[FEATURE REQUEST] Fuzzing with OPTIONS method then automatically Fuzzing with method returned in Allow headers.
Author: 0xDexter0usCreated May 15, 2023Updated Jul 28, 2023
Labelsenhancementpinned
Is your feature request related to a problem? Please describe.
When fuzzing APIs we all know and are lazy to FUZZ all GET, POST, PUT, PATCH, and DELETE, and miss a lot of stuff as for example GET /foo gives 404 while POST /foo might give a 200 Ok,
Describe the solution you'd like My solution sounds simple but might be hard to implement.
- Fuzz with
-m OPTIONSflag. - Read all the responses of
200and204, it's just headers. - Extract the value of the
Allow&Access-Control-Allow-Headersheaders from the responses. - Fuzz those methods from the responses. (Just with caution in the case of the
DELETEmethod)
Additional context
Source: epi052/feroxbuster