loading
Loading content
loading
Fuzzing
Directory and file brute forcing across many hosts.
overview
crithit takes a --target-list and a required --word-list, then tests each path across the full host set before advancing. Hits write as file and folder output for a later prober or scanner.
Use it when a WAF would ban a single-host wordlist hammer and you need breadth across an estate. --proxy rotates egress; --verify rechecks successes through different proxies.
Versus ffuf or feroxbuster, crithit skips deep recursion on one origin. You trade per-host depth for lower request rates that many WAFs never trip.
source github.com/codingo/crithit
use cases
Test each wordlist item across every host in --target-list, so content discovery covers an estate in one pass instead of host by host.
Spread requests across many hosts and rotate through a --proxy list so no single target sees enough traffic to trigger a low-limit firewall ban.
Use --verify to recheck successful results through different proxies and separate genuine findings from rate-limit responses.
Set --statuscodes or --statuscodesblacklist so only the responses you care about are reported, cutting noise on large runs.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| target-list | FILE | --target-list | A file containing the list of targets to brute force across. |
| word-list | FILE | --word-list | Required wordlist of paths to test against every host. |
| target | STRING | --target | The target URL for a single-host run. |
| statuscodes | STRING | --statuscodes | Positive status codes that count as hits (default includes 200, 301, 302, 401, 403). |
| proxy | FILE | --proxy | A file of proxies (IP:port) to rotate through. |
| verify | STRING | --verify | Verify successful results with different proxies. |
| threads | STRING | --threads | Number of threads to use (default 4). |
| signatures | FILE | --signatures | File of signatures to look out for across top-level domains. |
Showing key inputs. crithit exposes 15 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| proxy | FILE | --proxy | A file containing list of proxy names and port [IP:port]. |
| target | STRING | --target | The target URL. |
| verify | STRING | --verify | Verify successful results with different proxies. |
| threads | STRING | --threads | Number of threads to use (default: 4). |
| verbose | BOOLEAN | --verbose | Be verbose with output. |
| read-for | STRING | --read-for | Wait N seconds to receive data from server (default: 10). |
| wait-for | STRING | --wait-for | Wait N seconds to connect/send data to server (default: 5). |
| word-list | FILE | --word-list | (required) A filename containing list of words to use. |
| exceptions | FILE | --exceptions | File containing words. |
| signatures | FILE | --signatures | File containing list of signatures to look out for in top-level domains. |
| max-sockets | STRING | --max-sockets | Number of sockets to use. |
| statuscodes | STRING | --statuscodes | Positive status codes (will be overwritten with statuscodesblacklist if set) (default: 200,204,301,302,307,401,403,408). |
| target-list | FILE | --target-list | A file containing the list of targets. |
| randomize-agent | BOOLEAN | --randomize-agent | Use random user agents for requests. |
| statuscodesblacklist | STRING | --statuscodesblacklist | Negative status codes (will override statuscodes if set). |
example
# rotate one path across many hosts to dodge WAF limitscrithit --target-list hosts.txt --word-list paths.txt --threads 8 --statuscodes 200,204,301,302,401,403 --randomize-agenthttps://www.example.com/admin -> 401https://api.example.com/admin -> 403https://staging.example.com/backup -> 200https://app.example.com/.env -> 200https://cdn.example.com/server-status -> 403https://dev.example.com/console -> 302https://198.51.100.10/login -> 200https://203.0.113.25/.git/HEAD -> 200guidance
Use crithit when content discovery must cover many hosts and a single-target fuzzer would trip WAF limits. For recursive discovery on one host with rich filtering, prefer ffuf or feroxbuster.
Single-target FUZZ engine with rich response filtering. crithit spreads across hosts instead.
Recursive content discovery against one host. crithit favors breadth and WAF-safe rotation.
Simple per-host directory brute forcing without cross-host rotation.
faq
related
A fast web fuzzer written in Go.
Passive archive miner for parameterized URLs on a domain.
Enumerate IIS 8.3 short filenames to recover hidden paths.
ffuf looped over a URL list in one node.
Folder-output ffuf for a single target.
Host-header fuzzing packaged for vhost discovery.
A host list and a wordlist feed CritHit, which spreads each path across every host to dodge WAF limits and writes the discovered paths as a queryable output.
Facts on this page come from the live Trickest tool library.