Wfuzz
Web application fuzzer for content & parameters.
KaliParrotmedium
pkg: wfuzz
Wfuzz replaces FUZZ markers in requests to brute-force directories, parameters and form values, with flexible payloads and filters.
Syntax
wfuzz -w {wordlist} {url with FUZZ}
Example
wfuzz -w words.txt --hc 404 https://example.com/FUZZ
Fuzzes the path, hiding 404 responses (--hc).
Options & flags
What each switch does. Toggle them in the builder below to assemble a command.
Command builder
Tick options (and fill any values) to build a ready-to-copy command.
wfuzz
Usage examples
wfuzz -w words.txt --hc 404 https://target.tld/FUZZ
Directory fuzzing, hide 404s.
wfuzz -w users.txt -d "user=FUZZ&pass=x" https://t/login
Fuzz a POST parameter.
Advantages
- Fuzz any request component
- Powerful payload/encoder system
- Fine-grained response filtering
Disadvantages
- Steeper syntax
- Slower than ffuf
- Output verbose without filters
Tags
#web#fuzzing#parameters
Official docs: Wfuzz ↗
Related commands
Frequently asked questions
What is Wfuzz used for?
Wfuzz replaces FUZZ markers in requests to brute-force directories, parameters and form values, with flexible payloads and filters.
What is an example Wfuzz command?
A common example is: wfuzz -w words.txt --hc 404 https://example.com/FUZZ — Fuzzes the path, hiding 404 responses (--hc).
Is Wfuzz part of Kali Linux?
Yes. Wfuzz ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install wfuzz.
What category of security tool is Wfuzz?
Wfuzz is a Web Application tool with a medium-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.