gobuster
gobuster copied to clipboard
Feature Request: basic auth bruteforce on FUZZ mode
Currently gobuster can't bruteforce basic HTTP basic authentication easily (or I missed the option somewhere ?). With little improvements on the FUZZ mode, maybe this can be done with such a command line :
$ gobuster fuzz -u https://target.com/admin -U admin -P FUZZ -w passwords.txt
It will interpret the FUZZ
word on the password option for HTTP basic auth.
It seems to me it would make more sense to implement this as a new plugin so it would look something more like
gobuster auth -u https://target.com/admin -U admin -w passwords.txt
Like Wfuzz, I find it very handy to put the keyword FUZZ
anywhere I want and just fuzz it without adding new plugins for each action.
this is now implemented on the dev branch