ffuf

OVERVIEW

ffuf (Fuzz Faster U Fool) is a Go-based web fuzzer built around a single FUZZ keyword: drop it into the URL, a header, or the POST body and ffuf substitutes each line of a wordlist in its place, reporting response size, status code, word count, and timing for every request. It's fast enough to run large wordlists in minutes and flexible enough to cover directory/file discovery, parameter fuzzing, and virtual-host discovery from the same binary.

Its real strength is the filtering layer: matching or excluding by status code, response size, word count, line count, or regex lets you cut through noisy default pages and isolate the handful of responses that actually differ, which is what makes large-scale fuzzing usable instead of a wall of 200s.

USE CASES

Practical use cases

• 01

  Brute-forcing directories and files on a web application with a curated wordlist.

• 02

  Fuzzing GET/POST parameters to find hidden functionality or injection points.

• 03

  Discovering virtual hosts by fuzzing the Host header against a base IP.

• 04

  Chaining multiple wordlists (e.g. clusterbomb mode) to fuzz several positions at once.

QUICK START

When you need to brute-force directories, files, parameters, or Host headers fast, with full control over wordlists and filters.

1. Confirm the target host and paths are inside the agreed scope.
2. Pick a wordlist sized to the engagement window (e.g. SecLists common.txt for a quick pass).
3. Run a baseline request first to see the app's default 404 response size/behavior.
4. Fuzz the target path with FUZZ, filtering out the baseline response size.
5. Review hits manually before treating any of them as a real finding.

ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt:FUZZ -u https://target.example.com/FUZZ -fs 4242

BEFORE YOU RUN IT

What to check before running it