<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Fuzzing Templates — API Reference

## Attack Modes

| Mode | Description | Use Case |
|------|-------------|----------|
| `sniper` | One payload per position, one at a time | Single parameter testing |
| `pitchfork` | Parallel payloads, same index | Correlated username/password |
| `clusterbomb` | All combinations of payloads | Brute force, full coverage |

## Payload Sources

```yaml
# Inline payloads
payloads:
  param:
    - "value1"
    - "value2"

# File-based payloads
payloads:
  param: path/to/wordlist.txt

# Runtime payload generators
payloads:
  param:
    - "{{rand_int(1, 1000)}}"
    - "{{rand_text_alpha(8)}}"
```

## Fuzzing CLI Options

```bash
# Basic fuzzing scan
nuclei -u https://target.com -t fuzz-template.yaml -json

# Rate limited
nuclei -u https://target.com -t fuzz.yaml -rate-limit 10 -json

# With payload override
nuclei -u https://target.com -t fuzz.yaml -var param=custom_value

# Bulk target fuzzing
nuclei -l targets.txt -t fuzz.yaml -bulk-size 25 -json -o results.json

# Specific tags
nuclei -u https://target.com -tags fuzzing -json
```

## Payload Helpers

| Helper | Description | Example |
|--------|-------------|---------|
| `rand_int(min, max)` | Random integer | `{{rand_int(1, 9999)}}` |
| `rand_text_alpha(n)` | Random alpha string | `{{rand_text_alpha(8)}}` |
| `rand_text_alphanumeric(n)` | Random alphanumeric | `{{rand_text_alphanumeric(12)}}` |
| `rand_base(n, chars)` | Random from charset | `{{rand_base(6, "abc123")}}` |
| `md5(str)` | MD5 hash | `{{md5("canary")}}` |
| `sha256(str)` | SHA256 hash | `{{sha256("test")}}` |
| `base64(str)` | Base64 encode | `{{base64("payload")}}` |
| `url_encode(str)` | URL encode | `{{url_encode("<script>")}}` |

## Common Fuzzing Wordlists (SecLists)

| Path | Purpose |
|------|---------|
| `Fuzzing/SQLi/` | SQL injection payloads |
| `Fuzzing/XSS/` | Cross-site scripting payloads |
| `Fuzzing/LFI/` | Local file inclusion payloads |
| `Fuzzing/command-injection/` | OS command injection |
| `Fuzzing/SSTI/` | Template injection payloads |
| `Discovery/Web-Content/` | Directory and file discovery |
| `Passwords/Default-Credentials/` | Default credential pairs |
