{"id":13845051,"url":"https://github.com/htrgouvea/nozaki","last_synced_at":"2025-04-09T21:20:57.702Z","repository":{"id":38342762,"uuid":"224178974","full_name":"htrgouvea/nozaki","owner":"htrgouvea","description":"HTTP fuzzer engine security oriented","archived":false,"fork":false,"pushed_at":"2025-03-31T22:46:50.000Z","size":82619,"stargazers_count":57,"open_issues_count":21,"forks_count":12,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-03-31T23:29:01.694Z","etag":null,"topics":["api","bugbounty","fuzzer","fuzzing","graphql","http","nozaki","perl","research","rest","restfull","security"],"latest_commit_sha":null,"homepage":"","language":"Perl","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/htrgouvea.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":".github/CONTRIBUTING.md","funding":".github/FUNDING.yml","license":"LICENSE.md","code_of_conduct":".github/CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":["htrgouvea"]}},"created_at":"2019-11-26T11:43:44.000Z","updated_at":"2025-03-31T22:46:53.000Z","dependencies_parsed_at":"2024-01-11T03:59:41.570Z","dependency_job_id":"a2534b31-73af-4612-b57d-b0d2750f7ba3","html_url":"https://github.com/htrgouvea/nozaki","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/htrgouvea%2Fnozaki","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/htrgouvea%2Fnozaki/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/htrgouvea%2Fnozaki/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/htrgouvea%2Fnozaki/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/htrgouvea","download_url":"https://codeload.github.com/htrgouvea/nozaki/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248112365,"owners_count":21049646,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["api","bugbounty","fuzzer","fuzzing","graphql","http","nozaki","perl","research","rest","restfull","security"],"created_at":"2024-08-04T17:03:08.933Z","updated_at":"2025-04-09T21:20:57.683Z","avatar_url":"https://github.com/htrgouvea.png","language":"Perl","funding_links":["https://github.com/sponsors/htrgouvea"],"categories":["Perl"],"sub_categories":[],"readme":"\u003cp align=\"center\"\u003e\n  \u003cimg src=\"https://heitorgouvea.me/images/projects/nozaki/logo.png\" width=\"150px\" heigth=\"150px\"\u003e\n  \u003ch3 align=\"center\"\u003e\u003cb\u003eNozaki\u003c/b\u003e\u003c/h3\u003e\n  \u003cp align=\"center\"\u003eHTTP engine fuzzer security oriented\u003c/p\u003e\n  \u003cp align=\"center\"\u003e\n    \u003ca href=\"/LICENSE.md\"\u003e\n      \u003cimg src=\"https://img.shields.io/badge/license-MIT-blue.svg\"\u003e\n    \u003c/a\u003e\n    \u003ca href=\"https://github.com/htrgouvea/nozaki/releases\"\u003e\n      \u003cimg src=\"https://img.shields.io/badge/version-0.2.9-blue.svg\"\u003e\n    \u003c/a\u003e\n    \u003cbr/\u003e\n    \u003cimg src=\"https://github.com/htrgouvea/nozaki/actions/workflows/linter.yml/badge.svg\"\u003e\n    \u003cimg src=\"https://github.com/htrgouvea/nozaki/actions/workflows/zarn.yml/badge.svg\"\u003e\n    \u003cimg src=\"https://github.com/htrgouvea/nozaki/actions/workflows/security-gate.yml/badge.svg\"\u003e\n    \u003cimg src=\"https://github.com/htrgouvea/nozaki/actions/workflows/test-on-ubuntu.yml/badge.svg\"\u003e\n  \u003c/p\u003e\n\u003c/p\u003e\n\n---\n\n### Summary\n\n\"Fuzzing is one of the most powerful and proven strategies for identifying security issues in real-world software\" and for this reason, Nozaki tries to bridge the gap for a complete solution focused on web applications.\n\nThe idea is that this solution is complete enough to cover the entire fuzzing process in a web application (be it a monolith, a REST API, or even a GraphQL API) being fully parameterized, piped with other tools and with amazing filters.\n\nNozaki supports dynamic workflows written in YAML, from there we can write test cases only once and then reuse them as many times as necessary on different targets.\n\n---\n\n### Download \u0026 Install\n\n``` bash\n  $ git clone https://github.com/NozakiLabs/nozaki \u0026\u0026 cd nozaki\n  $ cpanm --installdeps .