wfuzz

Python web application fuzzer that substitutes supplied payloads wherever FUZZ markers appear in HTTP requests. Wfuzz can test paths/files, parameters, authentication/forms, headers, and plugin-supported vulnerability checks. The catalog commands below use wordlists for path discovery and candidate GET query-parameter names; returned responses are leads to validate, not proof of a vulnerability or successful access.