Decisive output: record the scheme, hostname/Host header, port, redirects, page title, certificate names, server/framework clues and whether the view is anonymous or authenticated.
Use a separate cookie jar per identity. Do not mix anonymous, ordinary-user and administrator evidence.
Confirm the proxy listener is active on 127.0.0.1:8080. Use -k only for the controlled lab because it disables destination-certificate verification.
Read / verify → Record final URL, host, status, redirects, cookies and authentication context before comparing payload results.
If it fails → A redirect loop or generic default page may indicate a wrong host or missing session rather than a nonexistent application.
Failure cue: uniform status/length may be the default vhost. Compare each candidate with a random host header before adding it to the application map.
Read / verify → Compare candidate and nonexistent-host responses, including content and redirects; resolve to the intended scoped address.
If it fails → A default response for every host or an SNI mismatch makes the result inconclusive; do not treat every guessed hostname as a real application.
Use when: Forms, downloads, exports, account functions or role-specific interfaces
Needs: A normal request baseline and the relevant account/role; authorized accounts for role comparisons
Client commands / example output
# Baseline
METHOD PATH | CONTENT-TYPE | ACCESS CONTEXT/ROLE
INPUT LOCATION + NAME | BASELINE VALUE
STATUS | LENGTH/HASH | REDIRECT | MARKER/ERROR/TIME
OBJECT/FUNCTION SELECTED | NEXT ONE-VARIABLE TEST
Next: a browser-side restriction is not server authorization. Replay the raw request and change one field, object reference, method or access-context element at a time.
Read / verify → Retain method, route, input location, identity and expected normal behavior; do not infer vulnerability from an interesting parameter name.
If it fails → Expired sessions, CSRF failures and malformed requests can imitate access-control differences; reproduce a valid baseline first.
Decisive output: a path, parameter, API schema, object identifier, component or secret-bearing artifact that creates a specific next request. Source disclosure is not command execution.
Shell commands
git-dumper is an optional third-party helper; install on demand in an isolated environment only when the exposure has been confirmed. Manual object recovery is possible but slower.
Decisive output: manually verified routes including useful 200, redirect, 401, 403 and 405 responses.
Use only the cookie or header that applies. An expired session can turn every result into the same login redirect.
Read / verify → Open candidates and record their actual behavior; status/length alone is only a selection clue.
If it fails → Aggressive filters can hide genuine routes and rate limiting can fabricate differences; validate the baseline and reduce the request rate.
Use when: An API/schema, numeric object IDs, hidden fields or different HTTP methods
Needs: A valid request and explicit role/object ownership; exact input format and content type
GET parameter names
# GET parameter names
ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -u 'http://TARGET:PORT/PATH?FUZZ=test' -ac -o params-get.json
# POST form parameter names
ffuf -w WORDLIST -u http://TARGET:PORT/PATH -X POST -H 'Content-Type: application/x-www-form-urlencoded' -d 'known=value&FUZZ=test' -ac -o params-post.json
# Object values with an authenticated API
ffuf -w NUMBERS -u 'http://TARGET:PORT/api/objects/FUZZ' -H 'Authorization: Bearer TOKEN' -mc all -fc 404 -o object-values.json
# ffuf — preserve a captured authenticated request
# HTTPS request, including its original method and session headers
ffuf -request request.txt -request-proto https -w WORDLIST -mc all -ac -t 10 -o request-https.json
# Plain HTTP request: otherwise ffuf defaults to HTTPS
ffuf -request request.txt -request-proto http -w WORDLIST -mc all -ac -t 10 -o request-http.json
Decisive output: a manually reproduced parameter or value that changes application behavior. Tool outliers are candidates, not confirmed access-control flaws.
Read: compare an outlier's status/length/body with a known missing value, then replay that exact request. A login redirect for every value → refresh the session before continuing. A one-time CSRF token → repair token handling; the saved-request flag does not refresh it automatically.
Ffuf — preserve a captured authenticated request
Read: compare an outlier's status/length/body with a known missing value, then replay that exact request. A login redirect for every value → refresh the session before continuing. A one-time CSRF token → repair token handling; the saved-request flag does not refresh it automatically.
Build a matrix across anonymous, user A, user B and administrator contexts where available
Interpretation:405 can establish that a route exists but rejects the method. Validation errors can reveal required fields. A token establishes only the authorization demonstrated by a later request.
# Build a matrix across anonymous, user A, user B and administrator contexts where available
PATH | METHOD | IDENTITY/ROLE | OBJECT/PROPERTY | RESULT | NEXT
Read / verify → Prove which input is consumed and whether state changes persist in an independent read.
If it fails → HTTP 400/415 may indicate encoding/schema rather than security enforcement. Keep a valid request before changing permissions-related properties.