> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/reconnaissance/web-fuzzing.md).
# Web 模糊测试
Web fuzzing 有助于在 Web 应用程序侦察过程中发现隐藏的目录、文件、扩展名、参数、虚拟主机和暴露的资源。
{% hint style="info" %}
有许多用于发现网站目录和文件的工具与方法，无论是通过命令行还是在线资源。以下是主要方法和最有用的工具：
{% endhint %}
## Gobuster：
> Gobuster 是一款用于对网站目录和文件进行暴力破解的快速且高效的工具。
### **仅目录：**
```bash
gobuster dir -u http://website.com/ -w /usr/share/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 100
```
* **-u**：目标站点的 URL。
* **-w**：包含关键词列表（wordlist）的文件路径。
* **-t**：用于搜索的线程数。
### **具有特定扩展名的文件：**
```bash
gobuster dir -u http://website.com/ -w /usr/share/SecLists/Discovery/Web-Content/quickhits.txt -t 100 -x html,php,txt
```
* **-x**：指定要搜索的扩展名。
### **为响应添加特定过滤器：**
* **-hh**：按字节大小过滤主体。
* **-hc**：排除具有特定状态码的响应（例如 404）。
## Wfuzz：
> Wfuzz 允许通过暴力破解进行高级且可配置的搜索，无论是针对目录还是 URL 中的参数。
### **仅目录：**
```bash
wfuzz -c -t 100 -w /usr/share/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt http://website.com/FUZZ
```
* **-c**：以彩色显示输出。
* **FUZZ**：表示将把关键词注入的位置。
### **具有特定扩展名的文件：**
```bash
wfuzz -c -t 100 -w /usr/share/SecLists/Discovery/Web-Content/quickhits.tx -z list,html-txt-php http://website.com/
```
* **-z**：定义搜索中要使用的附加扩展名（list 允许你定义多个扩展名）。
### **动态参数值（`?product_id=`) :**
```bash
wfuzz -c -t 100 -z range,1-200000 'http://website.com/shop/buy/detail?product_id=FUZZ'
```
* **-z range,1-200000**：执行一个范围为 1 到 200,000 的暴力破解攻击。
## **其他方法：**
### 公开来源发现：
如果你更喜欢可视化的公开来源方法，请使用其中维护的目录 [OSINT 和研究工具](/zh/hacking-tools/osint.md).
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/reconnaissance/web-fuzzing.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.