$ show gehaxelt/phuzz
Phuzz is a research-oriented web application fuzzing framework that orchestrates multiple fuzzers (Burp Suite, Wapiti, WFuzz, ZAP) alongside its own custom fuzzer to detect vulnerabilities in web applications. The repository includes a custom Python-based fuzzer with mutation and scoring modules, a crawler for discovering endpoints, a HAR generator for request capture, and Docker-based orchestration for running fuzzers against vulnerable test applications (bWAPP, DVWA, WackoPicko, XVWA, WordPress plugins). It also contains extensive experimental data and analysis scripts from studies on known and zero-day vulnerabilities, particularly targeting WordPress plugins. The architecture is modular, with separate components for crawling, fuzzing, and result analysis, all containerized via Docker Compose. While primarily a research tool, the core fuzzer and instrumentation components are well-structured and could be extracted for reuse in other security testing pipelines.
The LLM identified 5 files worth highlighting for reuse:
The main fuzzer engine that orchestrates the fuzzing process. It reads configuration files, generates mutated requests using the mutator module, sends them to target endpoints, and evaluates responses via the scoring and vulnerability check modules. This component is self-contained and could be reused as a standalone HTTP fuzzer with minimal adaptation.
Implements payload mutation strategies for fuzzing, including SQL injection, XSS, command injection, and other attack vectors. It provides a configurable mutation pipeline that can be extended with custom payloads. This module is decoupled from the rest of the fuzzer and can be reused in any security testing tool requiring payload generation.
Contains logic for detecting vulnerabilities in HTTP responses, such as SQL errors, XSS reflections, and path traversal indicators. It uses pattern matching and heuristic analysis to classify responses as vulnerable. This component is reusable for building custom vulnerability scanners or integrating into CI/CD pipelines.
PHP instrumentation script for collecting code coverage during fuzzing. It hooks into PHP execution to track which lines are executed, enabling coverage-guided fuzzing. This script is self-contained and can be reused in any PHP application to gather coverage data for security testing or debugging.
A web crawler that discovers endpoints and forms from target web applications. It parses HTML, follows links, and extracts form actions to build a list of fuzzable inputs. This component is independent and can be reused for reconnaissance in other security tools.