xmendez/wfuzz
Wfuzz
Wfuzz is a web application fuzzing framework that automates the injection of payloads into HTTP requests to discover hidden resources, parameters, and vulnerabilities. It functions as a content discovery scanner, a brute-force tool for credential guessing, and a plugin-based vulnerability scanner, all within a single modular system.
The tool distinguishes itself through its plugin-based extensibility, allowing custom Python modules to add new payload sources, output printers, or scanning logic without modifying core code. It supports concurrent request dispatch using thread-based parallelism to improve throughput on large payload sets, while also providing result filtering and comparison to highlight anomalies. Wfuzz replays captured HTTP requests and responses from prior sessions, preserving state for manual inspection and resending during testing.
The framework covers hidden endpoint and resource discovery, HTTP parameter fuzzing across query strings, POST bodies, headers, and cookies, and brute-force authentication against login forms and HTTP authentication mechanisms. It uses a keyword-based payload injection system where a placeholder token in any HTTP request field is replaced with values from wordlists, generators, or iterators.
Features
- Web Application Fuzzers - Automates the injection of payloads into HTTP requests to discover hidden resources, parameters, and vulnerabilities.
- Plugin Systems - Allows building custom plugins in Python to add new payload sources, printers, or scanning logic.
- Keyword-Based Payload Injectors - Replaces the FUZZ keyword in any HTTP request field with values from a payload source to test for hidden resources and vulnerabilities.
- Concurrent Fuzzing Dispatchers - Ships thread-based parallelism to send multiple fuzzing requests simultaneously, improving throughput on large payload sets.
- Hidden File Discovery - Substitutes payloads into request templates to probe web applications for undiscovered files, directories, and parameters.
- Parameter Fuzzing - Iterates through payloads for query strings, POST bodies, headers, and cookies to find injection points.
- Payload Injection Techniques - Replaces placeholders in HTTP requests with wordlist values to test many inputs automatically.
- Keyword-Based Injection Engines - Replaces a placeholder token in any HTTP request field with values from a wordlist or generator to automate input testing.
- Plugin-Based - Provides a plugin-based scanner that automatically finds and exploits security flaws in web applications through fuzzing.
- Security Vulnerability Scanning - Uses plugin-based scanning to automatically find and exploit common web application security flaws.
- Web Resource Discovery Scanners - Probes web applications for unlinked files, directories, and endpoints by substituting payloads into request templates.
- Thread-Based Fuzzing Dispatchers - Uses Python threading to send multiple fuzzing requests in parallel, improving throughput on large payload sets.
- Plugin-Based Logic Extensions - Loads custom Python modules at runtime to add new payload sources, output printers, or scanning logic.
- Payload Substitution Engines - Drives a loop that substitutes payloads into a request template and dispatches each variant to the target server.
- HTTP Fuzzing - Injects payloads into HTTP request parameters, headers, cookies, and URLs to test for hidden resources and vulnerabilities.
- Plugin-Based Scanning Frameworks - Uses custom Python plugins to extend fuzzing with new payloads, printers, or scan capabilities for security testing.
- Multi-Source Payload Pipelines - Combines payloads from files, generators, or iterators into a single stream that feeds the request engine.
- Plugin-Based Scanners - Uses custom Python plugins to extend fuzzing with new payloads, printers, or scan capabilities for security testing.
- Brute Force Tools - Cycles through username and password payloads to automate credential guessing against login forms and HTTP authentication.
- Credential Brute-Forcing - Cycles through username and password payloads to automate credential guessing against login forms and HTTP authentication.
- Response Anomaly Filters - Applies filters and diffing logic to responses to highlight anomalies, error codes, or size changes that indicate interesting findings.
- Brute Force Tools - Tool for web application fuzzing and brute forcing.
- Fuzzing - Web application fuzzer.
- Fuzzing Tools - Web application fuzzer.
- Application Security - Web application assessment tool based on payload replacement.
- Attack Payloads - Tool and payload collection for web application brute-forcing and fuzzing.
- Fuzzers and Brute Forcers - Flexible web application fuzzer for testing input validation and discovery.
- Fuzzing and Injection - Web application bruteforcer for testing input vectors.
- Information Gathering - Fuzzes web applications to discover hidden content and parameters.
- Network and Web Reconnaissance - Framework for web application scanning and fuzzing.
- Web Application Analysis - Web application fuzzer for discovering hidden content and vulnerabilities.
- Web Application Security - Versatile web application fuzzer for identifying security flaws.
