Wfuzz

Wfuzz replaces any part of a request — path, parameters, headers, cookies — with values from a wordlist and analyses the responses, making it a versatile tool for content discovery and for testing how inputs are handled.

Response data (codes, sizes, timing) for each tested value, with filtering that isolates the requests worth investigating from the routine ones.

Because it can fuzz anywhere in a request, it reveals input-handling quirks and hidden parameters that shape your real attack surface, feeding directly into deeper testing.