---
description: March 30, 2024
---

# Parameter Fuzzing - GET

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FodiTKVHHsgpmjX5TBhvy%2Fimage.png?alt=media&#x26;token=9d0470da-4755-4fa8-a637-5ba89360ed1d" alt=""><figcaption></figcaption></figure>

```
http://admin.academy.htb:36035/admin/admin.php
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F77BBSNCoIIX8PRzkIg0E%2Fimage.png?alt=media&#x26;token=c21a5857-973a-4df5-ab8c-3d7ce83177a5" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}
```
ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/burp-parameter-names.txt -u http://admin.academy.htb:36035/admin/admin.php?FUZZ=key -fs 798
```
{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FJAacK1MmxP6XCTgtdFPh%2Fimage.png?alt=media&#x26;token=79ee2a0e-0782-4955-b301-967683e8c380" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F7VgZtSWkVxiwotMbOZgU%2Fimage.png?alt=media&#x26;token=411ca18a-d392-40af-9f92-51ce7f3cf02e" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FejremQgZ686CCoPBk5CR%2Fimage.png?alt=media&#x26;token=68cd6f4a-b8d0-4fb0-921f-c836b6a62eb2" alt=""><figcaption></figcaption></figure>
