WFUZZ(1)

💅 NAME 💅

okay so wfuzz — it's a web application bruteforcer. that's the whole vibe. it goes brrr against web apps and finds the stuff nobody told you about. periodt. 🦋

✨ SYNOPSIS ✨

wfuzz [options] -z payload,params <url>

like literally that's it, bestie. options, a payload, and a url. the holy trinity 🎀

🌸 OPTIONS 🌸

• -h — prints info about all the available arguments. your little cheat sheet fr.
• --help — the advanced help. big brain mode unlocked 🧠✨
• --version — shows you the wfuzz version details. gotta know what you're working with.
• -e <type> — lists all the available encoders / payloads / iterators / printers / scripts. it's giving menu of possibilities 🍓
• --recipe <filename> — reads options from a recipe file. yes, like a lil recipe. so cute.
• --dump-recipe <filename> — prints your current options out as a recipe. save your setup, queen 👑
• --oF <filename> — saves fuzz results to a file. these can be consumed later using the wfuzz payload. leftovers that you actually reheat 💜
• -c — output with colors. no cap, everything hits different in color 🌈
• -v — verbose information. she's talkative and we love that.
• -f filename,printer — store results in the output file using the specified printer (raw printer if omitted).
• -o printer — format output using the specified printer. printer go brrr but make it aesthetic.
• --interact — (beta) if selected, all key presses are captured. this allows you to interact with the program. it's giving hands-on 🙈
• --dry-run — prints the results of applying the requests without actually making any HTTP request. pretend mode, zero consequences ✨
• --prev — prints the previous HTTP requests (only when using payloads generating fuzzresults).
• -p addr — use a proxy in the format ip:port:type. repeat the option for using various proxies. where type could be SOCKS4, SOCKS5 or HTTP if omitted. glow-up your traffic, bestie 🕶️
• -t N — specify the number of concurrent connections (10 default). multitasking icon.
• -s N — specify the time delay between requests (0 default). a lil pause, a lil self care 🧖
• -R depth — recursive path discovery, where depth is the maximum recursion level. it's giving we must go deeper 💀
• -L, --follow — follow HTTP redirections. she follows the plot wherever it goes 🎀
• -Z — scan mode (connection errors will be ignored). she simply does not perceive the drama.
• --req-delay N — sets the maximum time in seconds the request is allowed to take (CURLOPT_TIMEOUT). default 90.
• --conn-delay N — sets the maximum time in seconds the connection phase to the server is allowed to take (CURLOPT_CONNECTTIMEOUT). default 90.
• -A — alias for --script=default -v -c. the shortcut queen ✨
• --script= — equivalent to --script=default.
• --script=<plugins> — runs the script's scan. <plugins> is a comma separated list of plugin-files or plugin-categories.
• --script-help=<plugins> — show help about scripts. always read the instructions bestie 😭
• --script-args n1=v1,... — provide arguments to scripts. ie. --script-args grep.regex="<A href=\"(.*?)\">"
• -u url — specify a URL for the request. the main character of the operation 💅
• -m iterator — specify an iterator for combining payloads (product by default).
• -z payload — specify a payload for each FUZZ keyword, used in the form of type,parameters,encoder. a list of encoders can be used, ie. md5-sha1. encoders can be chained, ie. md5@sha1. an encoders category can be used, ie. url. use help as a payload to show payload plugin's details (you can filter using --slice).
• --zP <params> — arguments for the specified payload (it must be preceded by -z or -w).
• --slice <filter> — filter the payload's elements using the specified expression. it must be preceded by -z.
• -w wordlist — specify a wordlist file (alias for -z file,wordlist).
• -V alltype — all parameters bruteforcing (allvars and allpost). no need for the FUZZ keyword.
• -X method — specify an HTTP method for the request, ie. HEAD or FUZZ.
• -b cookie — specify a cookie for the requests. repeat the option for various cookies. 🍪 (literally cookies, we love a theme)
• -d postdata — use post data (ex: "id=FUZZ&catalogue=1").
• -H headers — use headers (ex: "Host:www.mysite.com,Cookie:id=1312321&user=FUZZ"). repeat the option for various headers.
• --basic/ntlm/digest auth — in format "user:pass" or "FUZZ:FUZZ" or "domain\FUZ2Z:FUZZ".
• --hc/hl/hw/hh N[,N]+ — hide responses with the specified code/lines/words/chars (use BBB for taking values from baseline). not me ignoring what i don't wanna see 🙈
• --sc/sl/sw/sh N[,N]+ — show responses with the specified code/lines/words/chars (use BBB for taking values from baseline). the only content i consume 👑
• --ss/hs regex — show/hide responses with the specified regex within the content.
• --filter <filter> — filter responses using the specified expression (use BBB for taking values from baseline). it should be composed of:

c,l,w,h / and,or / =,<,>,!=,<=,>=

Keyword: FUZZ, ..., FUZnZ — wherever you put these keywords wfuzz will replace them with the values of the specified payload.

Baseline: FUZZ{baseline_value} — FUZZ will be replaced by baseline_value. it will be the first request performed and could be used as a base for filtering.

bestie this one is a whole essay but every word of it matters, don't skip 💀

• --prefilter <filter> — filter items before fuzzing using the specified expression. pre-game filtering, we stan ✨

🦋 EXAMPLES 🦋

here's the tea, actual copy-pasteable energy:

wfuzz -c -z file,users.txt -z file,pass.txt --sc 200 http://www.site.com/log.asp?user=FUZZ&pass=FUZ2Z

wfuzz -c -z range,1-10 --hc=BBB http://www.site.com/FUZZ{something not there}

wfuzz --script=robots -z list,robots.txt http://www.webscantest.com/FUZZ

more examples are available in the README. yes, the README. go read it, i'll wait 🫶

and that's the whole page, bestie 💖 this one's from wfuzz 2.2.11, dated June 2018 — old but iconic, the way that a 2018 bop still hits in the club. you're welcome, mwah 💅✨