> For the complete documentation index, see [llms.txt](https://www.marialc.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.marialc.com/pentesterlab-labs/recon-badge/recon_05-wfuzz.md).

# recon\_05 (wfuzz)

View the exercise here: [PentesterLab: Recon 05](https://pentesterlab.com/exercises/recon_05/course)

### **OBJECTIVE**

For this challenge, your goal is to find a directory that is not directly accessible.

### **FUZZING DIRECTORIES**

When accessing a new webserver, it often pays off to brute force directories. To do this, you can use many tools like [**patator**](https://github.com/lanjelot/patator), [**FFUF**](https://github.com/ffuf/ffuf)**,** or [**WFuzz**](https://wfuzz.readthedocs.io/en/latest/) (amongst many others).

### **SOLUTION**

You can use [`wfuzz`](https://github.com/xmendez/wfuzz), [`ffuf`](https://github.com/ffuf/ffuf), or [`patator`](https://github.com/lanjelot/patator).

For wfuzz: <https://wfuzz.readthedocs.io/en/latest/>

**In Kali machine:**

We'll change the directory to `/usr/bin` and then check `wfuzz`.

{% code lineNumbers="true" %}

```bash
cd /usr/bin
./wfuzz
```

{% endcode %}

<figure><img src="https://290105472-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F89FZKOizBQcf0e0Qdrp8%2Fuploads%2F7qV3FLuEW5ZRt1eqhZOY%2FScreenshot_2024-07-19_at_09.11.02.png?alt=media&amp;token=3721c72b-2616-489a-80fb-abc85495a39a" alt=""><figcaption></figcaption></figure>

To discover wordlists to use for fuzzing:

<pre class="language-bash"><code class="lang-bash"><strong>ls /usr/share/wfuzz/wordlist/general
</strong></code></pre>

<figure><img src="https://290105472-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F89FZKOizBQcf0e0Qdrp8%2Fuploads%2FBfm3uwj2ndl7P0huZfAd%2FScreenshot_2024-07-19_at_09.15.14.png?alt=media&amp;token=cc81b265-e8b2-443d-8837-32a0ec95a92e" alt=""><figcaption></figcaption></figure>

We'll use `common.txt` and enter it in wfuzz.

```bash
wfuzz -c -z file,wordlist/general/common.txt --sc 200 http://hackycorp.com/FUZZ/
```

{% hint style="info" %}
**`-c`** to colorize the output

**`-z`** to define the payload type for fuzzing

**`--sc`** (show codes) In this case, it will only show responses with 200 OK status

**`--hc`** (hide codes)  hides responses that match the specified HTTP status codes
{% endhint %}

<figure><img src="https://290105472-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F89FZKOizBQcf0e0Qdrp8%2Fuploads%2FyE7q3Vt9t9BEgMnvZU78%2FScreenshot_2024-07-19_at_13.50.14.png?alt=media&amp;token=73a9644c-31a4-4912-8e2e-c0e431a776db" alt=""><figcaption></figcaption></figure>

{% hint style="warning" %}
**Notes:**

* **`--`** take note of the double dash, this is often the cause of errors
* add slash **`/`** at the end of the URL to get exactly 200 rather than 301 responses

  &#x20;

  <figure><img src="https://290105472-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F89FZKOizBQcf0e0Qdrp8%2Fuploads%2FiHDttWEYds3YmlkbagFt%2FScreenshot_2024-07-19_at_13.53.08.png?alt=media&amp;token=4ec6aa2c-efbf-4578-82e8-7af001a3fdbb" alt=""><figcaption></figcaption></figure>

{% endhint %}

From the wfuzz results, we use curl to the directories we've found to get the flag.

```bash
curl http://hackycorp.com/admin/
curl http://hackycorp.com/images/
curl http://hackycorp.com/startpage/
```

<figure><img src="https://290105472-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F89FZKOizBQcf0e0Qdrp8%2Fuploads%2F9zTlyfIj41e1hwRe64hT%2F72f51213-acde-4c9d-9b06-eaf47d7899e8.png?alt=media&amp;token=6260a9f5-f82c-484f-8c88-49ee1dd9c0b4" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="success" %}
We'll see the flag in **`http://hackycorp.com/startpage/`**
{% endhint %}