name: web-application-fuzzing-automation
description: |
Build and execute customized automated attacks against web applications. Use this skill when: systematically enumerating valid identifiers (userids, document IDs, session tokens) by iterating through a parameter range and detecting hits via HTTP status code, response length, response time, Location header, Set-Cookie header, or grep expression; harvesting sensitive data at scale from access-control-flawed endpoints; fuzzing every request parameter with a universal payload kit covering SQL injection (
',
'--,
'; waitfor delay '0:30:0'--), XSS (
xsstest,
">), OS command injection (
|| ping -i 30 127.0.0.1 ; x || ping -n 30 127.0.0.1 & and separator variants), path traversal (
../../../../../../etc/passwd,
../../../../../../boot.ini), script injection (
;echo 111111,
response.write 111111), and remote file inclusion (
http:///); selecting the correct Burp Intruder attack type: Sniper (one position cycled through all payloads), Battering Ram (same payload into all positions simultaneously), Pitchfork (parallel payload sets, one per position, advanced in lockstep), or Cluster Bomb (Cartesian product of multiple payload sets across multiple positions); maintaining valid sessions across automated runs using Burp Suite cookie jar, request macros (login, token fetch, multistep pre-requests), and session-handling rules (check session validity, run re-login macro, update token per request); bypassing automation barriers including per-request anti-CSRF tokens (macro extracts token from prior response, session-handling rule injects it), session expiry (validate-and-re-login rule), and CAPTCHA (solution exposed in source, solution replay, OCR, or human-solver integration); triaging results by clicking column headings to sort by status/length/time and Shift-clicking to reverse-sort. Covers JAttack custom Java scripting framework as a reference model for payload source design and response parsing. For authorized penetration testing and application security assessment only.
version: 1.0.0
homepage: https://github.com/bookforge-ai/bookforge-skills/tree/main/books/web-application-hackers-handbook/skills/web-application-fuzzing-automation
metadata: {"openclaw":{"emoji":"π","homepage":"https://github.com/bookforge-ai/bookforge-skills"}}
status: draft
depends-on: []
source-books:
- id: web-application-hackers-handbook
title: "The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws"
authors: ["Dafydd Stuttard", "Marcus Pinto"]
edition: 2
chapters: [14]
pages: "571-613"
tags: [fuzzing, burp-intruder, automation, identifier-enumeration, data-harvesting, sql-injection, xss, os-command-injection, path-traversal, session-handling, csrf-token, captcha-bypass, payload-generation, penetration-testing, appsec]
execution:
tier: 2
mode: interactive
inputs:
- type: document
description: "HTTP traffic / Burp Suite project file β request/response pairs to target"
- type: text
description: "Target URL, parameter names, scope confirmation from authorizing party"
tools-required: [Read, Write]
tools-optional: [Bash, WebFetch]
mcps-required: []
environment: "Authorized penetration test engagement. Burp Suite Professional (or equivalent) required for Intruder attack types and session-handling features. JAttack source available at companion site for custom scripting."
discovery:
goal: "Enumerate valid identifiers, harvest data from vulnerable endpoints, or identify input-based vulnerabilities across all request parameters via automated fuzzing β producing a triage-ready results table and prioritized follow-up list"
tasks:
- "Select the correct automation mode (enumeration, harvesting, or fuzzing) and configure the matching attack type and payload source"
- "Configure hit detection criteria appropriate to the target's response behavior"
- "Address session-handling barriers before launching to prevent false negatives from expired sessions or missing tokens"
- "Launch the attack, triage results by sorting on status/length/time/grep columns, and escalate anomalies to manual verification"
audience:
roles: ["penetration-tester", "application-security-engineer", "bug-bounty-researcher"]
experience: "intermediate-to-advanced β assumes working knowledge of HTTP, Burp Suite proxy/Intruder, and web vulnerability classes"
triggers:
- "Authorized pentest of an application with predictable identifiers, access-control findings worth harvesting, or large parameter surface needing fuzzing"
- "Coverage of dozens of dynamic pages where manual per-parameter testing is not feasible"
- "Session token analysis has revealed a pattern amenable to enumeration"
- "Burp Scanner found a potential injection but coverage of remaining parameters is needed"
not_for:
- "Unauthenticated or unauthorized testing β written authorization required"
- "Fully automated scanning without human triage β customized automation surpasses scanners only when a human reviews results"
- "Deep exploitation of confirmed vulnerabilities β use dedicated exploit skills after fuzzing identifies the candidate"
Web Application Fuzzing Automation
When to Use
You have authorized access to a web application and need to go beyond manual, one-request-at-a-time testing. Customized automation is appropriate when:
A parameter holds identifiers (document IDs, account numbers, session tokens) that need iterating to find all valid values
An access-control flaw lets you access other users' data, and you want to harvest it at scale
A large application has dozens of dynamic pages, each with multiple parameters β manual fuzzing is not feasible
Initial manual probing has revealed promising indicators (error messages, status code variation) that need systematic confirmation across the full parameter spaceThe core insight: Every web application is different. Off-the-shelf scanners apply generic signatures. A skilled tester using customized automation combines human intelligence (selecting the right request, interpreting subtle response differences, thinking like the application's designer) with computerized brute force to achieve results neither can deliver alone.
Authorized testing only. Never apply these techniques without explicit written authorization from the application owner.
Context and Input Gathering
Required Context
Scope and authorization: Which hosts, URLs, and parameters are in scope. Why: automation amplifies impact β an out-of-scope mistake at scale causes disproportionate harm.
A valid session: An authenticated account to carry through the attack. Why: most interesting functionality and identifiers are behind authentication; testing unauthenticated surfaces only misses the majority of findings.
Target request/response pair: The specific request to automate against, identified during manual recon. Why: automation needs a stable baseline β a request where the parameter of interest clearly affects the response.Observable Context (gather from environment)
Parameters with sequential or guessable values: uid=198, docId=10069, pageid=32010039
HTTP status code variation in response to different values (200 vs. 302 vs. 500)
Response length variation β template pages return fixed length for misses, variable length for hits
Session management mechanisms: anti-CSRF tokens in forms (field named __csrftoken, nonce, _token), session expiry behavior, multistage processes
Process
Step 1: Choose the Automation Mode
Three distinct uses for customized automation, each requiring different configuration:
Identifier Enumeration β Iterate through a range of values for a single parameter to determine which are valid. Hit detection is binary (valid vs. invalid). Payload source: numeric range or custom list.
Data Harvesting β Extend enumeration to extract content from each hit (page titles, names, credentials). Requires adding Extract Grep patterns to pull specific strings from each response. Hit detection is still used but you also capture response content.
Vulnerability Fuzzing β Submit a universal set of attack strings to every parameter in every request, regardless of normal function. You do not know in advance what a hit looks like; you capture as much response detail as possible and review manually for anomalies.
WHY distinct modes matter: Enumeration and harvesting require a focused request with a known-good baseline. Fuzzing is deliberately broad β you sacrifice focus for coverage. Mixing the two produces poor results: fuzzing an already-exploited endpoint wastes requests; applying a focused enumeration payload to a fuzz target misses everything else.
Step 2: Configure Attack Type (Burp Intruder)
Select the attack type based on how many payload positions and payload sets your attack requires:
| Attack Type | Positions | Payload Sets | Behavior | Best For |
|---|---|---|---|---|
| Sniper | One at a time | 1 | Cycles each position through all payloads; other positions hold their baseline value | Fuzzing each parameter independently; most common choice |
| Battering Ram | All simultaneously | 1 | Same payload inserted into every position at once | Testing username-equals-password login, or inserting a single attack string everywhere |
| Pitchfork | Multiple, in lockstep | One per position | Advances all payload lists simultaneously (position 1 gets payload 1 from list A, position 2 gets payload 1 from list B, etc.) | Testing credential pairs from a known username/password list |
| Cluster Bomb | Multiple | One per position | Cartesian product β every combination of all payload sets | Brute-forcing debug parameter name + value pairs; credential stuffing from independent lists |
WHY Sniper is the default for fuzzing: When fuzzing for input-based vulnerabilities, you need to test each parameter in isolation. If you inject into all parameters simultaneously, an anomalous response becomes ambiguous β you cannot determine which payload in which parameter triggered it. Sniper eliminates this ambiguity. Each payload appears in exactly one parameter per request; all others remain at their baseline values.
Set payload positions: Use the "Auto" button in Intruder's Positions tab to mark all URL, cookie, and body parameter values automatically. Manually adjust to add or remove positions as needed.
Step 3: Configure Payload Source
For enumeration/harvesting: Use the Numbers payload type. Configure sequential hexadecimal or decimal range, step size, and minimum digit count to match the application's identifier format. Example: tokens ending in 3 hex digits β range 0x000 to 0xfff, hex format, minimum 3 digits.
For fuzzing: Use the universal payload kit below. These are literal strings β Burp URL-encodes special characters by default; do not disable this.
# SQL Injection
'
'--
'; waitfor delay '0:30:0'--
1; waitfor delay '0:30:0'--XSS and Header Injection
xsstest
">OS Command Injection
|| ping -i 30 127.0.0.1 ; x || ping -n 30 127.0.0.1 &
| ping -i 30 127.0.0.1 |
| ping -n 30 127.0.0.1 |
& ping -i 30 127.0.0.1 &
& ping -n 30 127.0.0.1 &
; ping 127.0.0.1 ;
%0a ping -i 30 127.0.0.1 %0a
ping 127.0.0.1 Path Traversal
../../../../../../../../../../etc/passwd
../../../../../../../../../../boot.ini
..\..\..\..\..\..\..\..\..\..\etc\passwd
..\..\..\..\..\..\..\..\..\..\boot.iniScript Injection
;echo 111111
echo 111111
response.write 111111
;response.write 111111File Inclusion (point at a server you control and monitor for incoming connections)
http:///
http:///
WHY this kit: Each string is the minimal probe for its class. The SQL ' triggers syntax errors. The waitfor variants detect blind time-based SQL injection. The OS command strings use ping with a controlled delay β a 30-second response confirms blind injection regardless of whether output is visible. Script injection uses the literal value 111111 β if it appears alone in the response, the input was executed. Path traversal strings use redundant ../ sequences so they work regardless of how deep the web root is. File inclusion strings require monitoring for out-of-band connections, not response content.
Step 4: Configure Hit Detection and Response Analysis
In Burp Intruder's Options tab, configure the attributes to capture from each response:
Baseline columns (always captured):
HTTP status code
Response length
Response timeGrep β Match: Configure strings to flag in responses. For fuzzing, use:
error
exception
illegal
invalid
fail
stack
access
directory
file
not found
varchar
ODBC
SQL
SELECT
111111
quotation
syntax
Grep β Extract: For data harvesting, configure strings that precede the data you want to capture. Example: </code> captures page titles; <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em"><td>Name: </td><td></code> captures user names from HTML tables.</p><p style="margin:8px 0"><strong style="color:#e5e7eb">Grep β Payload:</strong> Enable "flag responses that reflect the payload" to detect potential XSS β any response that echoes back the <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">xsstest</code> string or the full XSS payload unmodified is a candidate.</p><p style="margin:8px 0"><strong style="color:#e5e7eb">WHY response length is critical even when you have a reliable status code indicator:</strong> Response length frequently surfaces anomalies you did not anticipate when designing the attack. In a session token enumeration, all HTTP 200 hits return roughly the same page β but noticeably longer responses indicate more-privileged user sessions. Always sort length even when status provides the primary signal.</p><p style="margin:8px 0"><hr style="border:none;border-top:1px solid #1e1e3f;margin:12px 0"></p><p style="margin:8px 0"><h4 style="color:#d1d5db;margin:14px 0 6px;font-size:.95em">Step 5: Handle Session Barriers Before Launching</h4></p><p style="margin:8px 0">Identify which barriers apply to the target, then configure Burp's session-handling stack in the order below. Each layer operates on every outgoing Intruder request automatically.</p><p style="margin:8px 0"><strong style="color:#e5e7eb">Cookie Jar (always enable):</strong>
Burp maintains a cookie jar tracking all application cookies seen in proxied traffic. Enable "add cookies from cookie jar" as the first session-handling rule action for the target domain. This ensures the most recent session token is always included.</p><p style="margin:8px 0"><strong style="color:#e5e7eb">Request Macros:</strong>
A macro is a predefined sequence of one or more requests replayed before (or instead of) the attack request. Define macros for each barrier:</p><p style="margin:8px 0"><li style="color:#94a3b8;margin:3px 0">*Validate session:* A GET to an authenticated page. Configure the macro item to read its session cookie from the cookie jar and update the jar with the response cookie. Used to check whether the current session is still valid.</li>
<li style="color:#94a3b8;margin:3px 0">*Re-login:* POST to the login endpoint with preset credentials. Updates the cookie jar with the new session token. Triggered when session validation fails.</li>
<li style="color:#94a3b8;margin:3px 0">*Obtain token/nonce:* GET or POST to the form page that contains the anti-CSRF token. Configure the macro item to extract the token from the response (Burp auto-detects derivable parameter relationships; manually confirm). The extracted value is injected into the target request.</li></p><p style="margin:8px 0"><strong style="color:#e5e7eb">Session-Handling Rules (apply in this order):</strong></p><p style="margin:8px 0">1. <strong style="color:#e5e7eb">All requests to target domain:</strong> Add cookies from cookie jar.
2. <strong style="color:#e5e7eb">All requests to target domain:</strong> Check whether session is valid by running the validate-session macro. If session is invalid, run the re-login macro and update the cookie jar.
