Web-Fuzzer - simple Web Fuzzer for detect XSSi, SQLi, Blind SQL

项目说明

Web-Fuzzer

General info

> simple Web Fuzzer
1. crawling : colect all internal url ( Crawler.py )
2. use selenium and BeautifulSoup to detect form & input params for fuzzing
3. inject payload
4. Check responses to detect
---

Requirements

python3

use en & install requirements packages (gist)

Chrome web driver : Download it from the address below and put it in the Wuzzer folder

---

Usage

for test on DVWA :

for more options :

---

Test on D

+ Run image

+ Database Setup
>
+ Login with default credentials
- Username: admin
- Password: password

---

Task-Lists

[x] Xss Injecyion attack

[x] SQL Injecyion attack

[x] Blind SQL Injecyion attack

[x] Cmd Injecyion attack

[x] Blind Cmd Injecyion attack

[ ] complete Document

[ ] threading support

[ ] use proxy

---

Related Link

Web Applications

* OWASP Web Applications Directory (github) (owasp)
* Web collection (github)

Payloads

* Cheatsheet_XSS_.txt (Cheatsheet-God github)
* xss_alert.txt (PayloadsAllTheThings github)
* SQL.txt (wfuzz github)
* BlindSqli.txt (sql-injection-payload-list github)
* xss-payload-list.txt (xss-payload-list github)

XSS

* Cross-site scripting (XSS) cheat sheet (portswigger)
* XSS Injection (PayloadsAllTheThings github)
* Cross-Site Scripting (XSS) (Resources-for-Beginner-Bug-Bounty-Hunters github)

Related work

* Most ad XSS scanner (XSStrike)
* Automatic SQL injection and database takeover tool (sqlmap)
* Web fuzzers review (pentestbook)

security game

* XSS Game By Google (xss-game)
* xssgame
* alert(1) to win (alf.nu)
* prompt(1) to win (prompt.ml)
* prompt("sibears") to win (xss school)
* xssgame by pwnfunction

项目信息

开发语言：Python

Star 数：10

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕simple Web Fuzzer for detect XSSi, SQLi, Blind SQLi, OSi and Blind OSi展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。