% web, webapp, burp, fuzzing

# Directory fuzzing with ffuf
ffuf -u http://<target>/FUZZ -w <wordlist>

# Directory fuzzing with extensions
ffuf -u http://<target>/FUZZ -w <wordlist> -e .php,.html,.txt,.bak

# Subdomain fuzzing
ffuf -u http://FUZZ.<domain> -w <wordlist> -H "Host: FUZZ.<domain>"

# POST parameter fuzzing
ffuf -u http://<target>/login -X POST -d "username=admin&password=FUZZ" -w <wordlist>

# Filter by status code
ffuf -u http://<target>/FUZZ -w <wordlist> -fc 404

# Filter by response size
ffuf -u http://<target>/FUZZ -w <wordlist> -fs 0

# Gobuster directory scan
gobuster dir -u http://<target> -w <wordlist>

# Gobuster with extensions
gobuster dir -u http://<target> -w <wordlist> -x php,html,txt

# Nikto scan
nikto -h http://<target>

# WhatWeb (technology detection)
whatweb http://<target>

# SQLMap basic
sqlmap -u "http://<target>/page.php?id=1" --batch

# SQLMap dump database
sqlmap -u "http://<target>/page.php?id=1" --dbs --batch

# SQLMap dump tables
sqlmap -u "http://<target>/page.php?id=1" -D <database> --tables --batch

# XSS test payload
<script>alert('XSS')</script>

# Curl with POST data
curl -X POST http://<target>/login -d "username=admin&password=test" -v

# Curl with cookies
curl http://<target> -b "session=<cookie>"

# Curl with headers
curl http://<target> -H "Authorization: Bearer <token>"

# --- Hidden API recon: content behind a JS shell ---
# Page renders blank to curl/wget? The content loads from an internal API the
# page's JavaScript calls after render. Find that call and replay it yourself.

# Crawl the site's JS for endpoints (ProjectDiscovery katana)
katana -u https://<target> -jc -silent | grep -iE 'api|graphql|\.json'

# Or watch the exact call live, then copy it as curl (mitmproxy / Burp intercept)
mitmproxy

# Replay the internal call with your session cookie + any CSRF header
# (CSRF header value often must match the session cookie, e.g. JSESSIONID)
curl -s -b <cookiejar> -H "csrf-token: <token>" -H "user-agent: <ua>" "<api_url>"

$ target: echo ""
$ domain: echo ""
$ wordlist: echo "/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt"
$ database: echo ""
$ cookie: echo ""
$ token: echo ""
$ cookiejar: echo "cookies.txt"
$ ua: echo "Mozilla/5.0"
$ api_url: echo ""