![Forrest logo](/images/logo.png)
On this page you find all important commands for the CLI tool wfuzz. If the
command you are looking for is missing please ask our AI.
wfuzz
WFuzz is a powerful and versatile command line tool used for web application penetration testing and vulnerability assessment. It is designed to help identify various types of vulnerabilities such as brute forcing, directory traversal, and injection attacks.
Here are 10 key points about WFuzz:
- WFuzz supports multiple attack types, including fuzzing, brute forcing, and discovery of hidden files and directories.
- It can be used to fuzz any request-related data, such as URLs, cookies, headers, and parameters.
- The tool supports both GET and POST requests, allowing comprehensive testing of web applications.
- WFuzz provides flexibility through customizable payloads, allowing users to define their own attack vectors.
- It includes a wide range of pre-defined attack vectors, including common file names, directory names, and parameter payloads.
- The tool's integrated proxy support helps intercept and modify HTTP requests and responses.
- WFuzz supports multithreading, enabling efficient scanning, brute forcing, and fuzzing of web applications.
- It includes various filters and options to limit and refine the scope of testing, such as response code filtering and HTTP method filtering.
- WFuzz provides detailed reports of the identified vulnerabilities and potential weaknesses.
- It is written in Python and supports both Windows and Unix-like systems, making it widely accessible for security professionals and researchers.
Overall, WFuzz is a powerful and versatile tool that aids in identifying potential vulnerabilities and improving web application security through extensive testing and analysis.
List of commands for wfuzz:
-
wfuzz:tldr:28032 wfuzz: Directory and file bruteforce using the specified wordlist and also proxying the traffic.$ wfuzz -w ${filename} -p ${127-0-0-1:8080} ${http:--example-com-FUZZ}try on your machineexplain this command
-
wfuzz:tldr:98034 wfuzz: Show colorized output while only showing the declared response codes in the output.$ wfuzz -c -w ${filename} --sc ${200,301,302} ${http:--example-com-FUZZ}try on your machineexplain this command
-
wfuzz:tldr:9deb5 wfuzz: Save the results to a file.$ wfuzz -w ${filename} -f ${filename} ${http:--example-com-FUZZ}try on your machineexplain this command
-
wfuzz:tldr:bd6db wfuzz: Use a custom header to fuzz subdomains while hiding specific response codes and word counts. Increase the threads to 100 and include the target ip/domain.$ wfuzz -w ${filename} -H ${"Host: FUZZ-example-com"} --hc ${301} --hw ${222} -t ${100} ${example-com}try on your machineexplain this command