3. <strong style="color:#e5e7eb">Requests containing the anti-CSRF token parameter:</strong> Run the obtain-token macro and set the token parameter to the extracted value from the macro's final response.</p><p style="margin:8px 0"><strong style="color:#e5e7eb">Scope each rule</strong> to the correct Burp tools (Spider, Scanner, Intruder, Repeater as appropriate) and to the target host/URL pattern. Use the session-handling tracer to verify each rule fires correctly before launching the full attack.</p><p style="margin:8px 0"><strong style="color:#e5e7eb">WHY this ordering matters:</strong> Adding the cookie jar before the session-validity check ensures the check uses the current token, not a stale one. Validating before every request (rather than on failure) prevents a wave of failed requests from triggering account lockout or defensive session termination. Obtaining the token last ensures it is always fresh β anti-CSRF tokens are typically invalidated after a single use.</p><p style="margin:8px 0"><hr style="border:none;border-top:1px solid #1e1e3f;margin:12px 0"></p><p style="margin:8px 0"><h4 style="color:#d1d5db;margin:14px 0 6px;font-size:.95em">Step 6: Launch the Attack and Triage Results</h4></p><p style="margin:8px 0">Launch the attack in Burp Intruder. Results appear in a table with one row per request.</p><p style="margin:8px 0"><strong style="color:#e5e7eb">Triage workflow:</strong></p><p style="margin:8px 0">1. Click the <strong style="color:#e5e7eb">Status</strong> column heading to sort by HTTP status code. Anomalous status codes (200 among mostly 302, or 500 among mostly 200) surface immediately.
2. Click the <strong style="color:#e5e7eb">Length</strong> column heading to sort by response length. Responses that are meaningfully longer or shorter than the majority are candidates for further review.
3. Click the <strong style="color:#e5e7eb">Time</strong> column heading to sort by response time. Significant delays (β₯25 seconds) against OS command injection payloads confirm blind time-based injection.
4. Click each <strong style="color:#e5e7eb">Grep column</strong> heading to surface responses that matched the error/exception strings.
5. <strong style="color:#e5e7eb">Shift-click any column</strong> to reverse-sort β useful to move both extremes into view without re-sorting by hand.
6. Double-click any row to view the full request and response. Right-click and "Send to Repeater" to manually investigate and refine the finding.</p><p style="margin:8px 0"><strong style="color:#e5e7eb">What to look for:</strong></p><p style="margin:8px 0"><li style="color:#94a3b8;margin:3px 0"><strong style="color:#e5e7eb">Enumeration:</strong> Status code 200 (or a Set-Cookie with a session token) among predominantly 302/404/500 responses = valid identifier found.</li>
<li style="color:#94a3b8;margin:3px 0"><strong style="color:#e5e7eb">Harvesting:</strong> Extracted column values populated for hits; empty for misses.</li>
<li style="color:#94a3b8;margin:3px 0"><strong style="color:#e5e7eb">Fuzzing β SQL injection:</strong> Single <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">'</code> produces a response containing <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">quotation</code>, <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">syntax</code>, or <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">ODBC</code> that differs from the <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">'--</code> response (which may restore normal behavior); <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">waitfor</code> payload produces ~30-second delay.</li>
<li style="color:#94a3b8;margin:3px 0"><strong style="color:#e5e7eb">Fuzzing β XSS:</strong> Payload Grep column shows the <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">xsstest</code> string was reflected unmodified.</li>
<li style="color:#94a3b8;margin:3px 0"><strong style="color:#e5e7eb">Fuzzing β OS command injection:</strong> Response time for ping-based payloads is ~30 seconds; other payloads respond immediately.</li>
<li style="color:#94a3b8;margin:3px 0"><strong style="color:#e5e7eb">Fuzzing β Script injection:</strong> Response contains <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">111111</code> alone, not as part of the submitted string.</li></p><p style="margin:8px 0">For each confirmed or suspected finding, refer to the dedicated vulnerability skill for detailed exploitation and verification steps.</p><p style="margin:8px 0"><hr style="border:none;border-top:1px solid #1e1e3f;margin:12px 0"></p><p style="margin:8px 0"><h3 style="color:#e5e7eb;margin:18px 0 8px;font-size:1.05em">Inputs</h3></p><p style="margin:8px 0"><li style="color:#94a3b8;margin:3px 0">Burp Suite project file or proxy history with the target application's traffic</li>
<li style="color:#94a3b8;margin:3px 0">At least one valid authenticated session (credentials or an active session token)</li>
<li style="color:#94a3b8;margin:3px 0">Confirmed scope and authorization from the authorizing party</li>
<li style="color:#94a3b8;margin:3px 0">(For harvesting) Knowledge of the HTML structure around the data to extract</li>
<li style="color:#94a3b8;margin:3px 0">(For enumeration) Known baseline response for a valid identifier value</li></p><p style="margin:8px 0"><h3 style="color:#e5e7eb;margin:18px 0 8px;font-size:1.05em">Outputs</h3></p><p style="margin:8px 0"><strong style="color:#e5e7eb">Attack Results Table</strong> with one row per request, columns: request number, parameter, payload, HTTP status, response length, response time, grep matches, extracted data (if configured). Sorted to surface anomalies.</p><p style="margin:8px 0"><strong style="color:#e5e7eb">Follow-up Findings List</strong> β for each anomalous row:
<pre style="background:#0a0a1c;border:1px solid #1e1e3f;border-radius:6px;padding:10px 12px;overflow-x:auto;font-size:.9em;margin:8px 0"><code style="color:#a5f3fc;background:none;padding:0;font-size:1em">Parameter: [name]
Payload: [string]
Anomaly: [status/length/time/grep observation]
Suspected class: [SQL injection | XSS | OS command | path traversal | script injection | access control]
Next step: [manual verification approach]
</code></pre></p><p style="margin:8px 0"><hr style="border:none;border-top:1px solid #1e1e3f;margin:12px 0"></p><p style="margin:8px 0"><h3 style="color:#e5e7eb;margin:18px 0 8px;font-size:1.05em">Key Principles</h3></p><p style="margin:8px 0"><li style="color:#94a3b8;margin:3px 0"><strong style="color:#e5e7eb">Isolation over coverage in fuzzing.</strong> Test one parameter at a time (Sniper). If you inject into all positions simultaneously, you cannot attribute which payload triggered an anomaly. Isolation costs more requests but produces actionable results.</li></p><p style="margin:8px 0"><li style="color:#94a3b8;margin:3px 0"><strong style="color:#e5e7eb">Response length is always informative.</strong> Even when status code provides a reliable hit signal, sort the length column anyway. The most interesting results are often the ones you didn't design the attack to find.</li></p><p style="margin:8px 0"><li style="color:#94a3b8;margin:3px 0"><strong style="color:#e5e7eb">Configure session handling before launching, not after failures appear.</strong> A wave of unauthenticated requests from a failed session produces misleading uniform responses that look like no findings. The session-handling tracer is the only way to confirm your rules fire correctly before the full run.</li></p><p style="margin:8px 0"><li style="color:#94a3b8;margin:3px 0"><strong style="color:#e5e7eb">Automation amplifies human intelligence, not replaces it.</strong> The goal is to reduce the mechanical load β submitting hundreds of requests, recording status and length β so you can spend your time on what automation cannot do: reasoning about why a response is different, recognizing a pattern that doesn't fit the expected schema, and deciding which anomaly is a real finding versus noise.</li></p><p style="margin:8px 0"><li style="color:#94a3b8;margin:3px 0"><strong style="color:#e5e7eb">10% accuracy is still useful.</strong> For CAPTCHA bypass via automated solving, perfect accuracy is not required. An attack that solves only 1 in 10 puzzles correctly still completes the task in roughly 10x the time of a human β which is still orders of magnitude faster than manual testing at scale.</li></p><p style="margin:8px 0"><hr style="border:none;border-top:1px solid #1e1e3f;margin:12px 0"></p><p style="margin:8px 0"><h3 style="color:#e5e7eb;margin:18px 0 8px;font-size:1.05em">Examples</h3></p><p style="margin:8px 0"><strong style="color:#e5e7eb">Scenario: Session token enumeration on an application with weak token generation</strong></p><p style="margin:8px 0">Trigger: "The session tokens look partially sequential β I want to enumerate valid sessions for privilege escalation testing."</p><p style="margin:8px 0">Process:
1. Analyze token structure from Burp Sequencer output: <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">000000-fb2200-16cb12-172ba72551</code>. The final 3 hex digits increment predictably; the middle segment is static; the second segment partially increments.
2. Capture a request to an authenticated page (<code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">GET /auth/502/Home.ashx</code>) that returns HTTP 200 for a valid session and HTTP 302 to login for an invalid one.
3. Configure Intruder Sniper: one payload position on the last 3 hex digits of the session cookie value. Payload type: Numbers, range 0x000β0xfff, hex format, 3-digit minimum. No custom grep needed β status code is the hit signal.
4. Launch. Sort results by Status. HTTP 200 rows = valid hijackable sessions.
5. Sort results by Length. Two HTTP 200 responses are significantly longer than the rest β these are more-privileged user sessions. Double-click to confirm admin content.</p><p style="margin:8px 0">Output: List of valid session tokens. Two confirmed as administrative. Escalate to manual session hijacking verification via Burp Repeater.</p><p style="margin:8px 0"><hr style="border:none;border-top:1px solid #1e1e3f;margin:12px 0"></p><p style="margin:8px 0"><strong style="color:#e5e7eb">Scenario: Data harvesting via access-control flaw on a user-details endpoint</strong></p><p style="margin:8px 0">Trigger: "We found that <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">GET /auth/498/YourDetails.ashx?uid=198</code> returns any user's full profile β we need to harvest all accounts."</p><p style="margin:8px 0">Process:
1. Inspect the response HTML: user data appears in table cells as <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em"><td>Name: </td><td>Phill Bellend</td></code>, <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em"><td>Username: </td><td>phillb</td></code>, <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em"><td>Password: </td><td>b3ll3nd</td></code>.
2. Configure Intruder Sniper: one payload position on <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">uid</code>. Payload type: Numbers, range 190β250 (start from known-good range, widen later). Session cookie as a fixed non-attack parameter.
3. Add three Extract Grep entries for <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em"><td>Name: </td><td></code>, <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em"><td>Username: </td><td></code>, <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em"><td>Password: </td><td></code> β each configured to capture text until the next <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em"><</code>.
4. Launch. Sort by Status. HTTP 200 rows with populated extract columns = valid users.
5. Export tab-delimited results into a spreadsheet. Widen the UID range to capture all accounts.</p><p style="margin:8px 0">Output: Complete user directory with credentials. Feed into privilege escalation and password reuse testing.</p><p style="margin:8px 0"><hr style="border:none;border-top:1px solid #1e1e3f;margin:12px 0"></p><p style="margin:8px 0"><strong style="color:#e5e7eb">Scenario: Baseline vulnerability fuzzing of a login form and authenticated function</strong></p><p style="margin:8px 0">Trigger: "We need to fuzz every parameter in the login and in the user-detail page before concluding the assessment."</p><p style="margin:8px 0">Process:
1. Send the login POST and the user-details GET from Burp Proxy history to Intruder using "Send to Intruder." Intruder auto-marks all parameter values as payload positions.
2. Configure Sniper attack type. Load the universal fuzzing payload kit (SQL, XSS, OS command, path traversal, script injection, file inclusion strings). Configure Grep-Match with the standard error-string list (<code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">error</code>, <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">exception</code>, <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">quotation</code>, <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">syntax</code>, <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">ODBC</code>, <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">111111</code>, <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">xsstest</code>). Enable Payload Grep to flag reflected payloads.
3. For the user-details page, configure a session-handling rule: validate session before each request; re-login macro runs if session is invalid. This prevents the expired-cookie false-negative problem.
4. Launch both attacks. Sort each by Status, then Length, then Time.
5. Login form results: <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">'</code> in <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">username</code> produces status 200, length 2941, with <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">exception</code> and <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">quotation</code> in grep β different from all other payloads which produce length ~1600. Confirmed SQL injection candidate.
6. User-details results: <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">xsstest</code> in <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">uid</code> is reflected in the response body (Payload Grep column shows match). Confirmed reflected input β escalate to manual XSS exploitation check.</p><p style="margin:8px 0">Output: Two candidates (SQL injection in login username, reflected input in uid parameter). Escalate each to the dedicated vulnerability skill for confirmation and exploitation.</p><p style="margin:8px 0"><hr style="border:none;border-top:1px solid #1e1e3f;margin:12px 0"></p><p style="margin:8px 0"><h3 style="color:#e5e7eb;margin:18px 0 8px;font-size:1.05em">References</h3></p><p style="margin:8px 0"><li style="color:#94a3b8;margin:3px 0">Attack type decision guide: <a href="references/intruder-attack-type-selection.md" target="_blank" rel="noopener" style="color:#6366f1">references/intruder-attack-type-selection.md</a></li>
<li style="color:#94a3b8;margin:3px 0">Universal fuzzing payload kit (extended): <a href="references/fuzzing-payload-kit.md" target="_blank" rel="noopener" style="color:#6366f1">references/fuzzing-payload-kit.md</a></li>
<li style="color:#94a3b8;margin:3px 0">Session-handling rule templates: <a href="references/session-handling-rule-templates.md" target="_blank" rel="noopener" style="color:#6366f1">references/session-handling-rule-templates.md</a></li>
<li style="color:#94a3b8;margin:3px 0">Source: Stuttard, D. & Pinto, M. (2011). *The Web Application Hacker's Handbook* (2nd ed.), Chapter 14: "Automating Customized Attacks," pp. 571β613. Wiley.</li></p><p style="margin:8px 0"><h3 style="color:#e5e7eb;margin:18px 0 8px;font-size:1.05em">License</h3></p><p style="margin:8px 0">This skill is licensed under <a href="https://creativecommons.org/licenses/by-sa/4.0/" target="_blank" rel="noopener" style="color:#6366f1">CC-BY-SA-4.0</a>.
