Fuzz Hidden Parameters

reconchecklist

Summary

Fuzz params; check for LFI.

Walkthrough

Discover hidden GET or POST parameters the application accepts. A hit is a parameter that changes the response or enables file read, debug output, or admin access.

Commands

bash

ffuf -u 'http://<IP>/admin/?FUZZ=' -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt