# Wfuzz

> Use for web content, parameter, and header fuzzing during authorized pentests. Trigger on hidden endpoint discovery, parameter discovery, virtual host testing, and controlled input variation during web and API assessments.

- Skill: `timsonner/wfuzz` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/wfuzz`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/wfuzz/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/wfuzz

---


# Wfuzz

## Purpose

Use this skill for focused fuzzing of paths, parameters, headers, or hostnames when the current hypothesis requires controlled variation of web requests.

## Phase Fit

- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Validation and Controlled Impact Demonstration, Retest and Closure

## Use When

- Need to fuzz paths, parameters, headers, or virtual hosts.
- Need a more flexible web fuzzing workflow than a simple directory brute force.
- Need a repeatable retest for a discovered input boundary issue.

## Avoid When

- Rate limits or application fragility are unclear.
- Broad fuzzing would exceed the approved impact level.

## Inputs

- Approved base URL and fuzz point
- Narrow wordlist or payload set
- Rate, filter, and auth constraints

## Procedure

1. Start with the smallest payload set that answers the question.
2. Separate authenticated and unauthenticated fuzzing.
3. Filter noise aggressively and validate only meaningful deltas.
4. Escalate material findings to manual validation.
5. Preserve the exact payload set and filters for retest.

## Command Syntax

Replace sample targets with approved in-scope URLs.

```bash
# Directory fuzzing, filter 404
wfuzz -c -z file,/usr/share/seclists/Discovery/Web-Content/common.txt --hc 404 https://portal.contoso.com/FUZZ

# POST login fuzzing
wfuzz -c -z file,users.txt -d "username=FUZZ&password=admin" https://portal.contoso.com/login

# Header fuzzing (e.g., X-Forwarded-For)
wfuzz -c -z file,ips.txt -H "X-Forwarded-For: FUZZ" https://portal.contoso.com/admin

# Authenticated scan with session cookie
wfuzz -c -z file,paths.txt -b "session=<token>" --hc 404 https://portal.contoso.com/FUZZ

# Filter by response string (hide known-bad responses)
wfuzz -c -z file,users.txt -d "user=FUZZ" --hs "Invalid user" https://portal.contoso.com/login

# Vhost brute-force via Host header
wfuzz -c -z file,subdomains.txt -H "Host: FUZZ.contoso.com" --hc 400,404 https://contoso.com/
```

## Evidence to Capture

- Paths or parameters that materially changed application behavior
- Exact payload set and filters used
- Minimal proof path for retest

## Safety Boundaries

- Keep payloads narrow and rate controlled.
- Stop if the application shows instability or lockout behavior.