# Firefly | Black Box Fuzzer For Web Applications **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, freebies\ **Created:** [June 20, 2023, 10:15pm UTC](https://onehack.st/t/firefly-black-box-fuzzer-for-web-applications/249109 "2023-06-20T22:15:10Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\ **Post date:** [June 20, 2023, 10:15pm UTC](https://onehack.st/t/firefly-black-box-fuzzer-for-web-applications/249109/1 "2023-06-20T22:15:10Z")
![image](https://onehack.st/uploads/default/original/3X/4/5/4589b58a4c395130ee90af2798fd2f7e3aaab9f0.png) \ Firefly is an advanced black-box fuzzer and not just a standard asset discovery tool. Firefly provides the advantage of testing a target with a large number of built-in checks to detect behaviors in the target. **Note:** > Firefly is in a very new stage (v1.0) but works well for now, if the target does not contain too much dynamic content. Firefly still detects and filters dynamic changes, but not yet perfectly. # Advantages - Hevy use of gorutines and internal hardware for great preformance - Built-in engine that handles each task for “x” response results inductively - Highly cusomized to handle more complex fuzzing - Filter options and request verifications to avoid junk results - Friendly error and debug output - Build in payloads (default list are mixed with the wordlist from [seclists](https://github.com/danielmiessler/SecLists)) - Payload tampering and encoding functionality # Features # [![fireflyOptions](https://github.com/Brum3ns/firefly/raw/main/fireflyOptions.png)](https://github.com/Brum3ns/firefly/blob/main/fireflyOptions.png) # Installation ```auto go install -v github.com/Brum3ns/firefly/cmd/firefly@latest ``` If the above install method do not work try the following: ```auto git clone https://github.com/Brum3ns/firefly.git cd firefly/ go build cmd/firefly/firefly.go ./firefly -h ``` # Usage ### Simple firefly -h firefly -u ‘[http://example.com/?query=FUZZ](http://example.com/?query=FUZZ)’ * * * ## Advanced usage ### Request Different types of request input that can be used Basic firefly -u ‘[http://example.com/?query=FUZZ](http://example.com/?query=FUZZ)’ --timeout 7000 Request with different methods and protocols firefly -u ‘[http://example.com/?query=FUZZ](http://example.com/?query=FUZZ)’ -m GET,POST,PUT -p https,http,ws #### Pipeline echo ‘[http://example.com/?query=FUZZ](http://example.com/?query=FUZZ)’ | firefly #### HTTP Raw firefly -r ’ GET /?query=FUZZ HTTP/1.1 Host: [example.com](http://example.com) User-Agent: FireFly’ This will send the HTTP Raw and auto detect all GET and/or POST parameters to fuzz. firefly -r ’ POST /?A=1 HTTP/1.1 Host: [example.com](http://example.com) User-Agent: Firefly X-Host: FUZZ B=2&C=3’ -au replace ### Request Verifier Request verifier is the most important part. This feature let Firefly know the core behavior of the target your fuzz. It’s important to do quality over quantity. More verfiy requests will lead to better quality at the cost of internal hardware preformance (_depending on your hardware_) firefly -u ‘[http://example.com/?query=FUZZ](http://example.com/?query=FUZZ)’ -e ### Payloads Payload can be highly customized and with a good core wordlist it’s possible to be able to fully adapt the payload wordlist within Firefly itself. #### Payload debug > Display the format of all payloads and exit firefly -show-payload #### Tampers > List of all Tampers avalible firefly -list-tamper Tamper all paylodas with given type (_More than one can be used separated by comma_) firefly -u ‘[http://example.com/?query=FUZZ](http://example.com/?query=FUZZ)’ -e s2c #### Encode firefly -u ‘[http://example.com/?query=FUZZ](http://example.com/?query=FUZZ)’ -e hex Hex then URL encode all payloads firefly -u ‘[http://example.com/?query=FUZZ](http://example.com/?query=FUZZ)’ -e hex,url #### Payload regex replace firefly -u ‘[http://example.com/?query=FUZZ](http://example.com/?query=FUZZ)’ -pr ‘([0-9]+=[0-9]+) =\> (13=(37-24))’ > The Payloads: `' or (1=1)-- -` and `" or(20=20)or "` Will result in: `' or (13=(37-24))-- -` and `" or(13=(37-24))or "` Where the `=>` (with spaces) inducate the “_replace to_”. ### Filters > Filter options to filter/match requests that include a given rule. Filter response to **ignore** (filter) `status code 302` and `line count 0` firefly -u ‘[http://example.com/?query=FUZZ](http://example.com/?query=FUZZ)’ -fc 302 -fl 0 Filter responses to **include** (match) `regex`, and `status code 200` firefly -u ‘[http://example.com/?query=FUZZ](http://example.com/?query=FUZZ)’ -mr ‘[Ee]rror (at|on) line \d’ -mc 200 firefly -u ‘[http://example.com/?query=FUZZ](http://example.com/?query=FUZZ)’ -mr ‘MySQL’ -mc 200 ### Preformance > Preformance and time delays to use for the request process Threads / Concurrency firefly -u ‘[http://example.com/?query=FUZZ](http://example.com/?query=FUZZ)’ -t 35 Time Delay in millisecounds (ms) for each Concurrency FireFly -u ‘[http://example.com/?query=FUZZ](http://example.com/?query=FUZZ)’ -t 35 -dl 2000 ### Wordlists > Wordlist that contains the paylaods can be added separatly or extracted from a given folder Single Wordlist with its attack type firefly -u ‘[http://example.com/?query=FUZZ](http://example.com/?query=FUZZ)’ -w wordlist.txt:fuzz Extract all wordlists inside a folder. Attack type is depended on the suffix `_wordlist.txt` firefly -u ‘[http://example.com/?query=FUZZ](http://example.com/?query=FUZZ)’ -w wl/ Example > Wordlists names inside folder `wl` : > > 1. fuzz\_wordlist.txt > 2. time\_wordlist.txt ### Output > JSON output is **strongly recommended**. This is because you can benefit from the `jq` tool to navigate throw the result and compare it. (_If Firefly is pipeline chained with other tools, standard plaintext may be a better choice._) Simple plaintext output format firefly -u ‘[http://example.com/?query=FUZZ](http://example.com/?query=FUZZ)’ -o file.txt JSON output format (_recommended_) firefly -u ‘[http://example.com/?query=FUZZ](http://example.com/?query=FUZZ)’ -oJ file.json # Community Everyone in the community are allowed to suggest new features, improvements and/or add new payloads to Firefly just make a pull request or add a comment with your suggestions! ## GitHub: > **[GitHub - Brum3ns/firefly: Black box fuzzer for web applications](https://github.com/Brum3ns/firefly)** > > Black box fuzzer for web applications