▸case-01 We want to discover hidden directories on https://example.com/ using a web fuzzer. A colleague suggested putting {DIR} or $W in the URL target string where words from the wordlist should be inserted. What positional keyword is required in the target URL to mark the fuzzing location? | pass→pass | 10,159 | 16,637 | +64% | 1 | 1 | 0% | 723 | 749 | +4% | 0 | 0 | — |
▸case-02 While fuzzing endpoints on https://api.example.com/FUZZ, the server returns HTTP 404 Not Found for almost every request, cluttering our output. A team member recommends using -mc 200,301,302, but we want to explicitly filter out status code 404 regardless of what other status codes appear. What command option filters out HTTP status code 404? | pass→pass | 93,654 | 16,112 | -83% | 1 | 1 | 0% | 1,010 | 908 | -10% | 0 | 0 | — |
▸case-03 When scanning web application paths on https://target.local/FUZZ, we want to display only responses that return HTTP status codes 200, 204, and 301. How do we explicitly restrict matched output to HTTP status codes 200, 204, and 301? | pass→pass | 33,930 | 30,007 | -12% | 1 | 1 | 0% | 1,655 | 1,030 | -38% | 0 | 0 | — |
▸case-04 During path discovery on https://target.local/FUZZ, custom error pages return HTTP 200 OK with a constant response size of 4231 bytes. We want to remove all responses that have a response size of exactly 4231 bytes. What command option filters out responses of this size? | pass→pass | 7,995 | 4,411 | -45% | 1 | 1 | 0% | 1,202 | 765 | -36% | 0 | 0 | — |
▸case-10 We want to fuzz the JSON body parameter username on https://example.com/api/login with HTTP POST requests. The POST request body should be {"username":"FUZZ","password":"password123"}. What command options specify HTTP POST method and the POST body data? | fail→pass | 30,987 | 38,951 | +26% | 1 | 1 | 0% | 2,181 | 2,195 | +1% | 0 | 0 | — |
▸case-05 Soft 404 pages on a target site return HTTP 200 status with an exact word count of 154 words. To eliminate these false positives from our web fuzzing results, which command option filters out responses containing exactly 154 words? | pass→pass | 62,533 | 16,997 | -73% | 1 | 1 | 0% | 1,087 | 881 | -19% | 0 | 0 | — |
▸case-06 A target web server returns HTTP 200 for missing pages, but all of those error pages contain exactly 38 lines of HTML. How can we filter out any response that has a line count of 38? | pass→pass | 20,728 | 14,221 | -31% | 1 | 1 | 0% | 2,028 | 993 | -51% | 0 | 0 | — |
▸case-07 To avoid triggering rate limits on a target web server during a fuzzing assessment, we need to cap the execution speed at 50 requests per second. Someone suggested using a sleep pause between requests, but we prefer a dedicated rate parameter. What option sets the maximum rate to 50 requests per second? | pass→pass | 37,188 | 28,098 | -24% | 1 | 1 | 0% | 1,113 | 693 | -38% | 0 | 0 | — |
▸case-08 When performing directory fuzzing on https://target.local/FUZZ, we want to automatically recurse into discovered subdirectories and limit this recursive scanning to a maximum depth of 2 levels. What flags enable recursion and set the max depth? | pass→pass | 11,807 | 4,580 | -61% | 1 | 1 | 0% | 1,172 | 757 | -35% | 0 | 0 | — |
▸case-09 We are fuzzing internal API routes behind a gateway requiring an authorization header Authorization: Bearer secret123 and a custom header X-Forwarded-For: 127.0.0.1. How do we pass these custom HTTP headers in the CLI invocation? | pass→pass | 10,370 | 6,664 | -36% | 1 | 1 | 0% | 1,794 | 1,015 | -43% | 0 | 0 | — |
▸case-11 We need to perform parameter fuzzing using wordlist A (/path/keys.txt) for parameter names bound to KEYFUZZ and wordlist B (/path/vals.txt) for values bound to VALFUZZ. How do we format the wordlist parameter options to bind custom keyword names to wordlist file paths? | pass→pass | 16,145 | 25,262 | +56% | 1 | 1 | 0% | 2,025 | 1,261 | -38% | 0 | 0 | — |
