Pfuzz, a web fuzzer following the Unix philosophy
I recently dipped my toes into bug bounty hunting and finding security flaws in web applications. As a friend of UNIX shells I was building a repertoire of command line tools to make and analyze HTTP requests. Fortunately there are already many suitable tools like curl, jq, different fuzzers and some really nice tools for specific tasks by Tom Hudson [1]. However, I disliked that the existing fuzzers were monoliths where I had no easy way of creating custom behavior or analyses. They commonly do a multitude of things: Create multiple requests using one or more wordlist, sending the request,…
Pfuzz, a web fuzzer following the Unix philosophy launched on January 21, 2024 with 93 votes, #687 of 4,437 launches that month and more than 90% of that year's launches. The site was still online in September 2026, 2 years on.
In plain words
Pfuzz is a web fuzzer designed for security testing that follows Unix philosophy principles. It breaks down fuzzing into modular components that users can combine and customize using standard Unix tools and shell commands, rather than offering a monolithic application with fixed features. The tool is intended for security researchers and bug bounty hunters who want flexibility in creating HTTP requests, applying custom filters, and analyzing responses without being constrained by pre-built functionality.
written from the facts on this page · September 2026
From the sources
A web fuzzer using the httpipe format. Contribute to codesoap/pfuzz development by creating an account on GitHub.
In the maker’s words, at launch
I recently dipped my toes into bug bounty hunting and finding security flaws in web applications. As a friend of UNIX shells I was building a repertoire of command line tools to make and analyze HTTP requests. Fortunately there are already many suitable tools like curl, jq, different fuzzers and some really nice…
Does a similar job
all alternatives →
PyFuzz2 – A little fuzzing framework in Python2015 · github.com · ▲42My little fuzzing framework inspired by grinder. Contribute to susperius/PyFuzz2 development by creating an account on GitHub.
OpenAPI fuzzer – fuzzing APIs based on OpenAPI specification2021 · github.com · ▲76Black-box fuzzer that fuzzes APIs based on OpenAPI specification. Find bugs for free! - matusf/openapi-fuzzer
The HTTP Garden – A Parser Vulnerability Research Tool2024 · github.com · ▲75I wrote this tool during an internship at Narf Industries in 2023. It's a REPL that allows for quickly developing, testing, and fuzzing for HTTP request smuggling attack payloads. I started the internship having never worked with web servers, and have now found over 100 HTTP implementation bugs. I attribute this mostly to the ease of experimentation in the Garden. REPL-oriented fuzzing is just a really good interface for finding parsing bugs. It's pretty neat to able to run a differential fuzzer, categorize and display all the discovered discrepancies, then let a human pick through them and…
Shite – little hot-reloadin' static site maker from shell2023 · github.com · ▲141Or more precisely, my little site maker... It is a personal tool that I thoroughly enjoyed making, and enjoy using to write my website . A caveat before any more; nobody was supposed to promote this insanity. Like, terrible things have been done involving inotify and xdotool. But. It showed up on HN some months ago. That too while it was still, shall we say, fermenting. It got "done" some time thence, and of course one could not let the half-past just be. So here we are, for better or worse. Thank you HN mods for helping me repost! _\\// The README explains all, animated GIFs and…
uFuzzy.js – A tiny, efficient fuzzy search that doesn't suck2022 · github.com · ▲251Hello HN! I became frustrated with the unpredictible/poor match quality and opaqueness of "relevance scores" in existing fuzzy and fulltext search libs, so I tried something different and this is the result. The main selling point is the result quality / ordering, with best-in-class memory overhead and excellent performance being bonuses. The API is pretty stable at this point, but looking for feedback before committing to 1.0. TL;DR The test corpus is a 4MB json file with 162k words/phrases, so give it a second for initial download. You can also drag/drop your own…
`fzf` * `Git` done right2020 · github.com · ▲251interactive `git` with the help of `fzf`. Contribute to bigH/git-fuzzy development by creating an account on GitHub.
More work this month
the category →
Endless lofi beats composed live in your browser, over pixel-art nights in Paris, Tokyo, New York, Hong Kong, Sydney, San Francisco and more. Free, no sign-up.
Work · 26d ago · loficities.com
Smooth Recorder▲257Mac screen recordings that look edited when you hit stop
Work · 20d ago · smoothrecorder.com
Work · 14d ago · readrare.com
Source: Show HN post ↗ · launch text quoted in part
Launched alongside, January 2024
the whole month →
Amie▲1,334Turn meeting notes into automated workflows. Handle meetings, summaries, todos and emails (soon) with your AI personal assistant.
Work · 2024 · amie.so
- IM
Sit in Shade - Discover the optimal seat to stay in the shade during your journey. Sit In Shade provides real-time sun exposure data and route visualization.
Life & fun · 2024 · sitinshade.com
