Manual Fuzzing — The Foundation of Exploit Development
In 2014, a security researcher named Reginald was testing a bug bounty target — a SaaS platform with hundreds of endpoints. He did not know where to start. Rather than guessing, he opened a wordlist, picked 20 payloads spanning five injection classes, and began sending them one at a time to the site's search bar. Most returned the same boring 200 response. Then he sent {{config}}. The server returned a 500 error. Three days later he had remote code execution and a five-figure bounty payout.
That workflow — select payloads, send them, read the responses, identify the anomaly — is called manual payload fuzzing, and it is how professional penetration testers build intuition about an application before scaling up to automated tools.
What Is a Payload?
A payload is a crafted input designed to trigger specific behavior in a target system. Security payloads are borrowed from known vulnerability classes: a SQL injection payload tries to manipulate a database query; an XSS payload tries to inject executable JavaScript into the response; an SSTI payload tries to trick a template engine into evaluating code.
What Is a Wordlist?
A wordlist is a text file containing one payload per line, organized by injection category. The industry-standard collection is SecLists, maintained by Daniel Miessler, which contains thousands of wordlists covering every major vulnerability class. For manual fuzzing, a short focused wordlist — 20 to 50 payloads — is sufficient to map the attack surface of a single endpoint.
What You Will Do in This Lab
You will work with a simulated fuzzing console targeting the endpoint POST /api/v1/search?q=<FUZZ>. The console contains 20 payloads across five injection categories:
- SQL Injection (SQLi)
- Cross-Site Scripting (XSS)
- Path Traversal
- Command Injection
- Server-Side Template Injection (SSTI)
You will select payloads, send them, and observe the response log — status codes, response lengths, and snippets. One category of payloads will trigger a 500 Internal Server Error while all others return 200 or 400. Your task is to identify which injection class caused the anomaly and explain why it produced a server error.
By the end of this lab you will understand how to read a fuzzing response log, recognize what a 500 error reveals about a target, and correctly classify SSTI as the injection technique responsible for server-side code evaluation errors.