- WFuzz - Fuzz POST params with file wordlist, colors, and hiding 0-word responses - `wfuzz -c -z file,date-wordlist.txt -d "date=FUZZ" --hw 0 -u http://10.10.62.67/api/site-log.php` - Fuzz subdomains via host header - `wfuzz -c -f sub-fighter -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u 'http://rocket.thm' -H "Host: FUZZ.rocket.thm" --hw 28`