Wfuzz – A Tool for Bruteforcing/Fuzzing Web Applications
Darknet spilled these bits on July 31st 2007 @ 4:43 am

Wfuzz is a tool designed for bruteforcing Web Applications, it can be used for finding resources not linked (directories, servlets, scripts, etc), bruteforce GET and POST parameters for checking different kind of injections (SQL, XSS, LDAP,etc), bruteforce Forms parameters (User/Password), Fuzzing,etc.

The tool is based on dictionaries and ranges, you choose where you want to bruteforce just by replacing the part of the URL or the POST by the keyword FUZZ.

It’s very flexible, here are some functionalities:

  • Recursion (When doing directory bruteforce)
  • Post data bruteforcing
  • Output to HTML (easy for just clicking the links and checking the page, even with postdata!!)
  • Colored output on all systems
  • Hide results by return code, word numbers, line numbers, etc.
  • URL encoding
  • Cookies
  • Multithreading
  • Proxy support
  • All parameters bruteforcing (POST and GET)
  • Dictionaries tailored for known applications (Weblogic, Iplanet, Tomcat, Domino, Oracle 9i, Vignette, Coldfusion and many more.

Example:

wfuzz.py -c -z file -f commons.txt --hc 404 --html http://www.mysite.com/FUZZ

This will bruteforce the site http://www.mysite.com/FUZZ in search of resources (directories, scripts, files,etc), it will hide from the output the return code 404 (for easy reading the results), it will use the dictionary commons.txt for the bruteforce.

It was created to facilitate the task in Web Applications assessments, it’s a tool by pentesters for pentesters.

You can download Wfuzz here:

Wfuzz 1.1 – Win32
Wfuzz 1.1 – Unix

Or read more here.

Tags:  ,  ,  ,  ,  ,  ,  ,  ,  ,  

rss Subscribe to Darknet RSS Feed rss

| 9,008 views |

comments are closed
  1. Sandeep Nain
    July 31st, 2007 | 6:33 am

    Nice tool… really like it.. very quick an easy to use…
    added it to my favourites list.

  2. July 31st, 2007 | 10:57 am

    it’s a great tool, but mostly I like the fact that it can use proxy support, and threading which is a must at bruteforcing tools…

  3. SN
    July 31st, 2007 | 12:33 pm

    nice tool.

  4. Sandeep Nain
    July 31st, 2007 | 11:31 pm

    ohh yeah…. multi threading is a must in such tools to make the attack faster…
    i like the nice formatted output too..

  5. August 1st, 2007 | 1:50 am

    not to mention that time means money in such a critical situation… meaning in the moments when the tools isn’t used for pen-testing

  6. Sandeep Nain
    August 1st, 2007 | 1:57 am

    yes you are right backbone…
    these tools are essential for pen testing jobs as most of the times (atleast for me), clients try not to spend much money on them and expect thorough testing… and its only possible by using good pen testing tools.

  7. cptInsane0
    August 23rd, 2007 | 1:26 pm

    I can’t seem to get wfuzz to work correctly. Whenever I try to run it I get a command not recognized error. I have installed pycurl, but it doesn’t seem to make a difference. If I have it output to an HTML file, the contents only say bash command not found. What am I doing wrong?

  8. Druid_masta4
    September 3rd, 2007 | 1:27 am

    it just pops up real quick, then closes, why?

  9. JP
    August 19th, 2008 | 10:44 pm

    Can someone point me documentations/manual for this tool?

Sitemap - ShaolinTiger - DigiSniper - Digital Photography
Shutter Asia Photography Forum - We Ate This