Show HN: Pfuzz, a web fuzzer following the Unix philosophy

Re:Show HN: Pfuzz, a web fuzzer following the Unix philosophy by sweatypalmer on Sunday January 21, 2024 @07:36AM (#39077896)

This may be a stupid question, but what makes this a fuzzer exactly?

I think would call this a formatter, as it doesn't seem to do any mutations or executions itself. I would call AFL a fuzzer.

I would think at the minimum a fuzzer would more or less copy the mutation aspect, because to me that's what makes fuzzers uniquely useful.

Curious to hear your thoughts, or if mutations are a planned feature I missed

[ Parent | on HN ]

Re:Show HN: Pfuzz, a web fuzzer following the Unix philosophy by codesoap on Sunday January 21, 2024 @12:15PM (#39080355)

It seems to me like "fuzzing" has a different meaning in web application penetration testing. Here, "fuzzer" is a term for tools that just generate different request using wordlists, without adding any mutations. For example, the two popular tools ffuf [1] and wfuzz [2] also call themselves fuzzers.

I see how reusing a term for a different concept is bothersome, but I feel like "fuzzer" is the term that people learning about bug bounty hunting are familiar with.

[1] https://github.com/ffuf/ffuf

[2] https://wfuzz.readthedocs.io/en/latest/

[ Parent | on HN ]

Re:Show HN: Pfuzz, a web fuzzer following the Unix philosophy by tptacek on Sunday January 21, 2024 @02:09PM (#39081750)

Yeah, this is generally what people mean by "web fuzzing".

[ Parent | on HN ]