How to use lbuster

What is lbuster?

lbuster is a fast web fuzzer made in SBCL. It can be used to enumerate file extensions, directories, paramaters, paramater values and sub domains. It is a work in progress and there is not rate limiting. Do not use it on production systems.

How do I use lbuster?

The sytax for lbuster is:

	# Use the keyword FUZZ on any part of the url to fuzz it.
	lbuster <url> <wordlist> <jobs>
	#
	# Subdomain fuzzing
	lbuster https://FUZZ.example.com/ subdomains.txt 60
	#
	# Directory fuzzing
	lbuster https://example.com/FUZZ common.txt 60
	#
	# Extension fuzzing
	lbuster https://example.com/indexFUZZ extensions.txt 60
	#
	# Paramater fuzzing
	lbuster https://example.com/register.php?FUZZ=test paramaters.txt 60
	#
	# Paramater value fuzzing
	lbuster https://example.com/register.php?username=FUZZ common.txt 60

Jobs are the amount of threads that get allocated for each batch. While it may be cool to crank up the jobs, there is no rate limiting and you will not get any results from a batch untill all workers are done. This means that using a large amount of jobs can make getting any output take longer. Setting jobs too high can overwelm a web server. Do not DOS someones poor VPS.

How do I compile lbuster?

To compile lbuster you first need SBCL and quicklisp installed. Just use your OS’s package manager and grab the sbcl package. To install quicklisp run:

	curl -o quicklisp.lisp https://beta.quicklisp.org/quicklisp.lisp;
	sbcl --load quicklisp.lisp;
	sbcl

When in sbcl run:

        (quicklisp-quickstart:install)

Exit when quicklisp is installed. Run:

	make

Happy fuzzing!