Simple Clientside vulnerability/xss fuzzer
npm install puff-fuzz
!npm package size
!npm puppeteer package


!Release - Downloads
!npm
I will eventually rewrite this project. It works well, but it's not very clean and from my amateur years.

```
git clone https://github.com/FlameOfIgnis/puff
cd puff
npm install
OR
If you dont have chromium:
``
npm install -g puff-fuzz
**If you have chromium: (Don't forget to set path via puff -c "path/to/chromium/"
windows:
``
set PUPPETEER_SKIP_DOWNLOAD=true
npm install -g puff-fuzz
linux:
``
export PUPPETEER_SKIP_DOWNLOAD=true
npm install -g puff-fuzz
Testing
`
Windows:
node puff.js -w .\wordlist-examples\xss.txt -u "http://www.xssgame.com/f/m4KKGHi2rVUN/?query=FUZZ"
Linux:
node puff.js -w ./wordlist-examples/xss.txt -u "http://www.xssgame.com/f/m4KKGHi2rVUN/?query=FUZZ"
`
`
Usage: puff [options]
Options:
-w, --wordlist
-u, --url
-t, --threads
-v, --verbose verbosity
-o, --output
-d, --demo Demo mode, hides url's in output, and clears terminal when run (to hide url in cli)
-s, --status Show requests with unusual response codes
-oA, --outputAll Output all the responses
-k, --ignoreSSL Ignore ssl errors
-c, --chromePath
-h, --help display help for command
`
instead of alert() in your payload.Sample runs
Running from source:
`
node puff.js -w xss.txt -u "http://your.url?message=FUZZ"node puff.js -w xss.txt -u "http://your.url?message=FUZZ" -t 25
node puff.js -w xss.txt -u "http://your.url?message=FUZZ" -d
`installed via npm:
`
puff -w xss.txt -u "http://your.url?message=FUZZ"puff -w xss.txt -u "http://your.url?message=FUZZ" -t 25
puff -w xss.txt -u "http://your.url?message=FUZZ" -d
`Running with stdin fuzzing mode:
`
cat urls.txt | node puff.js -w .\wordlist-examples\events.txt
cat urls.txt | puff -w .\wordlist-examples\events.txt
`
Where urls.txt is
`
http://example.com?query=FUZZ
https://another.com/page/#FUZZ
`
Running with stdin single payload mode:
`
cat urls.txt | node puff.js
cat urls.txt | puff
`Where urls.txt is
`
http://example.com?query=
http://example.com?query=javascript:alert()
https://another.com/page/#
``