wfuzz v3.1 released: Web application fuzzer

by do son · Published · Updated

wfuzz

Wfuzz has been created to facilitate the task in web application assessments and it is based on a simple concept: it replaces any reference to the FUZZ keyword by the value of a given payload.

A payload in Wfuzz is a source of data.

This simple concept allows any input to be injected in any field of an HTTP request, allowing to perform complex web security attacks in different web application components such as parameters, authentication, forms, directories/files, headers, etc.

Wfuzz is more than a web content scanner:

  • It could help you to secure your web applications by finding and exploiting web application vulnerabilities. Wfuzz’s web application vulnerability scanner is supported by plugins.
  • It is a completely modular framework and makes it easy for even the newest of Python developers to contribute. Building plugins are simple and take little more than a few minutes.
  • It exposes a simple language interface to the previous HTTP requests/responses performed using Wfuzz or other tools, such as Burp. This allows you to perform manual and semi-automatic tests with full context and understanding of your actions, without relying on a web application scanner underlying implementation.

It was created to facilitate the task in web applications assessments, it’s a tool by pentesters for pentesters 😉

Changelog v3.1

  • Added tox and change test in Makefile
  • Improved plugin field filter language capabilities, ie. data and severity can be specified
  • Plugin’s information is shown depending on severity when using -v
  • Filter language and fuzzresult’s description handle lists of results
  • Added some basic queue profiling for debugging
  • diff operator
  • Refactored discarded results
  • Dotdict str
  • Removed future library
  • Added operator tests

Plugins:

  • Refactored headers plugin
  • Links plugins looks in link and redirect headers
  • Improved links plugin regex based on nahamsec/JSParser
  • New field printer to output filter expressions only
  • burplog unittest
  • raw printer shows plugin data

wfpayload:

  • Added –prev and –AA, —AAA to wfpayload

wfencode:

  • -i reads from stdin
  • general handle exception in wfencode

Breaking changes:

  • Changed -A, –AA, —AAA plugin’s categories
  • Changed plugins filter language field.
  • Changed links filter parameters and kbase keys.
  • Changed headers kbase key and server result.
  • When slicing a payload FUZZ refers to the previous result.

Bugs:

  • Fixed –prev in wfpayload
  • Fixed -c and -v values within printers plugins
  • Don’t print empty values in wfpayload
  • Use lower() in ~ operator
  • Remove httpreceiver queue limit
  • Fixed –interactive actions
  • Stripped CRLF from burplog parsed responses
  • Fixed –slice when using FuzzResult payloads
  • Only add recursive and routing queues when transport is Http
  • Bug in reqresp when parsing nested http responses due to textparser

Installation

pip install wfuzz

Usage

Copyright (C) 2014 xmendez

Source: https://github.com/xmendez/

Tags: wfuzz