retour aux outils back to tools Ducklings

Wfuzz

Fuzzer d'applications web pour découvrir des ressources cachées, paramètres et vulnérabilités par brute-force. Web application fuzzer for discovering hidden resources, parameters, and vulnerabilities through brute-forcing.

↗ https://github.com/xmendez/wfuzz

Overview

Wfuzz replaces any part of an HTTP request with a payload — URLs, headers, cookies, POST data — making it versatile for directory discovery, parameter fuzzing, and brute-forcing.

Common Usage

Directory discovery (FUZZ replaces the injection point)

wfuzz -w /usr/share/seclists/Discovery/Web-Content/common.txt \
  --hc 404 https://target.com/FUZZ

File extension fuzzing

wfuzz -w /usr/share/wordlists/dirb/common.txt -z list,php-txt-html \
  --hc 404 https://target.com/FUZZ.FUZ2Z

POST parameter fuzzing (login brute-force)

wfuzz -w users.txt -w passwords.txt -d "user=FUZZ&pass=FUZ2Z" \
  --hc 401 https://target.com/login

Header fuzzing (subdomain/vhost discovery)

wfuzz -w subdomains.txt -H "Host: FUZZ.target.com" \
  --hh 0 https://target.com

Cookie fuzzing

wfuzz -w sessions.txt -b "session=FUZZ" --hc 403 https://target.com/admin

Filter Options

FlagMeaning
--hc CODEHide response code
--hl NHide response with N lines
--hw NHide response with N words
--hh NHide response with N chars
--sc CODEShow only response code
Help / Man page 
wfuzz [options] -w wordlist URL

PAYLOAD:
  -w FILE           Wordlist file (use multiple -w for FUZZ/FUZ2Z/FUZ3Z)
  -z TYPE,VALUE     Inline payload (list, range, file, ...)
  FUZZ              Injection point in URL, headers, or body
  FUZ2Z, FUZ3Z...   Additional injection points

FILTERING:
  --hc CODE         Hide response code(s)
  --hl N            Hide responses with N lines
  --hw N            Hide responses with N words
  --hh N            Hide responses with N chars
  --hs REGEX        Hide responses matching regex
  --sc / --sl / --sw / --sh  Show (opposite of hide)

HTTP OPTIONS:
  -d DATA           POST data
  -H HEADER         Custom header (KEY: VALUE)
  -b COOKIE         Cookie
  -X METHOD         HTTP method (default: GET)
  -u URL            Target URL

PERFORMANCE:
  -t N              Threads (default: 10)
  -s N              Delay between requests (seconds)
  --req-delay N     Max time for a single request

OUTPUT:
  -f FILE,FORMAT    Output to file (available: raw, json, csv, html)
  -v                Verbose
  -q                Quiet (no banner)

Vue d’ensemble

Wfuzz remplace n’importe quelle partie d’une requête HTTP par un payload : URLs, en-têtes, cookies, données POST : le rendant polyvalent pour la découverte de répertoires, le fuzzing de paramètres et le brute-force.

Utilisation courante

# Découverte de répertoires (FUZZ remplace le point d'injection)
wfuzz -w /usr/share/seclists/Discovery/Web-Content/common.txt \
  --hc 404 https://target.com/FUZZ

# Fuzzing d'extensions de fichiers
wfuzz -w /usr/share/wordlists/dirb/common.txt -z list,php-txt-html \
  --hc 404 https://target.com/FUZZ.FUZ2Z

# Fuzzing de paramètres POST (brute-force de connexion)
wfuzz -w users.txt -w passwords.txt -d "user=FUZZ&pass=FUZ2Z" \
  --hc 401 https://target.com/login

# Fuzzing d'en-têtes (découverte de sous-domaines/vhosts)
wfuzz -w subdomains.txt -H "Host: FUZZ.target.com" \
  --hh 0 https://target.com

# Fuzzing de cookies
wfuzz -w sessions.txt -b "session=FUZZ" --hc 403 https://target.com/admin

Options de filtrage

FlagSignification
--hc CODEMasquer le code de réponse
--hl NMasquer les réponses avec N lignes
--hw NMasquer les réponses avec N mots
--hh NMasquer les réponses avec N caractères
--sc CODEAfficher uniquement le code de réponse
Aide / Page de manuel 
wfuzz [options] -w wordlist URL

PAYLOAD:
  -w FILE           Wordlist file (use multiple -w for FUZZ/FUZ2Z/FUZ3Z)
  -z TYPE,VALUE     Inline payload (list, range, file, ...)
  FUZZ              Injection point in URL, headers, or body
  FUZ2Z, FUZ3Z...   Additional injection points

FILTERING:
  --hc CODE         Hide response code(s)
  --hl N            Hide responses with N lines
  --hw N            Hide responses with N words
  --hh N            Hide responses with N chars
  --hs REGEX        Hide responses matching regex
  --sc / --sl / --sw / --sh  Show (opposite of hide)

HTTP OPTIONS:
  -d DATA           POST data
  -H HEADER         Custom header (KEY: VALUE)
  -b COOKIE         Cookie
  -X METHOD         HTTP method (default: GET)
  -u URL            Target URL

PERFORMANCE:
  -t N              Threads (default: 10)
  -s N              Delay between requests (seconds)
  --req-delay N     Max time for a single request

OUTPUT:
  -f FILE,FORMAT    Output to file (available: raw, json, csv, html)
  -v                Verbose
  -q                Quiet (no banner)