nuclei-templates/examples/http-intruder-fuzz.yaml

id: dummy-raw
info:
  name: Example-Fuzzing

requests:
  - payloads:
      param_a: /home/user/wordlist_param_a.txt
      param_b: /home/user/wordlist_param_b.txt
    attack: clusterbomb  # Available options: sniper, pitchfork and clusterbomb
    raw:
      # Request with simple param and header manipulation with DSL functions
      - |
        POST /?param_a={{param_a}}&paramb={{param_b}} HTTP/1.1
        User-Agent: {{param_a}}
        Host: {{Hostname}}
        another_header: {{base64(param_b)}}
        Accept: */*

        This is the Body
      # Request with body manipulation
      - |
        DELETE / HTTP/1.1
        User-Agent: nuclei
        Host: {{Hostname}}

        This is the body {{sha256(param_a)}}
      # Yet another one
      - |
        PUT / HTTP/1.1
        Host: {{Hostname}}

        This is again the request body {{html_escape(param_a)}} + {{hex_encode(param_b))}}
    matchers:
      - type: word
        words:
          - "title"
          - "body"