Wfuzz
Wfuzz is a Python web fuzzer that replaces FUZZ placeholders in any part of a request with payloads.
Legal & ethical use. Use this tool only on systems, networks and data that you own or have explicit written permission to test. Unauthorised access or scanning can break computer-misuse laws (for example Pakistan's Prevention of Electronic Crimes Act, 2016, and equivalents elsewhere). Practise in your own lab or in authorised environments such as CTFs.
What it is used for
- Fuzz form fields and headers of a practice app
- Test authentication endpoints in a lab for weak behaviours
Key features
- Fuzz URLs, headers, cookies and POST data
- Flexible filters
- Payload encoders and iterators
Installation
Install with `pip install wfuzz` or from your distribution.
Beginner usage guide
Mark the position to fuzz with FUZZ, choose a wordlist and hide uninteresting responses with filters such as --hc 404.
Example commands
Run these only against your own lab or authorised targets. Placeholder addresses such as 192.0.2.x are documentation ranges.
Fuzz a URL path
wfuzz -c -z file,/usr/share/wordlists/dirb/common.txt --hc 404 http://127.0.0.1:8081/FUZZ-c adds colour, -z selects the payload list, --hc hides responses with code 404.
References
Source verification
Last reviewed: 2026-10-27
Links checked over HTTP: 2026-10-27 07:51 UTC — official: 200, docs: 200, repo: 200
Command flags checked against the real binary wfuzz (default) on 2026-10-27.