> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/web/web-fuzzers/wfuzz.md).

# Wfuzz

The web application Bruteforcer.

Wfuzz is a tool designed for bruteforcing Web Applications, it can be used for finding resources not linked (directories, servlets, scripts, etc), bruteforce GET and POST parameters for checking different kind of injections (SQL, XSS, LDAP,etc), bruteforce Forms parameters (User/Password), Fuzzing,etc.

**Some features:**

* Multiple Injection points capability with multiple dictionaries
* Recursion (When doing directory bruteforce)
* Post, headers and authentication data brute forcing
* Output to HTML
* Colored output
* Hide results by return code, word numbers, line numbers, regex.
* Cookies fuzzing
* Multi threading
* Proxy support
* SOCK support
* Time delays between requests
* Authentication support (NTLM, Basic)
* All parameters bruteforcing (POST and GET)
* Multiple encoders per payload
* Payload combinations with iterators
* Baseline request (to filter results against)
* Brute force HTTP methods
* Multiple proxy support (each request through a different proxy)
* HEAD scan (faster for resource discovery)
* Dictionaries tailored for known applications (Weblogic, Iplanet, Tomcat, Domino, Oracle 9i, Vignette, Coldfusion and many more.

## General tips

Add `-v` for verbose output.

Parameter `-w wordlist` is an alias for `-z file,wordlist`.

## Directory discovery

### Fuzz top directories

```bash
wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt --hc 404 "http://$TARGET_IP/FUZZ/"
```

### Fuzz subdirectories

```bash
wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt --hc 404 "http://$TARGET_IP/path/FUZZ/"
```

## File discovery

Fuzz both filenames and extensions separately

```bash
wfuzz -c -w /usr/share/wordlists/dirb/common.txt -w /usr/share/wordlists/wfuzz/extensions/extensions.txt --hc 404 http://target.com/FUZZ.FUZ2Z
```

Fuzz filenames and extensions in one go

```bash
wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/raft-large-files.txt --hc 404 http://target.com/FUZZ
```

## Other scenarios

### Fuzzing with numbers

To fuzz with a sequence of numbers from 1-100

```bash
wfuzz -c -z range,1-100 https://example.com/api/item?id=FUZZ
```

We can also let `wfuzz` encode the numbers with an encoder such as `base64`

```bash
wfuzz -c -z range,1-20,base64 --hc 404 -H "Cookie: PHPSESSID=acd7763de3c5b75ab69c821847c32005" 'http://idor-sandbox:80/challenge/?uid=FUZZ'
```

### Fuzzing HTTP Verbs

HTTP verbs fuzzing can be specified using the `-X` switch:

```bash
wfuzz -c -z list,GET-HEAD-POST-TRACE-OPTIONS -X FUZZ http://$TARGET_IP/
```

### Fuzzing POST Requests

To fuzz an HTML form

```bash
wfuzz -c -z file,wordlist/others/common_pass.txt -d "uname=FUZZ&pass=FUZZ"  --hc 302 http://testphp.vulnweb.com/userinfo.php
```

