ffuf

What is ffuf?

ffuf (short for Fuzz Faster U Fool) is a web fuzzer written in Go, extremely fast and very popular in pentesting and bug bounty. The idea is simple and powerful: you put the keyword FUZZ anywhere in an HTTP request (the URL, a parameter, a header, the body) and ffuf replaces it with each entry from a wordlist, analysing the responses. With that you can discover directories, files, hidden parameters, values, subdomains or virtual hosts.

What sets ffuf apart from simpler tools is its system of filters and matchers, which lets you keep only the interesting responses by status code, size, number of words or lines.

What ffuf is used for

• Fuzzing directories and files to find unlinked content.
• Discovering hidden parameters in an application (GET and POST).
• Fuzzing values to test IDs, tokens or file paths.
• Enumerating virtual hosts and subdomains via the Host header.
• Bug bounty and CTF: it is a Swiss army knife for the web enumeration phase.

Only use it against your own targets, labs, challenges or within the scope of an authorised programme.

How to install ffuf

On Kali Linux and Parrot OS it is in the repositories:

sudo apt update
sudo apt install ffuf

With Go installed, the latest version:

go install github.com/ffuf/ffuf/v2@latest

Check the install:

ffuf -h

How to use ffuf: practical examples

Directory fuzzing

Put FUZZ where you want to iterate and pass the wordlist with -w:

ffuf -u http://192.168.56.101/FUZZ -w /usr/share/wordlists/dirb/common.txt

To look for files with an extension, use -e:

ffuf -u http://192.168.56.101/FUZZ -w common.txt -e .php,.html,.txt

Filters: ffuf's real power

You will almost always need to filter noise. The key options are:

• -mc: match by status code (what you consider valid).
• -fc: filter by status code (what you discard; e.g. -fc 404).
• -fs: filter by response size in bytes.
• -fw: filter by word count; -fl: by line count.

Typical example: accept only 200 and 301 responses and discard those of 1686 bytes (a fixed-size error page):

ffuf -u http://192.168.56.101/FUZZ -w common.txt -mc 200,301 -fs 1686

Discovering hidden parameters

Put FUZZ in the parameter name. If a response changes size, that parameter is being processed:

ffuf -u "http://192.168.56.101/page?FUZZ=test" -w parameters.txt -fs 0

Fuzzing a POST request

For example, testing passwords on a lab login and filtering out the invalid-credentials response:

ffuf -u http://192.168.56.101/login -X POST \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "user=admin&pass=FUZZ" \
  -w /usr/share/wordlists/rockyou.txt -fc 401

Virtual hosts via the Host header

Fuzz the Host header and filter by the default response size to keep only the real vhosts:

ffuf -u http://192.168.56.101 -H "Host: FUZZ.target.local" \
  -w /usr/share/wordlists/subdomains.txt -fs 1256

Pro tips

• Do a calibration pass first. Run ffuf with no filters, note the typical size of the "junk" responses and filter that size with -fs.
• Enable recursion with -recursion so it automatically explores directories as it finds them.
• Export the results with -o output.json -of json to document or process them later.
• Use several lists at once with custom keywords (-w list1:W1 -w list2:W2) to fuzz two positions in a single request.
• Control the speed with -rate or -p (delay) so you do not overwhelm fragile targets.

Pros and cons

Pros	Cons
Extremely fast and configurable	So many options are overwhelming at first
Powerful filters (-fc, -fs, -mc...)	Needs good calibration to avoid noise
Fuzzes any part of the request	Terminal only, no GUI

ffuf alternatives

• Gobuster: simpler and more direct, organised into dir/dns/vhost modes.
• feroxbuster: in Rust, with very handy automatic recursion.
• wfuzz: the classic Python fuzzer, very flexible.
• Burp Suite's Intruder for manual, interactive fuzzing.
• Practise on Hack The Box or with the PortSwigger labs.

Frequently asked questions

Is ffuf free?

Yes, it is a free, open-source project available on GitHub and in the Kali and Parrot repositories.

What does the word FUZZ mean?

It is the default placeholder that ffuf replaces with each wordlist entry. You can put it in the URL, a header, the body or a parameter, and even use several with your own names.

How do I filter out responses I do not care about?

With the filters by code (-fc), size (-fs), words (-fw) or lines (-fl). For the opposite, use the matchers (-mc, -ms...).

ffuf or Gobuster?

For quick, tidy enumeration, Gobuster is very convenient. For complex cases with fine filtering or fuzzing of parameters and headers, ffuf is more powerful.

Want to master web fuzzing with real exercises? You will find it at the Hackers en Acción Academy.