# webfuzz — Changelog

## v1.0.0 — 2026-06-25

Initial release. Sixth tool in the "productivity-boost" series.
Pairs with lexharvest (wordlist generator).

### Purpose

Authorised attack-surface enumeration. webfuzz is the path / vhost /
parameter brute-force half of the offensive suite — lexharvest
generates the wordlist, webfuzz fans it out across HTTP requests.
Findings classify themselves by the path / hostname pattern into
jfind/v1 categories so complymap and dossier can consume them
downstream.

**Authorisation reminder:** webfuzz sends real HTTP traffic. ALWAYS
verify written authorisation to scan a target before running.

### Subcommands

```
webfuzz scan   <URL with FUZZ>  -w <wordlist>
webfuzz vhost  <URL>            -w <wordlist>          # uses Host header
webfuzz param  <URL with FUZZ>  -w <wordlist>
   (or `webfuzz param <URL> --param-name <N>` to append ?N=FUZZ)
```

Shared flags: `-w/--wordlist`, `--word a,b,c` inline, `--threads`
(default 30), `--rate <req/s>`, `--timeout-ms`, `--method`,
`-H 'Key: Value'`, `--match-status`, `--filter-status` (default
404), `--min-size`, `--max-size`, `--follow-redirects`, `-F human|
json|jfind`, `-o <file>`, `--fail-on <severity>`.

### Classification → jfind/v1

| Trigger | Category | Default severity |
|---|---|---|
| Sensitive file (`.env`, `.git/`, `.aws/`, `id_rsa`, `wp-config`, `.sql`, …) | `data-exposure` | High |
| `.bak` / `.zip` / `backup` / `.DS_Store` / `config.json` / `secret` | `data-exposure` | Medium |
| `admin`, `manage`, `console`, `phpmyadmin`, `kibana`, `grafana`, `actuator`, `swagger`, `graphql` | `network-exposure` | Medium |
| `dev.` / `staging.` / `test.` / `internal.` hosts (vhost mode) | `network-exposure` | Medium |
| Any other 2xx/3xx/401/403 hit | `asset-inventory` | Info |

Controls (always): DORA Art. 9, ISO/IEC 27001:2022 A.8.16.
Plus for `data-exposure`: DORA Art. 9(4)(c), NIS2 Art. 21(2)(g),
ISO 27001 A.8.24. Plus for `network-exposure`: DORA Art. 11, NIS2
Art. 21(2)(b), ISO 27001 A.8.21.

MITRE ATT&CK: T1595.003 (Active Scanning — Wordlist Scanning) on
every finding; T1083 + T1530 added for `data-exposure`.

### Exit codes

```
0  ok
2  usage (clap)
3  runtime (missing FUZZ, bad wordlist, header parse, unknown format)
4  policy gate failed (a finding crossed --fail-on)
```

### Build

- Library crate + thin CLI binary.
- 12 unit + 9 integration tests = 21 tests, all green.
- Zero compiler warnings.
- Concurrency: `tokio::sync::Semaphore` bounds in-flight requests.
- Rate limit: optional minimum inter-request gap via shared `Mutex`.
- TLS: rustls (matches the rest of the suite).
- Offline-by-default classification — no third-party intel lookups.
- NixOS-only platform gate in `install.sh`.

### Suite interop

| Producer | Consumer | Use case |
|---|---|---|
| lexharvest | webfuzz | wordlist generation → fuzz |
| operator   | webfuzz | discovery during authorised pentest |
| webfuzz    | complymap | map findings → DORA / NIS2 / ISO 27001 |
| webfuzz    | dossier   | pentest report append |
| webfuzz    | notify    | dispatch High+ to Slack / Teams |

### Deferred to v1.1

- Recursive directory walk (today: single-level enumeration).
- Body-content regex match (today: status + size only).
- Calibration against a known-bad path to set baseline 404 size.
- HTTP/2 + HTTP/3 explicit toggle (today: reqwest's default).
- Async I/O for wordlist (today: synchronous read).
- Cookie jar / authenticated session support beyond `-H 'Cookie: …'`.