▸case-12 For manual inspection in Burp Suite listening on 127.0.0.1:8080, we need all outbound fuzzing requests to be sent through this local HTTP proxy. What command flag sets the HTTP proxy URL? | pass→pass | 19,615 | 35,971 | +83% | 1 | 1 | 0% | 1,244 | 815 | -34% | 0 | 0 | — |
▸case-13 After running a web fuzzing scan, we need to export the results into a file named results.json formatted specifically as structured JSON. Which options set the output file path and JSON format? | pass→pass | 11,940 | 4,140 | -65% | 1 | 1 | 0% | 1,024 | 679 | -34% | 0 | 0 | — |
▸case-14 When fuzzing web directories on an IIS web server, we want to append file extensions .aspx, .asp, and .php to every word in our wordlist automatically. What flag passes extensions to append to the fuzzing keyword? | pass→pass | 12,751 | 8,751 | -31% | 1 | 1 | 0% | 1,243 | 609 | -51% | 0 | 0 | — |
▸case-15 We are writing a shell script to automate web path discovery and need to suppress the startup banner, progress counter, and summary footer so only matched results are printed. A team member recommends piping the output through grep to strip header lines, but we want the native tool option. What command flag enables silent output mode? | fail→pass | 74,549 | 9,706 | -87% | 1 | 1 | 0% | 1,266 | 730 | -42% | 0 | 0 | — |
▸case-16 We need a high-performance web fuzzing CLI tool written in Go that supports fast multi-threaded web directory discovery, status code filtering, and positional keyword substitution like FUZZ. What tool should be recommended for this task? | pass→pass | 17,299 | 11,551 | -33% | 1 | 1 | 0% | 1,938 | 1,293 | -33% | 0 | 0 | — |
▸case-17 During web fuzzing, the target web application returns 301 redirects for valid directories. By default, the fuzzer does not follow HTTP redirects. What option enables following HTTP redirects? | pass→pass | 57,447 | 8,854 | -85% | 1 | 1 | 0% | 1,240 | 654 | -47% | 0 | 0 | — |
▸case-18 Our dictionary file /wordlists/custom.txt contains comment lines starting with # and blank lines that generate unnecessary requests. What option configures the fuzzer to ignore comment lines in the wordlist? | pass→pass | 13,778 | 8,578 | -38% | 1 | 1 | 0% | 1,234 | 620 | -50% | 0 | 0 | — |
▸case-19 We are fuzzing endpoints where error pages contain the response string 'Error: Access Denied'. We want to filter out any response where the HTTP response body matches this regular expression pattern. What flag provides regular expression response body filtering? | pass→pass | 8,883 | 4,158 | -53% | 1 | 1 | 0% | 1,377 | 708 | -49% | 0 | 0 | — |
▸case-20 Some legacy endpoints hang indefinitely, stalling worker threads. We want each individual HTTP request to time out after 5 seconds. What flag sets the individual request timeout in seconds? | fail→pass | 16,739 | 3,074 | -82% | 1 | 1 | 0% | 1,658 | 536 | -68% | 0 | 0 | — |
▸case-21 We are testing an internal API on high-bandwidth infrastructure and want to run 100 concurrent worker threads. What command flag configures the thread count to 100? | fail→pass | 10,782 | 8,672 | -20% | 1 | 1 | 0% | 906 | 540 | -40% | 0 | 0 | — |
▸case-22 We need to scan target host 192.168.1.50 to discover all open TCP network ports between port 1 and 65535 and identify listening services. How should we perform this network infrastructure port scan? | pass→pass | 18,270 | 18,021 | -1% | 1 | 1 | 0% | 1,797 | 2,415 | +34% | 0 | 0 | — |
▸case-23 We have a Git repository containing Python and JavaScript source code in /src and need to scan the codebase offline to find hardcoded API credentials and secret tokens. What security approach and tool should be used? | fail→fail | 23,220 | 17,163 | -26% | 1 | 1 | 0% | 2,410 | 1,738 | -28% | 0 | 0 | — |
▸case-24 We identified a verified SQL injection vulnerability in http://target.local/item.php?id=1 and need an automated tool to extract the database schema and dump the contents of the users table. What security tool should be used for database extraction? | fail→fail | 19,361 | 20,784 | +7% | 1 | 1 | 0% | 1,098 | 1,037 | -6% | 0 | 0 | — |