\n```\n\n---\n\n### How to use\n\n```\n$ perl nozaki.pl\n\nNozaki v0.2.9\nCore Commands\n==============\n    Command           Description\n    -------           -----------\n    -A, --accept      Define a custom 'Accept' header\n    -T, --tasks       The number of threads to run in parallel\n    -H, --header      Define a custom header (header=value)\n    -m, --method      Define HTTP methods to use during fuzzing, separeted by \",\"\n    -u, --url         Define a target\n    -w, --wordlist    Define wordlist of paths\n    -d, --delay       Define seconds of delay between requests\n    -a, --agent       Define a custom User Agent\n    -r, --return      Set a filter based on HTTP Response Code\n    -e, --exclude     Exclude a specific result based on HTTP Response Code\n    -t, --timeout     Define the timeout, default is 10s\n    -p, --payload     Send a custom data\n    -j, --json        Display the results in JSON format\n    -W, --workflow    Pass a YML file with a fuzzing workflow\n    -S, --skip-ssl    Ignore SSL verification\n    -l, --length      Filter by the length of content response \n    -c, --content     Filter by string based on the content response\n    -P, --proxy       Send all requests through a proxy\n    -h, --help        See this screen\n```\n\n---\n\n### Basic examples\n\n```bash\n# Content Discovery: finding pages with 200 response code for the GET method\n$ perl nozaki.pl --method GET --url https://nozaki.io/ --return 200 --wordlist /path/to/wordlist.txt\n\nCode: 200 | URL: https://nozaki.io/CNAME | Method: GET | Response: OK | Length: null\nCode: 200 | URL: https://nozaki.io/index | Method: GET | Response: OK | Length: 6335\nCode: 200 | URL: https://nozaki.io/index.html | Method: GET | Response: OK | Length: 6335\nCode: 200 | URL: https://nozaki.io//README.md | Method: GET | Response: OK | Length: 3950\n```\n\n```bash\n# Discovery HTTP methods supported by the application with a personalized wordlist and auth token\n$ perl nozaki.pl -u http://lab.nozaki.io:8081 -e 404,400,405 -w ~/path/to/wordlist.txt -H \"X-Auth-Token=da1b16b40fe719cb73c7a19e2b6fa9c7\" -H \"Content-type=application/json\"\n\nCode: 200 | URL: http://lab.nozaki.io:8081/ | Method: GET | Response: OK | Length: 85\nCode: 200 | URL: http://lab.nozaki.io:8081/ | Method: HEAD | Response: OK | Length: 85\nCode: 200 | URL: http://lab.nozaki.io:8081/tokens | Method: GET | Response: OK | Length: 246\nCode: 500 | URL: http://lab.nozaki.io:8081/tokens | Method: POST | Response: Internal Server Error | Length: 1469\nCode: 200 | URL: http://lab.nozaki.io:8081/user/6 | Method: GET | Response: OK | Length: 72\nCode: 200 | URL: http://lab.nozaki.io:8081/tokens | Method: HEAD | Response: OK | Length: 246\nCode: 200 | URL: http://lab.nozaki.io:8081/uptime | Method: GET | Response: OK | Length: 129\nCode: 200 | URL: http://lab.nozaki.io:8081/user/6 | Method: HEAD | Response: OK | Length: 72\nCode: 200 | URL: http://lab.nozaki.io:8081/uptime | Method: HEAD | Response: OK | Length: 129\n```\n\n```yml\n# Using a YAML workflow for \"complex\" fuzzing tests cases\nrules:\n  - description: Find valid paths based on CMS directories\n    method: GET\n    wordlist: wordlists/technologies/cmsmap.txt\n    return: 200\n  - description: Find valid paths based on Wordpress\n    method: GET\n    wordlist: wordlists/technologies/wordpress.txt\n    return: 200\n  - description: Find valid paths based on Drupal\n    method: GET\n    wordlist: wordlists/technologies/drupal.txt\n    return: 200\n```\n\n```bash\n$ perl nozaki.pl -u http://lab.nozaki.io:31337/ -W /path/to/workflows/cms.yml\n\nCode: 200 | URL: http://lab.nozaki.io:31337/wp-content/plugins/easy-wp-smtp/ | Method: GET | Response: OK | Length: null\nCode: 200 | URL: http://lab.nozaki.io:31337/wp-json/wp/v2/users/ | Method: GET | Response: OK | Length: null\nCode: 200 | URL: http://lab.nozaki.io:31337/wp-config.php | Method: GET | Response: OK | Length: null\nCode: 200 | URL: http://lab.nozaki.io:31337/wp-content/backup-db/ | Method: GET | Response: OK | Length: null\n```\n\n* You can see [more examples here](/docs/Examples.md).\n\n---\n\n### Docker container\n\n```\n$ docker build -t nozaki . \n$ docker run -ti --rm nozaki --help\n```\n\n---\n\n### Contribution\n\nYour contributions and suggestions are heartily ♥ welcome. [See here the contribution guidelines.](/.github/CONTRIBUTING.md) Please, report bugs via [issues page](https://github.com/htrgouvea/nozaki/issues) and for security issues, see here the [security policy.](/SECURITY.md) (✿ ◕‿◕) This project follows the best practices defined by this [style guide](https://heitorgouvea.me/projects/perl-style-guide).\n\n---\n\n### License\n\nThis work is licensed under [MIT License.](/LICENSE.md)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhtrgouvea%2Fnozaki","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhtrgouvea%2Fnozaki","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhtrgouvea%2Fnozaki/lists"}