9.5. 模糊测试

9.5.1. Web Fuzz

• wfuzz

• SecLists

• fuzzdb

• foospidy payloads

• ffuf Fast web fuzzer written in Go

9.5.2. XSS Payloads

• PORTSWIGGER XSS cheat sheet

• Pgaijin66 XSS-Payloads

• OWASP XSS

9.5.3. Burp插件

• BurpBounty Scan Check Builder

• BurpShiroPassiveScan

• IntruderPayloads A collection of Burpsuite Intruder payloads

9.5.4. 字典

• Blasting dictionary

• pydictor A powerful and useful hacker dictionary builder for a brute-force attack

• fuzzDicts Web Pentesting Fuzz 字典

• bruteforce lists

• CT subdomains

• PentesterSpecialDict 渗透测试人员专用精简化字典

9.5.5. Unicode Fuzz

• utf16encode

9.5.6. WAF Bypass

• abuse ssl bypass waf

• wafninja