Source: <a href="https://github.com/bookforge-ai/bookforge-skills" target="_blank" rel="noopener" style="color:#6366f1">BookForge</a> β The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws by Dafydd Stuttard, Marcus Pinto.</p><p style="margin:8px 0"><h3 style="color:#e5e7eb;margin:18px 0 8px;font-size:1.05em">Related BookForge Skills</h3></p><p style="margin:8px 0">This skill is standalone. Browse more BookForge skills: <a href="https://github.com/bookforge-ai/bookforge-skills" target="_blank" rel="noopener" style="color:#6366f1">bookforge-skills</a>
</p></div></section><section class="skill-card" style="margin-bottom:20px"><h2 style="color:#f8fafc;font-size:1.2em;font-weight:800;margin:0 0 16px;display:flex;align-items:center;gap:8px">β‘ When to Use</h2><div><table style="width:100%;border-collapse:collapse;border:1px solid #1e1e3f;border-radius:8px;overflow:hidden;font-size:.9em"><thead><tr style="background:#0a0a1c"><th style="padding:12px 16px;text-align:left;color:#818cf8;font-weight:700;border-bottom:2px solid #6366f130">Trigger</th><th style="padding:12px 16px;text-align:left;color:#818cf8;font-weight:700;border-bottom:2px solid #6366f130">Action</th></tr></thead><tbody><tr><td style="padding:12px 16px;border-bottom:1px solid #1e1e3f;color:#94a3b8" colspan="2">- A parameter holds identifiers (document IDs, account numbers, session tokens) that need iterating to find all valid values</td></tr><tr><td style="padding:12px 16px;border-bottom:1px solid #1e1e3f;color:#94a3b8" colspan="2">- An access-control flaw lets you access other users' data, and you want to harvest it at scale</td></tr><tr><td style="padding:12px 16px;border-bottom:1px solid #1e1e3f;color:#94a3b8" colspan="2">- A large application has dozens of dynamic pages, each with multiple parameters β manual fuzzing is not feasible</td></tr><tr><td style="padding:12px 16px;border-bottom:1px solid #1e1e3f;color:#94a3b8" colspan="2">- Initial manual probing has revealed promising indicators (error messages, status code variation) that need systematic confirmation across the full parameter space</td></tr><tr><td style="padding:12px 16px;border-bottom:1px solid #1e1e3f;color:#94a3b8" colspan="2">**The core insight:** Every web application is different. Off-the-shelf scanners apply generic signatures. A skilled tester using customized automation combines human intelligence (selecting the right request, interpreting subtle response differences, thinking like the application's designer) with computerized brute force to achieve results neither can deliver alone.</td></tr><tr><td style="padding:12px 16px;border-bottom:1px solid #1e1e3f;color:#94a3b8" colspan="2">**Authorized testing only.** Never apply these techniques without explicit written authorization from the application owner.</td></tr><tr><td style="padding:12px 16px;border-bottom:1px solid #1e1e3f;color:#94a3b8" colspan="2">---</td></tr></tbody></table></div></section><section class="skill-card" style="margin-bottom:20px"><h2 style="color:#f8fafc;font-size:1.2em;font-weight:800;margin:0 0 16px;display:flex;align-items:center;gap:8px">π‘ Examples</h2><div style="font-size:.92em;color:#94a3b8;line-height:1.75"><p style="margin:8px 0"><strong style="color:#e5e7eb">Scenario: Session token enumeration on an application with weak token generation</strong></p><p style="margin:8px 0">Trigger: "The session tokens look partially sequential β I want to enumerate valid sessions for privilege escalation testing."</p><p style="margin:8px 0">Process:
1. Analyze token structure from Burp Sequencer output: <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">000000-fb2200-16cb12-172ba72551</code>. The final 3 hex digits increment predictably; the middle segment is static; the second segment partially increments.
2. Capture a request to an authenticated page (<code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">GET /auth/502/Home.ashx</code>) that returns HTTP 200 for a valid session and HTTP 302 to login for an invalid one.
3. Configure Intruder Sniper: one payload position on the last 3 hex digits of the session cookie value. Payload type: Numbers, range 0x000β0xfff, hex format, 3-digit minimum. No custom grep needed β status code is the hit signal.
4. Launch. Sort results by Status. HTTP 200 rows = valid hijackable sessions.
5. Sort results by Length. Two HTTP 200 responses are significantly longer than the rest β these are more-privileged user sessions. Double-click to confirm admin content.</p><p style="margin:8px 0">Output: List of valid session tokens. Two confirmed as administrative. Escalate to manual session hijacking verification via Burp Repeater.</p><p style="margin:8px 0"><hr style="border:none;border-top:1px solid #1e1e3f;margin:12px 0"></p><p style="margin:8px 0"><strong style="color:#e5e7eb">Scenario: Data harvesting via access-control flaw on a user-details endpoint</strong></p><p style="margin:8px 0">Trigger: "We found that <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">GET /auth/498/YourDetails.ashx?uid=198</code> returns any user's full profile β we need to harvest all accounts."</p><p style="margin:8px 0">Process:
1. Inspect the response HTML: user data appears in table cells as <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em"><td>Name: </td><td>Phill Bellend</td></code>, <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em"><td>Username: </td><td>phillb</td></code>, <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em"><td>Password: </td><td>b3ll3nd</td></code>.
2. Configure Intruder Sniper: one payload position on <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">uid</code>. Payload type: Numbers, range 190β250 (start from known-good range, widen later). Session cookie as a fixed non-attack parameter.
3. Add three Extract Grep entries for <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em"><td>Name: </td><td></code>, <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em"><td>Username: </td><td></code>, <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em"><td>Password: </td><td></code> β each configured to capture text until the next <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em"><</code>.
4. Launch. Sort by Status. HTTP 200 rows with populated extract columns = valid users.
5. Export tab-delimited results into a spreadsheet. Widen the UID range to capture all accounts.</p><p style="margin:8px 0">Output: Complete user directory with credentials. Feed into privilege escalation and password reuse testing.</p><p style="margin:8px 0"><hr style="border:none;border-top:1px solid #1e1e3f;margin:12px 0"></p><p style="margin:8px 0"><strong style="color:#e5e7eb">Scenario: Baseline vulnerability fuzzing of a login form and authenticated function</strong></p><p style="margin:8px 0">Trigger: "We need to fuzz every parameter in the login and in the user-detail page before concluding the assessment."</p><p style="margin:8px 0">Process:
1. Send the login POST and the user-details GET from Burp Proxy history to Intruder using "Send to Intruder." Intruder auto-marks all parameter values as payload positions.
2. Configure Sniper attack type. Load the universal fuzzing payload kit (SQL, XSS, OS command, path traversal, script injection, file inclusion strings). Configure Grep-Match with the standard error-string list (<code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">error</code>, <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">exception</code>, <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">quotation</code>, <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">syntax</code>, <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">ODBC</code>, <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">111111</code>, <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">xsstest</code>). Enable Payload Grep to flag reflected payloads.
3. For the user-details page, configure a session-handling rule: validate session before each request; re-login macro runs if session is invalid. This prevents the expired-cookie false-negative problem.
4. Launch both attacks. Sort each by Status, then Length, then Time.
5. Login form results: <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">'</code> in <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">username</code> produces status 200, length 2941, with <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">exception</code> and <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">quotation</code> in grep β different from all other payloads which produce length ~1600. Confirmed SQL injection candidate.
6. User-details results: <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">xsstest</code> in <code style="background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em">uid</code> is reflected in the response body (Payload Grep column shows match). Confirmed reflected input β escalate to manual XSS exploitation check.</p><p style="margin:8px 0">Output: Two candidates (SQL injection in login username, reflected input in uid parameter). Escalate each to the dedicated vulnerability skill for confirmation and exploitation.</p><p style="margin:8px 0"><hr style="border:none;border-top:1px solid #1e1e3f;margin:12px 0"></p></div></section></div><div class="two-col-side"></div></div></div><script>
document.querySelectorAll('.copy-btn, .script-copy-btn').forEach(btn => {
btn.addEventListener('click', () => {
const cmd = btn.getAttribute('data-cmd');
if (!cmd) return;
navigator.clipboard.writeText(cmd).then(() => {
const orig = btn.textContent;
btn.textContent = 'Copied!';
setTimeout(() => btn.textContent = orig, 1500);
}).catch(() => {});
});
});
</script><!--$--><!--/$--></main><footer style="background:var(--bg-primary);border-top:1px solid var(--border-secondary);margin-top:60px"><div style="border-top:1px solid var(--border-light);max-width:1200px;margin:0 auto;padding:24px 20px"><div style="display:flex;justify-content:space-between;flex-wrap:wrap;gap:24px;margin-bottom:24px"><div><div style="font-weight:700;color:var(--text-muted);margin-bottom:8px">BytesAgain</div><div style="color:var(--text-muted3);font-size:.82em;max-width:200px">Discover the best AI agent skills for your workflow.</div></div><div><div style="color:var(--text-muted);font-size:.75em;text-transform:uppercase;letter-spacing:1px;margin-bottom:10px">Explore</div><div style="margin-bottom:6px"><a href="/skills" style="color:var(--text-muted2);text-decoration:none;font-size:.85em">Skills</a></div><div style="margin-bottom:6px"><a href="/articles" style="color:var(--text-muted2);text-decoration:none;font-size:.85em">Articles</a></div><div style="margin-bottom:6px"><a href="/use-case" style="color:var(--text-muted2);text-decoration:none;font-size:.85em">Cases</a></div></div><div><div style="color:var(--text-muted);font-size:.75em;text-transform:uppercase;letter-spacing:1px;margin-bottom:10px">Company</div><div style="margin-bottom:6px"><a href="/about" style="color:var(--text-muted2);text-decoration:none;font-size:.85em">About</a></div><div style="margin-bottom:6px"><a href="/contact" style="color:var(--text-muted2);text-decoration:none;font-size:.85em">Contact</a></div><div style="margin-bottom:6px"><a href="/privacy-policy" style="color:var(--text-muted2);text-decoration:none;font-size:.85em">Privacy Policy</a></div><div style="margin-bottom:6px"><a href="/terms" style="color:var(--text-muted2);text-decoration:none;font-size:.85em">Terms</a></div><div style="margin-bottom:6px"><a href="/feedback" style="color:var(--text-muted2);text-decoration:none;font-size:.85em">Feedback</a></div></div></div><div style="border-top:1px solid var(--border-light);padding-top:16px"><div style="color:var(--text-muted4);font-size:.8em;margin-bottom:8px">Β© <!-- -->2026<!-- --> BytesAgain. All rights reserved.</div><div style="color:var(--text-muted5);font-size:.75em;line-height:1.6;max-width:720px">BytesAgain is an independent skill directory. We index and link to third-party content (ClawHub, GitHub, LobeHub, Dify, etc.) for informational purposes only. All trademarks, skill names, and content are the property of their respective owners. BytesAgain does not claim ownership of any indexed content.</div></div></div></footer><button style="position:fixed;bottom:28px;right:28px;z-index:1000;width:48px;height:48px;border-radius:50%;border:none;cursor:pointer;background:linear-gradient(135deg,#667eea,#00d4ff);color:#fff;font-size:1.3em;box-shadow:0 4px 20px #667eea66;display:flex;align-items:center;justify-content:center;transition:transform .2s">π¬</button><script src="/_next/static/chunks/0ze4gu236oq96.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ" id="_R_" async=""></script><script>(self.__next_f=self.__next_f||[]).push([0])</script><script>self.__next_f.push([1,"1:\"$Sreact.fragment\"\n2:I[62894,[\"/_next/static/chunks/0ph_0rx9ah5dc.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/0i_x3w546rsb3.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/06ig5gym-0n-u.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\"],\"LangProvider\"]\n3:I[89220,[\"/_next/static/chunks/0ph_0rx9ah5dc.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/0i_x3w546rsb3.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/06ig5gym-0n-u.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\"],\"ThemeProvider\"]\n4:I[16988,[\"/_next/static/chunks/0ph_0rx9ah5dc.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/0i_x3w546rsb3.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/06ig5gym-0n-u.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\"],\"default\"]\ne:I[68027,[\"/_next/static/chunks/0ph_0rx9ah5dc.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/0i_x3w546rsb3.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/06ig5gym-0n-u.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\"],\"default\",1]\n:HL[\"/_next/static/chunks/051nc0vy_6.rl.css?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"style\"]\n:HL[\"/_next/static/media/caa3a2e1cccd8315-s.p.09~u27dqhyhd6.woff2?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n5:Td5e,"])</script><script>self.__next_f.push([1,"[{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"BytesAgain\",\"url\":\"https://bytesagain.com\",\"description\":\"Search 60,000+ verified AI agent skills via MCP API or REST. Supports 7 languages. Free, no auth required.\",\"inLanguage\":[\"en\",\"zh\",\"es\",\"fr\",\"de\",\"ja\",\"ko\"],\"potentialAction\":{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https://bytesagain.com/skills?q={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}},{\"@context\":\"https://schema.org\",\"@type\":\"Organization\",\"name\":\"BytesAgain\",\"url\":\"https://bytesagain.com\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://bytesagain.com/og-image.png\"},\"description\":\"AI agent skill directory. Search 60,000+ skills, 1,000+ use cases, and community requests.\",\"foundingDate\":\"2026\",\"foundingLocation\":{\"@type\":\"Place\",\"name\":\"Global\"},\"sameAs\":[\"https://x.com/bytesagain\",\"https://github.com/bytesagain/ai-skills\",\"https://clawhub.ai/profile/bytesagain\"],\"contactPoint\":{\"@type\":\"ContactPoint\",\"email\":\"hello@bytesagain.com\",\"contactType\":\"customer support\"},\"numberOfEmployees\":{\"@type\":\"QuantitativeValue\",\"value\":1}},{\"@context\":\"https://schema.org\",\"@type\":\"WebApplication\",\"name\":\"BytesAgain AI Skills Search\",\"url\":\"https://bytesagain.com\",\"applicationCategory\":\"DeveloperApplication\",\"operatingSystem\":\"Web\",\"description\":\"Search engine and MCP API for 60,000+ AI agent skills. Semantic search, role recommendations, and use case packs.