xmendez/wfuzz

Health v2 · maintenance only

Adoption not part of the score

6558 stars · 1398 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Wfuzz is a Python-based command-line web application fuzzer that replaces a FUZZ keyword in HTTP requests with values from configurable payloads. It supports fuzzing parameters, headers, directories, forms, and authentication, and includes a plugin-based vulnerability scanner.

Use cases

• brute-force directories and files on a web server
• fuzz HTTP parameters to find injection vulnerabilities
• discover hidden endpoints during a web app pentest
• brute-force login forms and authentication
• fuzz HTTP headers for security testing
• replay and modify requests captured from Burp Suite

When to choose

• you need a scriptable CLI fuzzer for web security assessments
• you want to inject payloads into any part of an HTTP request
• you prefer a modular Python tool you can extend with plugins

When to avoid

• you need a modern actively developed alternative like ffuf or feroxbuster
• you want a GUI web vulnerability scanner
• you need non-HTTP protocol fuzzing

Facets

cli-tool · maturity maintenance

penetration-testing http-client security web-scraping security penetration-testing web-development python cli windows web-fuzzer fuzzing wordlists burp-suite vulnerability-scanning http-requests command-line linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="xmendez/wfuzz")