ffuf (Fuzz Faster U Fool) is a high-speed web fuzzer written in Go. It has become the tool of choice for directory discovery, parameter fuzzing, virtual host enumeration, and virtually any task that involves injecting a payload into an HTTP request and analyzing the response. Its speed, flexibility, and powerful filtering system make it indispensable during the reconnaissance phase of web application assessments.
This guide covers twenty practical ffuf commands, explaining what each does and when to reach for it during a security assessment.
1. Basic Directory Discovery
ffuf -u https://example.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt
The -u flag sets the target URL with the FUZZ keyword marking the injection point. The -w flag points to the wordlist. This is the foundational ffuf command, replacing each FUZZ occurrence with entries from the wordlist to discover hidden directories and files.
2. File Extension Fuzzing
ffuf -u https://example.com/FUZZ -w wordlist.txt -e .php,.bak,.old,.txt,.zip
The -e flag appends extensions to every wordlist entry. Directories reveal structure; files reveal data. Backup files, old configuration files, and source code archives are frequently exposed with predictable naming patterns.
3. Match Specific Status Codes
ffuf -u https://example.com/FUZZ -w wordlist.txt -mc 200,301,302,403
The -mc flag defines which HTTP status codes count as valid findings. By default ffuf matches 200, 204, 301, 302, 307, 401, and 403. Customizing this helps focus on specific response types.
4. Filter Out Status Codes
ffuf -u https://example.com/FUZZ -w wordlist.txt -fc 404,403
The -fc flag excludes specified status codes. When a server returns 403 for everything, filtering that code removes noise and surfaces genuine findings.
5. Filter by Response Size
ffuf -u https://example.com/FUZZ -w wordlist.txt -fs 1234
The -fs flag filters responses by content length. When a server returns the same generic page for all invalid paths, filtering its size eliminates false positives. This is one of the most effective filtering techniques.
6. Auto-Calibration
ffuf -u https://example.com/FUZZ -w wordlist.txt -ac
The -ac flag automatically calibrates filtering options by sending random requests and learning what a "not found" response looks like. This is considered non-negotiable by experienced testers because it dramatically reduces false positives on unpredictable applications.
7. Fuzz Host Header for Virtual Hosts
ffuf -u https://example.com -H "Host: FUZZ.example.com" -w subdomains.txt -mc 200
The -H flag adds a custom header. Virtual host discovery finds applications served on the same IP but under different hostnames. This reveals development, staging, and administrative interfaces that are not publicly linked.
8. Fuzz GET Parameters
ffuf -u "https://example.com/api?FUZZ=test" -w params.txt
Place FUZZ in the parameter name position to discover hidden parameters that the application accepts but does not document. This is a common finding in modern web applications where legacy parameters remain active.
9. Fuzz POST Data
ffuf -u https://example.com/login -X POST -d "user=admin&pass=FUZZ" -w passwords.txt
The -X flag sets the HTTP method and -d provides POST body data. This is used for parameter fuzzing in forms, APIs, and authentication endpoints.
10. Fuzz JSON POST Data
ffuf -u https://example.com/api -X POST -H "Content-Type: application/json" -d '{"name": "FUZZ", "key": "value"}' -w wordlist.txt
Fuzzing JSON APIs requires setting the correct Content-Type header and embedding FUZZ within the JSON body. Modern APIs are JSON-first, making this essential for API security testing.
11. Use Raw HTTP Requests
ffuf --request req.txt -w wordlist.txt -ac
The --request flag loads a complete HTTP request from a file. This is the most powerful feature for authenticated testing. Capture a request from Burp Suite, replace the target value with FUZZ, and ffuf replays the entire request including cookies, authentication headers, and CSRF tokens.
12. Multi-Position Fuzzing
ffuf -u https://FUZZ.example.com/FUZZ2 -w subdomains.txt:FUZZ -w paths.txt:FUZZ2 -mode pitchfork
The -w flag supports custom keywords using the wordlist:KEYWORD syntax. The -mode flag controls how multiple wordlists combine: pitchfork iterates them in parallel, clusterbomb tests every combination. This enables complex testing scenarios like fuzzing both subdomain and path simultaneously.
13. Recursive Scanning
ffuf -u https://example.com/FUZZ -w wordlist.txt -recursion -recursion-depth 2
The -recursion flag automatically queues discovered directories for further fuzzing. The -recursion-depth cap prevents runaway scans. When /admin/ is found, recursion explores its contents automatically.
14. Rate Limiting
ffuf -u https://example.com/FUZZ -w wordlist.txt -rate 50 -t 10
The -rate flag limits requests per second and -t controls concurrent threads. Default thread count is 40. Lowering both values reduces load on fragile targets and helps evade rate-limiting systems and WAF detection.
15. Add Delays Between Requests
ffuf -u https://example.com/FUZZ -w wordlist.txt -p 0.5
The -p flag sets a delay in seconds between requests. Accepts a single value or a range like 0.1-2.0 for random delays. This is essential for stealthy scanning against monitored targets.
16. Route Through a Proxy
ffuf -u https://example.com/FUZZ -w wordlist.txt -x http://127.0.0.1:8080
The -x flag routes all traffic through an HTTP or SOCKS5 proxy. Use Burp Suite or OWASP ZAP to inspect, modify, and replay requests in real time. The -replay-proxy flag sends only matched requests to the proxy for focused analysis.
17. Add Cookies for Authenticated Fuzzing
ffuf -u https://example.com/FUZZ -w wordlist.txt -b "sessionid=abc123; token=xyz789"
The -b flag supplies cookie data with every request. Combined with -ac, this enables authenticated content discovery without constructing raw request files.
18. Match Responses by Regex
ffuf -u https://example.com/search?q=FUZZ -w payloads.txt -mr "error|warning|stack trace"
The -mr flag matches responses containing a specific regular expression. Filter by -fr to exclude regex matches. This is useful for vulnerability detection, finding error messages that reveal injection points or information disclosure.
19. Output Results to JSON
ffuf -u https://example.com/FUZZ -w wordlist.txt -o results.json -of json
The -o flag writes output to a file and -of sets the format. Supported formats include JSON, HTML, Markdown, CSV, and eJSON. Structured output integrates with reporting tools and automation pipelines.
20. Silent Mode for Scripting
ffuf -u https://example.com/FUZZ -w wordlist.txt -s | tee results.txt
The -s flag suppresses the banner and progress indicators, showing only results. Piping through tee saves output while displaying it. This pattern is ideal for embedding ffuf in shell scripts and recon pipelines.
Explore More Tools
For a comprehensive collection of hacking tools, cheat sheets, and resources, visit my GitHub repository:
https://github.com/yogsec/Hacking-Tools/
Stay connected for more security content and updates:
Top comments (0)