wfuzz

wfuzz (github.com/xmendez/wfuzz) is a command-line web application fuzzer — conceptually the CLI counterpart of Burp Suite’s Intruder, but much faster, as one expects from a dedicated CLI tool. Its core idea is simple: any occurrence of the keyword FUZZ in a request is replaced by each element of a payload, and a payload is just a source of data (wordlist file, range, list, etc.). Because FUZZ can appear anywhere — URL paths, parameters, headers, POST bodies, authentication fields — it can fuzz any part of an HTTP request.

Basic usage

wfuzz -z file,rockyou.txt \
      https://example.com/FUZZ/img/secret.webp

Key options:

• -c — color output
• -z file,<wordlist> — payload: replace FUZZ with entries from a wordlist
• --hc 404 — hide responses with a given status code (e.g. suppress 404 noise in directory brute-forcing)
• FUZZ, FUZ2Z, FUZ3Z, … — multiple injection slots; each maps to a corresponding -z payload in order

See wfuzz --help and the full documentation for filters (--hc/--hl/--hw/--hh hide by code/lines/words/chars), encoders, iterators, and scripting.

Relationship to other tools

• gobuster — Go-based directory/DNS/vhost brute-forcer; faster for pure enumeration, narrower than wfuzz’s general request fuzzing
• ffuf — Go-based successor with the same FUZZ keyword model; the modern default CLI fuzzer
• turbo-intruder — Burp-based, Python-scripted, optimized for extreme request rates and race conditions
• Burp Intruder — GUI-driven; slower than wfuzz but tightly integrated with the Burp workflow (burp-suite-firefox)
• owasp-zap — open-source proxy with its own fuzzer

Payloads often need encoding first — see url-encode-file-python for mass URL-encoding wordlists.

Sources

• GitHub — xmendez/wfuzz
• wfuzz documentation (Read the Docs)