Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 15, 2026

Fuzzing

Rotate path brute forcing across a host list

Directory and file brute forcing across many hosts.

Agent
Brute force a whole scope at onceEvade WAF rate limitsConfirm real hits

overview

What crithit does

crithit takes a --target-list and a required --word-list, then tests each path across the full host set before advancing. Hits write as file and folder output for a later prober or scanner.

Use it when a WAF would ban a single-host wordlist hammer and you need breadth across an estate. --proxy rotates egress; --verify rechecks successes through different proxies.

Versus ffuf or feroxbuster, crithit skips deep recursion on one origin. You trade per-host depth for lower request rates that many WAFs never trip.

source github.com/codingo/crithit

use cases

Where crithit fits

Brute force a whole scope at once

Test each wordlist item across every host in --target-list, so content discovery covers an estate in one pass instead of host by host.

Evade WAF rate limits

Spread requests across many hosts and rotate through a --proxy list so no single target sees enough traffic to trigger a low-limit firewall ban.

Confirm real hits

Use --verify to recheck successful results through different proxies and separate genuine findings from rate-limit responses.

Tune which responses count

Set --statuscodes or --statuscodesblacklist so only the responses you care about are reported, cutting noise on large runs.

reference

crithit inputs and flags

15 inputs
NameTypeFlagDescription
target-listFILE--target-listA file containing the list of targets to brute force across.
word-listFILE--word-listRequired wordlist of paths to test against every host.
targetSTRING--targetThe target URL for a single-host run.
statuscodesSTRING--statuscodesPositive status codes that count as hits (default includes 200, 301, 302, 401, 403).
proxyFILE--proxyA file of proxies (IP:port) to rotate through.
verifySTRING--verifyVerify successful results with different proxies.
threadsSTRING--threadsNumber of threads to use (default 4).
signaturesFILE--signaturesFile of signatures to look out for across top-level domains.

Showing key inputs. crithit exposes 15 inputs in total.

Full flag reference (15 inputs)
NameTypeFlagDescription
proxyFILE--proxyA file containing list of proxy names and port [IP:port].
targetSTRING--targetThe target URL.
verifySTRING--verifyVerify successful results with different proxies.
threadsSTRING--threadsNumber of threads to use (default: 4).
verboseBOOLEAN--verboseBe verbose with output.
read-forSTRING--read-forWait N seconds to receive data from server (default: 10).
wait-forSTRING--wait-forWait N seconds to connect/send data to server (default: 5).
word-listFILE--word-list(required) A filename containing list of words to use.
exceptionsFILE--exceptionsFile containing words.
signaturesFILE--signaturesFile containing list of signatures to look out for in top-level domains.
max-socketsSTRING--max-socketsNumber of sockets to use.
statuscodesSTRING--statuscodesPositive status codes (will be overwritten with statuscodesblacklist if set) (default: 200,204,301,302,307,401,403,408).
target-listFILE--target-listA file containing the list of targets.
randomize-agentBOOLEAN--randomize-agentUse random user agents for requests.
statuscodesblacklistSTRING--statuscodesblacklistNegative status codes (will override statuscodes if set).

example

Run crithit

crithit · command
# rotate one path across many hosts to dodge WAF limitscrithit --target-list hosts.txt --word-list paths.txt --threads 8 --statuscodes 200,204,301,302,401,403 --randomize-agent
sample output
https://www.example.com/admin -> 401https://api.example.com/admin -> 403https://staging.example.com/backup -> 200https://app.example.com/.env -> 200https://cdn.example.com/server-status -> 403https://dev.example.com/console -> 302https://198.51.100.10/login -> 200https://203.0.113.25/.git/HEAD -> 200

guidance

Choosing crithit

Use crithit when content discovery must cover many hosts and a single-target fuzzer would trip WAF limits. For recursive discovery on one host with rich filtering, prefer ffuf or feroxbuster.

ffuf

Single-target FUZZ engine with rich response filtering. crithit spreads across hosts instead.

feroxbuster

Recursive content discovery against one host. crithit favors breadth and WAF-safe rotation.

gobuster

Simple per-host directory brute forcing without cross-host rotation.

faq

crithit questions

It tests one --word-list item across every host in --target-list before moving to the next path, so no single target sees a dense burst.

related

More Fuzzing tools

  1. ffuf

    A fast web fuzzer written in Go.

  2. paramspider

    Passive archive miner for parameterized URLs on a domain.

  3. shortscan

    Enumerate IIS 8.3 short filenames to recover hidden paths.

  4. ffuf-virtual-hosts

    Host-header fuzzing packaged for vhost discovery.

  5. medusa

    Recursive HTTP directory and file fuzzer.

  6. x8

    Hidden parameter discovery by response comparison.

Run crithit yourself

A host list and a wordlist feed CritHit, which spreads each path across every host to dodge WAF limits and writes the discovered paths as a queryable output.

Run crithit in TrickestBrowse the library

Facts on this page come from the live Trickest tool library.