PUFF

Simple clientside vulnerability fuzzer, powered by puppeteer.

** I will eventually rewrite this project. It works well, but it's not very clean and from my amateur years.**

How does it work?

This tool uses puppeteer to open a headless browser, and then injects payloads into the page, and checks if the payload was executed. This ensures there are no false alarms as it will only report a URL if the function was already called, providing a proof-of-concept.

Requirements

• npm

INSTALL

git clone https://github.com/FlameOfIgnis/puff
cd puff
npm install

OR

If you dont have chromium:

npm install -g puff-fuzz

**If you have chromium: (Don't forget to set path via puff -c "path/to/chromium/"

windows:

set PUPPETEER_SKIP_DOWNLOAD=true
npm install -g puff-fuzz

linux:

export PUPPETEER_SKIP_DOWNLOAD=true
npm install -g puff-fuzz

Testing

Windows:
node puff.js -w .\wordlist-examples\xss.txt -u "http://www.xssgame.com/f/m4KKGHi2rVUN/?query=FUZZ"

Linux:
node puff.js -w ./wordlist-examples/xss.txt -u "http://www.xssgame.com/f/m4KKGHi2rVUN/?query=FUZZ"

Help String

Usage: puff [options]

Options:
  -w, --wordlist <file>    wordlist to use
  -u, --url <url>          url to fuzz
  -t, --threads <tcount>   threads to run (default: 5)
  -v, --verbose            verbosity
  -o, --output <filename>  output filename
  -d, --demo               Demo mode, hides url's in output, and clears terminal when run (to hide url in cli)
  -s, --status             Show requests with unusual response codes
  -oA, --outputAll         Output all the responses
  -k, --ignoreSSL          Ignore ssl errors
  -c, --chromePath <path>  Set chromium path permenantly
  -h, --help               display help for command

Alert is filtered by WAF?

Don't worry, just modify your wordlist to use puff() instead of alert() in your payload.

Sample runs

Running from source:

node puff.js -w xss.txt -u "http://your.url?message=FUZZ"

node puff.js -w xss.txt -u "http://your.url?message=FUZZ" -t 25

node puff.js -w xss.txt -u "http://your.url?message=FUZZ" -d

installed via npm:

puff -w xss.txt -u "http://your.url?message=FUZZ"

puff -w xss.txt -u "http://your.url?message=FUZZ" -t 25

puff -w xss.txt -u "http://your.url?message=FUZZ" -d

Running with stdin fuzzing mode:

cat urls.txt | node puff.js -w .\wordlist-examples\events.txt


cat urls.txt | puff -w .\wordlist-examples\events.txt

Where urls.txt is

http://example.com?query=FUZZ
https://another.com/page/#FUZZ

Running with stdin single payload mode:

cat urls.txt | node puff.js


cat urls.txt | puff

Where urls.txt is

http://example.com?query=<script>alert()</script>
http://example.com?query=javascript:alert()
https://another.com/page/#<script>alert()</script>