webfuzz

Wordlist-driven HTTP fuzzer — path / vhost / param with jfind/v1 classification

v1.0.0
NixOS x86_64

Quick start

Install via jcli (recommended)

jcli install webfuzz

If you don't have jcli yet, install it first with curl -fsSL https://cli.johlem.net/tools/jcli/install.sh | bash.

Install directly

curl -fsSL https://cli.johlem.net/install.sh | bash -s -- webfuzz

Ed25519 signature verification is mandatory by default; set ALLOW_UNVERIFIED=1 to explicitly opt out (not recommended).

Run it

webfuzz --help                # subcommand catalogue + flags
webfuzz --full                # extended help across every subcommand
webfuzz --about               # machine-readable attribution (JSON)
webfuzz --version             # version string

What it does

webfuzz fans out a wordlist across HTTP requests, classifies hits by path / host pattern, and emits jfind/v1 findings: data-exposure (Medium/High) for sensitive-file leaks (.env, .git/HEAD, id_rsa, .sql, .aws/, wp-config, backup, .bak, config.json, …), network-exposure (Medium) for admin / dev / staging surface (admin, phpmyadmin, kibana, grafana, actuator, swagger, graphql; dev./staging./internal. hosts in vhost mode), asset-inventory (Info) for any other 2xx/3xx/401/403 hit. Three subcommands: scan (path enumeration with FUZZ marker), vhost (wordlist as Host header against the target), param (query parameter fuzzing — either FUZZ-marked URL or --param-name to append). Concurrency via tokio::sync::Semaphore; --rate <req/s> enforces a hard inter-request gap. Filters: --match-status, --filter-status (default 404), --min-size, --max-size, --follow-redirects, -H header. Pre-fills DORA Art. 9 + ISO/IEC 27001:2022 A.8.16 on every finding; data-exposure adds DORA Art. 9(4)(c) + NIS2 Art. 21(2)(g) + ISO 27001 A.8.24; network-exposure adds DORA Art. 11 + NIS2 Art. 21(2)(b) + ISO 27001 A.8.21. MITRE T1595.003 on every finding, T1083 + T1530 added for data-exposure. Pairs with lexharvest (wordlist generator). Suite app: offsec. 12 unit + 9 integration tests; zero warnings. Authorisation reminder: real HTTP traffic — ALWAYS verify written authorisation before scanning.

Authorisation and warranty: use only in environments where you have explicit written authorisation. This tool is provided as-is with no warranty. Report vulnerabilities privately at security@johlem.net.

Release artefacts & provenance

Every signed release ships with checksum + signature sidecars plus a CycloneDX SBOM. Enterprise procurement can pin third-party components without unpacking the binary.