Wfuzz

What Wfuzz is

Wfuzz is a framework for automating web application security assessments and finding and exploiting web application vulnerabilities. It works by replacing FUZZ markers in HTTP requests with values from payloads, so assessors can test request components such as parameters, authentication, forms, directories, files, and headers. Its documented coverage also includes paths, query parameters, POST data, cookies, custom headers, and HTTP verbs. Users can work with multiple payloads, combine payloads, apply encoders, and filter responses to select or hide results. A plugin-supported vulnerability scanner is part of the framework, and its modular structure allows users to build plugins. Wfuzz can expose a language interface to earlier requests and responses made with Wfuzz or tools such as Burp for manual and semi-automatic testing. It also includes wfpayload for generating payloads and wfencode for encoding and decoding. Wfuzz runs locally and supports Linux, macOS, Windows, and self-hosted use. Installation options include pip and a Docker image. The project is free and licensed under GPL-2.0. Documentation and GitHub issues and pull requests provide project resources and activity.

Who it suits

Wfuzz suits people performing web application assessments and penetration testing who need to generate inputs across HTTP request components. Its local execution and plugin framework may also suit users who want to extend their assessment tooling.

Getting started

1. Open the GitHub project at https://github.com/xmendez/wfuzz.
2. Install Wfuzz with pip, or use the project's Docker image command.
3. Place FUZZ markers in the HTTP request components you want to test.
4. Use payloads and filters to generate and select responses.

Verdict

Choose Wfuzz if you need a free, locally run framework for generating inputs across HTTP requests and assessing web applications. Its broad request coverage, scanner plugins, and payload tools are useful reasons to consider it. Look elsewhere if you need a service that does not run locally or a license other than GPL-2.0.