Wfuzz - Web application bruteforcer
Wfuzz is a tool designed for bruteforcing Web Applications, it can be used for finding resources not linked (directories, servlets, scripts, etc), bruteforce GET and POST parameters for checking different kind of injections (SQL, XSS, LDAP,etc), bruteforce Forms parameters (User/Password), Fuzzing,etc.
It's very flexible, here are some functionalities:
- Multiple Injection points capability with multiple dictionaries
- Recursion (When doing directory bruteforce)
- Post, headers and authentication data brute forcing
- Output to HTML
- Colored output
- Hide results by return code, word numbers, line numbers, regex.
- Cookies fuzzing
- Multi threading
- Proxy support
- SOCK support
- Time delays between requests
- Authentication support (NTLM, Basic)
- All parameters bruteforcing (POST and GET)
- Multiple encoders per payload
- Payload combinations with iterators
- Baseline request (to filter results against)
- Brute force HTTP methods
- Multiple proxy support (each request through a different proxy)
- HEAD scan (faster for resource discovery)
- Dictionaries tailored for known applications (Weblogic, Iplanet, Tomcat, Domino, Oracle 9i, Vignette, Coldfusion and many more. (Many dictionaries are from Darkraver's Dirb, www.open-labs.org)
Payloads:
- File
- List
- hexrand
- range
- names
- hexrange
Encodings:
- random_uppercase
- urlencode
- binary_ascii
- base64
- double_nibble_hex
- uri_hex
- sha1
- md5
- double_urlencode
- utf8
- utf8_binary
- html
- html decimal
- custom
- many more...
Iterators:
- Product
- Zip
- Chain
- Basic example
Basic example
Source
wfuzz
Download Wfuzz
Examples
- wfuzz.py -c -z file -f wordlists/commons.txt --hc 404 --html http://www.mysite.com/FUZZ 2> results.html
This will bruteforce the site http://www.mysyte.com/FUZZ in search of resources (directories, scripts, files,etc), it will hide from the output the return code 404 (for easy reading the results), it will use the dictionary commons.txt for the bruteforce, and also will output the results to the results.html
file (with a cool format to work).
wfuzz.py -c -z range -r 1-100 --hc 404 http://www.mysite.com/list.asp?id=FUZZ
In this example instead of using a file as dictionary, it will use a range from 1-100, and will bruteforce the parameter "id".
wfuzz.py -c -z file -f wordlists/commons.txt --hc 404 --html -d "id=1&catalogue=FUZZ"
http://www.mysite.com/check.asp 2 > results.html
Here you can see the use of POST data, with the option "-d".
wfuzz.py -c -z file -f wordlists/commons.txt --hc 404 -R 1 http://www.mysite.com/FUZZ
Example of path discovery, using a recursive level of 1 paths.
wfuzz.py -c -z file -f wordlists/Injection/SQL.txt -V allvars http://www.mysite.com/res.asp?id=1&name=cars&cat=2
Example of Sql injection on every parameter of the request, you can fuzz every parameter with the option "-V allvars".
For more information pls visit
Edge Security
wfuzz
Download Wfuzz
Examples
- wfuzz.py -c -z file -f wordlists/commons.txt --hc 404 --html http://www.mysite.com/FUZZ 2> results.html
This will bruteforce the site http://www.mysyte.com/FUZZ in search of resources (directories, scripts, files,etc), it will hide from the output the return code 404 (for easy reading the results), it will use the dictionary commons.txt for the bruteforce, and also will output the results to the results.html
file (with a cool format to work).
wfuzz.py -c -z range -r 1-100 --hc 404 http://www.mysite.com/list.asp?id=FUZZ
In this example instead of using a file as dictionary, it will use a range from 1-100, and will bruteforce the parameter "id".
wfuzz.py -c -z file -f wordlists/commons.txt --hc 404 --html -d "id=1&catalogue=FUZZ"
http://www.mysite.com/check.asp 2 > results.html
Here you can see the use of POST data, with the option "-d".
wfuzz.py -c -z file -f wordlists/commons.txt --hc 404 -R 1 http://www.mysite.com/FUZZ
Example of path discovery, using a recursive level of 1 paths.
wfuzz.py -c -z file -f wordlists/Injection/SQL.txt -V allvars http://www.mysite.com/res.asp?id=1&name=cars&cat=2
Example of Sql injection on every parameter of the request, you can fuzz every parameter with the option "-V allvars".
For more information pls visit
Edge Security
