diff --git a/docs/scanning/configuration.md b/docs/scanning/configuration.md index 47dfb43f08..2542a0c8dd 100644 --- a/docs/scanning/configuration.md +++ b/docs/scanning/configuration.md @@ -433,6 +433,8 @@ In addition to the stated options for each module, the following universal optio | modules.lightfuzz.disable_post | bool | Disable processing of POST parameters, avoiding form submissions. | False | | modules.lightfuzz.enabled_submodules | list | A list of submodules to enable. Empty list enabled all modules. | ['sqli', 'cmdi', 'xss', 'path', 'ssti', 'crypto', 'serial', 'esi'] | | modules.lightfuzz.force_common_headers | bool | Force emit commonly exploitable parameters that may be difficult to detect | False | +| modules.lightfuzz.try_get_as_post | bool | For each GETPARAM, also fuzz it as a POSTPARAM (in addition to normal GET fuzzing). | False | +| modules.lightfuzz.try_post_as_get | bool | For each POSTPARAM, also fuzz it as a GETPARAM (in addition to normal POST fuzzing). | False | | modules.medusa.snmp_versions | list | List of SNMP versions to attempt against the SNMP server (default ['1', '2C']) | ['1', '2C'] | | modules.medusa.snmp_wordlist | str | Wordlist url for SNMP community strings, newline separated (default https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Discovery/SNMP/snmp.txt) | https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Discovery/SNMP/common-snmp-community-strings.txt | | modules.medusa.threads | int | Number of communities to be tested concurrently (default 5) | 5 | diff --git a/docs/scanning/presets_list.md b/docs/scanning/presets_list.md index af7ca4db37..f07d4cda45 100644 --- a/docs/scanning/presets_list.md +++ b/docs/scanning/presets_list.md @@ -295,6 +295,8 @@ Discover web parameters and lightly fuzz them for vulnerabilities, with more int lightfuzz: enabled_submodules: [cmdi,crypto,path,serial,sqli,ssti,xss,esi] disable_post: False + try_post_as_get: True + try_get_as_post: True ``` Category: web @@ -354,6 +356,7 @@ Discover web parameters and lightly fuzz them for vulnerabilities. Uses all ligh modules: lightfuzz: enabled_submodules: [cmdi,crypto,path,serial,sqli,ssti,xss,esi] + try_post_as_get: True ``` Category: web