Wfuzz（一款支持各种Web漏洞扫描的工具）

Wfuzz是一款Web应用程序暴力破解工具。它可以通过遍历以发现隐藏的资源（例如：目录、脚本和servlets等）。Wfuzz能够穷举GET和POST参数，用于检测不同类型的注入，它还能够暴力破解Form参数，如用户名/密码（User/Password）、Fuzzing等。

Wfuzz is a tool designed to brutefore web applications, it’s very flexible, it supports:

-Recursion (When doing directory discovery)
-Post data bruteforcing
-Header bruteforcing
-Output to HTML (easy for just clicking the links and checking the page, even with postdata!)
-Colored output
-Hide results by return code, word numbers, line numbers, etc.
-Url encoding
-Cookies
-Multithreading
-Proxy support
-All parameter fuzzing

It was created to facilitate the task in web applications assessments, it’s a tool by pentesters for pentesters 😉

所以，如果你觉得合适的话，可以试试，使用方法/选项如下：
——————

The tool is based on dictionaries or ranges, then you choose where you want to bruteforce just by replacing the value by the word FUZZ.（WFuzz是基于 字典or排列组合 的暴力猜解，你只要将下面的FUZZ替换成对应的方式即可。）

使用样例：

- wfuzz.py -c -z file,wordlists/commons.txt --hc 404 -o html http://www.mysite.com/FUZZ 2> results.html

This will bruteforce the site http://www.mysyte.com/FUZZ in search of resources i
(directories, scripts, files,etc), it will hide from the output the return code 404
(for easy reading results), it will use the dictionary commons.txt for the bruteforce
, and also will output the results to the results.html file (with a cool format to work).

- wfuzz.py -c -z range,1-100 --hc 404 http://www.mysite.com/list.asp?id=FUZZ
In this example instead of using a file as dictionary, it will use a range from 1-100,
and will bruteforce the parameter "id".

- wfuzz.py -c -z file,wordlists/commons.txt --hc 404 --html -d "id=1&catalogue=FUZZ"
http://www.mysite.com/check.asp 2> results.html
Here you can see the use of POST data, with the option "-d".

- wfuzz.py -c -z file, wordlists/commons.txt --hc 404 -R 2 http://www.mysite.com/FUZZ
Example of path discovery, using a recursive level of 2 paths.

- wfuzz.py -z file,wordlists/http_methods.txt -X http://testphp.vulnweb.com/
HTTP method scanning example

- wfuzz.py -z file,wordlists/http_methods.txt -z file,wordlists/commons.txt -X http://testphp.vulnweb.com/FUZ2Z/
HTTP method scanning example in several paths

- wfuzz.py -z list,TRACE -X http://testphp.vulnweb.com/
Scanning for TRACE method using a list payload

- wfuzz.py -c -z file,wordlists/methods.txt --hc 404 -v --follow http://www.mysite.com/FUZZ
Bruteforce following HTTP redirects

- wfuzz.py -c -z file,wordlists/commons.txt --hc 404 -I http://www.mysite.com/FUZZ
Bruteforce using HEAD HTTP method

- wfuzz.py -z list,http://mysite.com -z list,dir-dir2-dir3 FUZZ/FUZ2Z
Bruteforce using URL as payload and a list of directories.

- wfuzz.py -z list,..,double_nibble_hexa@second_nibble_hexa@uri_double_hexadecimal@uri_hexadecimal@first_nibble_hexa@none http://mysite.com/FUZZ/jmx-console
Bruteforce using multiple encodings per payload.

- wfuzz.py -z list,dir1-dir2 -z file,wordlist/general/common.txt -z list,jsp-php-asp -z range,1-40 http://localhost/FUZZ/FUZ2Z.FUZ3Z?id=FUZ4Z
Fuzzing using 4 payloads

- wfuzz.py -z -c -z range,1-10 --hc=BBB http://mysite.com/FUZZ{directory}
Baseline support, Bruteforcing and hiding the response codes that are equal to http://mysite.com/directory

- Combining payloads using iterators:

zip

- wfuzz.py -z list,a-b-c -z list,1-2-3 -m zip http://mysite.com/FUZZ/FUZ2Z

Target: http://mysite.com/FUZZ/FUZ2Z
Payload type: list,a-b-c; list,1-2-3

Total requests: 3
==========================================================
ID Response Lines Word Chars Request
==========================================================

00001: C=404 9 L 32 W 276 Ch "a - 1"
00002: C=404 9 L 32 W 276 Ch "c - 3"
00003: C=404 9 L 32 W 276 Ch "b - 2"


chain

- wfuzz.py -z list,a-b-c -z list,1-2-3 -m chain http://mysite.com/FUZZ/FUZ2Z

Target: http://mysite.com/FUZZ/FUZ2Z
Payload type: list,a-b-c; list,1-2-3

Total requests: 6
==========================================================
ID Response Lines Word Chars Request
==========================================================

00001: C=404 9 L 32 W 280 Ch "b"
00002: C=404 9 L 32 W 280 Ch "a"
00003: C=404 9 L 32 W 280 Ch "c"
00004: C=404 9 L 32 W 280 Ch "1"
00006: C=404 9 L 32 W 280 Ch "3"
00005: C=404 9 L 32 W 280 Ch "2"


product

- wfuzz.py -z list,a-b-c -z list,1-2-3 http://mysite.com/FUZZ/FUZ2Z

Target: http://mysite.com/FUZZ/FUZ2Z
Payload type: list,a-b-c; list,1-2-3

Total requests: 9
==========================================================
ID Response Lines Word Chars Request
==========================================================

00001: C=404 9 L 32 W 276 Ch "a - 2"
00002: C=404 9 L 32 W 276 Ch "a - 1"
00005: C=404 9 L 32 W 276 Ch "b - 2"
00004: C=404 9 L 32 W 276 Ch "a - 3"
00008: C=404 9 L 32 W 276 Ch "c - 2"
00003: C=404 9 L 32 W 276 Ch "b - 1"
00007: C=404 9 L 32 W 276 Ch "c - 1"
00006: C=404 9 L 32 W 276 Ch "b - 3"
00009: C=404 9 L 32 W 276 Ch "c - 3"

 

Dependencies:
————

On *nix systems, need pycurl to work.
On Windows just run the wfuzz.exe

——

The wordlist directory includes FuzzDB project:

http://code.google.com/p/fuzzdb/

 

下载地址：

https://wfuzz.googlecode.com/files/wfuzz-2.0.tgz

再加上两篇PDF文档介绍/说明：

https://wfuzz.googlecode.com/files/wfuzzforpentester2011.pdf
https://wfuzz.googlecode.com/files/Blackhat%20Arsenal%202.pdf