root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat wfuzz.md
// web

Wfuzz

21 Jul 2026 · 7 min read
webcheatsheetswfuzz
wfuzz is a Python web fuzzer that replaces the FUZZ keyword anywhere in an HTTP request with each line of a wordlist. It is used to discover paths, parameters, headers or credentials by automatically testing thousands of values. Its strength lies in its filters: you decide which responses to show or hide based on status code, size, word count or content.

The key to wfuzz is not firing requests but knowing how to read the noise. A server usually answers with a constant size or word count for things that do not exist; you spot that pattern and hide it with --hc, --hw or --hh so only the anomalies stand out. You can also place FUZZ at several points at once and combine it with encoders, which makes it far more flexible than a plain directory buster.

1. Beginner level — paths, POST and filters

WFUZZ cheat sheet — Beginner
CommandWhat it does
wfuzz -w <wl> https://<t>/FUZZPath fuzzing
wfuzz -w <wl> --hc 404 https://<t>/FUZZHides 404 responses
wfuzz -w <wl> --sc 200 https://<t>/FUZZShows only the 200s
wfuzz -w <wl> --hw 20 https://<t>/FUZZHides by word count
wfuzz -w <wl> --hh 0 https://<t>/FUZZHides by size (characters)
wfuzz -w <wl> -d 'user=FUZZ&pass=x' https://<t>/loginFuzzing in the POST body
wfuzz -w <wl> -H 'Cookie: s=FUZZ' https://<t>Fuzzing in headers/cookies
wfuzz -w users -w pass https://<t>/FUZZ/FUZ2ZTwo wordlists (two markers)
wfuzz -w <wl> -X POST https://<t>/FUZZChanges the HTTP method
wfuzz -w <wl> -c https://<t>/FUZZColored output
wfuzz -w <wl> -f out.txt https://<t>/FUZZSaves the output to a file
wfuzz -w <wl> -t 40 https://<t>/FUZZAdjusts the concurrency
wfuzz -w <wl> -p 127.0.0.1:8080 https://<t>/FUZZUses a proxy
wfuzz -hShows the help

2. Advanced level — vhosts, ranges and encoders

WFUZZ cheat sheet — Advanced
CommandWhat it does
wfuzz -w <wl> -H 'X-Forwarded-For: FUZZ' https://<t>Bypass by header IP
wfuzz -w sub.txt -H 'Host: FUZZ.<t>' https://<t>Vhost fuzzing
wfuzz -z range,1-1000 https://<t>/id=FUZZFuzzing by numeric range
wfuzz -w <wl> --hs 'error' https://<t>/FUZZHides by text in the response
wfuzz -w <wl> --ss 'admin' https://<t>/FUZZShows only if a text appears
wfuzz -w u -w p -d 'u=FUZZ&p=FUZ2Z' https://<t>/loginLogin with two lists
wfuzz -z file,<wl>,md5 https://<t>/FUZZApplies an encoder (md5, base64...)
wfuzz -w <wl> --filter 'c=200 and l>50' https://<t>/FUZZAdvanced filter by expression
wfuzz -w <wl> -b 'session=x' https://<t>/FUZZAdds cookies
wfuzz -w u -w p -m clusterbomb https://<t>Full payload combination
wfuzz -z burp,req.burp https://<t>Replays requests exported from Burp
wfuzz -w <wl> --req-delay 5 https://<t>/FUZZDelay between requests
wfuzz -w <wl> -R 2 https://<t>/FUZZRecursion of 2 levels
wfuzz -w <wl> -A https://<t>/FUZZVerbose mode (all headers)

3. Details people miss

  • Default filtering hides nothing: always start with --hc 404, or measure a baseline request and hide its size with --hh or its word count with --hw, or you will drown in false positives.
  • --hc, --hw and --hh are the counterparts of --sc, --sw, --ss: use the hide ones to discard known noise and the show ones once you know what you are after, but do not mix both logics in the same scan.
  • With multiple wordlists the markers are FUZZ, FUZ2Z, FUZ3Z… in that order; forgetting the second marker or the mode (-m clusterbomb) is the most common mistake in login attacks.
  • To fuzz vhosts with Host: FUZZ.domain you must filter by size, because the server returns 200 for everything; the real vhost gives itself away through a different size or word count, not through the status code.
  • wfuzz is discontinued and barely maintained; on recent Kali it may break due to pycurl dependencies. If you need something modern, ffuf or feroxbuster cover almost all of its use cases.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.