Wfuzz – A Tool for Bruteforcing/Fuzzing Web Applications

Keep on Guard!

Wfuzz is a tool designed for bruteforcing Web Applications, it can be used for finding resources not linked (directories, servlets, scripts, etc), bruteforce GET and POST parameters for checking different kind of injections (SQL, XSS, LDAP,etc), bruteforce Forms parameters (User/Password), Fuzzing,etc.

The tool is based on dictionaries and ranges, you choose where you want to bruteforce just by replacing the part of the URL or the POST by the keyword FUZZ.

It’s very flexible, here are some functionalities:

  • Recursion (When doing directory bruteforce)
  • Post data bruteforcing
  • Output to HTML (easy for just clicking the links and checking the page, even with postdata!!)
  • Colored output on all systems
  • Hide results by return code, word numbers, line numbers, etc.
  • URL encoding
  • Cookies
  • Multithreading
  • Proxy support
  • All parameters bruteforcing (POST and GET)
  • Dictionaries tailored for known applications (Weblogic, Iplanet, Tomcat, Domino, Oracle 9i, Vignette, Coldfusion and many more.


This will bruteforce the site in search of resources (directories, scripts, files,etc), it will hide from the output the return code 404 (for easy reading the results), it will use the dictionary commons.txt for the bruteforce.

It was created to facilitate the task in Web Applications assessments, it’s a tool by pentesters for pentesters.

You can download Wfuzz here:

Wfuzz 1.1 – Win32
Wfuzz 1.1 – Unix

Or read more here.

Posted in: Hacking Tools, Web Hacking

, , , , , , , , ,

Recent in Hacking Tools:
- Github Dorks – Github Security Scanning Tool
- scanless – A Public Port Scan Scraper
- Ubertooth – Open Source Bluetooth Sniffer

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 2,020,634 views
- Brutus Password Cracker – Download AET2 - 1,592,084 views
- wwwhack 1.9 – Download Web Hacking Tool - 704,407 views

9 Responses to Wfuzz – A Tool for Bruteforcing/Fuzzing Web Applications

  1. Sandeep Nain July 31, 2007 at 6:33 am #

    Nice tool… really like it.. very quick an easy to use…
    added it to my favourites list.

  2. backbone July 31, 2007 at 10:57 am #

    it’s a great tool, but mostly I like the fact that it can use proxy support, and threading which is a must at bruteforcing tools…

  3. SN July 31, 2007 at 12:33 pm #

    nice tool.

  4. Sandeep Nain July 31, 2007 at 11:31 pm #

    ohh yeah…. multi threading is a must in such tools to make the attack faster…
    i like the nice formatted output too..

  5. backbone August 1, 2007 at 1:50 am #

    not to mention that time means money in such a critical situation… meaning in the moments when the tools isn’t used for pen-testing

  6. Sandeep Nain August 1, 2007 at 1:57 am #

    yes you are right backbone…
    these tools are essential for pen testing jobs as most of the times (atleast for me), clients try not to spend much money on them and expect thorough testing… and its only possible by using good pen testing tools.

  7. cptInsane0 August 23, 2007 at 1:26 pm #

    I can’t seem to get wfuzz to work correctly. Whenever I try to run it I get a command not recognized error. I have installed pycurl, but it doesn’t seem to make a difference. If I have it output to an HTML file, the contents only say bash command not found. What am I doing wrong?

  8. Druid_masta4 September 3, 2007 at 1:27 am #

    it just pops up real quick, then closes, why?

  9. JP August 19, 2008 at 10:44 pm #

    Can someone point me documentations/manual for this tool?