In the previous chapters, we have learned about Metasploit basics, the Metasploit modules that can be used in web application penetration testing, performing reconnaissance and enumeration using Metasploit modules, different modules supported by Metasploit for different technologies and different Content Management Systems (CMSes), and the different exploitation techniques used. In this chapter, we'll be learning about another important aspect of web application penetration testing – web application fuzzing.
Web application fuzzing is not exactly a mandatory phase in a generic penetration test case. However, it is a crucial step in finding logical vulnerabilities. Based on how a web application server responds to certain requests, the fuzzer can be used to understand the behavior of the server to find flaws that are unseen...