.TH WFUZZ "1" "July 2016" "wfuzz 2.1.4" "User Commands"
.SH NAME
wfuzz \- a web application bruteforcer
.SH SYNOPSIS
.B wfuzz
[\fI\,options\/\fR] \fI\,-z payload,params <url>\/\fR
.SH OPTIONS
.TP
.BR \-h ", " \-\-help
Print out informations about available arguments.
.TP
.BR \-\-version
Wfuzz version details
.TP
.BR \-e " <type>"
List of available encoders/payloads/iterators/printers/scripts
.TP
.BR \-c
Output with colors
.TP
.BR \-v
Verbose information. Alias for \fB\-o\fR verbose
.TP
.BR \-o " printer"
Format output using the specified printer (default printer if omitted).
.TP
.BR \-\-interact
(beta) If selected, all key presses are captured. This allows you to interact with the program.
.TP
.BR \-p " addr"
Use Proxy in format ip:port:type or ip:port:type\-...\-ip:port:type for using various proxies.
Where type could be SOCKS4, SOCKS5 or HTTP if omitted.
.TP
.BR \-t " N"
Specify the number of concurrent connections (10 default)
.TP
.BR \-s " N"
Specify time delay between requests (0 default)
.TP
.BR \-R " depth"
Recursive path discovery being depth the maximum recursion level.
.TP
.BR \-I
Use HTTP HEAD method (No HTML body responses).
.TP
.BR \-\-follow
Follow HTTP redirections
.TP
.BR \-Z
Scan mode (Connection errors will be ignored).
.TP
.BR \-A
Alias for \fB\-\-script\fR=\fI\,default\/\fR \fB\-v\fR \fB\-c\fR
.TP
.BR \-\-script=
Equivalent to \fB\-\-script\fR=\fI\,default\/\fR
.TP
.BR \-\-script=<plugins>
Runs script's scan. <plugins> is a comma separated list of plugin\-files or plugin\-categories
.TP
.BR \-\-script\-help=<plugins>
Show help about scripts.
.TP
.BR \-\-script\-args " n1=v1,..."
Provide arguments to scripts. ie. \fB\-\-script\-args\fR grep.regex="<A href=\e"(.*?)\e">"
.TP
.BR \-m " iterator"
Specify an iterator for combining payloads (product by default)
.TP
.BR \-z " payload"
Specify a payload for each FUZZ keyword used in the form of type,parameters,encoder.
A list of encoders can be used, ie. md5\-sha1. Encoders can be chained, ie. md5@sha1.
Encoders category can be used. ie. url
.TP
.BR \-w " wordlist"
Specify a wordlist file (alias for \fB\-z\fR file,wordlist).
.TP
.BR \-V " alltype"
All parameters bruteforcing (allvars and allpost). No need for FUZZ keyword.
.TP
.BR \-X
Payload within HTTP methods (ex: "FUZZ HTTP/1.0"). No need for FUZZ keyword.
.TP
.BR \-b " cookie"
Specify a cookie for the requests
.TP
.BR \-d " postdata"
Use post data (ex: "id=FUZZ&catalogue=1")
.TP
.BR \-H " headers"
Use headers (ex:"Host:www.mysite.com,Cookie:id=1312321&user=FUZZ")
.TP
.BR \-\-basic/ntlm/digest " auth"
in format "user:pass" or "FUZZ:FUZZ" or "domain\eFUZ2Z:FUZZ"
.TP
.BR \-\-hc/hl/hw/hh " N[,N]+"
Hide responses with the specified code/lines/words/chars (Use BBB for taking values from baseline)
.TP
.BR \-\-sc/sl/sw/sh " N[,N]+"
Show responses with the specified code/lines/words/chars (Use BBB for taking values from baseline)
.TP
.BR \-\-ss/hs " regex"
Show/Hide responses with the specified regex within the content
.TP
.BR \-\-filter " <filter>"
Filter responses using the specified expression (Use BBB for taking values from baseline)
It should be composed of: c,l,w,h/and,or/=,<,>,!=,<=,>=
Keyword: FUZZ, ..., FUZnZ  wherever you put these keywords wfuzz will replace them with the values of the specified payload.
Baseline: FUZZ{baseline_value} FUZZ will be replaced by baseline_value. It will be the first request performed and could be used as a base for filtering.
.PP
.SH EXAMPLES
.PP
.nf
.RS
wfuzz \fB\-c\fR \fB\-z\fR file,users.txt \fB\-z\fR file,pass.txt \fB\-\-sc\fR 200 http://www.site.com/log.asp?user=FUZZ&pass=FUZ2Z
.TP
wfuzz \fB\-c\fR \fB\-z\fR range,1\-10 \fB\-\-hc\fR=\fI\,BBB\/\fR http://www.site.com/FUZZ{something not there}
.TP
wfuzz \fB\-\-script\fR=\fI\,robots\/\fR \fB\-z\fR list,robots.txt http://www.webscantest.com/FUZZ
.RE
.TP
More examples are available in the README..