PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Firefly: a smart black-box fuzzer for web applications testing

yeswehack.com | blog | #bug-bounty | #fuzzing | #web-security | #tools | #vulnerability-detection | #black-box-testing
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A look at Firefly, a black-box web fuzzer inspired by James Kettle's Backslash Powered Scanner: behaviour verification, difference scanning and payload transformations to surface anomalies.
Published
Collected

Related coverage

vulnerability · vercel.com
The Vercel Bug Bounty Program is now publicly available
Vercel's Bug Bounty Program is now public on HackerOne, covering all Vercel products and open-source projects. Learn how to participate and report findings.
vulnerability · vercel.com
The Vercel OSS Bug Bounty program is now available
Vercel is opening its open source software bug bounty program to the public for researchers find vulnerabilities and make OSS safer
vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
blog · yeswehack.com
Web Application Black-Box Testing
Black-box testing techniques for web applications: state transition, fuzzing, error guessing and payload design, plus how to spot behaviours like reflected output, errors and response-time changes.
blog · yeswehack.com
PimpMyBurp #8 – Perform Advanced Fuzzing With Turbo Intruder
Tutorial on Turbo Intruder, James Kettle's Burp Suite extension for high-speed fuzzing, showing how to write custom Python templates for race conditions, brute force and rate-limit evasion.
blog · yeswehack.com
Parameter Discovery: A quick guide to start
A quick-start guide to parameter discovery: why hidden or unlinked parameters matter for attack surface mapping, and how to hunt them with tools like Arjun, ParamSpider and Param-Miner.
Back