security enabled verified medium v1.0.0

wfuzz

Web application bruteforcer for discovering hidden resources, parameter fuzzing, and content discovery.

📋 Live Preview 
wfuzz -w {wordlist} -u {target}
🌍 wordlist → /usr/share/wordlists/dirb/common.txt 🌍 target → url 
wfuzz -w {wordlist} -u {target}

Sandbox: execFile · Timeout: 600s

Capabilities

web.fuzz
web.discovery.hidden
web.bruteforce.parameters
web.content.discovery

Parameters

Name Type Required Default Description Aliases
wordlist string Yes - Path to wordlist file (-w) -w
url string Yes - Target URL with FUZZ keyword (-u) -u
method string No GET HTTP method (GET, POST, etc.) (-X) -X
headers string No - Additional HTTP headers (-H) -H
post-data string No - POST data payload (-d) -d
cookies string No - Cookie string (-c) -c
threads integer No 10 Number of concurrent threads (-t) -t
proxy string No - Proxy URL (-p) -p
filter string No - Filter results by code/word/line (-f) -f
hide-codes string No - Hide responses with these HTTP codes (--hc) --hc
show-codes string No - Show only responses with these HTTP codes (--sc) --sc
verbose boolean No - Verbose output (-v) -v
recursive boolean No - Recursive scan (-R) -R
follow-redirects boolean No - Follow HTTP redirects (--follow) --follow
output string No - Output file (-o) -o
b boolean No - cookie HTTP Cookie header -b
f boolean No - filter Filter by response code, lines, words -f
req_delay boolean No - Delay between requests in seconds --req-delay
s boolean No - Silent mode (suppress banner) -s
z boolean No - type Payload type (file, list, range, etc.) -z

Artifacts

TypeDescriptionMIMESchemaTrust
web.fuzz.outputFuzzing output resultstext/plain-verified

Contract

Inputs

web.target.url

Target URL with FUZZ placeholder

web.fuzz.wordlist

Wordlist file for fuzzing

Outputs

web.fuzz.results

Fuzzing results with response codes/sizes

Side effects: network_traffic

Workflow Edges

Produces

web.fuzz.results

Consumes

web.target.urlweb.fuzz.wordlist

Resource Profile

ResourceValue
CPUmedium
Memory128 MB
Networkmedium
Disk I/Olow

Examples

Basic directory fuzzing

wfuzz -w /usr/share/wordlists/dirb/common.txt -u http://target.com/FUZZ

Fuzz with POST method

wfuzz -w users.txt -X POST -d "username=FUZZ&password=test" -u http://target.com/login

Filter out 404 responses

wfuzz -w wordlist.txt -u http://target.com/FUZZ --hc 404

Show only 200 responses

wfuzz -w wordlist.txt -u http://target.com/FUZZ --sc 200

Documentation

WFuzz — Web Application Bruteforcer

WFuzz is a web application bruteforcing tool for discovering hidden resources, fuzzing parameters, and performing content discovery through HTTP response analysis.

Basic Usage

# Directory fuzzing
wfuzz -w /usr/share/wordlists/dirb/common.txt -u http://target.com/FUZZ

# Parameter fuzzing
wfuzz -w params.txt -u http://target.com/page.php?FUZZ=1

# POST data fuzzing
wfuzz -w users.txt -X POST -d "username=FUZZ&password=test" -u http://target.com/login

Filtering Results

Filter Description
--hc CODE Hide responses with specific HTTP code
--hl NUM Hide responses with specific line count
--hw NUM Hide responses with specific word count
--hh NUM Hide responses with specific char count
--sc CODE Show only responses with specific code
--sl NUM Show only responses with specific line count
--sw NUM Show only responses with specific word count
--sh NUM Show only responses with specific char count

Iterators

WFuzz supports multiple payload types via -z:

  • -z list,item1-item2 — inline list
  • -z range,0-10 — numeric range
  • -z file,/path/wordlist.txt — file-based

Related Tools

ffufgobusterdirsearch

References