wfuzz — Web Application Brute-Force and Fuzzing Tool

Introduction

wfuzz is a Python-based web application fuzzing tool that replaces the keyword FUZZ in any part of an HTTP request with payloads from wordlists. It can brute-force directories, parameters, headers, cookies, POST data, and authentication credentials. Its filtering system lets testers isolate meaningful responses from noise based on status codes, response size, word count, or line count.

What wfuzz Does

• Replaces FUZZ markers in URLs, headers, POST bodies, and cookies with wordlist entries for systematic testing
• Filters responses by HTTP status code, response length, word count, or line count to surface anomalies
• Supports multiple simultaneous injection points using FUZZ, FUZ2Z, FUZ3Z markers
• Chains encoders to transform payloads with URL encoding, base64, MD5, hex, and custom encoding schemes
• Handles authentication including Basic, Digest, and NTLM for testing authenticated endpoints

Architecture Overview

wfuzz is built on a producer-consumer model in Python. The payload generator produces request candidates by substituting FUZZ markers with wordlist entries, optionally applying encoder chains. A thread pool sends requests concurrently while a filter engine processes responses against user-defined conditions. Results passing the filter are displayed or saved. The modular design supports custom payload generators, encoders, and output printers as plugins.

Self-Hosting & Configuration

• Install with pip install wfuzz on Python 3.6+
• No configuration files needed; all options are specified via command-line arguments
• Adjust concurrency with -t flag (default 10 threads) based on target capacity
• Use --hc, --hl, --hw, --hh to hide responses by code, lines, words, or characters respectively
• Proxy support via -p flag for routing through Burp Suite or other intercepting proxies

Key Features

• FUZZ keyword substitution works in any part of the HTTP request including URL path, query string, headers, and body
• Response filtering system eliminates noise and highlights only meaningful results during large-scale fuzzing
• Encoder chaining applies multiple transformations to payloads for WAF bypass and encoding-specific testing
• Recursive mode follows discovered directories to enumerate deeper path structures automatically
• Output plugins save results in JSON, CSV, HTML, or raw format for reporting and further analysis

Comparison with Similar Tools

• ffuf — a Go-based fuzzer with faster performance; wfuzz offers richer encoder chaining and Python extensibility
• Gobuster — focused on directory and DNS brute-forcing; wfuzz handles arbitrary parameter positions in any request component
• Burp Intruder — GUI-based with similar payload positioning; wfuzz is free, scriptable, and command-line native
• feroxbuster — Rust-based recursive content discovery; wfuzz provides more flexible injection point control and encoding

FAQ

Q: What does the FUZZ keyword do? A: FUZZ is a placeholder in the request that gets replaced with each entry from the wordlist. You can place it anywhere in the URL, headers, or body to fuzz that specific part of the request.

Q: How do I filter out irrelevant responses? A: Use --hc 404 to hide 404 responses, --hl 0 to hide empty responses, or --hw 12 to hide responses with exactly 12 words. Combine multiple filters for precision.

Q: Can wfuzz handle multiple wordlists simultaneously? A: Yes, use FUZ2Z for the second wordlist, FUZ3Z for the third, and so on. wfuzz will iterate through all combinations.

Q: Is wfuzz still maintained? A: wfuzz receives periodic updates. For actively developed alternatives with similar functionality, consider ffuf or feroxbuster.

Sources

• https://github.com/xmendez/wfuzz
• https://wfuzz.readthedocs.io/