Mastering ffuf — Fuzz Faster U Fool: A Practical Guideffuf (Fuzz Faster U Fool) is a fast, flexible web fuzzer designed for discovering hidden resources, parameters, and vulnerabilities on web applications. Built for speed and simplicity, ffuf is a go-to tool for penetration testers and bug bounty hunters who need a lightweight, scriptable fuzzer that can be integrated into automated workflows. This guide walks through installation, basic usage, advanced techniques, performance tuning, integration with other tools, practical workflows, and tips to get the most out of ffuf.
What is ffuf and when to use it
ffuf is a content discovery and fuzzing tool that submits HTTP requests with fuzzable payloads and analyzes responses to help find interesting endpoints, files, parameters, or behaviors. Use ffuf when you want to:
- Enumerate directories and files on a web server (wordlist-based discovery).
- Fuzz parameters or header values to find hidden functionality or injection points.
- Perform virtual host discovery.
- Test response-based differences (status codes, response lengths, words, line counts, or regex matches).
- Run fast, large-scale checks with configurable concurrency and retries.
ffuf stands out for its performance (written in Go), flexible matching/filtering options, and easy integration in pipelines.
Installation
ffuf is cross-platform and can be installed via prebuilt binaries, package managers, or compiled from source.
- On Linux (using apt on Debian-based):
- Use the latest release binary from the official repository, or install via snap/homebrew where available.
- On macOS:
- brew install ffuf
- From source:
- git clone https://github.com/ffuf/ffuf && go install ./cmd/ffuf@latest
Confirm installation:
ffuf -h Basic usage
The simplest usage pattern is directory brute-forcing:
ffuf -u http://example.com/FUZZ -w /path/to/wordlist.txt Key options explained:
- -u, –url: URL with FUZZ token where payloads are injected.
- -w, –wordlist: Path to wordlist (single file or multiple, comma-separated).
- -c, –concurrency: Number of concurrent threads (default 40).
- -t, –timeout: Request timeout.
- -mc, –match-codes: Match specific HTTP response codes (e.g., 200,301).
- -fc, –filter-codes: Filter out response codes.
- -ml, –match-lines, -mr, –match-regex, -ms, –match-size, -mw, –match-words: Other response-based matching criteria.
- -H, –header: Custom headers.
- -X: HTTP method.
- -v: Verbose.
Example: show only 200 responses
ffuf -u http://example.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -mc 200 Wordlists and payloads
Good wordlists are essential. Popular sources:
- SecLists (common, big, discovery lists).
- Dirbuster, dirb lists for common paths.
- Custom lists derived from target app structure, technology, or leaked directories.
Using multiple wordlists or combining lists helps. ffuf accepts multiple wordlists with the -w flag (comma-separated) and also supports reading from stdin:
cat custom-list.txt | ffuf -u http://example.com/FUZZ -w - For parameter fuzzing:
ffuf -u "http://example.com/search?q=FUZZ" -w params.txt For header fuzzing:
ffuf -u http://example.com/ -H "X-Api-Version: FUZZ" -w versions.txt Matching and filtering strategies
ffuf’s power lies in flexible filters and matches to reduce noise.
Common filters/matches:
- Status codes: -mc (match), -fc (filter)
- Response size: -ms, -fs (filter size)
- Word count: -mw, -fw
- Line count: -ml, -fl
- Regex matching: -mr (match regex), -fr (filter regex)
Example: match responses with length 1234 or containing “Admin”:
ffuf -u http://example.com/FUZZ -w list.txt -ms 1234 -mr "Admin" Use negative filters to remove noisy responses, e.g., filter out 404 and 403:
ffuf -u http://example.com/FUZZ -w list.txt -fc 404,403 Advanced techniques
Virtual host discovery:
ffuf -u http://TARGET/ -H "Host: FUZZ.TARGET" -w vhosts.txt Recursive fuzzing
- ffuf can be scripted to recursively fuzz discovered directories by passing results to subsequent runs. Example workflow:
- Run initial ffuf, save results (-o results.json).
- Parse results for directories.
- Launch ffuf on each discovered directory.
