The act of Fuzzing web applications.
Usually used to enumerate them to find hidden pages or files.
Targets
Sub-directory
Sub directories be searched by using as input common directory names from a wordlist and append them to the URL after a \, e.g. <URL>/<FUZZ input>.
Sub-domain
Sub-domains can be found be prepending common sub-domain names from a wordlist to the URL followed by a ., e.g. <FUZZ input>.<URL>.
Sometimes sub-domains are not published in public DNS records and one might look for VHosts instead.
VHost
To discover VHosts one can fuzz the HOST header of a HTTP request, e.g HOST: <FUZZ input>.<URL>.
Extension
We can find the file extensions used by the web application by using as input common file extensions, e.g. after index with <URL>/index.<FUZZ input>., to see what software the web application is running.
Parameter
Get-requests
To discover what parameters a website accepts with get-requests we can fuzz them by <URL>?<FUZZ input>=key.
Once accepted parameters are found one can fuzz the accepted key values for those parameters by <URL>?<parameter>=<FUZZ input>.
Post-requests
To discover what parameters are accepted with post-request we can fuzz with <FUZZ input>=key in the data field, and remember that PHP only accepts it if we include the header Content-Type: application/x-www-form-urlencoded.
When an accepted parameter is found one can then fuzz the accepted key values for that parameter with <parameter>=<FUZZ input> in the data field.