Fuzzy

Fuzzy is a concurrent web-content fuzzer written in Gleam using BEAM processes.

It reads entries from a provided wordlist, inserts each entry into a target URL, sends concurrent HTTP requests, and prints responses matching the provided status codes.

Warning

Only use Fuzzy against systems you own or have permission to test.

Features

Concurrent HTTP requests using BEAM processes
Configurable concurrency and request timeout
Status-code filtering

Requirements

Fuzzy currently targets only Erlang and has been tested with Gleam 1.17

Installation

Clone the repository:

git clone https://github.com/MasMariusD/fuzzy.git
cd fuzzy

Run it directly with Gleam:

gleam run -- --help

Alternatively, build a standalone single-file Erlang escript:

gleam export escript 
./fuzzy --help

The escript still requires Erlang to be installed.

Usage

./fuzzy \
    --target=<URL> \
    --wordlist=<PATH> \
    [--status=<CODES>] \
    [--concurrency=<NUMBER>] \
    [--timeout=<MILLISECONDS>]

Example against a locally hosted application:

./fuzzy \
    --target=http://localhost:8080/pages/FZY \
    --wordlist=common.txt \
    --status=200,301,302,401,403 \
    --concurrency=50 \
    --timeout=3000

Target Placeholder

Use FZY in the target URL to control where each wordlist entry is inserted:

http://localhost:8080/api/FZY/details

If the target does not contain FZY, Fuzzy appends /FZY to the target URL automatically.

http://localhost:8080

becomes:

http://localhost:8080/FZY

Options

Option	Required	Default	Description
--target	Yes	-	The target URI. Use FZY as the wordlist placeholder
--wordlist	Yes	-	Path to a newline-separated wordlist
--status	No	All	Comma-separated status response codes to print
--concurrency	No	50	Number of concurrent requests
--timeout	No	3000	Request timeout in milliseconds
--help	No	-	Display command help

Wordlists

Fuzzy accepts any text file containing one entry per line. Empty lines are ignored.

The repository includes the common.txt wordlist from the SecLists project. See THIRD_PARTY_NOTICES.md.

Current limitations

Fuzzy 0.1.0 is still an early release. It currently:

Sends GET requests only
Filters results purely by HTTP status codes
Does not support custom headers or authentication
Does not perform recursive discovery

These features are planned as future expansions.

License

Fuzzy is available under the MIT license.