\",\"offers\":{\"@type\":\"Offer\",\"price\":\"0\",\"priceCurrency\":\"USD\"},\"featureList\":[\"Search 60,000+ AI agent skills\",\"Role-based recommendations for developers, creators, and traders\",\"1,000+ curated use case packs\",\"Free MCP API and REST API\",\"Multi-language search (EN, ZH, ES, FR, DE, JA, KO)\"],\"potentialAction\":{\"@type\":\"SearchAction\",\"target\":\"https://bytesagain.com/skills?q={search_term_string}\",\"query-input\":\"required name=search_term_string\"},\"dateModified\":\"2026-09-16\"},{\"@context\":\"https://schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"What is BytesAgain?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"BytesAgain is a curated directory of 60,000+ AI agent skills from ClawHub, GitHub, LobeHub, and Dify. Search skills by keyword in 7 languages, browse by role (developer, creator, trader, marketer) or by use case.\"}},{\"@type\":\"Question\",\"name\":\"How do I find AI skills on BytesAgain?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Use the search bar on BytesAgain.com to search by keyword in 7 languages. You can also browse by role (developer, creator, trader, marketer) or by use case. Each skill shows install instructions for Claude, Cursor, OpenClaw, Continue, and more.\"}},{\"@type\":\"Question\",\"name\":\"Is BytesAgain free?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes, BytesAgain is completely free. No registration required for searching skills. The MCP API is also free with rate limits.\"}},{\"@type\":\"Question\",\"name\":\"Does BytesAgain have an API for AI agents?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes! BytesAgain provides a free MCP SSE endpoint at /api/mcp/sse for AI agents, plus a REST API at /api/mcp?action=search\u0026q=\u003cquery\u003e. No authentication needed.\"}},{\"@type\":\"Question\",\"name\":\"Can I request a new AI skill on BytesAgain?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes! Visit the Requests page on BytesAgain.com to submit a skill request. Your request will be visible to the community and notified to the site admin.\"}}]}]"])</script><script>self.__next_f.push([1,"0:{\"P\":null,\"c\":[\"\",\"skill\",\"bookforge-web-application-fuzzing-automation\"],\"q\":\"\",\"i\":false,\"f\":[[[\"\",{\"children\":[\"skill\",{\"children\":[[\"slug\",\"bookforge-web-application-fuzzing-automation\",\"d\",null],{\"children\":[\"__PAGE__\",{}]}]}]},\"$undefined\",\"$undefined\",16],[[\"$\",\"$1\",\"c\",{\"children\":[[[\"$\",\"link\",\"0\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/chunks/051nc0vy_6.rl.css?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-0\",{\"src\":\"/_next/static/chunks/0ph_0rx9ah5dc.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-1\",{\"src\":\"/_next/static/chunks/0i_x3w546rsb3.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-2\",{\"src\":\"/_next/static/chunks/06ig5gym-0n-u.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"async\":true,\"nonce\":\"$undefined\"}]],[\"$\",\"html\",null,{\"lang\":\"en\",\"children\":[[\"$\",\"head\",null,{\"children\":[[\"$\",\"link\",null,{\"rel\":\"llms\",\"href\":\"/llms.txt\"}],[\"$\",\"link\",null,{\"rel\":\"llms-full\",\"href\":\"/llms-full.txt\"}],[\"$\",\"script\",null,{\"async\":true,\"src\":\"https://www.googletagmanager.com/gtag/js?id=G-3C1MM9FWYF\"}],[\"$\",\"script\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"\\n window.dataLayer = window.dataLayer || [];\\n function gtag(){dataLayer.push(arguments);}\\n gtag('js', new Date());\\n gtag('config', 'G-3C1MM9FWYF');\\n \"}}]]}],[\"$\",\"body\",null,{\"className\":\"geist_9e050971-module__05dp7a__className\",\"style\":{\"margin\":0},\"children\":[\"$\",\"$L2\",null,{\"children\":[\"$\",\"$L3\",null,{\"children\":[[\"$\",\"div\",null,{\"style\":{\"width\":\"100%\",\"background\":\"var(--bg-subscribe)\",\"borderBottom\":\"1px solid var(--border-primary)\",\"padding\":\"8px 20px\",\"textAlign\":\"center\",\"fontSize\":\".82em\",\"color\":\"#818cf8\"},\"children\":[\"π \",[\"$\",\"strong\",null,{\"style\":{\"color\":\"var(--text-primary)\"},\"children\":\"Get the FREE AI Skills Starter Guide\"}],\" β \",[\"$\",\"a\",null,{\"href\":\"/register\",\"style\":{\"color\":\"#00d4ff\",\"textDecoration\":\"underline\"},\"children\":\"Subscribe β\"}]]}],[\"$\",\"$L4\",null,{}],[\"$\",\"script\",null,{\"type\":\"application/ld+json\",\"dangerouslySetInnerHTML\":{\"__html\":\"$5\"}}],\"$L6\",\"$L7\",\"$L8\"]}]}]}]]}]]}],{\"children\":[\"$L9\",{\"children\":[\"$La\",{\"children\":[\"$Lb\",{},null,false,null]},null,false,\"$@c\"]},null,false,\"$@c\"]},null,false,null],\"$Ld\",false]],\"m\":\"$undefined\",\"G\":[\"$e\",[\"$Lf\"]],\"S\":true,\"h\":null,\"s\":\"$undefined\",\"l\":\"$undefined\",\"p\":\"$undefined\",\"d\":\"$undefined\"}\n"])</script><script>self.__next_f.push([1,"10:I[39756,[\"/_next/static/chunks/0ph_0rx9ah5dc.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/0i_x3w546rsb3.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/06ig5gym-0n-u.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\"],\"default\"]\n11:I[37457,[\"/_next/static/chunks/0ph_0rx9ah5dc.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/0i_x3w546rsb3.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/06ig5gym-0n-u.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\"],\"default\"]\n12:I[22016,[\"/_next/static/chunks/0ph_0rx9ah5dc.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/0i_x3w546rsb3.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/06ig5gym-0n-u.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/0ka051yepewro.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\"],\"\"]\n13:I[90940,[\"/_next/static/chunks/0ph_0rx9ah5dc.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/0i_x3w546rsb3.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/06ig5gym-0n-u.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\"],\"default\"]\n14:I[16397,[\"/_next/static/chunks/0ph_0rx9ah5dc.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/0i_x3w546rsb3.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/06ig5gym-0n-u.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\"],\"default\"]\n16:I[97367,[\"/_next/static/chunks/0ph_0rx9ah5dc.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/0i_x3w546rsb3.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/06ig5gym-0n-u.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\"],\"OutletBoundary\"]\n17:\"$Sreact.suspense\"\n1a:I[97367,[\"/_next/static/chunks/0ph_0rx9ah5dc.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/0i_x3w546rsb3.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/06ig5gym-0n-u.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\"],\"ViewportBoundary\"]\n1c:I[97367,[\"/_next/static/chunks/0ph_0rx9ah5dc.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/0i_x3w546rsb3.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/06ig5gym-0n-u.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\"],\"MetadataBoundary\"]\n"])</script><script>self.__next_f.push([1,"6:[\"$\",\"main\",null,{\"children\":[\"$\",\"$L10\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L11\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":[[\"$\",\"main\",null,{\"style\":{\"minHeight\":\"100vh\",\"display\":\"flex\",\"alignItems\":\"center\",\"justifyContent\":\"center\",\"background\":\"#050611\",\"color\":\"#e5e7eb\"},\"children\":[[\"$\",\"style\",null,{\"children\":\"\\n .nf-box { text-align: center; padding: 60px 32px; }\\n .nf-code { font-size: 6rem; font-weight: 900; color: #22d3ee; line-height: 1; margin: 0; }\\n .nf-title { font-size: 1.8rem; font-weight: 800; margin: 12px 0 8px; }\\n .nf-desc { color: var(--text-muted2); font-size: 1rem; margin-bottom: 32px; max-width: 440px; }\\n .nf-link { display: inline-block; padding: 12px 28px; background: linear-gradient(135deg,#34d399,#22d3ee); color: #000; font-weight: 900; border-radius: 12px; text-decoration: none; }\\n \"}],[\"$\",\"div\",null,{\"className\":\"nf-box\",\"children\":[[\"$\",\"p\",null,{\"className\":\"nf-code\",\"children\":\"404\"}],[\"$\",\"h1\",null,{\"className\":\"nf-title\",\"children\":\"Page Not Found\"}],[\"$\",\"p\",null,{\"className\":\"nf-desc\",\"children\":\"The skill or page you're looking for doesn't exist or has been moved.\"}],[\"$\",\"$L12\",null,{\"className\":\"nf-link\",\"href\":\"/\",\"children\":\"Back to BytesAgain\"}]]}]]}],[]],\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]}]\n"])</script><script>self.__next_f.push([1,"7:[\"$\",\"$L13\",null,{}]\n8:[\"$\",\"$L14\",null,{}]\n9:[\"$\",\"$1\",\"c\",{\"children\":[null,[\"$\",\"$L10\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L11\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]]}]\na:[\"$\",\"$1\",\"c\",{\"children\":[null,[\"$\",\"$L10\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L11\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]]}]\nb:[\"$\",\"$1\",\"c\",{\"children\":[\"$L15\",[[\"$\",\"script\",\"script-0\",{\"src\":\"/_next/static/chunks/12w5ognupk9fb.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"async\":true,\"nonce\":\"$undefined\"}]],[\"$\",\"$L16\",null,{\"children\":[\"$\",\"$17\",null,{\"name\":\"Next.MetadataOutlet\",\"children\":\"$@18\"}]}]]}]\n19:[]\nc:\"$W19\"\nd:[\"$\",\"$1\",\"h\",{\"children\":[null,[\"$\",\"$L1a\",null,{\"children\":\"$L1b\"}],[\"$\",\"div\",null,{\"hidden\":true,\"children\":[\"$\",\"$L1c\",null,{\"children\":[\"$\",\"$17\",null,{\"name\":\"Next.Metadata\",\"children\":\"$L1d\"}]}]}],[\"$\",\"meta\",null,{\"name\":\"next-size-adjust\",\"content\":\"\"}]]}]\nf:[\"$\",\"link\",\"0\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/chunks/051nc0vy_6.rl.css?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}]\n"])</script><script>self.__next_f.push([1,"1b:[[\"$\",\"meta\",\"0\",{\"charSet\":\"utf-8\"}],[\"$\",\"meta\",\"1\",{\"name\":\"viewport\",\"content\":\"width=device-width, initial-scale=1\"}]]\n"])</script><script>self.__next_f.push([1,"1e:I[27201,[\"/_next/static/chunks/0ph_0rx9ah5dc.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/0i_x3w546rsb3.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/06ig5gym-0n-u.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\"],\"IconMark\"]\n18:null\n"])</script><script>self.__next_f.push([1,"1d:[[\"$\",\"title\",\"0\",{\"children\":\"Web Application Fuzzing Automation β AI Agent Skill | BytesAgain | BytesAgain\"}],[\"$\",\"meta\",\"1\",{\"name\":\"description\",\"content\":\"Build and execute customized automated attacks against web applications. Use this skill when: systematically enumerating valid identifiers (userids, document...\"}],[\"$\",\"meta\",\"2\",{\"name\":\"robots\",\"content\":\"index, follow\"}],[\"$\",\"meta\",\"3\",{\"name\":\"googlebot\",\"content\":\"index, follow, max-image-preview:large, max-snippet:-1\"}],[\"$\",\"meta\",\"4\",{\"name\":\"llms-txt\",\"content\":\"https://bytesagain.com/llms.txt\"}],[\"$\",\"meta\",\"5\",{\"name\":\"llms-full-txt\",\"content\":\"https://bytesagain.com/llms-full.txt\"}],[\"$\",\"link\",\"6\",{\"rel\":\"canonical\",\"href\":\"https://bytesagain.com/skill/bookforge-web-application-fuzzing-automation\"}],[\"$\",\"meta\",\"7\",{\"name\":\"baidu-site-verification\",\"content\":\"codeva-0evUqX1TFs\"}],[\"$\",\"meta\",\"8\",{\"property\":\"og:title\",\"content\":\"Web Application Fuzzing Automation β AI Agent Skill | BytesAgain\"}],[\"$\",\"meta\",\"9\",{\"property\":\"og:description\",\"content\":\"Build and execute customized automated attacks against web applications. Use this skill when: systematically enumerating valid identifiers (userids, document...\"}],[\"$\",\"meta\",\"10\",{\"property\":\"og:url\",\"content\":\"https://bytesagain.com/skill/bookforge-web-application-fuzzing-automation\"}],[\"$\",\"meta\",\"11\",{\"property\":\"og:site_name\",\"content\":\"BytesAgain\"}],[\"$\",\"meta\",\"12\",{\"property\":\"og:image\",\"content\":\"https://bytesagain.com/social-preview.png\"}],[\"$\",\"meta\",\"13\",{\"property\":\"og:image:width\",\"content\":\"1200\"}],[\"$\",\"meta\",\"14\",{\"property\":\"og:image:height\",\"content\":\"630\"}],[\"$\",\"meta\",\"15\",{\"property\":\"og:type\",\"content\":\"website\"}],[\"$\",\"meta\",\"16\",{\"name\":\"twitter:card\",\"content\":\"summary_large_image\"}],[\"$\",\"meta\",\"17\",{\"name\":\"twitter:title\",\"content\":\"Web Application Fuzzing Automation β AI Agent Skill | BytesAgain\"}],[\"$\",\"meta\",\"18\",{\"name\":\"twitter:description\",\"content\":\"Build and execute customized automated attacks against web applications. Use this skill when: systematically enumerating valid identifiers (userids, document...\"}],[\"$\",\"meta\",\"19\",{\"name\":\"twitter:image\",\"content\":\"https://bytesagain.com/social-preview.png\"}],[\"$\",\"meta\",\"20\",{\"name\":\"twitter:image:width\",\"content\":\"1200\"}],[\"$\",\"meta\",\"21\",{\"name\":\"twitter:image:height\",\"content\":\"630\"}],[\"$\",\"link\",\"22\",{\"rel\":\"icon\",\"href\":\"/favicon.ico?favicon.0x3dzn~oxb6tn.ico\",\"sizes\":\"256x256\",\"type\":\"image/x-icon\"}],[\"$\",\"$L1e\",\"23\",{}]]\n"])</script><script>self.__next_f.push([1,"1f:T1562,"])</script><script>self.