[FEATURE REQUEST] Fuzzing with OPTIONS method then automatically Fuzzing with method returned in Allow headers.

Author: 0xDexter0usCreated May 15, 2023Updated Jul 28, 2023
Labelsenhancementpinned

Is your feature request related to a problem? Please describe.

When fuzzing APIs we all know and are lazy to FUZZ all GET, POST, PUT, PATCH, and DELETE, and miss a lot of stuff as for example GET /foo gives 404 while POST /foo might give a 200 Ok,

Describe the solution you'd like My solution sounds simple but might be hard to implement.

  • Fuzz with -m OPTIONS flag.
  • Read all the responses of 200 and 204, it's just headers.
  • Extract the value of the Allow & Access-Control-Allow-Headers headers from the responses.
  • Fuzz those methods from the responses. (Just with caution in the case of the DELETE method)

Additional context 2023-05-15_20-01