1

I know that you can pass cookies in Wfuzz by using multiple -b parameters like so: wfuzz -w /path/to/wordlist -b cookie1=foo -b cookie2=bar http://example.com/FUZZ

but I am wondering if you can pass a list of cookies, instead of doing them one by one, which takes forever and is ineffecient. I have looked everywhere for an answer it seems but I can't find one.

squelch
  • 23
  • 1
  • 4

2 Answers2

1

I'm not 100% sure what you mean by "list" in this case, but I'm assuming you mean you want to pass them as a single argument instead of having to specify multiple -b arguments.

Of course, cookies are just sent in an HTTP header, and -b is provided for convenience as to not require you to craft the header manually.

However, check out the wfuzz man page:

-H headers 

Use headers (ex:"Host:www.mysite.com,Cookie:id=1312321&user=FUZZ"). Repeat option for various headers.

So, you should be able to pass a cookie header with a list of cookies.

multithr3at3d
  • 12,842
  • 3
  • 32
  • 43
  • Yes I read before that you can just make your own headers. I was hoping there was a way to just save the cookies to a cookie jar, but I guess thats not a feature in wfuzz. Thanks for the answer. – squelch Jan 04 '20 at 17:46
0

wfuzz does provide session cookie functionality comparable to curl's cookie jar functionality.
At the core, it's wfuzz' introspection functionality and the wfuzzp type payload that can be used from the preceding request in an HTTP session.

There's a detailed explanation of how it is done on the github page of a framework called metahttp (which can be used as a convenience wrapper that generates wfuzz commands), see https://github.com/1LAB9fJYvmL9FUQREiUc2Rz7weVCm42qBs/metahttp/blob/master/ADVANCED.md

Basically, the scenario has a request save its corresponding HTTP response as an object file using the --oF WFUZZP1 switch, which the subsequent request introspects with the -z wfuzzp,WFUZZP1 directive which associates the payload with the placeholder FUZZ (or FUZ2Z,FUZ3Z, respectively).
Based on that, wfuzz can set the cookies of the subsequent HTTP request using a switch such as -b 'cookieXYZ=FUZZ[r.cookies.response.cookieXYZ]'

lab9
  • 544
  • 2
  • 7