ffuf

ffuf - より速くファズれ、愚か者よ Go で書かれた高速な Web ファザーです。 インストール 使用例 コンテンツ発見 バーチャルホスト発見 パラメータファジング POST データファジング 外部ミューテーターの使用 設定ファイル ヘルプ インタラクティブモード インストール ダウンロード リリースページ からプリビルドバイナリを入手し、解凍して実行してください！ または Windows で Scoop を使用している場合、ffuf は次のコマンドでインストールできます: scoop install ffuf または Windows で Winget を使用している場合、ffuf...

AutoDirbuster

/ | / / / / / / / / /| |/ / / / / / / / / / / / / / / / / / / / / // / // // / // / / / / // / // // / / // |,////// /./,///// 複数のIPに対してffufスキャンを自動実行し保存する 目次 クイック実行 FAQ なぜ？ 推奨される使用方法は？ 必要なデータは？ このスクリプトの動作は？ プログラムが動作しない場合 使用方法 クイック実行 git clone https://github.com/NetSPI/AutoDirbuster.git cd...

recollapse

REcollapse REcollapse is a helper tool for black-box regex fuzzing to bypass validations and discover normalizations in web applications. It can also be helpful to bypass WAFs and weak vulnerability mitigations. For more information, take a look at the REcollapse blog post. The goal of this tool ...

tmux

Welcome to tmux! tmux is a terminal multiplexer: it enables a number of terminals to be created, accessed, and controlled from a single screen. tmux may be detached from a screen and continue running in the background, then later reattached. This release runs on OpenBSD, FreeBSD, NetBSD, Linux,...

lazyrecon

| | | |/ | /| | | | / / |/ | \ | | | / / | | | | | | / | | | ||\ |/ \ || ||/|| |v2 |/ Lazyrecon v2 is a subdomain discovery tool that finds and resolves valid subdomains then performs SSRF/LFI/SQLi fuzzing, brute-force and port scanning. It has a simple modular architecture and is optimized...

unfurl

unfurl Pull out bits of URLs provided on stdin Install If you have Go installed and configured: ▶ go install github.com/tomnomnom/unfurl@latest Otherwise download the latest binary for your platform, extract it and move it to somewhere in your $PATH e.g. /usr/bin/: ▶ wget...

ffufPostprocessing

Ffuf：后处理 不幸的是——尽管带有 "-ac" 标志，ffuf 仍会生成大量无关条目。因此我创建了一个后处理工具来过滤掉这些条目。 此外，我发现在使用 "-ac" 时，大量相关条目被删除——尤其是当 ffuf 遇到 json 或 xml 文件时，"-ac" 可能会将它们完全丢弃。 此工具必须在 ffuf 运行完成后执行。另外，初始 ffuf 命令应使用以下标志运行： -o /folder/to/results.json -od /folder/to/bodies -of json default 这会强制 ffuf 将 json 格式的汇总文件以及响应体写入磁盘。 添加 "-od"...

ffufw

ffufw ffuf 加了特制酱料 安装 go install github.com/puzzlepeaches/ffufw@latest 为什么？ ffufw 是一个围绕 ffuf 的包装器，使目录爆破更容易、更智能。该工具具有以下特性： 对 URL 列表多线程执行 ffuf 命令 使用 gowappalyzer 动态检测技术 根据检测到的技术动态生成 ffuf 命令（包括自定义字典和扩展名） 解析 ffuf 输出以去除垃圾信息并识别潜在感兴趣的端点 能够将发现的 URL 传递给 gowitness 进行审查 能够从扫描中排除使用 WAF 的 URL 快速开始 本项目需要安装...

SUSE CVE-2026-73232

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently...

ffuf v2.3.0

ffuf - Fuzz Faster U Fool A fast web fuzzer written in Go. Installation Example usage Content discovery Vhost discovery Parameter fuzzing POST data fuzzing Using external mutator Configuration files Help Interactive mode Installation Download a prebuilt binary from releases page, unpack and run! ...

GO-2026-6369 ffuf denial of service (OOM) via HTTP response decompression bomb in github.com/ffuf/ffuf

ffuf denial of service OOM via HTTP response decompression bomb in github.com/ffuf/ffuf...

ffuf denial of service (OOM) via HTTP response decompression bomb

Summary A malicious or attacker-controlled target server can crash ffuf with an out-of-memory condition by returning a compressed HTTP response that decompresses to a very large body a decompression bomb. This works against default usage with no special flags. Details The response body size guard...

GHSA-JCVH-XF52-2CWM ffuf denial of service (OOM) via HTTP response decompression bomb

Summary A malicious or attacker-controlled target server can crash ffuf with an out-of-memory condition by returning a compressed HTTP response that decompresses to a very large body a decompression bomb. This works against default usage with no special flags. Details The response body size guard...

EUVD-2026-56926

ffuf denial of service OOM via HTTP response decompression bomb...

CVE-2026-73232

A flaw was found in ffuf, a fast web fuzzer. A malicious server could exploit this vulnerability by sending a specially crafted HTTP response that, when decompressed by ffuf, consumes excessive memory. This can lead to an out-of-memory condition, causing a denial of service DoS for the ffuf...

Linux Distros Unpatched Vulnerability : CVE-2026-73232

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response...

CVE-2026-73232

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently...

DEBIAN-CVE-2026-73232

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently...

UBUNTU-CVE-2026-73232

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently...

CVE-2026-73232

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently...