RustFuzz

High-performance web fuzzer written in Rust

Discover hidden files, directories, and vulnerabilities with blazing speed

✨ Latest Release: v3.3 with enhanced proxy support and improved diagnostics

Download Now View Documentation

🚀 Powerful Features

⚡

High Performance

Async/multithreaded engine for maximum speed. Built with Rust for optimal performance and memory safety.

🌐

URL & Directory Fuzzing

Quickly identify hidden endpoints, files, and directories on web servers with customizable wordlists.

🧰

Flexible & Customizable

Support for custom headers, cookies, authentication tokens, proxy settings, and configuration files.

🔒

Modern Security Workflows

Designed for both bug bounty hunters and blue teams with advanced analysis and export capabilities.

🕷️

Smart Crawling

Intelligent crawler to discover more endpoints automatically with depth control and domain restrictions.

📊

Results Analysis

Export results in JSON/CSV format and analyze findings with beautiful reporting and statistics.

📖 Documentation

📦 Installation & Setup

🚀 Quick Download (Recommended)

Download pre-built binaries for instant use:

  • Linux: rustfuzz-3.3-linux
  • Windows: rustfuzz-3.3-win.exe
  • RPM: rustfuzz-3.3.0-1.x86_64.rpm
  • DEB: rustfuzz_3.3.0-1_amd64.deb
# Download latest release
wget https://github.com/martian56/rustfuzz/releases/download/v3.3/rustfuzz-3.3-linux
chmod +x rustfuzz-3.3-linux
./rustfuzz-3.3-linux --help

# Or install via package manager
# Ubuntu/Debian:
sudo dpkg -i rustfuzz_3.3.0-1_amd64.deb

# RHEL/CentOS/Fedora:
sudo rpm -i rustfuzz-3.3.0-1.x86_64.rpm

🔨 Build from Source

For development or custom builds:

  • Rust 1.70+ installed
  • Cargo package manager
  • Git for cloning repository
# Install Rust (if not already installed)
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

# Clone and build RustFuzz
git clone https://github.com/martian56/rustfuzz.git
cd rustfuzz
cargo build --release

# Binary will be at ./target/release/rustfuzz

✨ Latest Release - v3.3

🚀 What's New in v3.3

  • Enhanced Proxy Support: Full HTTP, HTTPS, and SOCKS5 support
  • Better Error Handling: Clearer error messages and diagnostics
  • Config Flexibility: Improved TOML parsing and CLI overrides
  • Bug Fixes: Fixed proxy configuration and endpoint display issues
  • Code Quality: Refactored URL construction and matcher logic
# New proxy support examples
proxy = "http://127.0.0.1:8080"
proxy = "socks5://proxy.example.com:1080"

# Enhanced error diagnostics
./rustfuzz -u https://target.com \
  -w wordlist.txt \
  --proxy socks5://proxy:1080

🚀 Quick Start Guide

Basic Directory Fuzzing

Start with a simple directory discovery:

./rustfuzz -u https://target.com/FUZZ \
  -w wordlists/common.txt \
  -t 20

With Configuration File

Use TOML config for complex setups:

./rustfuzz --config config.toml

Command Line Override

Override config values:

./rustfuzz --config config.toml \
  -u https://new-target.com

⚙️ Configuration Options

Core Settings

  • url: Target URL to fuzz
  • wordlist: Path to wordlist file
  • threads: Concurrent threads (default: 40)
  • timeout: Request timeout in seconds
  • matcher: Status codes to match
# Basic configuration
url = "https://example.com"
wordlist = "wordlists/common.txt"
threads = 40
timeout = 15
matcher = "200,301,302,405,500"

Authentication & Headers

  • headers: Custom HTTP headers
  • cookies: Session cookies
  • auth_token: Bearer token authentication
# Authentication setup
headers = [
  ["User-Agent", "RustFuzz/3.3"],
  ["X-API-Key", "your-api-key"],
  ["Accept", "application/json"]
]

cookies = [
  ["session", "Session_Key"],
  ["auth", "token"]
]

auth_token = "eyJhbGciOi..."

🔧 Advanced Features

Proxy & Rate Limiting

  • HTTP/HTTPS: Standard web proxies
  • SOCKS5: SOCKS5 proxy support
  • Burp Suite: Integration ready
  • Rate Limiting: Control request speed
# Proxy configuration
proxy = "http://127.0.0.1:8080"
proxy = "socks5://proxy.example.com:1080"

# Rate limiting (milliseconds)
rate_limit = 100

Smart Discovery

  • Crawling: Automatic endpoint discovery
  • Mutation: Dynamic payload generation
  • OpenAPI: Parse API specifications
  • Payloads: Custom injection payloads
# Enable smart crawling
crawl = true

# Mutation-based fuzzing
mutate = true

# Custom payloads
payloads = "payloads/xss.txt"

# OpenAPI parsing
openapi = "https://api.example.com/openapi.json"

📊 Results & Analysis

Export Formats

  • JSON: Structured data export
  • CSV: Spreadsheet compatibility
  • Analysis: Beautiful result summaries
# Export results
export = "results/output.json"
export = "results/output.csv"

# Analyze exported results
./rustfuzz --analyze results.json

🎯 Practical Examples

Bug Bounty Hunting

Comprehensive target reconnaissance:

# Full reconnaissance scan
./rustfuzz --config bounty.toml \
  --crawl \
  --mutate \
  --export results.json

API Testing

Fuzz REST API endpoints:

# API endpoint fuzzing
./rustfuzz -u https://api.example.com/v1/FUZZ \
  -w wordlists/api-endpoints.txt \
  --header "Authorization: Bearer token" \
  --matcher "200,201,400,401,403"

Penetration Testing

Professional security assessment:

# Professional pentest setup
./rustfuzz --config pentest.toml \
  --proxy http://127.0.0.1:8080 \
  --rate-limit 50 \
  --export pentest-results.json

Asset Discovery

Map web application structure:

# Asset discovery
./rustfuzz -u https://target.com \
  --crawl \
  -w wordlists/directories.txt \
  --matcher "200,301,302" \
  --export assets.json

📋 Command Line Reference

Basic Options

  • -u, --url Target URL
  • -w, --wordlist Wordlist file
  • -t, --threads Thread count
  • -T, --timeout Request timeout
  • -m, --matcher Status codes

Advanced Options

  • --config Configuration file
  • --proxy Proxy server
  • --crawl Enable crawling
  • --mutate Mutation fuzzing
  • --export Export results
  • --analyze Analyze results