__next_f.push([1,"\n .skill-page { max-width: 1100px; margin: 0 auto; padding: 32px 20px 80px; }\n .two-col { display: flex; gap: 32px; align-items: flex-start; }\n .two-col-main { flex: 1; min-width: 0; }\n .two-col-side { width: 300px; flex-shrink: 0; }\n @media (max-width: 860px) {\n .two-col { flex-direction: column; }\n .two-col-side { width: 100%; }\n }\n .breadcrumb { font-size: .82em; color: var(--text-muted2); margin-bottom: 28px; }\n .breadcrumb a { color: #818cf8; text-decoration: none; }\n .breadcrumb a:hover { text-decoration: underline; }\n .skill-card { background: var(--bg-card); border: 1px solid var(--border-card); border-radius: 20px; padding: 28px; margin-bottom: 24px; }\n .skill-header { display: flex; align-items: flex-start; justify-content: space-between; gap: 16px; margin-bottom: 20px; flex-wrap: wrap; }\n .skill-badges { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; }\n .skill-top-actions { display: flex; align-items: center; gap: 10px; margin-left: auto; }\n .badge { display: inline-flex; align-items: center; gap: 5px; font-size: .75em; font-weight: 600; padding: 4px 12px; border-radius: 999px; border: 1px solid transparent; }\n .skill-title { font-size: 1.6em; font-weight: 800; color: var(--text-primary); margin: 0 0 4px; line-height: 1.2; }\n .skill-owner { font-size: .82em; color: var(--text-muted2); margin: 0 0 14px; }\n .skill-owner span { color: #818cf8; }\n .skill-desc { font-size: .92em; color: var(--text-secondary); line-height: 1.65; margin: 0 0 16px; }\n .skill-meta { display: flex; gap: 16px; flex-wrap: wrap; margin-bottom: 18px; padding-bottom: 16px; border-bottom: 1px solid var(--border-card); }\n .meta-item { display: flex; flex-direction: column; gap: 2px; }\n .meta-label { font-size: .7em; color: var(--text-muted5); text-transform: uppercase; letter-spacing: 1px; font-weight: 600; }\n .meta-value { font-size: .92em; color: var(--text-muted2); font-weight: 600; }\n .tags-row { display: flex; gap: 6px; flex-wrap: wrap; }\n .tag { font-size: .75em; color: #6366f1; background: #6366f115; border: 1px solid #6366f130; border-radius: 6px; padding: 3px 10px; text-decoration: none; }\n .tag:hover { background: #6366f125; }\n .install-box { background: var(--bg-deep); border: 1px solid var(--border-card); border-radius: 12px; overflow: hidden; margin-bottom: 24px; }\n .install-header { display: flex; align-items: center; justify-content: space-between; padding: 10px 16px; border-bottom: 1px solid var(--border-card); }\n .install-dots { display: flex; gap: 6px; }\n .dot { width: 10px; height: 10px; border-radius: 50%; }\n .install-label { font-size: .72em; color: var(--text-muted5); font-family: monospace; letter-spacing: 1px; }\n .install-body { padding: 16px 20px; display: flex; align-items: center; justify-content: space-between; gap: 12px; }\n .install-cmd { color: var(--text-code);\n font-family: 'Courier New', monospace; font-size: 1em; }\n .copy-btn { font-size: .75em; color: #6366f1; background: #6366f115; border: 1px solid #6366f130; border-radius: 6px; padding: 5px 12px; cursor: pointer; white-space: nowrap; transition: all .15s; }\n .copy-btn:hover { background: #6366f125; }\n .btn-secondary { display: inline-flex; align-items: center; gap: 8px; padding: 13px 24px; background: transparent; border: 1px solid var(--border-card); border-radius: 10px; color: #6b7280; text-decoration: none; font-weight: 600; font-size: .95em; transition: all .15s; }\n .btn-secondary:hover { border-color: #818cf8; color: #818cf8; }\n .ours-badge { display: inline-flex; align-items: center; gap: 6px; font-size: .72em; font-weight: 700; color: #22d3ee; background: #22d3ee10; border: 1px solid #22d3ee30; border-radius: 999px; padding: 4px 14px; }\n .section-card { background: var(--bg-card); border: 1px solid var(--border-card); border-radius: 16px; padding: 22px 24px; margin-bottom: 20px; }\n .section-title { color: var(--text-primary); font-size: 1.08em; font-weight: 800; margin: 0 0 12px; display: flex; align-items: center; gap: 8px; }\n /* Script box */\n .script-header { display: flex; align-items: center; justify-content: space-between; padding: 8px 14px; background: var(--bg-input); border-bottom: 1px solid var(--border-card); }\n .script-filename { font-size: .72em; color: var(--text-muted2); font-family: 'Courier New', monospace; }\n .script-copy-btn { font-size: .72em; color: #6366f1; background: none; border: 1px solid #6366f130; border-radius: 4px; padding: 2px 10px; cursor: pointer; }\n .script-copy-btn:hover { background: #6366f115; }\n .script-body { padding: 14px 16px; font-family: 'Courier New', monospace; font-size: .82em; line-height: 1.6; color: var(--text-code); overflow-x: auto; max-height: 420px; overflow-y: auto; white-space: pre; }\n /* Articles */\n .article-card { display: block; background: var(--bg-secondary); border: 1px solid var(--border-primary); border-radius: 10px; padding: 14px 16px; text-decoration: none; transition: border-color .15s; }\n .article-card:hover { border-color: #6366f1; }\n @media (max-width: 600px) {\n .skill-card { padding: 20px; }\n .skill-title { font-size: 1.5em; }\n }\n "])</script><script>self.__next_f.push([1,"15:[[\"$\",\"style\",null,{\"children\":\"$1f\"}],\"$L20\",\"$L21\"]\n"])</script><script>self.__next_f.push([1,"22:I[78297,[\"/_next/static/chunks/0ph_0rx9ah5dc.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/0i_x3w546rsb3.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/06ig5gym-0n-u.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/12w5ognupk9fb.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\"],\"default\"]\n23:Ta053,"])</script><script>self.__next_f.push([1,"\u003cp style=\"margin:8px 0\"\u003e\u003chr style=\"border:none;border-top:1px solid #1e1e3f;margin:12px 0\"\u003e\nname: web-application-fuzzing-automation\ndescription: |\n Build and execute customized automated attacks against web applications. Use this skill when: systematically enumerating valid identifiers (userids, document IDs, session tokens) by iterating through a parameter range and detecting hits via HTTP status code, response length, response time, Location header, Set-Cookie header, or grep expression; harvesting sensitive data at scale from access-control-flawed endpoints; fuzzing every request parameter with a universal payload kit covering SQL injection (\u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e'\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e'--\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e'; waitfor delay '0:30:0'--\u003c/code\u003e), XSS (\u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003exsstest\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e\"\u003e\u003cscript\u003ealert('xss')\u003c/script\u003e\u003c/code\u003e), OS command injection (\u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e|| ping -i 30 127.0.0.1 ; x || ping -n 30 127.0.0.1 \u0026\u003c/code\u003e and separator variants), path traversal (\u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e../../../../../../etc/passwd\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e../../../../../../boot.ini\u003c/code\u003e), script injection (\u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e;echo 111111\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003eresponse.write 111111\u003c/code\u003e), and remote file inclusion (\u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003ehttp://\u003cyour-server\u003e/\u003c/code\u003e); selecting the correct Burp Intruder attack type: Sniper (one position cycled through all payloads), Battering Ram (same payload into all positions simultaneously), Pitchfork (parallel payload sets, one per position, advanced in lockstep), or Cluster Bomb (Cartesian product of multiple payload sets across multiple positions); maintaining valid sessions across automated runs using Burp Suite cookie jar, request macros (login, token fetch, multistep pre-requests), and session-handling rules (check session validity, run re-login macro, update token per request); bypassing automation barriers including per-request anti-CSRF tokens (macro extracts token from prior response, session-handling rule injects it), session expiry (validate-and-re-login rule), and CAPTCHA (solution exposed in source, solution replay, OCR, or human-solver integration); triaging results by clicking column headings to sort by status/length/time and Shift-clicking to reverse-sort. Covers JAttack custom Java scripting framework as a reference model for payload source design and response parsing. For authorized penetration testing and application security assessment only.\nversion: 1.0.0\nhomepage: https://github.com/bookforge-ai/bookforge-skills/tree/main/books/web-application-hackers-handbook/skills/web-application-fuzzing-automation\nmetadata: {\"openclaw\":{\"emoji\":\"π\",\"homepage\":\"https://github.com/bookforge-ai/bookforge-skills\"}}\nstatus: draft\ndepends-on: []\nsource-books:\n - id: web-application-hackers-handbook\n title: \"The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws\"\n authors: [\"Dafydd Stuttard\", \"Marcus Pinto\"]\n edition: 2\n chapters: [14]\n pages: \"571-613\"\ntags: [fuzzing, burp-intruder, automation, identifier-enumeration, data-harvesting, sql-injection, xss, os-command-injection, path-traversal, session-handling, csrf-token, captcha-bypass, payload-generation, penetration-testing, appsec]\nexecution:\n tier: 2\n mode: interactive\n inputs:\n - type: document\n description: \"HTTP traffic / Burp Suite project file β request/response pairs to target\"\n - type: text\n description: \"Target URL, parameter names, scope confirmation from authorizing party\"\n tools-required: [Read, Write]\n tools-optional: [Bash, WebFetch]\n mcps-required: []\n environment: \"Authorized penetration test engagement. Burp Suite Professional (or equivalent) required for Intruder attack types and session-handling features. JAttack source available at companion site for custom scripting.\"\ndiscovery:\n goal: \"Enumerate valid identifiers, harvest data from vulnerable endpoints, or identify input-based vulnerabilities across all request parameters via automated fuzzing β producing a triage-ready results table and prioritized follow-up list\"\n tasks:\n - \"Select the correct automation mode (enumeration, harvesting, or fuzzing) and configure the matching attack type and payload source\"\n - \"Configure hit detection criteria appropriate to the target's response behavior\"\n - \"Address session-handling barriers before launching to prevent false negatives from expired sessions or missing tokens\"\n - \"Launch the attack, triage results by sorting on status/length/time/grep columns, and escalate anomalies to manual verification\"\n audience:\n roles: [\"penetration-tester\", \"application-security-engineer\", \"bug-bounty-researcher\"]\n experience: \"intermediate-to-advanced β assumes working knowledge of HTTP, Burp Suite proxy/Intruder, and web vulnerability classes\"\n triggers:\n - \"Authorized pentest of an application with predictable identifiers, access-control findings worth harvesting, or large parameter surface needing fuzzing\"\n - \"Coverage of dozens of dynamic pages where manual per-parameter testing is not feasible\"\n - \"Session token analysis has revealed a pattern amenable to enumeration\"\n - \"Burp Scanner found a potential injection but coverage of remaining parameters is needed\"\n not_for:\n - \"Unauthenticated or unauthorized testing β written authorization required\"\n - \"Fully automated scanning without human triage β customized automation surpasses scanners only when a human reviews results\"\n - \"Deep exploitation of confirmed vulnerabilities β use dedicated exploit skills after fuzzing identifies the candidate\"\n\u003chr style=\"border:none;border-top:1px solid #1e1e3f;margin:12px 0\"\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch2 style=\"color:#f3f4f6;margin:20px 0 10px;font-size:1.15em\"\u003eWeb Application Fuzzing Automation\u003c/h2\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch3 style=\"color:#e5e7eb;margin:18px 0 8px;font-size:1.05em\"\u003eWhen to Use\u003c/h3\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eYou have authorized access to a web application and need to go beyond manual, one-request-at-a-time testing. Customized automation is appropriate when:\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003eA parameter holds identifiers (document IDs, account numbers, session tokens) that need iterating to find all valid values\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003eAn access-control flaw lets you access other users' data, and you want to harvest it at scale\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003eA large application has dozens of dynamic pages, each with multiple parameters β manual fuzzing is not feasible\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003eInitial manual probing has revealed promising indicators (error messages, status code variation) that need systematic confirmation across the full parameter space\u003c/li\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eThe core insight:\u003c/strong\u003e Every web application is different. Off-the-shelf scanners apply generic signatures. A skilled tester using customized automation combines human intelligence (selecting the right request, interpreting subtle response differences, thinking like the application's designer) with computerized brute force to achieve results neither can deliver alone.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eAuthorized testing only.\u003c/strong\u003e Never apply these techniques without explicit written authorization from the application owner.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003chr style=\"border:none;border-top:1px solid #1e1e3f;margin:12px 0\"\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch3 style=\"color:#e5e7eb;margin:18px 0 8px;font-size:1.05em\"\u003eContext and Input Gathering\u003c/h3\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch4 style=\"color:#d1d5db;margin:14px 0 6px;font-size:.95em\"\u003eRequired Context\u003c/h4\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eScope and authorization:\u003c/strong\u003e Which hosts, URLs, and parameters are in scope. Why: automation amplifies impact β an out-of-scope mistake at scale causes disproportionate harm.\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eA valid session:\u003c/strong\u003e An authenticated account to carry through the attack. Why: most interesting functionality and identifiers are behind authentication; testing unauthenticated surfaces only misses the majority of findings.\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eTarget request/response pair:\u003c/strong\u003e The specific request to automate against, identified during manual recon. Why: automation needs a stable baseline β a request where the parameter of interest clearly affects the response.\u003c/li\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch4 style=\"color:#d1d5db;margin:14px 0 6px;font-size:.95em\"\u003eObservable Context (gather from environment)\u003c/h4\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003eParameters with sequential or guessable values: \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003euid=198\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003edocId=10069\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003epageid=32010039\u003c/code\u003e\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003eHTTP status code variation in response to different values (200 vs. 302 vs. 500)\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003eResponse length variation β template pages return fixed length for misses, variable length for hits\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003eSession management mechanisms: anti-CSRF tokens in forms (field named \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e__csrftoken\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003enonce\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e_token\u003c/code\u003e), session expiry behavior, multistage processes\u003c/li\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003chr style=\"border:none;border-top:1px solid #1e1e3f;margin:12px 0\"\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch3 style=\"color:#e5e7eb;margin:18px 0 8px;font-size:1.05em\"\u003eProcess\u003c/h3\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch4 style=\"color:#d1d5db;margin:14px 0 6px;font-size:.95em\"\u003eStep 1: Choose the Automation Mode\u003c/h4\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eThree distinct uses for customized automation, each requiring different configuration:\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eIdentifier Enumeration\u003c/strong\u003e β Iterate through a range of values for a single parameter to determine which are valid. Hit detection is binary (valid vs. invalid). Payload source: numeric range or custom list.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eData Harvesting\u003c/strong\u003e β Extend enumeration to extract content from each hit (page titles, names, credentials). Requires adding Extract Grep patterns to pull specific strings from each response. Hit detection is still used but you also capture response content.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eVulnerability Fuzzing\u003c/strong\u003e β Submit a universal set of attack strings to every parameter in every request, regardless of normal function. You do not know in advance what a hit looks like; you capture as much response detail as possible and review manually for anomalies.