fuzzer/fuzz.sh at master · hackingyseguridad/fuzzer · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
#!/bin/sh
# (r) HackingySeguridad.COM 2026
# @antonio_taboada

cat << "INFO"
   __                  _     _   _
  / _|                | |   | | | |
 | |_ _   _ _________ | |__ | |_| |_ _ __  ___
 |  _| | | |_  /_  /  | '_ \| __| __| '_ \/ __|
 | | | |_| |/ / / /   | | | | |_| |_| |_) \__ \
 |_|  \__,_/___/___\  |_| |_|\__|\__| .__/|___/ v1.25 (Enero 2026)
           ALDEA DEL FRESNO / MADRID / ESPAÑA
           http://www.hackingyseguridad.com/
           (https://github.com/hackingyseguridad/fuzzer/)
INFO
if [ -z "$1" ]; then
        echo
        echo "Uso: $0 <https://dominio.com>"
        echo "Tiempo estimado +1 hora ..."
        exit 0
fi
echo
echo "Fuzz de: " $1
echo
echo "Cod Significado"
echo "--- -----------"
echo "200 OK"
echo "301 Movido permamentemente"
echo "302 Encontrado"
echo "304 No modificado"
echo "400 Solicitud incorrecta"
echo "400 No autorizado"
echo "403 Prohibido"
echo "404 No encontrado"
echo "410 Ya no esta disponible"
echo "500 Error interno en el servidor"
echo

wfuzz -c -z file,ficheros.txt --hc 301,302,400,401,403,404,405,411,500,503 $1/FUZZ

gobuster dir -e -u $1 $2 -w ficheros.txt --no-error -k -a "User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0" -r

# gobuster dir -e -u $1 $2 -w ficheros.txt -x .php,.html

dirb $1 ficheros.txt -N 403 409 500 503 302 204 307 400 401  -b -f -w -S -z 99 -a "User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0" -H "Accept: text/html, applicattion/xhtml+xml, application/xml;q=0.9,*/*;q=0.8" -H "X-Forwarded-For: 127.0.0.1" -H "X-Originating-IP: 127.0.0.1" -H "X-Remote-IP: 127.0.0.1" -H "X-Client-IP: 127.0.0.1"

dirsearch -u $n $1 $2 -e txt,php,htm,html,asp,jsp -x 200 --exclude-status=300-399,400-499,500-599 --full-url -t 99 -w carpetas.txt