Fuzzmap is a simple and fast command-line web fuzzing tool written in Go. It allows you to discover hidden directories, files, and endpoints on a target web server using a specified wordlist and concurrent threads.
- Concurrent Fuzzing: Utilizes a worker pool pattern with Go channels and wait groups for fast multithreaded scanning.
- Configurable Threads: Easily adjust the number of parallel workers using
-tflag. - Color-Coded Terminal Output: Highlights status codes and finding using distinct colors via
fatih/color. - Flexible URL Fuzzing: Custom target targeting mechanism via the
FUZZkeyword replacement. - Simple Command-Line interface: Straightforward argument parsing using the standard
flaglibrary.
- Clone the repository.
git clone https://github.com/wreakdev/fuzzmap
cd fuzzmap- Build the binary.
make all install cleanThe binary will be installed to ~/.local/bin/fuzzmap. Ensure that this directory is in your system PATH.
fuzzmapp -u https://example.com/FUZZ -w wordlist.txt -t 50| Flag | Description | Default |
|---|---|---|
-u |
Target Domain (ex. https://example.com/FUZZ) | None |
-w |
Path to the wordlist | wordlist.txt |
-t |
Number of concurrent threads | 50 |
- Go (version 1.18 or higher recommended)
This tool is created for educational purposes and authorized security testing only. The author is not responsible for any misuse of this software. Always ensure you have permission to test the target domain before running this tool.
Contributions are welcome! If you'd like to help improve fuzzmap, please read the CONTRIBUTING.md file to understand how to get started, report bugs, or submit your own pull requests.