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eWHY distinct modes matter:\u003c/strong\u003e Enumeration and harvesting require a focused request with a known-good baseline. Fuzzing is deliberately broad β you sacrifice focus for coverage. Mixing the two produces poor results: fuzzing an already-exploited endpoint wastes requests; applying a focused enumeration payload to a fuzz target misses everything else.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003chr style=\"border:none;border-top:1px solid #1e1e3f;margin:12px 0\"\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch4 style=\"color:#d1d5db;margin:14px 0 6px;font-size:.95em\"\u003eStep 2: Configure Attack Type (Burp Intruder)\u003c/h4\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eSelect the attack type based on how many payload positions and payload sets your attack requires:\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e| Attack Type | Positions | Payload Sets | Behavior | Best For |\n|---|---|---|---|---|\n| \u003cstrong style=\"color:#e5e7eb\"\u003eSniper\u003c/strong\u003e | One at a time | 1 | Cycles each position through all payloads; other positions hold their baseline value | Fuzzing each parameter independently; most common choice |\n| \u003cstrong style=\"color:#e5e7eb\"\u003eBattering Ram\u003c/strong\u003e | All simultaneously | 1 | Same payload inserted into every position at once | Testing username-equals-password login, or inserting a single attack string everywhere |\n| \u003cstrong style=\"color:#e5e7eb\"\u003ePitchfork\u003c/strong\u003e | Multiple, in lockstep | One per position | Advances all payload lists simultaneously (position 1 gets payload 1 from list A, position 2 gets payload 1 from list B, etc.) | Testing credential pairs from a known username/password list |\n| \u003cstrong style=\"color:#e5e7eb\"\u003eCluster Bomb\u003c/strong\u003e | Multiple | One per position | Cartesian product β every combination of all payload sets | Brute-forcing debug parameter name + value pairs; credential stuffing from independent lists |\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eWHY Sniper is the default for fuzzing:\u003c/strong\u003e When fuzzing for input-based vulnerabilities, you need to test each parameter in isolation. If you inject into all parameters simultaneously, an anomalous response becomes ambiguous β you cannot determine which payload in which parameter triggered it. Sniper eliminates this ambiguity. Each payload appears in exactly one parameter per request; all others remain at their baseline values.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eSet payload positions:\u003c/strong\u003e Use the \"Auto\" button in Intruder's Positions tab to mark all URL, cookie, and body parameter values automatically. Manually adjust to add or remove positions as needed.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003chr style=\"border:none;border-top:1px solid #1e1e3f;margin:12px 0\"\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch4 style=\"color:#d1d5db;margin:14px 0 6px;font-size:.95em\"\u003eStep 3: Configure Payload Source\u003c/h4\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eFor enumeration/harvesting:\u003c/strong\u003e Use the Numbers payload type. Configure sequential hexadecimal or decimal range, step size, and minimum digit count to match the application's identifier format. Example: tokens ending in 3 hex digits β range 0x000 to 0xfff, hex format, minimum 3 digits.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eFor fuzzing:\u003c/strong\u003e Use the universal payload kit below. These are literal strings β Burp URL-encodes special characters by default; do not disable this.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cpre style=\"background:#0a0a1c;border:1px solid #1e1e3f;border-radius:6px;padding:10px 12px;overflow-x:auto;font-size:.9em;margin:8px 0\"\u003e\u003ccode style=\"color:#a5f3fc;background:none;padding:0;font-size:1em\"\u003e# SQL Injection\n'\n'--\n'; waitfor delay '0:30:0'--\n1; waitfor delay '0:30:0'--\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch2 style=\"color:#f3f4f6;margin:20px 0 10px;font-size:1.15em\"\u003eXSS and Header Injection\u003c/h2\u003e\nxsstest\n\"\u003e\u003cscript\u003ealert('xss')\u003c/script\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch2 style=\"color:#f3f4f6;margin:20px 0 10px;font-size:1.15em\"\u003eOS Command Injection\u003c/h2\u003e\n|| ping -i 30 127.0.0.1 ; x || ping -n 30 127.0.0.1 \u0026\n| ping -i 30 127.0.0.1 |\n| ping -n 30 127.0.0.1 |\n\u0026 ping -i 30 127.0.0.1 \u0026\n\u0026 ping -n 30 127.0.0.1 \u0026\n; ping 127.0.0.1 ;\n%0a ping -i 30 127.0.0.1 %0a\n\u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e ping 127.0.0.1 \u003c/code\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch2 style=\"color:#f3f4f6;margin:20px 0 10px;font-size:1.15em\"\u003ePath Traversal\u003c/h2\u003e\n../../../../../../../../../../etc/passwd\n../../../../../../../../../../boot.ini\n..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\etc\\passwd\n..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\boot.ini\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch2 style=\"color:#f3f4f6;margin:20px 0 10px;font-size:1.15em\"\u003eScript Injection\u003c/h2\u003e\n;echo 111111\necho 111111\nresponse.write 111111\n;response.write 111111\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch2 style=\"color:#f3f4f6;margin:20px 0 10px;font-size:1.15em\"\u003eFile Inclusion (point at a server you control and monitor for incoming connections)\u003c/h2\u003e\nhttp://\u003cyour-server\u003e/\nhttp://\u003cnonexistent-ip\u003e/\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eWHY this kit:\u003c/strong\u003e Each string is the minimal probe for its class. The SQL \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e'\u003c/code\u003e triggers syntax errors. The \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003ewaitfor\u003c/code\u003e variants detect blind time-based SQL injection. The OS command strings use \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003eping\u003c/code\u003e with a controlled delay β a 30-second response confirms blind injection regardless of whether output is visible. Script injection uses the literal value \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e111111\u003c/code\u003e β if it appears alone in the response, the input was executed. Path traversal strings use redundant \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e../\u003c/code\u003e sequences so they work regardless of how deep the web root is. File inclusion strings require monitoring for out-of-band connections, not response content.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003chr style=\"border:none;border-top:1px solid #1e1e3f;margin:12px 0\"\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch4 style=\"color:#d1d5db;margin:14px 0 6px;font-size:.95em\"\u003eStep 4: Configure Hit Detection and Response Analysis\u003c/h4\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eIn Burp Intruder's Options tab, configure the attributes to capture from each response:\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eBaseline columns (always captured):\u003c/strong\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003eHTTP status code\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003eResponse length\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003eResponse time\u003c/li\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eGrep β Match:\u003c/strong\u003e Configure strings to flag in responses. For fuzzing, use:\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cpre style=\"background:#0a0a1c;border:1px solid #1e1e3f;border-radius:6px;padding:10px 12px;overflow-x:auto;font-size:.9em;margin:8px 0\"\u003e\u003ccode style=\"color:#a5f3fc;background:none;padding:0;font-size:1em\"\u003eerror\nexception\nillegal\ninvalid\nfail\nstack\naccess\ndirectory\nfile\nnot found\nvarchar\nODBC\nSQL\nSELECT\n111111\nquotation\nsyntax\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eGrep β Extract:\u003c/strong\u003e For data harvesting, configure strings that precede the data you want to capture. Example: \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e\u003ctitle\u003e\u003c/code\u003e captures page titles; \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e\u003ctd\u003eName: \u003c/td\u003e\u003ctd\u003e\u003c/code\u003e captures user names from HTML tables.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eGrep β Payload:\u003c/strong\u003e Enable \"flag responses that reflect the payload\" to detect potential XSS β any response that echoes back the \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003exsstest\u003c/code\u003e string or the full XSS payload unmodified is a candidate.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eWHY response length is critical even when you have a reliable status code indicator:\u003c/strong\u003e Response length frequently surfaces anomalies you did not anticipate when designing the attack. In a session token enumeration, all HTTP 200 hits return roughly the same page β but noticeably longer responses indicate more-privileged user sessions. Always sort length even when status provides the primary signal.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003chr style=\"border:none;border-top:1px solid #1e1e3f;margin:12px 0\"\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch4 style=\"color:#d1d5db;margin:14px 0 6px;font-size:.95em\"\u003eStep 5: Handle Session Barriers Before Launching\u003c/h4\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eIdentify which barriers apply to the target, then configure Burp's session-handling stack in the order below. Each layer operates on every outgoing Intruder request automatically.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eCookie Jar (always enable):\u003c/strong\u003e\nBurp maintains a cookie jar tracking all application cookies seen in proxied traffic. Enable \"add cookies from cookie jar\" as the first session-handling rule action for the target domain. This ensures the most recent session token is always included.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eRequest Macros:\u003c/strong\u003e\nA macro is a predefined sequence of one or more requests replayed before (or instead of) the attack request. Define macros for each barrier:\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003e*Validate session:* A GET to an authenticated page. Configure the macro item to read its session cookie from the cookie jar and update the jar with the response cookie. Used to check whether the current session is still valid.\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003e*Re-login:* POST to the login endpoint with preset credentials. Updates the cookie jar with the new session token. Triggered when session validation fails.\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003e*Obtain token/nonce:* GET or POST to the form page that contains the anti-CSRF token. Configure the macro item to extract the token from the response (Burp auto-detects derivable parameter relationships; manually confirm). The extracted value is injected into the target request.\u003c/li\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eSession-Handling Rules (apply in this order):\u003c/strong\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e1. \u003cstrong style=\"color:#e5e7eb\"\u003eAll requests to target domain:\u003c/strong\u003e Add cookies from cookie jar.\n2. \u003cstrong style=\"color:#e5e7eb\"\u003eAll requests to target domain:\u003c/strong\u003e Check whether session is valid by running the validate-session macro. If session is invalid, run the re-login macro and update the cookie jar.\n3. \u003cstrong style=\"color:#e5e7eb\"\u003eRequests containing the anti-CSRF token parameter:\u003c/strong\u003e Run the obtain-token macro and set the token parameter to the extracted value from the macro's final response.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eScope each rule\u003c/strong\u003e to the correct Burp tools (Spider, Scanner, Intruder, Repeater as appropriate) and to the target host/URL pattern. Use the session-handling tracer to verify each rule fires correctly before launching the full attack.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eWHY this ordering matters:\u003c/strong\u003e Adding the cookie jar before the session-validity check ensures the check uses the current token, not a stale one. Validating before every request (rather than on failure) prevents a wave of failed requests from triggering account lockout or defensive session termination. Obtaining the token last ensures it is always fresh β anti-CSRF tokens are typically invalidated after a single use.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003chr style=\"border:none;border-top:1px solid #1e1e3f;margin:12px 0\"\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch4 style=\"color:#d1d5db;margin:14px 0 6px;font-size:.95em\"\u003eStep 6: Launch the Attack and Triage Results\u003c/h4\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eLaunch the attack in Burp Intruder. Results appear in a table with one row per request.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eTriage workflow:\u003c/strong\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e1. Click the \u003cstrong style=\"color:#e5e7eb\"\u003eStatus\u003c/strong\u003e column heading to sort by HTTP status code. Anomalous status codes (200 among mostly 302, or 500 among mostly 200) surface immediately.\n2. Click the \u003cstrong style=\"color:#e5e7eb\"\u003eLength\u003c/strong\u003e column heading to sort by response length. Responses that are meaningfully longer or shorter than the majority are candidates for further review.\n3. Click the \u003cstrong style=\"color:#e5e7eb\"\u003eTime\u003c/strong\u003e column heading to sort by response time. Significant delays (β₯25 seconds) against OS command injection payloads confirm blind time-based injection.\n4. Click each \u003cstrong style=\"color:#e5e7eb\"\u003eGrep column\u003c/strong\u003e heading to surface responses that matched the error/exception strings.\n5. \u003cstrong style=\"color:#e5e7eb\"\u003eShift-click any column\u003c/strong\u003e to reverse-sort β useful to move both extremes into view without re-sorting by hand.\n6. Double-click any row to view the full request and response. Right-click and \"Send to Repeater\" to manually investigate and refine the finding.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eWhat to look for:\u003c/strong\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eEnumeration:\u003c/strong\u003e Status code 200 (or a Set-Cookie with a session token) among predominantly 302/404/500 responses = valid identifier found.\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eHarvesting:\u003c/strong\u003e Extracted column values populated for hits; empty for misses.\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eFuzzing β SQL injection:\u003c/strong\u003e Single \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e'\u003c/code\u003e produces a response containing \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003equotation\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003esyntax\u003c/code\u003e, or \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003eODBC\u003c/code\u003e that differs from the \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e'--\u003c/code\u003e response (which may restore normal behavior); \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003ewaitfor\u003c/code\u003e payload produces ~30-second delay.