tools

Overview

wenum is the actively maintained fork of wfuzz, developed by WebFuzzForge. It is a Python-based web fuzzer designed for parameter discovery and flexible input manipulation. Where ffuf excels at speed and directory enumeration, wenum is purpose-built for parameter fuzzing — systematically testing GET and POST parameter values to surface input validation flaws, hidden parameters, and injection points. Its standout feature is a real-time terminal dashboard that shows live request statistics, match counts, and filter summaries as the scan runs.

Target / Context

Web application parameters — GET query strings, POST bodies, and custom headers. Best used after initial directory enumeration has identified interesting endpoints that accept user-controlled input.

Installation

ℹ︎Installation Commands:

Requires pipx for isolated Python environment management:

sudo apt install pipx
pipx ensurepath
sudo pipx ensurepath --global

Install wenum:

pipx install git+https://github.com/WebFuzzForge/wenum
pipx runpip wenum install setuptools

Basic Usage

ℹ︎Basic Usage:

Place FUZZ in the URL where the parameter value should be tested:

wenum -w <wordlist> -u "http://<target>/page.php?param=FUZZ"

Hide noise (e.g. 404 responses) with —hc:

wenum -w /usr/share/seclists/Discovery/Web-Content/common.txt --hc 404 -u "http://<target>/page.php?x=FUZZ"

Flags & Options

ℹ︎Core Flags:
FlagDescriptionExample
-wWordlist path-w /usr/share/seclists/Discovery/Web-Content/common.txt
-uTarget URL with FUZZ placeholder-u “http://target/page.php?x=FUZZ”
-XHTTP method-X POST
-HCustom request header-H “Content-Type: application/x-www-form-urlencoded”
-dPOST body data-d “y=FUZZ”
-pProxy to route traffic through-p http://127.0.0.1:8080
ℹ︎Filter & Match Flags:
FlagDescriptionExample
—hcHide responses with these status codes—hc 404,400
—scShow only responses with these status codes—sc 200
—hlHide responses with this line count—hl 10
—slShow only responses with this line count—sl 5
—hwHide responses with this word count—hw 219
—swShow only responses with this word count—sw 5
—hsHide responses with this size in bytes—hs 1024
—ssShow only responses with this size in bytes—ss 512
—hrHide responses whose body matches this regex—hr “Invalid parameter”
—srShow only responses whose body matches this regex—sr “admin”
—filterShow only responses matching a regex (plugins still process hidden)—filter “Login”
—hard-filterHide responses matching a regex AND prevent plugin processing—hard-filter “Login”

Common Use Cases

GET Parameter Fuzzing

Use curl to probe an endpoint first to confirm the parameter name, then automate value discovery with wenum.

ℹ︎Commands:

Probe manually first to confirm parameter behaviour:

curl "http://<target>/get.php?x=test"

Automate with wenum once the parameter name is known:

wenum -w /usr/share/seclists/Discovery/Web-Content/common.txt --hc 404 -u "http://<target>/get.php?x=FUZZ"

Combining filters — show only 200 responses with more than 5 words:

wenum -w wordlist.txt --sc 200 --sw 5 -u "http://<target>/page.php?x=FUZZ"

POST Parameter Fuzzing

ℹ︎Commands:

Probe with curl to identify the parameter and confirm POST behaviour:

curl -d "" "http://<target>/post.php"

Fuzz the parameter value:

wenum -w /usr/share/seclists/Discovery/Web-Content/common.txt --hc 404 -u "http://<target>/post.php" -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "y=FUZZ"

Regex-Based Filtering

Useful when status codes alone aren’t enough to distinguish valid from invalid responses — the server returns 200 for everything but the response body differs.

ℹ︎Commands:

Show only responses containing “admin”:

wenum -w wordlist.txt --sr "admin" -u "http://<target>/FUZZ"

Hide responses with a known error message:

wenum -w wordlist.txt --hr "Invalid parameter value" -u "http://<target>/page.php?x=FUZZ"

Combine with status filter:

wenum -w wordlist.txt --sc 200,301,302 --sr "admin|password" -u "https://<target>/FUZZ"

References / Images