GO KALI FREE

Wfuzz

Web Application

Advancedmedium risk

Wfuzz is a highly flexible web application fuzzer designed to brute force parameters, discover hidden directories, files, and test for various vulnerabilities by injecting payloads into any HTTP request section.

Installation

sudo apt install wfuzz

Basic Syntax

wfuzz -w <wordlist> <URL/FUZZ>

Quick Facts

Full Name
Wfuzz
License
GPLv2
Written In
Python
Platforms
Linux, Windows, macOS
Category
Web Application Fuzzer
Payloads
Extensive (built-in + custom)
First Release
2011
Author
Xavier Mendez

Tool Overview

Wfuzz is a highly flexible web application fuzzer designed to brute force parameters, discover hidden directories and files, and test for vulnerabilities by injecting payloads into any part of an HTTP request.

Unlike simpler directory brute forcers, Wfuzz supports advanced payload processing including encoding, decoding, hashing, and custom scripts. It can simultaneously fuzz multiple parts of a request using multiple FUZZ keywords.

Wfuzz is the tool of choice for complex fuzzing scenarios where payload transformations, recursive scanning, and plugin-based extensibility are required.

Common Commands

wfuzz -w /usr/share/wordlists/dirb/common.txt http://target.com/FUZZDirectory bruteforce - Discover hidden directories and files using a standard path dictionary
wfuzz -w wordlist.txt -d "user=FUZZ&pass=test" http://target.com/loginPOST parameter fuzzing - Inject wordlist payloads into data strings to test authentication or input vectors
wfuzz -w wordlist.txt --hc 404 http://target.com/FUZZHide specific status codes - Filter out unhelpful HTTP 404 responses from the console display
wfuzz -w wordlist.txt -H "Cookie: session=FUZZ" http://target.com/Header fuzzing - Inject payloads into custom HTTP headers or session cookies to test state management
wfuzz -w wordlist.txt -d "user=FUZZ&pass=test" http://target.com/loginPOST parameter fuzzing
wfuzz -w wordlist.txt -H "Cookie: session=FUZZ" http://target.com/Header fuzzing
wfuzz -w wordlist.txt --hw 0 http://target.com/FUZZHide by words — filter out responses with a given word count
wfuzz -w users.txt -w pass.txt -d "user=FUZZ&pass=FUZ2Z" http://target.com/loginTwo payloads — brute-force username and password together
wfuzz -w wordlist.txt -X POST -u http://target.com/FUZZMethod — fuzz using an explicit HTTP method
wfuzz -z range,1-1000 http://target.com/user?id=FUZZNumeric range — enumerate IDs without a wordlist
wfuzz -w wordlist.txt -p 127.0.0.1:8080:HTTP http://target.com/FUZZProxy — send all fuzz requests through Burp/ZAP
wfuzz -w wordlist.txt -f out.json,json http://target.com/FUZZOutput — save results to a JSON file

Step-by-Step Guide

  1. 1Select a wordlist appropriate for your specific objective
  2. 2Insert the placeholder 'FUZZ' where you want the payloads injected
  3. 3Initiate the command with your chosen configuration
  4. 4Utilize flags like --hc to hide irrelevant output from the screen
  5. 5Manually verify the intriguing results returned by the tool

Warnings

Use Cases

Directory Brute Force

Discover hidden directories and files using wordlist-based attacks with payload processing.

Parameter Fuzzing

Enumerate hidden GET/POST parameters with encoded and processed payloads.

Header & Cookie Fuzzing

Test HTTP headers and cookies for injection vulnerabilities and bypass attempts.

Recursive Scanning

Automatically discover and fuzz subdirectories found during initial scanning.

Authentication Bypass

Test login forms and authentication mechanisms with custom payload lists.

WAF Bypass Testing

Encode and transform payloads to test web application firewall rules.

Key Features

Related Tools

FFUF

Web Application

Faster web fuzzer with advanced filtering.

Gobuster

Web Application

Simpler directory brute forcer with DNS modes.

Nikto

Web Application

Web server scanner for vulnerabilities.

Frequently Asked Questions

What is Wfuzz used for?

Wfuzz is a flexible web application fuzzer used for directory brute forcing, parameter fuzzing, header injection, cookie testing, and payload processing for web application security testing.

How does Wfuzz differ from FFUF?

Wfuzz offers more advanced payload processing, encoding, and recursion features. FFUF is faster but Wfuzz provides more flexibility for complex fuzzing scenarios requiring payload transformations.

What is the FUZZ keyword in Wfuzz?

FUZZ is a placeholder in Wfuzz where wordlist entries are injected. Unlike FFUF, Wfuzz supports multiple FUZZ keywords (FUZZ, FUZ2Z, FUZ3Z) for simultaneous fuzzing of multiple request parts.

Is Wfuzz good for beginners?

Wfuzz has a steeper learning curve than alternatives like gobuster or FFUF. Beginners should start with simpler tools and advance to Wfuzz when they need payload processing and complex fuzzing capabilities.

How do I install Wfuzz?

Install Wfuzz using: sudo apt install wfuzz on Kali Linux. On other systems, install via pip: pip install wfuzz.

How do I use Wfuzz for directory fuzzing?

Run wfuzz -w wordlist.txt http://target.com/FUZZ to fuzz directory paths. Use --hc 404 to hide 404 responses.

What are the most common Wfuzz commands?

Common commands include: wfuzz -w wordlist.txt -d 'user=FUZZ' http://target/login (POST fuzzing), wfuzz -w wordlist.txt -H 'Cookie: session=FUZZ' http://target/ (header fuzzing).

How does Wfuzz compare to gobuster?

Wfuzz offers more advanced payload processing and recursion. gobuster is simpler and faster for basic directory and subdomain discovery.

Is Wfuzz legal to use?

Wfuzz itself is legal software. However, fuzzing web servers without permission from the owner may violate laws. Always obtain written authorization before testing.

What is the --hc flag in Wfuzz?

The --hc flag hides responses with specific HTTP status codes: --hc 404 to hide 404 Not Found responses.

What is the --sc flag in Wfuzz?

The --sc flag shows only responses with specific HTTP status codes: --sc 200,301,302 to only show those codes.

How do I fuzz POST data with Wfuzz?

Use -d flag: wfuzz -w wordlist.txt -d 'user=admin&pass=FUZZ' http://target/login to fuzz POST parameters.

How do I fuzz HTTP headers with Wfuzz?

Use -H flag: wfuzz -w wordlist.txt -H 'Cookie: session=FUZZ' http://target/ to fuzz headers.

What is the -p flag in Wfuzz?

The -p flag adds a delay between requests: -p 1 for 1 second delay. Useful for avoiding rate limits.

How do I save Wfuzz results?

Use -o results.txt to save results to a file. Also supports JSON output with -o results.json.

What wordlists work with Wfuzz?

Wfuzz works with any text-based wordlist. Use SecLists wordlists for comprehensive directory and parameter discovery.

How do I run Wfuzz in recursive mode?

Use -R flag for recursive scanning: wfuzz -w wordlist.txt -R http://target/FUZZ to automatically fuzz discovered subdirectories.

How long does a Wfuzz scan take?

Wfuzz scan time depends on thread count and wordlist size. Use 10-20 threads for most targets to avoid crashes.

Tags

#web-application#fuzzing#content-discovery#directory-bruteforce#parameter-injection

Output Explanation

Displays a structured table showing the HTTP response code, line count, word count, and character count for every executed payload. Filtering is crucial to make sense of the data.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.