Wfuzz Integration with DefectDojo
Wfuzz is an open-source web application fuzzer written in Python that facilitates security assessments by replacing FUZZ keywords with values from customizable payloads to inject test data into any HTTP request field including parameters, authentication headers, forms, directories, files, and cookies to identify vulnerabilities in web applications. The modular framework supports plugin-based vulnerability scanning with flexible payload sources including wordlists, ranges, and custom data generators, integrating seamlessly into penetration testing workflows to help security professionals discover and exploit web application vulnerabilities including SQL injection, XSS, directory traversal, and authentication weaknesses throughout security assessments.
Data Granularity: What Gets Imported
The following fields are captured from Wfuzz results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "Wfuzz",
"engagement": "<engagement-id>",
"file": "results.json"
}