Gobuster Section 5 of 13

Generic Fuzzing

The fuzz mode is Gobuster's most flexible feature. It replaces the FUZZ keyword anywhere in an HTTP request with wordlist entries, enabling you to fuzz URLs, query parameters, headers, POST data, and more.

How Fuzzing Works

Unlike the dir mode which only appends words to a base URL, the fuzz mode lets you place the FUZZ keyword anywhere in the request. Gobuster replaces FUZZ with each wordlist entry and sends the modified request. This makes it incredibly versatile for testing APIs, form fields, authentication endpoints, and custom URL patterns.

You can use multiple FUZZ keywords (FUZZ1, FUZZ2, etc.) with separate wordlists for each. This allows combinatorial testing where you test every combination of values from multiple wordlists.

Info

The FUZZ keyword is case-sensitive and must appear exactly as shown. Gobuster replaces it before sending each request.

Fuzzing Examples

Fuzz URL Paths

Replaces FUZZ in the URL with each wordlist entry. Tests for hidden directories, files, and API endpoints.

bash

1gobuster fuzz -u "http://10.0.0.1/FUZZ" -w /usr/share/wordlists/common.txt

Fuzz with Extensions

Appends .php to each wordlist entry. Useful for finding PHP scripts and endpoints in PHP-based applications.

bash

1gobuster fuzz -u "http://10.0.0.1/FUZZ.php" -w /usr/share/wordlists/common.txt

Fuzz Query Parameters

Discovers hidden query parameters that the API might accept. Often reveals debug modes, feature flags, or internal parameters.

bash

1gobuster fuzz -u "http://10.0.0.1/api?FUZZ=test" -w /usr/share/wordlists/parameters.txt

Fuzz with Custom Headers

Adds custom headers to each request. Useful for authenticated fuzzing or testing API endpoints that require specific headers.

bash

1gobuster fuzz -u "http://10.0.0.1/FUZZ" -w common.txt -H "X-API-Key: secret123" -H "Accept: application/json"

Fuzz POST Data

Fuzzes the password field in a POST login request. Combines with a password wordlist to test credential strength.

bash

1gobuster fuzz -u "http://10.0.0.1/login" -w passwords.txt -d "username=admin&password=FUZZ" -X POST

Multiple FUZZ Keywords

Uses multiple FUZZ placeholders with separate wordlists for each. Tests combinations of directories and files simultaneously.

bash

1gobuster fuzz -u "http://10.0.0.1/FUZZ1/FUZZ2" -w1 dirs.txt -w2 files.txt

Tips for Effective Fuzzing

Tip

Use --exclude-length to filter out responses with a known false-positive body length. This dramatically reduces noise in fuzzing results.

Warning

Fuzzing POST data on authentication endpoints can trigger account lockout policies. Be careful with brute-force attempts and always verify you have authorization.

Info

For API fuzzing, combine Gobuster with tools like ffuf or wfuzz for more advanced response filtering and match conditions.

Next: Common Flags Back