Now that we have a clear understanding of the fuzzing concept, the terminology, and the attack types, let's start with web application-based fuzzing. As mentioned before, web application-based fuzzing is done by using URLs, forms, headers, and methods as the primary fuzz vectors. In this chapter, we will be using the following tools for fuzzing an HTTP-based web application: Wfuzz, Ffuf, and Burp Suite. Before moving forward, let's install the tools outlined in this section to hunt logical bugs.