repository·main·Indexed 19 days ago
https://github.com/brum3ns/fireflyAn advanced black-box fuzzer designed for asset discovery and detecting complex target behaviors. Firefly utilizes high-concurrency goroutines, a two-phase execution process (Verification and Attack), and features such as payload tampering, encoding, request verification, and regex-based payload replacement to identify vulnerabilities and target patterns.
The Request Verifier is a critical feature that helps Firefly understand the core behavior of the target. By verifying requests, Firefly can avoid junk results and focus on high-quality findings. Note that increasing verification depth may impact performance depending on your hardware.
Use the -e flag to enable verification.
firefly -u 'http://example.com/?query=FUZZ' -eYou can install Firefly using go install or go get. Ensure you have Go installed on your system.
go install -v github.com/Brum3ns/firefly/cmd/firefly@latestYou can provide your own wordlists for fuzzing.
Specify a file and its attack type using the format file:type.
Point to a folder to extract all wordlists. Firefly expects wordlists to follow the naming convention <type>_wordlist.txt (e.g., fuzz_wordlist.txt, time_wordlist.txt).
# Single wordlist with attack type
firefly -u 'http://example.com/?query=FUZZ' -w wordlist.txt:fuzz
# Extract all wordlists from a folder
firefly -u 'http://example.com/?query=FUZZ' -w wl/Firefly supports several ways to define the target request:
Specify multiple HTTP methods and protocols using comma-separated lists.
-m: HTTP methods (e.g., GET,POST,PUT)-p: Protocols (e.g., https,http,ws)You can pipe URLs directly into Firefly via stdin.
Use the -r flag to provide a raw HTTP request. Firefly will automatically detect GET and/or POST parameters to fuzz. You can use -au replace to specify how to handle parameter replacement.
Set a custom timeout for requests using --timeout (in milliseconds).
# Using methods and protocols
firefly -u 'http://example.com/?query=FUZZ' -m GET,POST,PUT -p https,http,ws
# Using pipeline
echo 'http://example.com/?query=FUZZ' | firefly
# Using raw HTTP request
firefly -r 'GET /?query=FUZZ HTTP/1.1\nHost: example.com\nUser-Agent: FireFly'
# Raw request with parameter replacement
firefly -r 'POST /?A=1 HTTP/1.1\nHost: example.com\nUser-Agent: Firefly\nX-Host: FUZZ\n\nB=2&C=3' -au replaceFirefly allows you to manipulate payloads before they are sent to the target.
-show-payload: Displays the format of all payloads and exits.-list-tamper: Lists all available tamper types.Use the -e flag to apply transformations. You can provide multiple transformations separated by commas.
s2c).hex, url).Use -pr to perform regex-based replacement on payloads. The syntax uses => (with spaces) to indicate the replacement string.
Example: Replacing (1=1) with (13=(37-24)) in payloads.
# List available tampers
firefly -list-tamper
# Apply a tamper (e.g., s2c)
firefly -u 'http://example.com/?query=FUZZ' -e s2c
# Apply multiple encodings (hex then URL)
firefly -u 'http://example.com/?query=FUZZ' -e hex,url
# Regex payload replacement
firefly -u 'http://example.com/?query=FUZZ' -pr '\([0-9]+=[0-9]+\) => (13=(37-24))'Firefly is a fuzzer that operates in two distinct phases: a verification phase and an attack phase.
VerifyRunner to detect normal behavior and patterns within the target. This phase generates KnowledgeStorage.AttackRunner (black-box enumeration) using the knowledge gathered during the verification phase to perform the actual fuzzing.Upon completion, the tool outputs a summary including total requests/responses, scanned items, detected behaviors, filtered requests, errors, and total execution time.
# Note: As this is the main entrypoint, usage typically involves running the compiled binary.
# The tool automatically handles setup, configuration, and the two-stage execution process.
./fireflyYou can deploy a local test server environment for Firefly using the provided docker-compose.yml. This service runs a php-apache container which builds from the local Dockerfile and exposes the Firefly service on port 1337 of your host machine.
docker-compose upTo perform a simple fuzzing task, provide a target URL containing the FUZZ keyword.
firefly -u 'http://example.com/?query=FUZZ'Adjust how Firefly utilizes system resources:
-t: Set the number of threads/concurrency.-dl: Set a time delay in milliseconds (ms) for each concurrency level.# Use 35 threads
firefly -u 'http://example.com/?query=FUZZ' -t 35
# Use 35 threads with a 2000ms delay
firefly -u 'http://example.com/?query=FUZZ' -t 35 -dl 2000Specify how results are saved using the -o flag.
-oJ): Strongly recommended for structured data. Allows for easy navigation and comparison using tools like jq.# Plaintext output
firefly -u 'http://example.com/?query=FUZZ' -o file.txt
# JSON output (recommended)
firefly -u 'http://example.com/?query=FUZZ' -oJ file.jsonUse filters to include or exclude results based on specific criteria to reduce noise.
Use -fc to filter by status code and -fl to filter by line count to ignore specific responses.
Use -mr to match a regex pattern in the response and -mc to match a specific status code to include only those responses.
# Ignore status code 302 and line count 0
firefly -u 'http://example.com/?query=FUZZ' -fc 302 -fl 0
# Include only responses matching a regex and status code 200
firefly -u 'http://example.com/?query=FUZZ' -mr '[Ee]rror (at|on) line \d' -mc 200When running the test server via Docker Compose, the service is mapped as follows:
133780 (Apache default)Access the service at http://localhost:1337.
ports:
- 1337:80