Hack Forums
[Legends] Wfuzz: The Ultimate Ethical Hackers Guide + Atack Website Example - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [Legends] Wfuzz: The Ultimate Ethical Hackers Guide + Atack Website Example (/showthread.php?tid=6289693)

Wfuzz: The Ultimate Ethical Hackers Guide + Atack Website Example - JoseMar - Jan 15, 2025

Wfuzz: The Ultimate Ethical Hacker’s Guide

When it comes to web application vulnerability scanning, Wfuzz is a must have for ethical hackers. This very versatile tool allows you to automate HTTP requests and find hidden files, directories and even security flaws. Whether you are new to security or an experienced tester, Wfuzz has got you covered.



What’s so special about Wfuzz?
  • Customizable testing
  • Payloads: Use existing wordlists or create your own custom ones for your target.
  • Filtering: Exclude results based on HTTP codes, content length or specific text to focus on what matters.
  • Integration: Wfuzz works with Burp Suite and supports proxy for deeper analysis.
  • Fast: Multithreading and connection reuse for large scale testing without performance hit


How to use Wfuzz


1. Find Hidden Directories and Files Web applications have directories or files not meant to be public. Wfuzz can help you find them:

Code
wfuzz -c -z file,/path/to/wordlist.txt --hc 404 http://example.com/FUZZ
  • -c: adds color output
  • -z: specifies the payload source (wordlist)
  • --hc 404: hides 404 responses (non-existent resources)


2. Test Web Parameters Find parameters in GET or POST requests that expose vulnerabilities:

Code
wfuzz -c -z file,/path/to/parameters.txt http://example.com/page.php?FUZZ=value

For POST parameter testing:
Code
wfuzz -c -z file,/path/to/parameters.txt -d "FUZZ=value" http://example.com/page.php



3. Brute-Force Login Credentials Test weak username and password combinations to test authentication:

Code
wfuzz -c -z file,usernames.txt -z file,passwords.txt --hc 401 -d "username=FUZZ&password=FUZ2Z" http://example.com/login

Here:  --hc 401 fifilters out unauthorized responses, highlighting successful logins



4. SQL Injection Detect SQL injection points with crafted payloads:

Code
wfuzz -c -z file,sqli_payloads.txt --hh 1000 http://example.com/index.php?id=FUZZ



5. HTTP Headers Test custom or modified HTTP headers:

Code
wfuzz -c -z file,headers.txt -H "FUZZ: value" http://example.com/



6. API Test endpoints in REST APIs:

Code
wfuzz -c -z file,api_endpoints.txt http://example.com/api/FUZZ


7. Subdomain Find subdomains of a target domain:

Code
wfuzz -c -z file,subdomains.txt -H "Host: FUZZ.example.com" http://example.com





Real Test Machine:

-u 192.168.0.42    -->   Victim IP website


Here, the main page is http://logan.hmv, but we want to check if there are any subdomains before logan.hmv. 
In that case, we add FUZZ  before logan.hmv, is mean that we need to add FUZZ.logan.hmv to the command.

[Image: 79KPQUp.png]



But now, something is not good that we have a lot of pages , way too many, so we stop them from scanning:

[Image: F1jV8Br.png]


Here we can hide them so they no longer show,
  • Line
  • Characters, or the third column


In this example we hide by line. We add the following to the previous command:
--hl=1

if we want to hide the others column we can use:
--hw=number
--hc=number (here I will add 404 for hide all 404 error page)


Code
wfuzz -c --hc=404 --hl=1 -w /usr/share/...dicionar.txt -H “Host: FUZZ.logan.hmv” -u 192.168.0.42

[Image: 3WfqK2C.png]

Now line 1 is no longer showing because we hid it.

We can see a subdomain called “admin” was found, so the page will be admin.logan.hmv

[Image: nBdHZyA.png]

But the page won’t load because it also needs to be added to /etc/hosts

How to add this page to /etc/hosts ?

Open terminal and write:
nano /etc/hosts

and add IP + domain

[Image: aNzMWCi.png] 


Now we can see the website:

[Image: FbtwPgs.png]




Advanced


Wfuzz has advanced features for power users:
  • HTTP Methods: GET, POST, PUT, DELETE
  • Payload Encoding: Base64, URL encoding, custom schemes
  • Filtering Options:
    1. Exclude by HTTP status code: --hc
    2. Focus on specific response lengths: --hl or --hh
    3. Search for or exclude keywords in responses: --filter "text='keyword'



Wfuzz Best Practices

  1. Targeted Wordlists: Use CeWL to create custom wordlists for better precision.
  2. Proxies: Run Wfuzz through Burp Suite to see requests and responses.
  3. Start Small: Run a subset of payloads to see how the app behaves before running big scans.
  4. Monitor Impact: Don’t flood the target with too many requests.
  5. Combine Tools: Run Wfuzz with Nmap and OWASP ZAP for full testing.


Legal and Ethical
Remember, ethical hacking requires permission from system owners before testing. Unauthorized activities are illegal and unethical. Always follow responsible disclosure when reporting vulnerabilities.


Wfuzz is a powerful tool for ethical hackers to do web application testing. By learning its features and best practices you can better identify and fix security issues. If you have any question or need help with your virtual lab setup, ask me!

RE: Wfuzz: The Ultimate Ethical Hackers Guide + Atack Website Example - Bastille - Jan 16, 2025

Going to my favs, I've only used this tool a few times on tryhackme for fuzzing, next time I'll use it I'll refer to this thread, thanks for the share !

RE: Wfuzz: The Ultimate Ethical Hackers Guide + Atack Website Example - JoseMar - Jan 16, 2025

(Jan 16, 2025 04:57 AM)Bastille Wrote:  Going to my favs, I've only used this tool a few times on tryhackme for fuzzing, next time I'll use it I'll refer to this thread, thanks for the share !

Can you tell me which programs you use more often for or instead of Wfuzz, which one you prefer, and which one you think is the best all-in-one tool?
I mean for Fuzzing 🕵️

RE: Wfuzz: The Ultimate Ethical Hackers Guide + Atack Website Example - Bastille - Jan 17, 2025

(Jan 16, 2025 09:17 AM)JoseMar Wrote:  Can you tell me which programs you use more often for or instead of Wfuzz, which one you prefer, and which one you think is the best all-in-one tool?
I mean for Fuzzing 🕵️

I use gobuster, I've also heard about dirbuster but it seems that gobuster is faster. Also heard about fuff, I've maybe used it a couple of times back in the days but don't remember.

RE: Wfuzz: The Ultimate Ethical Hackers Guide + Atack Website Example - RoundLettuce - Aug 24, 2025

Epic tutorial man! I do love Fuzzing and I'm studying a lot of Web App Security recently. Thanks! :)