​
Overview

Fuzzer is a sophisticated security assessment tool designed to discover hidden or undocumented web resources. It employs an advanced, multi-threaded approach to systematically enumerate directories, files, and endpoints within web applications, helping security professionals map out the complete attack surface. By leveraging intelligent wordlist processing and dynamic pattern matching, the fuzzer can reveal potential security vulnerabilities, sensitive information exposure, and unintended access points. The tool supports both managed and custom wordlists. This fuzzer is capable of:
  • Fuzzing with several HTTP request methods (such as GET, POST, PUT, etc.)
  • Fuzzing for live hosts (subdomain bruteforcing)
  • Fuzzing for virtual hosts (VHOST enumeration)
  • Fuzzing for input parameters
  • Fuzzing with custom wordlists

​
Usage Examples

You can specify a target URL for Fuzzer to find hidden links, endpoints, files and application routes.
1

Specify Target

Specify a target for Fuzzer. You may use the positional FUZZ keyword to instruct the scanner where to inject the word from your wordlist file.
2

Select Wordlist

Select at least 1 Managed or Custom wordlist.
3

Set Matchers & Filters

Now set the conditions on when you’d like the fuzzer to mark a resource as found. Ideally, you’d want to filter out resources responding with a status code such as 404.
Optionally, you may configure any settings you’d like. Afterward, simply click on Scan to launch your scan. Shortly after your scan has been launched, you will be redirected to the page to view your pending scan.

​
Scanner settings

This scanner accepts the following optional parameters:

​
Follow redirects

You may instruct the scanner to follow redirects imposed by the target server. The maximum number of redirects the fuzzer can follow is currently a constant and set to 10 redirects. Default: true

​
Generate custom keywords relevant to your target

Fuzzer is also capable of generating possible keywords based on your target. These will be added to your selected wordlist(s) and used to help discover more content. Default: true

​
Capabilities

Fuzzer is a comprehensive content discovery scanner equipped with the following capabilities:

​
Limitations

There are currently no limitations reported for SPIDER X Fuzzer.

​
Best Practices

We recommend you to follow the best practices that we’ve outlined in detail.