fuzzing_parameters

Test extracted parameters with payloads using ffuf or wfuzz to identify vulnerabilities in web applications during security assessments.

Instructions

Fuzz extracted parameters with various payloads using ffuf/wfuzz

Input Schema

TableJSON Schema

Name	Required	Description	Default
`parameters`	Yes	Array of extracted parameters to fuzz
`tool`	No	Fuzzing tool to use

Implementation Reference

src/tools/fuzzing.ts:37-101 (handler)

Core handler function implementing the fuzzing_parameters tool logic: configures fuzzing tool (ffuf/wfuzz), groups parameters by endpoint, executes fuzzing, analyzes responses for vulnerabilities, and returns structured ScanResult.

async fuzzParameters(parameters: ExtractedParameter[], config: Partial<FuzzingConfiguration> = {}): Promise<ScanResult> {
  try {
    const defaultConfig: FuzzingConfiguration = {
      tool: 'ffuf',
      threads: 10,
      timeout: 10,
      delay: 100,
      wordlist: this.getDefaultWordlist('parameters'),
      filter_codes: [404, 403],
      ...config
    };
    
    console.error(`🔍 Fuzzing ${parameters.length} parameters with ${defaultConfig.tool}`);
    
    const allResults: FuzzingResult[] = [];
    
    // Group parameters by URL and method for efficient fuzzing
    const paramGroups = this.groupParametersByEndpoint(parameters);
    
    for (const [endpoint, params] of paramGroups.entries()) {
      console.error(`  Fuzzing endpoint: ${endpoint}`);
      
      if (defaultConfig.tool === 'ffuf') {
        const ffufResults = await this.runFFUF(endpoint, params, defaultConfig);
        allResults.push(...ffufResults);
      } else if (defaultConfig.tool === 'wfuzz') {
        const wfuzzResults = await this.runWfuzz(endpoint, params, defaultConfig);
        allResults.push(...wfuzzResults);
      }
      
      // Rate limiting between endpoints
      await this.sleep(defaultConfig.delay);
    }
    
    // Analyze results for vulnerabilities
    const analyzedResults = this.analyzeResults(allResults);
    const vulnerabilities = analyzedResults.filter(r => r.vulnerability_detected);
    
    return {
      target: 'parameter_fuzzing',
      timestamp: new Date().toISOString(),
      tool: 'fuzzing_engine',
      results: {
        total_tests: allResults.length,
        vulnerabilities_found: vulnerabilities.length,
        critical_findings: vulnerabilities.filter(v => v.severity === 'critical').length,
        high_findings: vulnerabilities.filter(v => v.severity === 'high').length,
        fuzzing_results: allResults,
        vulnerability_summary: this.summarizeVulnerabilities(vulnerabilities),
        recommendations: this.generateRecommendations(vulnerabilities)
      },
      status: 'success'
    };
    
  } catch (error) {
    return {
      target: 'parameter_fuzzing',
      timestamp: new Date().toISOString(),
      tool: 'fuzzing_engine',
      results: {},
      status: 'error',
      error: error instanceof Error ? error.message : String(error)
    };
  }
}

src/index.ts:282-301 (registration)

Tool registration entry defining the name, description, and input schema for the fuzzing_parameters tool in the MCP server.

{
  name: "fuzzing_parameters",
  description: "Fuzz extracted parameters with various payloads using ffuf/wfuzz",
  inputSchema: {
    type: "object",
    properties: {
      parameters: { 
        type: "array", 
        items: { type: "object" },
        description: "Array of extracted parameters to fuzz" 
      },
      tool: { 
        type: "string", 
        enum: ["ffuf", "wfuzz"],
        description: "Fuzzing tool to use" 
      }
    },
    required: ["parameters"]
  }
},

src/index.ts:552-553 (handler)
Dispatch handler in main tool call switch statement that invokes the FuzzingEngine.fuzzParameters method with parsed arguments.
```
case "fuzzing_parameters":
  return respond(await this.fuzzingEngine.fuzzParameters(args.parameters, { tool: args.tool || 'ffuf' }));
```

src/tools/fuzzing.ts:22-33 (schema)

Type definitions for FuzzingConfiguration (used for tool options) and FuzzingResult (output structure for fuzzing findings).

export interface FuzzingConfiguration {
  tool: 'ffuf' | 'wfuzz';
  threads: number;
  timeout: number;
  delay: number;
  wordlist: string;
  extensions?: string[];
  filter_codes?: number[];
  filter_size?: number[];
  match_codes?: number[];
  custom_headers?: Record<string, string>;
}

src/tools/fuzzing.ts:204-271 (helper)

Helper method to execute ffuf fuzzing on parameters, parse output, and create FuzzingResult objects.

private async runFFUF(endpoint: string, parameters: ExtractedParameter[], config: FuzzingConfiguration): Promise<FuzzingResult[]> {
  try {
    // Check if ffuf is installed
    try {
      await execAsync('ffuf -h', { timeout: 5000 });
    } catch {
      console.warn('ffuf not found, skipping ffuf fuzzing');
      return [];
    }
    
    const results: FuzzingResult[] = [];
    
    for (const param of parameters.slice(0, 5)) { // Limit to 5 params per endpoint
      const payloads = this.getPayloadsForParameter(param);
      
      for (const payload of payloads.slice(0, 20)) { // Limit payloads
        try {
          const testUrl = this.buildTestUrl(endpoint, param, payload);
          
          const command = `ffuf -u "${testUrl}" -w ${config.wordlist} -t ${config.threads} -timeout ${config.timeout} -p ${config.delay / 1000} -o /dev/null -s`;
          
          const { stdout } = await execAsync(command, { 
            timeout: 30000,
            maxBuffer: 1024 * 1024 
          });
          
          // Parse ffuf output (simplified)
          const lines = stdout.split('\n').filter(line => line.trim());
          
          for (const line of lines) {
            if (line.includes('Status:') && line.includes('Size:')) {
              const statusMatch = line.match(/Status:\s*(\d+)/);
              const sizeMatch = line.match(/Size:\s*(\d+)/);
              const timeMatch = line.match(/Time:\s*(\d+)/);
              
              if (statusMatch && sizeMatch) {
                const result: FuzzingResult = {
                  parameter: param.name,
                  payload,
                  url: testUrl,
                  method: param.method,
                  response_code: parseInt(statusMatch[1]),
                  response_size: parseInt(sizeMatch[1]),
                  response_time: timeMatch ? parseInt(timeMatch[1]) : 0,
                  vulnerability_detected: false,
                  severity: 'info'
                };
                
                // Analyze for vulnerabilities
                this.analyzeResponseForVulnerabilities(result, param);
                results.push(result);
              }
            }
          }
          
        } catch (error) {
          console.error(`FFuf error for ${param.name}:`, error);
        }
      }
    }
    
    return results;
    
  } catch (error) {
    console.error('FFuf execution error:', error);
    return [];
  }
}

MCP Pentest