Loading...
Master FFUF for directory bruteforcing, parameter fuzzing, subdomain discovery, and more.
Commands will automatically replace example.com with your target domain
apt install ffufgo install github.com/ffuf/ffuf@latestffuf -u https://example.com/FUZZ -w wordlist.txtffuf -w wordlist.txt -u https://example.com/FUZZ -X POSTffuf -u https://example.com/FUZZ -w wordlist.txt -ic -cffuf -u https://example.com/indexFUZZ -w wordlist.txt -e .php,.asp,.bak,.dbffuf -u https://example.com/FUZZ -w wordlist.txt -recursion -recursion-depth 3ffuf -w wordlist.txt -u https://example.com/FUZZ -fc 404,500ffuf -u https://example.com/W2/W1/ -w dict.txt:W1 -w dns_dict.txt:W2ffuf -w subdomains.txt -u https://FUZZ.example.com/ffuf -w vhosts.txt -u https://example.com/ -H "Host: FUZZ.example.com"ffuf -w wordlist.txt -u https://example.com/page.php?FUZZ=valueffuf -w wordlist.txt -u https://example.com/api -X POST -d 'FUZZ=value'ffuf -w passwordlist.txt -X POST -d "username=admin&password=FUZZ" -u https://example.com/loginffuf -w wordlist.txt -X PUT -u https://example.com/FUZZ -b 'session=abcdef'ffuf -w users.txt:USER -w passwords.txt:PASS -u https://example.com/login?username=USER&password=PASS -mode clusterbombffuf -request req.txt -request-proto http -mode clusterbomb -w usernames.txt:HFUZZ -w passwords.txt:WFUZZffuf -w users.txt:USER -w passwords.txt:PASS -u https://example.com/login?username=USER&password=PASS -mode pitchforkffuf -b "SESSIONID=abcd1234; USER=admin" -w wordlist.txt -u https://example.com/FUZZffuf -x http://127.0.0.1:8080 -w wordlist.txt -u https://example.com/FUZZffuf -w headers.txt -u https://example.com/ -H "X-Custom-Header: FUZZ"ffuf -u "https://example.com/FUZZ" -w wordlist.txt -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)"ffuf -w wordlist.txt -u https://example.com/FUZZ -rate 50 -t 50ffuf -w wordlist.txt -u https://example.com/FUZZ -o results.html -of htmlffuf -w wordlist.txt -u https://example.com/FUZZ -o results.json -of jsonffuf -w wordlist.txt -u https://example.com/FUZZ -o results.csv -of csvffuf -w wordlist.txt -u https://example.com/FUZZ -o results -of allFUZZ = Placeholder for wordlist value-w = Wordlist file path-u = Target URL-X = HTTP method (GET, POST, PUT, etc.)-H = Custom header-fc = Filter status codes (exclude)-fs = Filter by size (exclude)-b = Cookie data-o = Output file-x = Proxy URL