Description

This pull request adds a "sniper" mode to ffuf. This lets you specify payload locations using template characters, and ffuf will then run through each one. TLDR, this now works:

./ffuf -w wordlist -u http://127.0.0.1:8000/test?feature=§aaa§&thingie=§bbb§&array[§0§]=§baz§ --mode sniper

ffuf will hit each of the payload locations above, one after the other, while preserving the other values.

Here's some background before delving into the details.

The main issue is that using ffuf to hunt for vulnerabilities rather than do content discovery can be rather clunky. What I'd like to do is take a single request that I'm interested in, highlight the locations I want to attack, and then have ffuf go through and smash my word-list at each value, one after the other, while preserving the legitimate values in the other fields I've highlighted.

Currently, a single request would need multiple command line runs and multiple request files (if you use ffuf with request files instead of building out every request by hand with flags), one for each fuzzing location. For example, the following request (an attempt to log in to GitHub):

POST /session HTTP/1.1
Host: github.com
...snip...

commit=Sign+in&authenticity_token=...redact..&login=foo&password=bar&trusted_device=&webauthn-support=supported&webauthn-iuvpaa-support=unsupported&return_to=..redact..&allow_signup=&client_id=&integration=&required_field_9b00=&timestamp=..redact..&timestamp_secret=..redact..

This would need a 14 different request files for just value side of the POST parameters, each with a FUZZ parameter. When looking at an entire application this becomes problematic. With the sniper mode that this pull request implements, instead of using 14 different request files, there is just one:

POST /session HTTP/1.1
Host: github.com
...snip...

commit=§Sign+in§&authenticity_token=§...redact..§&login=§foo§&password=§bar§&trusted_device=§§&webauthn-support=§supported§&webauthn-iuvpaa-support=§unsupported§&return_to=§..redact..§&allow_signup=§§&client_id=§§&integration=§§&required_field_9b00=§§&timestamp=§..redact..§&timestamp_secret=§..redact..§

The section sign characters can be added in vi using ctrl-k followed by shift+S+E. There are key combos for windows/macos/linux/whatever detailed here

This pull request touches a fair bit of ffuf's internals, which I'll try go over in some detail.

General arch

I tried to integrate these changes with the existing ffuf design without changing the internals too much wherever possible. The new sniper mode is a thin veil over the clusterbomb mode. It generally works like this:

• The user specifies sniper mode, and the options parser does some checks to make sure the arguments are sane.
• The input word-list is loaded as per the clusterbomb mode, with FUZZ used as the keyword
• The job runner logic starts (Start()) and if sniper mode is configured, then the requests are parsed for template characters (§)
• An array of requests is returned by SniperRequests, with one location specified by the user replaced by FUZZ in each request.
• A queue job is created per request
• The job runner continues as-per usual

Change summary

• main.go - minor changes for new mode string
• input/input.go - minor changes to support the new mode string
• interactive/termhandler.go - Queue jobs are no longer just for recursion jobs, so the language has been changed in the termhandler to reflect that.
• runner/simple.go - Prepare() has been modified to take a Request parameter, rather than build a new Request struct from the global config.
• ffuf/config.go - InputProviderConfig now includes a Template string field which holds the payload locator symbol used by sniper mode.
• ffuf/interfaces.go - RunnerProvider has been tweaked such that Prepare now requires a base request.
• ffuf/job.go - QueueJob structs now hold a Request field, this is the base request used by each QueueJob when it's running. Start() has been modified to implement the sniper request parser when necessary, and additional changes made to the other methods to support pulling the base request for each job out of the queue struct.
• ffuf/optionsparser.go - Changes for the additional mode and a validator for sniper configuration. This now handles the modes prior to dealing with wordlists/input commands.
• ffuf/optionsparser_test.go - New file, implements test logic for the sniper validator.
• ffuf/request.go - New methods to generate requests from the current config, copy requests and handle sniper request parsing logic.
• ffuf/request_test.go - New file, tests for the new Request functions