Vhost & Parameter Fuzzing with Wfuzz

Uses Wfuzz for virtual host discovery (FUZZ in the Host header) and parameter fuzzing (FUZZ in the query string), hiding noise responses by character count with --hh.

Use wfuzz to brute-force virtual hosts via the Host header and to discover hidden GET parameters.

Steps

• For vhosts, place FUZZ in the Host: header with a DNS wordlist; hide the default response by character count using --hh.
• For parameter discovery, place FUZZ in the query string (e.g. ?FUZZ=) with a parameter-names wordlist.
• Pass authenticated session cookies with -H "Cookie: ..." when needed.