{"id":22216678,"url":"https://github.com/tiagorangel1/bunbuster","last_synced_at":"2025-04-06T10:10:31.601Z","repository":{"id":265956570,"uuid":"896963128","full_name":"tiagorangel1/bunbuster","owner":"tiagorangel1","description":"Ridiculously fast web \u0026 TCP fuzzer designed for brute-forcing directories, subdomains, and files on web servers.","archived":false,"fork":false,"pushed_at":"2025-03-18T11:12:23.000Z","size":9573,"stargazers_count":103,"open_issues_count":0,"forks_count":6,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-03-30T09:05:32.348Z","etag":null,"topics":["bun","fuzzer","web-fuzzer"],"latest_commit_sha":null,"homepage":"https://bunbuster.glitch.me/","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tiagorangel1.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-12-01T18:22:05.000Z","updated_at":"2025-03-20T08:13:30.000Z","dependencies_parsed_at":"2025-01-11T16:19:02.254Z","dependency_job_id":"ebdf531b-f28a-4b73-ab78-3ca06bd87dd3","html_url":"https://github.com/tiagorangel1/bunbuster","commit_stats":null,"previous_names":["tiagorangel1/bunbuster"],"tags_count":11,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tiagorangel1%2Fbunbuster","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tiagorangel1%2Fbunbuster/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tiagorangel1%2Fbunbuster/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tiagorangel1%2Fbunbuster/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tiagorangel1","download_url":"https://codeload.github.com/tiagorangel1/bunbuster/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247464220,"owners_count":20942970,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bun","fuzzer","web-fuzzer"],"created_at":"2024-12-02T22:12:48.757Z","updated_at":"2025-04-06T10:10:31.584Z","avatar_url":"https://github.com/tiagorangel1.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# BunBuster\n## Ridiculously fast web \u0026 TCP fuzzer designed for brute-forcing directories, subdomains, and files on web servers.\n\nUp to **3.5x** faster than ffuf and fully built with Bun. Available for Windows, Mac and Linux.\n\n\n| [Download](#installation) | [Usage \u0026 examples](#usage) | [Website](https://bunbuster.glitch.me)\n|----------|----------|----------|\n\n![Screenshot of a BunBuster scan's result, finding 2 paths on a test server](./assets/screenshot.png)\n![Screenshot of a BunBuster scan in progress](./assets/screenshot-loader.png)\n\n\u003csmall\u003e* Without using artificial ratelimits, and in my own testing. Might vary depending on your machine.\u003c/small\u003e\n\n***\n\n## Installation\n\n1. Go to the [releases page](https://github.com/tiagorangel1/bunbuster/releases/latest) and download the executable for your platform.\n2. Rename the file to `bunbuster`\n3. If you're on Linux, give the file executable permissions (`chmod +x bunbuster`)\n4. Add the executable to your PATH:\n   - **Linux:** `echo 'export PATH=\"$PATH:$(pwd)/bunbuster\"' \u003e\u003e ~/.bashrc \u0026\u0026 source ~/.bashrc`\n   - **Windows:** `setx PATH \"%PATH%;%cd%\\bunbuster\"`\n   - **Mac:** `echo 'export PATH=\"$PATH:$(pwd)/bunbuster\"' \u003e\u003e ~/.zshrc \u0026\u0026 source ~/.zshrc`\n\n\nMake sure it has executable permissions (`chmod +x bunbuster-xxxxxxx`) and to add it to PATH, or else you'll have to cd into the executable's folder and use `./bunbuster` instead of `bunbuster`.\n\n### (alternative) Compile from scratch\nYou'll only need Bun. Install it and run `bun install`, then `bun run build.js`. The executables should pop up in the out/ folder.\n\n## Features\n\n- **Super fast**:\n  - Optimized for speed, multi-threaded by default.