ffuf

Directory fuzzing

$ ffuf -u [https://target.com/FUZZ] -w [wordlist.txt]

$ ffuf -u [https://target.com/api] -w [wordlist.txt] -X POST -d "param=FUZZ"

$ ffuf -u [https://target.com/FUZZ] -w [wordlist.txt] -fc [404]

$ ffuf -u [https://target.com/FUZZ] -w [wordlist.txt] -ms [1234]

$ ffuf -u [https://target.com/FUZZ1/FUZZ2] -w [list1.txt]:FUZZ1 -w [list2.txt]:FUZZ2

ffuf [options]

ffuf (Fuzz Faster U Fool) is a fast web fuzzer written in Go. It discovers hidden content, parameters, and vulnerabilities by sending requests with wordlist entries substituted at marked positions.
The tool excels at content discovery, parameter fuzzing, and virtual host enumeration. Filtering options allow matching or excluding responses by status, size, words, or lines.
ffuf's speed and flexibility make it popular for penetration testing and security assessments.

-u URL

Target URL with FUZZ keyword.

Wordlist file.

HTTP method.

POST data.

Custom header.

Filter by status code.

Filter by response size.

Match status codes.

Match response size.

Number of threads.

Display help information.

Only use against authorized targets. High thread counts may overwhelm servers. Results need manual verification.

ffuf was created by joohoi as a fast, flexible web fuzzer. Written in Go for performance, it has become a standard tool in web application security testing.

gobuster(1), dirb(1), wfuzz(1)