	Explanation of use
-c	Color output on the console
-z file,<filename>	Read the values from a file to replace FUZZ, FUZ2Z...FUZnZ. In our example, we have two parameters to be replaced with fuzz data.
-f <Output_filename>,html	Output the result to an HTML file named Wfuzz_report.html
-d "name=FUZZ"	It defines the POST message body. The FUZZ keyword and FUZ2Z will be replaced with the file input, which was defined by ...