# Crawl/Fuzz

**# Crawlers**\
dirhunt [https://url.com/](https://url.com/)\
hakrawler -domain [https://url.com/](https://url.com/)\
python3 sourcewolf.py -h\
gospider -s "[https://example.com/"](https://example.com/) -o output -c 10 -d 1\
gospider -S sites.txt -o output -c 10 -d 1\
gospider -s "[https://example.com/"](https://example.com/) -o output -c 10 -d 1 --other-source --include-subs\
\
&#xNAN;**# Fuzzers**\
&#xNAN;**# ffuf**\
&#xNAN;**# Discover content**\
ffuf -recursion -mc all -ac -c -e .htm,.shtml,.php,.html,.js,.txt,.zip,.bak,.asp,.aspx,.xml -w six2dez/OneListForAll/onelistforall.txt -u [https://url.com/FUZZ](https://url.com/FUZZ)\
\
&#xNAN;**# Headers discover**\
ffuf -mc all -ac -u [https://hackxor.net](https://hackxor.net) -w six2dez/OneListForAll/onelistforall.txt -c -H "FUZZ: Hellothereheadertesting123 asd"\
\
&#xNAN;**# Ffuf - burp**\
ffuf -replay-proxy http:127.0.0.1:8080\
\
&#xNAN;**# Fuzzing extensions**\
&#xNAN;**# General**\
.htm,.shtml,.php,.html,.js,.txt,.zip,.bak,.asp,.aspx,.xml,.inc\
\
&#xNAN;**# Backups**\
'.bak','.bac','.old','.000','.\~','.01','.\_bak','.001','.inc','.Xxx'\
\
&#xNAN;**# kr**\
\# [https://github.com/assetnote/kiterunner](https://github.com/assetnote/kiterunner)\
kr brute [https://whatever.com/](https://whatever.com/) -w onelistforallmicro.txt -x 100 --fail-status-codes 404\
kr scan [https://whatever.com/](https://whatever.com/) -w routes-small.kite -A=apiroutes-210228 -x 100 --ignore-length=34\
\
&#xNAN;**# chameleon**\
\# [https://github.com/iustin24/chameleon](https://github.com/iustin24/chameleon)\
./chameleon -u [http://testphp.vulnweb.com](http://testphp.vulnweb.com) -a -A\
\
&#xNAN;**# Best wordlists for fuzzing:**\
\# [https://github.com/danielmiessler/SecLists/tree/master/Discovery/Web-Content](https://github.com/danielmiessler/SecLists/tree/master/Discovery/Web-Content)\
\- raft-large-directories-lowercase.txt\
\- directory-list-2.3-medium.txt\
\- RobotsDisallowed/top10000.txt\
\# [https://github.com/assetnote/commonspeak2-wordlists/tree/master/wordswithext](https://github.com/assetnote/commonspeak2-wordlists/tree/master/wordswithext) -\
\# [https://github.com/random-robbie/bruteforce-lists](https://github.com/random-robbie/bruteforce-lists)\
\# [https://github.com/google/fuzzing/tree/master/dictionaries](https://github.com/google/fuzzing/tree/master/dictionaries)\
\# [https://github.com/six2dez/OneListForAll](https://github.com/six2dez/OneListForAll)\
\# AIO: [https://github.com/foospidy/payloads](https://github.com/foospidy/payloads)\
\# Check [https://wordlists.assetnote.io/](https://wordlists.assetnote.io/)\
\
\# Pro tip: set "Host: localhost" as header\
\
&#xNAN;**# Custom generated dictionary**\
gau example.com | unfurl -u paths\
\
&#xNAN;**# Get files only**\
sed 's#/#\n#g' paths.txt |sort -u\
\
&#xNAN;**# Other things**\
gau example.com | unfurl -u keys\
gau example.com | head -n 1000 |fff -s 200 -s 404\
\
&#xNAN;**# Hadrware devices admin panel**\
\# [https://github.com/InfosecMatter/default-http-login-hunter](https://github.com/InfosecMatter/default-http-login-hunter)\
default-http-login-hunter.sh [https://10.10.0.1:443/](https://10.10.0.1/)\
\
&#xNAN;**# Dirsearch**\
dirsearch -r -f -u [https://10.11.1.111](https://10.11.1.111) --extensions=htm,html,asp,aspx,txt -w six2dez/OneListForAll/onelistforall.txt --request-by-hostname -t 40\
\
&#xNAN;**# dirb**\
dirb [http://10.11.1.111](http://10.11.1.111) -r -o dirb-10.11.1.111.txt\
\
&#xNAN;**# wfuzz**\
wfuzz -c -z file,six2dez/OneListForAll/onelistforall.txt --hc 404 [http://10.11.1.11/FUZZ](http://10.11.1.11/FUZZ)\
\
&#xNAN;**# gobuster**\
gobuster dir -u [http://10.11.1.111](http://10.11.1.111) -w six2dez/OneListForAll/onelistforall.txt -s '200,204,301,302,307,403,500' -e\
\
&#xNAN;**# Cansina**\
\# [https://github.com/deibit/cansina](https://github.com/deibit/cansina)\
python3 cansina.py -u example.com -p PAYLOAD\
\
&#xNAN;**# Ger endpoints from JS**\
&#xNAN;**# LinkFinder**\
\# [https://github.com/GerbenJavado/LinkFinder](https://github.com/GerbenJavado/LinkFinder)\
python linkfinder.py -i [https://example.com](https://example.com) -d\
python linkfinder.py -i burpfile -b\
\
&#xNAN;**# JS enumeration**\
\# [https://github.com/KathanP19/JSFScan.sh](https://github.com/KathanP19/JSFScan.sh)\
\
&#xNAN;**# Tip, if 429 add one of these headers:**\
Client-Ip: IP\
X-Client-Ip: IP\
X-Forwarded-For: IP\
X-Forwarded-For: 127.0.0.1