\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eFuzzing β XSS:\u003c/strong\u003e Payload Grep column shows the \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003exsstest\u003c/code\u003e string was reflected unmodified.\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eFuzzing β OS command injection:\u003c/strong\u003e Response time for ping-based payloads is ~30 seconds; other payloads respond immediately.\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eFuzzing β Script injection:\u003c/strong\u003e Response contains \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e111111\u003c/code\u003e alone, not as part of the submitted string.\u003c/li\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eFor each confirmed or suspected finding, refer to the dedicated vulnerability skill for detailed exploitation and verification steps.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003chr style=\"border:none;border-top:1px solid #1e1e3f;margin:12px 0\"\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch3 style=\"color:#e5e7eb;margin:18px 0 8px;font-size:1.05em\"\u003eInputs\u003c/h3\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003eBurp Suite project file or proxy history with the target application's traffic\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003eAt least one valid authenticated session (credentials or an active session token)\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003eConfirmed scope and authorization from the authorizing party\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003e(For harvesting) Knowledge of the HTML structure around the data to extract\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003e(For enumeration) Known baseline response for a valid identifier value\u003c/li\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch3 style=\"color:#e5e7eb;margin:18px 0 8px;font-size:1.05em\"\u003eOutputs\u003c/h3\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eAttack Results Table\u003c/strong\u003e with one row per request, columns: request number, parameter, payload, HTTP status, response length, response time, grep matches, extracted data (if configured). Sorted to surface anomalies.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eFollow-up Findings List\u003c/strong\u003e β for each anomalous row:\n\u003cpre style=\"background:#0a0a1c;border:1px solid #1e1e3f;border-radius:6px;padding:10px 12px;overflow-x:auto;font-size:.9em;margin:8px 0\"\u003e\u003ccode style=\"color:#a5f3fc;background:none;padding:0;font-size:1em\"\u003eParameter: [name]\nPayload: [string]\nAnomaly: [status/length/time/grep observation]\nSuspected class: [SQL injection | XSS | OS command | path traversal | script injection | access control]\nNext step: [manual verification approach]\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003chr style=\"border:none;border-top:1px solid #1e1e3f;margin:12px 0\"\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch3 style=\"color:#e5e7eb;margin:18px 0 8px;font-size:1.05em\"\u003eKey Principles\u003c/h3\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eIsolation over coverage in fuzzing.\u003c/strong\u003e Test one parameter at a time (Sniper). If you inject into all positions simultaneously, you cannot attribute which payload triggered an anomaly. Isolation costs more requests but produces actionable results.\u003c/li\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eResponse length is always informative.\u003c/strong\u003e Even when status code provides a reliable hit signal, sort the length column anyway. The most interesting results are often the ones you didn't design the attack to find.\u003c/li\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eConfigure session handling before launching, not after failures appear.\u003c/strong\u003e A wave of unauthenticated requests from a failed session produces misleading uniform responses that look like no findings. The session-handling tracer is the only way to confirm your rules fire correctly before the full run.\u003c/li\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eAutomation amplifies human intelligence, not replaces it.\u003c/strong\u003e The goal is to reduce the mechanical load β submitting hundreds of requests, recording status and length β so you can spend your time on what automation cannot do: reasoning about why a response is different, recognizing a pattern that doesn't fit the expected schema, and deciding which anomaly is a real finding versus noise.\u003c/li\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003e10% accuracy is still useful.\u003c/strong\u003e For CAPTCHA bypass via automated solving, perfect accuracy is not required. An attack that solves only 1 in 10 puzzles correctly still completes the task in roughly 10x the time of a human β which is still orders of magnitude faster than manual testing at scale.\u003c/li\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003chr style=\"border:none;border-top:1px solid #1e1e3f;margin:12px 0\"\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch3 style=\"color:#e5e7eb;margin:18px 0 8px;font-size:1.05em\"\u003eExamples\u003c/h3\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eScenario: Session token enumeration on an application with weak token generation\u003c/strong\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eTrigger: \"The session tokens look partially sequential β I want to enumerate valid sessions for privilege escalation testing.\"\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eProcess:\n1. Analyze token structure from Burp Sequencer output: \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e000000-fb2200-16cb12-172ba72551\u003c/code\u003e. The final 3 hex digits increment predictably; the middle segment is static; the second segment partially increments.\n2. Capture a request to an authenticated page (\u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003eGET /auth/502/Home.ashx\u003c/code\u003e) that returns HTTP 200 for a valid session and HTTP 302 to login for an invalid one.\n3. Configure Intruder Sniper: one payload position on the last 3 hex digits of the session cookie value. Payload type: Numbers, range 0x000β0xfff, hex format, 3-digit minimum. No custom grep needed β status code is the hit signal.\n4. Launch. Sort results by Status. HTTP 200 rows = valid hijackable sessions.\n5. Sort results by Length. Two HTTP 200 responses are significantly longer than the rest β these are more-privileged user sessions. Double-click to confirm admin content.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eOutput: List of valid session tokens. Two confirmed as administrative. Escalate to manual session hijacking verification via Burp Repeater.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003chr style=\"border:none;border-top:1px solid #1e1e3f;margin:12px 0\"\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eScenario: Data harvesting via access-control flaw on a user-details endpoint\u003c/strong\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eTrigger: \"We found that \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003eGET /auth/498/YourDetails.ashx?uid=198\u003c/code\u003e returns any user's full profile β we need to harvest all accounts.\"\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eProcess:\n1. Inspect the response HTML: user data appears in table cells as \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e\u003ctd\u003eName: \u003c/td\u003e\u003ctd\u003ePhill Bellend\u003c/td\u003e\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e\u003ctd\u003eUsername: \u003c/td\u003e\u003ctd\u003ephillb\u003c/td\u003e\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e\u003ctd\u003ePassword: \u003c/td\u003e\u003ctd\u003eb3ll3nd\u003c/td\u003e\u003c/code\u003e.\n2. Configure Intruder Sniper: one payload position on \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003euid\u003c/code\u003e. Payload type: Numbers, range 190β250 (start from known-good range, widen later). Session cookie as a fixed non-attack parameter.\n3. Add three Extract Grep entries for \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e\u003ctd\u003eName: \u003c/td\u003e\u003ctd\u003e\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e\u003ctd\u003eUsername: \u003c/td\u003e\u003ctd\u003e\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e\u003ctd\u003ePassword: \u003c/td\u003e\u003ctd\u003e\u003c/code\u003e β each configured to capture text until the next \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e\u003c\u003c/code\u003e.\n4. Launch. Sort by Status. HTTP 200 rows with populated extract columns = valid users.\n5. Export tab-delimited results into a spreadsheet. Widen the UID range to capture all accounts.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eOutput: Complete user directory with credentials. Feed into privilege escalation and password reuse testing.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003chr style=\"border:none;border-top:1px solid #1e1e3f;margin:12px 0\"\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eScenario: Baseline vulnerability fuzzing of a login form and authenticated function\u003c/strong\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eTrigger: \"We need to fuzz every parameter in the login and in the user-detail page before concluding the assessment.\"\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eProcess:\n1. Send the login POST and the user-details GET from Burp Proxy history to Intruder using \"Send to Intruder.\" Intruder auto-marks all parameter values as payload positions.\n2. Configure Sniper attack type. Load the universal fuzzing payload kit (SQL, XSS, OS command, path traversal, script injection, file inclusion strings). Configure Grep-Match with the standard error-string list (\u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003eerror\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003eexception\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003equotation\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003esyntax\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003eODBC\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e111111\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003exsstest\u003c/code\u003e). Enable Payload Grep to flag reflected payloads.\n3. For the user-details page, configure a session-handling rule: validate session before each request; re-login macro runs if session is invalid. This prevents the expired-cookie false-negative problem.\n4. Launch both attacks. Sort each by Status, then Length, then Time.\n5. Login form results: \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e'\u003c/code\u003e in \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003eusername\u003c/code\u003e produces status 200, length 2941, with \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003eexception\u003c/code\u003e and \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003equotation\u003c/code\u003e in grep β different from all other payloads which produce length ~1600. Confirmed SQL injection candidate.\n6. User-details results: \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003exsstest\u003c/code\u003e in \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003euid\u003c/code\u003e is reflected in the response body (Payload Grep column shows match). Confirmed reflected input β escalate to manual XSS exploitation check.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eOutput: Two candidates (SQL injection in login username, reflected input in uid parameter). Escalate each to the dedicated vulnerability skill for confirmation and exploitation.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003chr style=\"border:none;border-top:1px solid #1e1e3f;margin:12px 0\"\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch3 style=\"color:#e5e7eb;margin:18px 0 8px;font-size:1.05em\"\u003eReferences\u003c/h3\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003eAttack type decision guide: \u003ca href=\"references/intruder-attack-type-selection.md\" target=\"_blank\" rel=\"noopener\" style=\"color:#6366f1\"\u003ereferences/intruder-attack-type-selection.md\u003c/a\u003e\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003eUniversal fuzzing payload kit (extended): \u003ca href=\"references/fuzzing-payload-kit.md\" target=\"_blank\" rel=\"noopener\" style=\"color:#6366f1\"\u003ereferences/fuzzing-payload-kit.md\u003c/a\u003e\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003eSession-handling rule templates: \u003ca href=\"references/session-handling-rule-templates.md\" target=\"_blank\" rel=\"noopener\" style=\"color:#6366f1\"\u003ereferences/session-handling-rule-templates.md\u003c/a\u003e\u003c/li\u003e\n\u003cli style=\"color:#94a3b8;margin:3px 0\"\u003eSource: Stuttard, D. \u0026 Pinto, M. (2011). *The Web Application Hacker's Handbook* (2nd ed.), Chapter 14: \"Automating Customized Attacks,\" pp. 571β613. Wiley.\u003c/li\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch3 style=\"color:#e5e7eb;margin:18px 0 8px;font-size:1.05em\"\u003eLicense\u003c/h3\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eThis skill is licensed under \u003ca href=\"https://creativecommons.org/licenses/by-sa/4.0/\" target=\"_blank\" rel=\"noopener\" style=\"color:#6366f1\"\u003eCC-BY-SA-4.0\u003c/a\u003e.\nSource: \u003ca href=\"https://github.com/bookforge-ai/bookforge-skills\" target=\"_blank\" rel=\"noopener\" style=\"color:#6366f1\"\u003eBookForge\u003c/a\u003e β The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws by Dafydd Stuttard, Marcus Pinto.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003ch3 style=\"color:#e5e7eb;margin:18px 0 8px;font-size:1.05em\"\u003eRelated BookForge Skills\u003c/h3\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eThis skill is standalone. Browse more BookForge skills: \u003ca href=\"https://github.com/bookforge-ai/bookforge-skills\" target=\"_blank\" rel=\"noopener\" style=\"color:#6366f1\"\u003ebookforge-skills\u003c/a\u003e\n\u003c/p\u003e"])</script><script>self.__next_f.push([1,"20:[\"$\",\"div\",null,{\"className\":\"skill-page\",\"children\":[[\"$\",\"script\",null,{\"type\":\"application/ld+json\",\"dangerouslySetInnerHTML\":{\"__html\":\"{\\\"@context\\\":\\\"https://schema.org\\\",\\\"@type\\\":\\\"SoftwareApplication\\\",\\\"name\\\":\\\"Web Application Fuzzing Automation\\\",\\\"description\\\":\\\"Build and execute customized automated attacks against web applications. Use this skill when: systematically enumerating valid identifiers (userids, document...