NAME

       wfuzz - a web application bruteforcer

SYNOPSIS

       wfuzz [options] -z payload,params <url>

OPTIONS

       -h     Print information about available arguments.

       --help Advanced help.

       --version
              Wfuzz version details

       -e <type>
              List of available encoders/payloads/iterators/printers/scripts

       --recipe <filename>
              Reads options from a recipe

       --dump-recipe <filename>
              Prints current options as a recipe

       --oF <filename>
              Saves fuzz results to a file. These can be consumed later using the wfuzz payload.

       -c     Output with colors

       -v     Verbose information.

       -f filename,printer
              Store  results  in  the  output  file  using  the specified printer (raw printer if
              omitted).

       -o printer
              Format output using the specified printer.

       --interact
              (beta) If selected, all key presses are captured. This allows you to interact  with
              the program.

       --dry-run
              Print  the  results  of  applying  the  requests  without  actually making any HTTP
              request.

       --prev Print the previous HTTP requests (only when using payloads generating fuzzresults)

       -p addr
              Use Proxy in format ip:port:type. Repeat option for using various  proxies.   Where
              type could be SOCKS4, SOCKS5 or HTTP if omitted.

       -t N   Specify the number of concurrent connections (10 default)

       -s N   Specify time delay between requests (0 default)

       -R depth
              Recursive path discovery being depth the maximum recursion level.

       -L, --follow
              Follow HTTP redirections

       -Z     Scan mode (Connection errors will be ignored).

       --req-delay N
              Sets  the maximum time in seconds the request is allowed to take (CURLOPT_TIMEOUT).
              Default 90.

       --conn-delay N
              Sets the maximum time in seconds  the  connection  phase  to  the  server  to  take
              (CURLOPT_CONNECTTIMEOUT). Default 90.

       -A     Alias for --script=default -v -c

       --script=
              Equivalent to --script=default

       --script=<plugins>
              Runs  script's  scan.  <plugins>  is  a  comma  separated  list  of plugin-files or
              plugin-categories

       --script-help=<plugins>
              Show help about scripts.

       --script-args n1=v1,...
              Provide arguments to scripts. ie. --script-args grep.regex="<A href=\"(.*?)\">"

       -u url Specify a URL for the request.

       -m iterator
              Specify an iterator for combining payloads (product by default)

       -z payload
              Specify   a   payload   for   each   FUZZ   keyword   used   in   the    form    of
              type,parameters,encoder.   A  list  of encoders can be used, ie. md5-sha1. Encoders
              can be chained, ie. md5@sha1.  Encoders category can be used. ie. url.  Use help as
              a payload to show payload plugin's details (you can filter using --slice)

       --zP <params>
              Arguments for the specified payload (it must be preceded by -z or -w).

       --slice <filter>
              Filter  payload's  elements  using the specified expression. It must be preceded by
              -z.

       -w wordlist
              Specify a wordlist file (alias for -z file,wordlist).

       -V alltype
              All parameters bruteforcing (allvars and allpost). No need for FUZZ keyword.

       -X method
              Specify an HTTP method for the request, ie. HEAD or FUZZ

       -b cookie
              Specify a cookie for the requests. Repeat option for various cookies.

       -d postdata
              Use post data (ex: "id=FUZZ&catalogue=1")

       -H headers
              Use headers (ex:"Host:www.mysite.com,Cookie:id=1312321&user=FUZZ").  Repeat  option
              for various headers.

       --basic/ntlm/digest auth
              in format "user:pass" or "FUZZ:FUZZ" or "domain\FUZ2Z:FUZZ"

       --hc/hl/hw/hh N[,N]+
              Hide responses with the specified code/lines/words/chars (Use BBB for taking values
              from baseline)

       --sc/sl/sw/sh N[,N]+
              Show responses with the specified code/lines/words/chars (Use BBB for taking values
              from baseline)

       --ss/hs regex
              Show/Hide responses with the specified regex within the content

       --filter <filter>
              Filter  responses  using  the  specified expression (Use BBB for taking values from
              baseline) It should be composed of:  c,l,w,h/and,or/=,<,>,!=,<=,>=  Keyword:  FUZZ,
              ..., FUZnZ  wherever you put these keywords wfuzz will replace them with the values
              of the specified payload.  Baseline: FUZZ{baseline_value} FUZZ will be replaced  by
              baseline_value.  It will be the first request performed and could be used as a base
              for filtering.

       --prefilter <filter>
              Filter items before fuzzing using the specified expression.

EXAMPLES

              wfuzz -c -z file,users.txt -z file,pass.txt --sc 200 http://www.site.com/log.asp?user=FUZZ&pass=FUZ2Z

              wfuzz -c -z range,1-10 --hc=BBB http://www.site.com/FUZZ{something not there}

              wfuzz --script=robots -z list,robots.txt http://www.webscantest.com/FUZZ

       More examples are available in the README..