\n  - Built with Bun\n  - 3.5x faster than ffuf\n- **Extensible**:\n  - Fully-fledged TCP support\n  - Fuzz by path, subdomains, parameters, request body, headers and more\n- **Filtering**:\n  - Filter responses by size\n  - Filter responses by status code\n- **Super customizable**:\n  - Custom headers\n  - Custom methods\n  - Fully configurable request parameters\n  - Use fuzzing in any request parameter, URL, paths, subdomains and more.\n- **Bypass ratelimits**:\n  - Built-in rate limit detection and evasion by using a backoff delay.\n  - Configurable request throttling by using the `requests per minute` config.\n  - Simple IP spoofing by setting a randomized `X-Forwarded-For`/`X-Real-IP` header\n  - Built-in timeout handling\n- **And more**:\n  - Export as CSV\n  - View request sizes\n  - Easy to understand docs\n  - Clean UX\n\n\n\u003e Note: As all other web fuzzers, you'll need a wordlist. You can download sample ones from the `assets/wordlists` folder in this repo.\n\n***\n\n![BunBuster vs FFUF speed comparison](./assets/speed-graph.svg)\n\n\u003ccenter\u003e\n\u003cb\u003eSpeed comparison: Time to run a full scan\u003c/b\u003e\u003cbr\u003e\n\u003csmall\u003eon \u003ccode\u003ehttp://ffuf.me/cd/basic/FUZZ\u003c/code\u003e, default settings, same wordlist (7530 words)\u003c/small\u003e\n\u003c/center\u003e\n\n## Usage\n\n```bash\nbunbuster \u003curl\u003e [options]\n```\n\nUse `FUZZ` as the placeholder for fuzzing. This is in order to make it easier to use with other tools like ffuf.    \nRun `bunbuster --help` to see all of the available arguments and options.\n\n## Examples\n\n### Basic\n```bash\nbunbuster http://ffuf.me/cd/basic/FUZZ -w ./wordlists/common.txt\n```\n\n### FUZZ between extension and path\n```bash\nbunbuster http://ffuf.me/cd/ext/logs/FUZZ.log -w ./wordlists/common.txt\n```\n\n### FUZZ in parameters\n```bash\nbunbuster http://ffuf.me/cd/param/data?FUZZ=1 -w ./wordlists/parameters.txt\n```\n\n### Set ratelimiting\n```bash\nbunbuster http://ffuf.test/cd/rate/FUZZ -w ./wordlists/common.txt -rpm 3000 # 50 req/s\n```\n\n### Automatic ratelimit detection\n```bash\nbunbuster http://ffuf.test/cd/rate/FUZZ -w ./wordlists/common.txt\n# note that -rpm is not set\n```\n\n### Proxying\n```bash\nbunbuster http://ffuf.test/cd/rate/FUZZ --proxy https://username:password@proxy.example.com:8080\n```\n\n### Subdomain Discovery\n```bash\nbunbuster https://FUZZ.example.com -w ./wordlists/subdomains.txt\n```\n\n### Custom Headers\n```bash\nbunbuster https://api.example.com/FUZZ \\\n  -w ./wordlists/all.txt \\\n  -o '{\"headers\": {\"Authorization\": \"Bearer TOKEN\"}}'\n```\n\n### Verbose logging\n```bash\nbunbuster https://api.example.com/FUZZ \\\n  -w ./wordlists/all.txt \\\n  --verbose\n```\n\n## Roadmap\nThese features aren't currently implemented but they might be comming soon.\n* Different wordlists that match to different keywords, e.g.\n```bash\nbunbuster https://$FUZZ1.example.com/$FUZZ2 -w \"./wordlists/subdomains.txt, ./wordlists/common.txt\"\n```\n\n* Ability to use with `bunx`\n\n## Notes\n\n- If you don't know how to use this, copy this file and give it to ChatGPT. It will tell you everything you need to know. Don't open an issue.\n- Be mindful of potential IP blocking. BunBuster currently does not have support for Tor, but you can set up a VPN and it should use it too.\n- As always, use this responsibly and only on systems you have explicit permission to test BunBuster is intended for security research and authorized penetration testing. Always obtain proper authorization before scanning or testing any system you do not own or have explicit permission to test.\n- I know that the bundle size might be pretty big, but that's a Bun problem since it embeds its binary directly into the executable. But it's still under 95mb, so prob not a problem for most people.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftiagorangel1%2Fbunbuster","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftiagorangel1%2Fbunbuster","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftiagorangel1%2Fbunbuster/lists"}