## Usage information

<details>

<summary>wfuzz -h</summary>

```bash
┌──(kali㉿kali)-[~]
└─$ wfuzz -h                                                                                                    
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
*                                                      *
* Version up to 1.4c coded by:                         *
* Christian Martorella (cmartorella@edge-security.com) *
* Carlos del ojo (deepbit@gmail.com)                   *
*                                                      *
* Version 1.4d to 3.1.0 coded by:                      *
* Xavier Mendez (xmendez@edge-security.com)            *
********************************************************

Usage:  wfuzz [options] -z payload,params <url>

        FUZZ, ..., FUZnZ  wherever you put these keywords wfuzz will replace them with the values of the specified payload.
        FUZZ{baseline_value} FUZZ will be replaced by baseline_value. It will be the first request performed and could be used as a base for filtering.


Options:
        -h                        : This help
        --help                    : Advanced help
        --version                 : Wfuzz version details
        -e <type>                 : List of available encoders/payloads/iterators/printers/scripts

        -c                        : Output with colors
        -v                        : Verbose information.
        --interact                : (beta) If selected,all key presses are captured. This allows you to interact with the program.

        -p addr                   : Use Proxy in format ip:port:type. Repeat option for using various proxies.
                                    Where type could be SOCKS4,SOCKS5 or HTTP if omitted.

        -t N                      : Specify the number of concurrent connections (10 default)
        -s N                      : Specify time delay between requests (0 default)
        -R depth                  : Recursive path discovery being depth the maximum recursion level (0 default)
        -D depth                  : Maximum link depth level (4 default)
        -L, --follow              : Follow HTTP redirections

        -u url                    : Specify a URL for the request.
        -z payload                : Specify a payload for each FUZZ keyword used in the form of type,parameters,encoder.
                                    A list of encoders can be used, ie. md5-sha1. Encoders can be chained, ie. md5@sha1.
                                    Encoders category can be used. ie. url
                                    Use help as a payload to show payload plugin's details (you can filter using --slice)
        -w wordlist               : Specify a wordlist file (alias for -z file,wordlist).
        -V alltype                : All parameters bruteforcing (allvars and allpost). No need for FUZZ keyword.
        -X method                 : Specify an HTTP method for the request, ie. HEAD or FUZZ

        -b cookie                 : Specify a cookie for the requests
        -d postdata               : Use post data (ex: "id=FUZZ&catalogue=1")
        -H header                 : Use header (ex:"Cookie:id=1312321&user=FUZZ")
        --basic/ntlm/digest auth  : in format "user:pass" or "FUZZ:FUZZ" or "domain\FUZ2Z:FUZZ"

        --hc/hl/hw/hh N[,N]+      : Hide responses with the specified code/lines/words/chars (Use BBB for taking values from baseline)
        --sc/sl/sw/sh N[,N]+      : Show responses with the specified code/lines/words/chars (Use BBB for taking values from baseline)
        --ss/hs regex             : Show/Hide responses with the specified regex within the content

```

</details>

<details>

<summary>wfuzz -e payloads</summary>

```bash
┌──(kali㉿kali)-[~/OffSec_Courses/WEB-200]
└─$ wfuzz -e payloads
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.

Available payloads:

  Name            | Summary                                                                           
------------------------------------------------------------------------------------------------------
  burpitem        | This payload loads request/response from items saved from Burpsuite.              
  hexrand         | Returns random hex numbers from the given range.                                  
  list            | Returns each element of the given word list separated by -.                       
  autorize        | Returns fuzz results' from autorize.                                              
  range           | Returns each number of the given range.                                           
  burpstate       | Returns fuzz results from a Burp state.                                           
  file            | Returns each word from a file.                                                    
  buffer_overflow | Returns a string using the following pattern A * given number.                    
  shodanp         | Returns URLs of a given Shodan API search (needs api key).                        
  burplog         | Returns fuzz results from a Burp log.                                             
  ipnet           | Returns list of IP addresses of a network.                                        
  hexrange        | Returns each hex number of the given hex range.                                   
  wfuzzp          | Returns fuzz results' URL from a previous stored wfuzz session.                   
  guitab          | This payload reads requests from a tab in the GUI                                 
  iprange         | Returns list of IP addresses of a given IP range.                                 
  permutation     | Returns permutations of the given charset and length.                             
  bing            | Returns URL results of a given bing API search (needs api key).                   
  names           | Returns possible usernames by mixing the given words, separated by -, using know  
                  | n typical constructions.                                                          
  stdin           | Returns each item read from stdin.                                                
  dirwalk         | Returns filename's recursively from a local directory.  
  
```

</details>

## Resources

Web Tool - WFuzz - HackTricks: <https://book.hacktricks.wiki/en/pentesting-web/web-tool-wfuzz.html>

Wfuzz - Docs: <https://wfuzz.readthedocs.io/en/latest/>

Wfuzz - GitHub: <https://github.com/xmendez/wfuzz>

Wfuzz - Kali Tools: <https://www.kali.org/tools/wfuzz/>

Wfuzz Cheat Sheet - 1337skills.com: <https://1337skills.com/cheatsheets/wfuzz/>