ffuf

Fast web fuzzer for content discovery and parameter fuzzing

Methods12 commands

#fuzzing#bruteforce#discovery#enumeration

Installation

1Install using Go

2Download wordlists

3Verify installation

# Using Go
go install github.com/ffuf/ffuf/v2@latest

# Download SecLists
git clone https://github.com/danielmiessler/SecLists.git

# Verify
ffuf -V

Basic Usage

Fuzz web endpoints for directories, files, and parameters

# Directory bruteforce
ffuf -u https://example.com/FUZZ -w wordlist.txt

# File extension fuzzing
ffuf -u https://example.com/FUZZ -w files.txt -e .php,.html,.js

# Parameter fuzzing
ffuf -u "https://example.com/api?FUZZ=test" -w params.txt

# POST data fuzzing
ffuf -u https://example.com/login -X POST -d "user=admin&pass=FUZZ" -w passwords.txt

# Subdomain fuzzing
ffuf -u https://FUZZ.example.com -w subdomains.txt

Command Reference

1Target URL with FUZZ keyword

-u

2Wordlist path

-w

3Extensions to append

-e

4HTTP method

-X

5POST data

-d

6HTTP header

-H

7Match status codes

-mc

8Filter status codes

-fc

9Filter response size

-fs

10Number of threads

-t

11Requests per second

-rate

12Output file

-o

When to Use

Content discovery

Finding hidden endpoints

Parameter bruteforcing

Virtual host discovery

API endpoint enumeration

Notes & Tips

Use -fc to filter unwanted responses

Calibrate with -ac for auto-calibration

Use SecLists for comprehensive wordlists

Rate limit to avoid detection

Common Errors & Solutions

Too many results

Use -fc to filter status codes or -fs to filter sizes

Blocked by WAF

Reduce rate with -rate flag, use -H for custom headers

# Directory bruteforce ffuf -u https://example.com/FUZZ -w wordlist.txt # File extension fuzzing ffuf -u https://example.com/FUZZ -w files.txt -e .php,.html,.js # Parameter fuzzing ffuf -u "https://example.com/api?FUZZ=test" -w params.txt # POST data fuzzing ffuf -u https://example.com/login -X POST -d "user=admin&pass=FUZZ" -w passwords.txt # Subdomain fuzzing ffuf -u https://FUZZ.example.com -w subdomains.txt