Depending on what you are looking for you will want to filter by different methods to get the right results. First one filters by HTTP status code, the second one filters by character count in response and third one filters by number of lines returned in response. I think the most important thing using wfuzz is to know how to filter the results using -hc -hh -hl etc.

hc is used for hide http response so 418,404,302 responses will not be displayed as we are mostly interested in 200 responses for content discovery. t stands for threads so it will use 150 threads. I will break down the above command, first parameter - z file, is to specify wordlist wfuzz will replace FUZZ keyword with. I made some personal modifications to the word lists there but and in the example I’m using a large directory wordlist. First of all I suggest cloning SecLists into your wfuzz directory. This is very useful for CTF and bug bounty. The simplest way you can use wfuzz is for rapid content discovery. I will try to explain how to use the tool but nothing I can say will replace the documentation so I suggest you go read it first. Personally, I mainly use it for content discovery, admin account takeovers and enumerating endpoints vulnerable to IDOR. wfuzz is a very versatile tool that can be used for a lot of things. The tools I’m about to share should help you both with CTFs and bug bounties alike.įirst of all, I told myself I would get Burp Suite Pro after my first big bounty which came 3 months ago using wfuzz. However, do be warned that these will create some noise and might get you blacklisted across CDNs or even ISPs, so try to not go too crazy with your testing.

Even though these are not revolutionary tips I believe they are criminally underutilized. Over the past month I’ve tried to distinguish my recon game from other hackers.

Burppro