Fuzzing multiple parameters simultaneously:
ffuf -u "http://example.com/page?user=FUZZ&pass=FUZ2Z" -w users.txt:FUZZ,passlist.txt:FUZ2Z Use of encoders and payloads:
- Pre-encode payloads or use external tools to generate encoded entries for testing (URL encoding, Base64).
Throttling and politeness:
- Respect rate limits; use -p (proxy) or -s options as needed, and lower concurrency with -c when testing production systems.
Performance tuning
- Concurrency (-c): Increase for fast targets and powerful clients, decrease when hitting rate limits.
- Timeout (-t): Adjust when target responses are slow.
- Retry logic: Use external wrappers or ffuf’s built-in retry behavior if network instability occurs.
- Keep-Alive: Ensure HTTP keep-alive is used where supported to reduce connection overhead.
Example high-performance run:
ffuf -u http://example.com/FUZZ -w large-list.txt -c 200 -t 5s -mc 200,301 Be mindful: very high concurrency can trigger WAFs, IDS, or cause service outages.
Output formats and automation
ffuf supports multiple output formats suitable for automation:
- JSON (-of json) for structured results.
- CSV (-of csv) for spreadsheets.
- HTML (-of html) for quick human review.
Example saving to JSON:
ffuf -u http://example.com/FUZZ -w list.txt -o results.json -of json Integrate ffuf into CI or bug bounty workflows by:
- Writing small scripts to run ffuf and parse JSON to create issues or alerts.
- Combining with tools like aquatone for screenshotting discovered hosts.
- Feeding results into fuzzing chains (e.g., pass discovered endpoints to gobuster, dirsearch, or custom scanners).
Practical workflows and examples
- Quick discovery baseline
- Run a fast wordlist, filter 404s, and collect results.
ffuf -u http://target/FUZZ -w common.txt -fc 404 -o baseline.json -of json
- Parameter fuzzing for an API endpoint
- Use targeted wordlist for parameter names and values.
ffuf -u "http://api.target/v1/resource?FUZZ=1" -w api_params.txt -mc 200,204
- Virtual host enumeration + screenshot
- Discover vhosts, then screenshot interesting ones.
ffuf -u http://target/ -H "Host: FUZZ.target" -w vhosts.txt -mc 200 -o vhosts.json -of json
- Recursive discovery script (pseudo)
- Run initial ffuf -> parse directories -> spawn ffuf on each directory with the same wordlist.
Common pitfalls and mitigation
- False positives: Differences in response size or status codes may not indicate real content. Manually verify interesting hits.
- WAF/IPS blocking: Use lower concurrency, randomize headers, or slow down scans.
- Rate-limiting and legal concerns: Always have authorization before fuzzing. Respect robots.txt where appropriate and agree scope with stakeholders.
- Large wordlists: Chunk lists or run staged scans to avoid overload.
Useful tips and tricks
- Use golden wordlists: curate lists specific to the application’s language/framework (e.g., paths from PHP apps vs. Node.js).
- Combine filters to reduce noise (e.g., filter 404, 302 and match length differences).
- Leverage -recursion via scripting for deeper discovery.
- Keep payloads realistic — include common file extensions and casing variations.
- Use HTTP/2 support and proxying (-p) when necessary to inspect traffic.
Example ffuf command bank (copy-paste)
Directory discovery:
ffuf -u https://target.com/FUZZ -w /path/to/seclists/Discovery/Web-Content/common.txt -mc 200 -c -t 50 -o dirs.json -of json Parameter fuzzing:
ffuf -u "https://target.com/search?q=FUZZ" -w param-names.txt -mr "results found" -c Virtual host fuzzing:
ffuf -u https://target/ -H "Host: FUZZ.target" -w vhosts.txt -mc 200 -c 100 Header fuzzing:
ffuf -u https://target/ -H "X-Api-Version: FUZZ" -w api-versions.txt -mc 200 Further resources
- Official ffuf GitHub repository for releases, documentation, and examples.
- SecLists for comprehensive wordlists.
- Community write-ups and bug-bounty reports that demonstrate real-world use.
Mastering ffuf is about combining good wordlists, smart matching/filters, performance tuning, and integrating discovery results into verification workflows. With practice and careful tuning, ffuf can dramatically speed up content discovery and fuzzing tasks while remaining lightweight and scriptable.
Leave a Reply