\\\",\\\"url\\\":\\\"https://bytesagain.com/skill/bookforge-web-application-fuzzing-automation\\\",\\\"applicationCategory\\\":\\\"requires-sensitive-credentials\\\",\\\"operatingSystem\\\":\\\"Any\\\",\\\"offers\\\":{\\\"@type\\\":\\\"Offer\\\",\\\"price\\\":\\\"0\\\",\\\"priceCurrency\\\":\\\"USD\\\"},\\\"publisher\\\":{\\\"@type\\\":\\\"Organization\\\",\\\"name\\\":\\\"BytesAgain\\\",\\\"url\\\":\\\"https://bytesagain.com\\\"}}\"}}],[\"$\",\"div\",null,{\"className\":\"breadcrumb\",\"children\":[[\"$\",\"a\",null,{\"href\":\"/\",\"children\":\"BytesAgain\"}],\" βΊ \",[\"$\",\"a\",null,{\"href\":\"/skills\",\"children\":\"Skills\"}],\" βΊ \",\"Web Application Fuzzing Automation\"]}],[\"$\",\"div\",null,{\"className\":\"two-col\",\"children\":[[\"$\",\"div\",null,{\"className\":\"two-col-main\",\"children\":[[\"$\",\"div\",null,{\"className\":\"skill-card\",\"children\":[[\"$\",\"div\",null,{\"className\":\"skill-header\",\"children\":[[\"$\",\"div\",null,{\"className\":\"skill-badges\",\"children\":[[\"$\",\"span\",null,{\"className\":\"badge\",\"style\":{\"color\":\"#818cf8\",\"background\":\"#818cf822\",\"borderColor\":\"#818cf844\"},\"children\":[\"π¦\",\" \",\"ClawHub\"]}],false]}],[\"$\",\"div\",null,{\"className\":\"skill-top-actions\",\"children\":[\"$\",\"$L22\",null,{\"slug\":\"bookforge-web-application-fuzzing-automation\"}]}]]}],[\"$\",\"h1\",null,{\"className\":\"skill-title\",\"children\":\"Web Application Fuzzing Automation\"}],[\"$\",\"p\",null,{\"className\":\"skill-owner\",\"children\":[\"by \",[\"$\",\"span\",null,{\"children\":[\"@\",\"quochungto\"]}]]}],[\"$\",\"p\",null,{\"className\":\"skill-desc\",\"children\":\"Build and execute customized automated attacks against web applications. Use this skill when: systematically enumerating valid identifiers (userids, document...\"}],[\"$\",\"div\",null,{\"className\":\"skill-meta\",\"children\":[[\"$\",\"div\",null,{\"className\":\"meta-item\",\"children\":[[\"$\",\"span\",null,{\"className\":\"meta-label\",\"children\":\"Version\"}],[\"$\",\"span\",null,{\"className\":\"meta-value\",\"children\":[\"v\",\"1.0.0\"]}]]}],[\"$\",\"div\",null,{\"className\":\"meta-item\",\"children\":[[\"$\",\"span\",null,{\"className\":\"meta-label\",\"children\":\"Downloads\"}],[\"$\",\"span\",null,{\"className\":\"meta-value\",\"children\":\"289\"}]]}],false,false,false,[\"$\",\"div\",null,{\"className\":\"meta-item\",\"style\":{\"flexDirection\":\"row\",\"gap\":6,\"alignItems\":\"center\"},\"children\":[[\"$\",\"a\",\"legal\",{\"href\":\"/?q=legal\",\"className\":\"tag\",\"children\":[\"#\",\"legal\"]}],[\"$\",\"a\",\"automation\",{\"href\":\"/?q=automation\",\"className\":\"tag\",\"children\":[\"#\",\"automation\"]}]]}]]}],[\"$\",\"div\",null,{\"style\":{\"marginTop\":6},\"children\":[\"$\",\"a\",null,{\"href\":\"https://clawhub.ai/quochungto/bookforge-web-application-fuzzing-automation\",\"target\":\"_blank\",\"rel\":\"noopener\",\"className\":\"btn-secondary\",\"style\":{\"padding\":\"6px 12px\",\"fontSize\":\".82em\",\"borderRadius\":8,\"background\":\"transparent\",\"border\":\"1px solid var(--border-card)\",\"color\":\"var(--text-muted2)\",\"textDecoration\":\"none\",\"whiteSpace\":\"nowrap\"},\"children\":[\"View on \",\"ClawHub\",\" β\"]}]}]]}],[\"$\",\"div\",null,{\"className\":\"install-box\",\"children\":[[\"$\",\"div\",null,{\"className\":\"install-header\",\"children\":[[\"$\",\"div\",null,{\"className\":\"install-dots\",\"children\":[[\"$\",\"div\",null,{\"className\":\"dot\",\"style\":{\"background\":\"#ef4444\"}}],[\"$\",\"div\",null,{\"className\":\"dot\",\"style\":{\"background\":\"#eab308\"}}],[\"$\",\"div\",null,{\"className\":\"dot\",\"style\":{\"background\":\"#22c55e\"}}]]}],[\"$\",\"span\",null,{\"className\":\"install-label\",\"children\":\"TERMINAL\"}]]}],[\"$\",\"div\",null,{\"className\":\"install-body\",\"style\":{\"flexWrap\":\"wrap\"},\"children\":[[\"$\",\"code\",null,{\"className\":\"install-cmd\",\"children\":\"clawhub install bookforge-web-application-fuzzing-automation\"}],[\"$\",\"button\",null,{\"className\":\"copy-btn\",\"data-cmd\":\"clawhub install bookforge-web-application-fuzzing-automation\",\"style\":{\"fontWeight\":700},\"children\":\"Copy\"}]]}]]}],[\"$\",\"section\",null,{\"className\":\"skill-card\",\"style\":{\"marginBottom\":20},\"children\":[[\"$\",\"h2\",null,{\"style\":{\"color\":\"#f8fafc\",\"fontSize\":\"1.2em\",\"fontWeight\":800,\"margin\":\"0 0 16px\",\"display\":\"flex\",\"alignItems\":\"center\",\"gap\":8},\"children\":\"π About This Skill\"}],[\"$\",\"div\",null,{\"style\":{\"fontSize\":\".92em\",\"color\":\"#94a3b8\",\"lineHeight\":1.75},\"dangerouslySetInnerHTML\":{\"__html\":\"$23\"}}]]}],\"$L24\",\"$L25\",null,null,null,null,null,false,false]}],\"$L26\"]}]]}]\n"])</script><script>self.__next_f.push([1,"21:[\"$\",\"script\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"\\n document.querySelectorAll('.copy-btn, .script-copy-btn').forEach(btn =\u003e {\\n btn.addEventListener('click', () =\u003e {\\n const cmd = btn.getAttribute('data-cmd');\\n if (!cmd) return;\\n navigator.clipboard.writeText(cmd).then(() =\u003e {\\n const orig = btn.textContent;\\n btn.textContent = 'Copied!';\\n setTimeout(() =\u003e btn.textContent = orig, 1500);\\n }).catch(() =\u003e {});\\n });\\n });\\n \"}}]\n"])</script><script>self.__next_f.push([1,"29:I[71521,[\"/_next/static/chunks/0ph_0rx9ah5dc.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/0i_x3w546rsb3.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/06ig5gym-0n-u.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\",\"/_next/static/chunks/12w5ognupk9fb.js?dpl=dpl_9zPFH6pojPkqyspdDNz28GzCc6KQ\"],\"default\"]\n27:T866,"])</script><script>self.__next_f.push([1,"\u003ctable style=\"width:100%;border-collapse:collapse;border:1px solid #1e1e3f;border-radius:8px;overflow:hidden;font-size:.9em\"\u003e\u003cthead\u003e\u003ctr style=\"background:#0a0a1c\"\u003e\u003cth style=\"padding:12px 16px;text-align:left;color:#818cf8;font-weight:700;border-bottom:2px solid #6366f130\"\u003eTrigger\u003c/th\u003e\u003cth style=\"padding:12px 16px;text-align:left;color:#818cf8;font-weight:700;border-bottom:2px solid #6366f130\"\u003eAction\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd style=\"padding:12px 16px;border-bottom:1px solid #1e1e3f;color:#94a3b8\" colspan=\"2\"\u003e- A parameter holds identifiers (document IDs, account numbers, session tokens) that need iterating to find all valid values\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd style=\"padding:12px 16px;border-bottom:1px solid #1e1e3f;color:#94a3b8\" colspan=\"2\"\u003e- An access-control flaw lets you access other users' data, and you want to harvest it at scale\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd style=\"padding:12px 16px;border-bottom:1px solid #1e1e3f;color:#94a3b8\" colspan=\"2\"\u003e- A large application has dozens of dynamic pages, each with multiple parameters β manual fuzzing is not feasible\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd style=\"padding:12px 16px;border-bottom:1px solid #1e1e3f;color:#94a3b8\" colspan=\"2\"\u003e- Initial manual probing has revealed promising indicators (error messages, status code variation) that need systematic confirmation across the full parameter space\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd style=\"padding:12px 16px;border-bottom:1px solid #1e1e3f;color:#94a3b8\" colspan=\"2\"\u003e**The core insight:** Every web application is different. Off-the-shelf scanners apply generic signatures. A skilled tester using customized automation combines human intelligence (selecting the right request, interpreting subtle response differences, thinking like the application's designer) with computerized brute force to achieve results neither can deliver alone.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd style=\"padding:12px 16px;border-bottom:1px solid #1e1e3f;color:#94a3b8\" colspan=\"2\"\u003e**Authorized testing only.** Never apply these techniques without explicit written authorization from the application owner.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd style=\"padding:12px 16px;border-bottom:1px solid #1e1e3f;color:#94a3b8\" colspan=\"2\"\u003e---\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"])</script><script>self.__next_f.push([1,"24:[\"$\",\"section\",null,{\"className\":\"skill-card\",\"style\":{\"marginBottom\":20},\"children\":[[\"$\",\"h2\",null,{\"style\":{\"color\":\"#f8fafc\",\"fontSize\":\"1.2em\",\"fontWeight\":800,\"margin\":\"0 0 16px\",\"display\":\"flex\",\"alignItems\":\"center\",\"gap\":8},\"children\":\"β‘ When to Use\"}],[\"$\",\"div\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"$27\"}}]]}]\n28:T1b68,"])</script><script>self.__next_f.push([1,"\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eScenario: Session token enumeration on an application with weak token generation\u003c/strong\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eTrigger: \"The session tokens look partially sequential β I want to enumerate valid sessions for privilege escalation testing.\"\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eProcess:\n1. Analyze token structure from Burp Sequencer output: \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e000000-fb2200-16cb12-172ba72551\u003c/code\u003e. The final 3 hex digits increment predictably; the middle segment is static; the second segment partially increments.\n2. Capture a request to an authenticated page (\u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003eGET /auth/502/Home.ashx\u003c/code\u003e) that returns HTTP 200 for a valid session and HTTP 302 to login for an invalid one.\n3. Configure Intruder Sniper: one payload position on the last 3 hex digits of the session cookie value. Payload type: Numbers, range 0x000β0xfff, hex format, 3-digit minimum. No custom grep needed β status code is the hit signal.\n4. Launch. Sort results by Status. HTTP 200 rows = valid hijackable sessions.\n5. Sort results by Length. Two HTTP 200 responses are significantly longer than the rest β these are more-privileged user sessions. Double-click to confirm admin content.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eOutput: List of valid session tokens. Two confirmed as administrative. Escalate to manual session hijacking verification via Burp Repeater.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003chr style=\"border:none;border-top:1px solid #1e1e3f;margin:12px 0\"\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eScenario: Data harvesting via access-control flaw on a user-details endpoint\u003c/strong\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eTrigger: \"We found that \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003eGET /auth/498/YourDetails.ashx?uid=198\u003c/code\u003e returns any user's full profile β we need to harvest all accounts.\"\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eProcess:\n1. Inspect the response HTML: user data appears in table cells as \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e\u003ctd\u003eName: \u003c/td\u003e\u003ctd\u003ePhill Bellend\u003c/td\u003e\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e\u003ctd\u003eUsername: \u003c/td\u003e\u003ctd\u003ephillb\u003c/td\u003e\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e\u003ctd\u003ePassword: \u003c/td\u003e\u003ctd\u003eb3ll3nd\u003c/td\u003e\u003c/code\u003e.\n2. Configure Intruder Sniper: one payload position on \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003euid\u003c/code\u003e. Payload type: Numbers, range 190β250 (start from known-good range, widen later). Session cookie as a fixed non-attack parameter.\n3. Add three Extract Grep entries for \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e\u003ctd\u003eName: \u003c/td\u003e\u003ctd\u003e\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e\u003ctd\u003eUsername: \u003c/td\u003e\u003ctd\u003e\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e\u003ctd\u003ePassword: \u003c/td\u003e\u003ctd\u003e\u003c/code\u003e β each configured to capture text until the next \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e\u003c\u003c/code\u003e.\n4. Launch. Sort by Status. HTTP 200 rows with populated extract columns = valid users.\n5. Export tab-delimited results into a spreadsheet. Widen the UID range to capture all accounts.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eOutput: Complete user directory with credentials. Feed into privilege escalation and password reuse testing.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003chr style=\"border:none;border-top:1px solid #1e1e3f;margin:12px 0\"\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003cstrong style=\"color:#e5e7eb\"\u003eScenario: Baseline vulnerability fuzzing of a login form and authenticated function\u003c/strong\u003e\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eTrigger: \"We need to fuzz every parameter in the login and in the user-detail page before concluding the assessment.\"\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eProcess:\n1. Send the login POST and the user-details GET from Burp Proxy history to Intruder using \"Send to Intruder.\" Intruder auto-marks all parameter values as payload positions.\n2. Configure Sniper attack type. Load the universal fuzzing payload kit (SQL, XSS, OS command, path traversal, script injection, file inclusion strings). Configure Grep-Match with the standard error-string list (\u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003eerror\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003eexception\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003equotation\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003esyntax\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003eODBC\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e111111\u003c/code\u003e, \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003exsstest\u003c/code\u003e). Enable Payload Grep to flag reflected payloads.\n3. For the user-details page, configure a session-handling rule: validate session before each request; re-login macro runs if session is invalid. This prevents the expired-cookie false-negative problem.\n4. Launch both attacks. Sort each by Status, then Length, then Time.\n5. Login form results: \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003e'\u003c/code\u003e in \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003eusername\u003c/code\u003e produces status 200, length 2941, with \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003eexception\u003c/code\u003e and \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003equotation\u003c/code\u003e in grep β different from all other payloads which produce length ~1600. Confirmed SQL injection candidate.\n6. User-details results: \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003exsstest\u003c/code\u003e in \u003ccode style=\"background:#0d0d1e;color:#a5f3fc;padding:1px 5px;border-radius:3px;font-size:.88em\"\u003euid\u003c/code\u003e is reflected in the response body (Payload Grep column shows match). Confirmed reflected input β escalate to manual XSS exploitation check.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003eOutput: Two candidates (SQL injection in login username, reflected input in uid parameter). Escalate each to the dedicated vulnerability skill for confirmation and exploitation.\u003c/p\u003e\u003cp style=\"margin:8px 0\"\u003e\u003chr style=\"border:none;border-top:1px solid #1e1e3f;margin:12px 0\"\u003e\u003c/p\u003e"])</script><script>self.__next_f.push([1,"25:[\"$\",\"section\",null,{\"className\":\"skill-card\",\"style\":{\"marginBottom\":20},\"children\":[[\"$\",\"h2\",null,{\"style\":{\"color\":\"#f8fafc\",\"fontSize\":\"1.2em\",\"fontWeight\":800,\"margin\":\"0 0 16px\",\"display\":\"flex\",\"alignItems\":\"center\",\"gap\":8},\"children\":\"π‘ Examples\"}],[\"$\",\"div\",null,{\"style\":{\"fontSize\":\".92em\",\"color\":\"#94a3b8\",\"lineHeight\":1.75},\"dangerouslySetInnerHTML\":{\"__html\":\"$28\"}}]]}]\n26:[\"$\",\"div\",null,{\"className\":\"two-col-side\",\"children\":[\"$\",\"$L29\",null,{\"category\":\"requires-sensitive-credentials\",\"currentSlug\":\"bookforge-web-application-fuzzing-automation\",\"name\":\"Web Application Fuzzing Automation\",\"tags\":[\"legal\",\"automation\"]}]}]\n"])</script></body></html>
