Lion Cipher Lab
Fuzz your own web app to find hidden inputs and endpoints
- Penetration Testing / Red Team
- Beginner
- ~40 min
- Free · no account required
Why it matters
Fuzzing is sending a large, systematic set of inputs at an application to discover what it does — which paths exist, which parameters it accepts, which values change its behaviour, and where it breaks. It's how you find the endpoints and inputs that aren't linked anywhere in the UI, which are exactly the ones developers forget to secure. For a defender testing their own app, fuzzing surfaces the hidden attack surface before an attacker does: the forgotten admin endpoint, the debug parameter, the input that throws a revealing error. Learning to fuzz methodically — and to read the flood of…
What you'll learn
- what fuzzing is
- fuzzing paths, parameters, and values with ffuf
- reading responses by status/size/words to find signal
- filtering out noise
- why fuzzing is authorized-only
Steps in this lab
- The rule, and what fuzzing is
- The tool and the FUZZ keyword
- Fuzz paths (recap and baseline)
- Fuzz parameters — the hidden inputs
- Read the signal: filter by status, size, and words
- From discovery to defensive action
- Why fuzzing your own app pays off