---
description: March 30, 2024
---

# Parameter Fuzzing - POST

{% code overflow="wrap" %}
```
ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/burp-parameter-names.txt -u http://admin.academy.htb:36035/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs 798
```
{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FQTSJ2WxhAc2FJCduk8fS%2Fimage.png?alt=media&#x26;token=17c46fe0-a090-48f8-a601-7c51c898c80f" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}
```
curl http://admin.academy.htb:36035/admin/admin.php -X POST -d 'id=key' -H 'Content-Type: application/x-www-form-urlencoded'
```
{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F9OT9XuUyFIzOostEpQm9%2Fimage.png?alt=media&#x26;token=066956f5-2695-481e-9ea0-2982abb16893" alt=""><figcaption></figcaption></figure>

