Wfuzz Package Description

Wfuzz is a tool designed for bruteforcing Web Applications, it can be used for finding resources not linked (directories, servlets, scripts, etc), bruteforce GET and POST parameters for checking different kind of injections (SQL, XSS, LDAP,etc), bruteforce Forms parameters (User/Password), Fuzzing,etc.

Some features:

• Multiple Injection points capability with multiple dictionaries
• Recursion (When doing directory bruteforce)
• Post, headers and authentication data brute forcing
• Output to HTML
• Colored output
• Hide results by return code, word numbers, line numbers, regex
• Cookies fuzzing
• Multi threading
• Proxy support
• SOCK support
• Time delays between requests
• Authentication support (NTLM, Basic)
• All parameters bruteforcing (POST and GET)
• Multiple encoders per payload
• Payload combinations with iterators
• Baseline request (to filter results against)
• Brute force HTTP methods
• Multiple proxy support (each request through a different proxy)
• HEAD scan (faster for resource discovery)
• Dictionaries tailored for known applications (Weblogic, Iplanet, Tomcat, Domino, Oracle 9i, Vignette, Coldfusion and many more

Source: http://www.edge-security.com/wfuzz.php
Wfuzz Homepage | Kali Wfuzz Repo

• Author: Christian Martorella, Carlos del ojo, Xavier Mendez aka Javi
• License: GPLv2

Tools included in the wfuzz package

wfuzz – Web application bruteforcer

[email protected]:~# wfuzz

********************************************************
* Wfuzz  2.0 - The Web Bruteforcer                     *
********************************************************

Usage: /usr/bin/wfuzz [options] <url>

Options:
-c              : Output with colors
-v              : Verbose information
-o printer          : Output format by stderr

-p addr             : use Proxy (ip:port or ip:port-ip:port-ip:port)
-x type             : use SOCK proxy (SOCKS4,SOCKS5)
-t N                : Specify the number of threads (20 default)
-s N                : Specify time delay between requests (0 default)

-e <type>           : List of available encodings/payloads/iterators/printers
-R depth            : Recursive path discovery
-I              : Use HTTP HEAD instead of GET method (No HTML body responses).
--follow            : Follow redirections

-m iterator         : Specify iterator (product by default)
-z payload          : Specify payload (type,parameters,encoding)
-V alltype          : All parameters bruteforcing (allvars and allpost). No need for FUZZ keyword.

-X              : Payload within HTTP methods (ex: "FUZZ HTTP/1.0"). No need for FUZZ keyword.
-b cookie           : Specify a cookie for the requests
-d postdata             : Use post data (ex: "id=FUZZ&catalogue=1")
-H headers              : Use headers (ex:"Host:www.mysite.com,Cookie:id=1312321&user=FUZZ")

--basic/ntlm/digest auth    : in format "user:pass" or "FUZZ:FUZZ" or "domain\FUZ2Z:FUZZ"

--hc/hl/hw/hh N[,N]+        : Hide resposnes with the specified[s] code/lines/words/chars (Use BBB for taking values from baseline)
--hs regex          : Hide responses with the specified regex within the response

Keyword: FUZZ,FUZ2Z  wherever you put these words wfuzz will replace them by the payload selected.

Example: - wfuzz.py -c -z file,commons.txt --hc 404 -o html http://www.site.com/FUZZ 2> res.html
     - wfuzz.py -c -z file,users.txt -z file,pass.txt --hc 404 http://www.site.com/log.asp?user=FUZZ&pass=FUZ2Z
     - wfuzz.py -c -z range,1-10 --hc=BBB http://www.site.com/FUZZ{something}

       More examples in the README.

wfuzz Usage Example

Use colour output (-c), a wordlist as a payload (-z file,/usr/share/wfuzz/wordlist/general/common.txt), and hide 404 messages (–hc 404) to fuzz the given URL (http://192.168.1.202/FUZZ):

[email protected]:~# wfuzz -c -z file,/usr/share/wfuzz/wordlist/general/common.txt --hc 404 http://192.168.1.202/FUZZ

********************************************************
* Wfuzz  2.0 - The Web Bruteforcer                     *
********************************************************

Target: http://192.168.1.202/FUZZ
Payload type: file,/usr/share/wfuzz/wordlist/general/common.txt

Total requests: 950
==================================================================
ID  Response   Lines      Word         Chars          Request    
==================================================================

00429:  C=200      4 L        25 W      177 Ch    " - index"
00466:  C=301      9 L        28 W      319 Ch    " - javascript"