security enabled community medium v1.0.0

ffuf

Fast web fuzzer written in Go for directory discovery, parameter fuzzing, virtual host enumeration, and value brute-forcing.

📋 Live Preview

ffuf -u {target} -w {wordlist} -t {threads}

🌍 target → url 🌍 wordlist → /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt 🌍 threads → 40

ffuf -u {target} -w {wordlist} -t {threads}

Sandbox: execFile · Timeout: 1800s

Capabilities

web.fuzzing.directory

web.fuzzing.parameter

web.discovery.vhost

web.fuzzing.value

web.content.brute

web.filter.response

Parameters

Name	Type	Required	Default	Description	Aliases
`url`	string	Yes	-	Target URL with FUZZ keyword	`-u`
`wordlist`	file	Yes	-	Path to wordlist file	`-w`
`method`	string	No	GET	HTTP method (GET, POST, PUT, etc.)	`-X`
`headers`	string	No	-	Custom HTTP headers	`-H`
`data`	string	No	-	POST request body	`-d`
`proxy`	string	No	-	Proxy URL	`-p`
`threads`	integer	No	40	Number of concurrent threads	`-t`
`output`	file	No	-	Output file path	`-o`
`output-format`	string	No	json	Output format: json, csv, html, md	`-of`
`filter-code`	string	No	-	Filter by HTTP status codes	`-fc`
`filter-size`	string	No	-	Filter by response size	`-fs`
`filter-words`	string	No	-	Filter by word count	`-fw`
`filter-lines`	string	No	-	Filter by line count	`-fl`
`follow-redirect`	boolean	No	-	Follow HTTP redirects	`-r`
`recursion`	boolean	No	-	Enable recursion	`-recursion`
`recursion-depth`	integer	No	-	Maximum recursion depth	`-recursion-depth`
`auto-calibration`	boolean	No	-	Auto-calibrate filtering	`-ac`
`extension`	string	No	-	File extension to append	`-e`
`silent`	boolean	No	-	Silent mode	`-s`
`verbose`	boolean	No	-	Verbose output	`-v`
`timeout`	integer	No	-	HTTP request timeout in seconds	`-timeout`
`e`	boolean	No	-	File extension to append	`-e`, `--extension`
`output_format`	boolean	No	-	Output format (json, csv, html, md)	`--output-format`
`s`	boolean	No	-	Silent mode	`-s`, `--silent`
`v`	boolean	No	-	Verbose output	`-v`, `--verbose`

Artifacts

Type	Description	MIME	Schema	Trust
`web.fuzzing.results`	Fuzzing results in JSON format	application/json	-	community
`web.fuzzing.html`	HTML fuzzing report	text/html	-	community

Contract

Inputs

web.target.url

Target URL with FUZZ keyword

file.wordlist

Wordlist for fuzzing

web.http.method

HTTP method (GET, POST, etc.)

Outputs

web.fuzzing.results

Fuzzing results in JSON

Side effects: network_traffic

Workflow Edges

Produces

web.fuzzing.results

Consumes

web.target.urlfile.wordlistweb.http.method

Resource Profile

Resource	Value
CPU	low
Memory	64 MB
Network	medium
Disk I/O	low

Examples

Directory discovery with common wordlist

ffuf -u https://example.com/FUZZ -w /usr/share/wordlists/dirb/common.txt

Parameter fuzzing with POST data

ffuf -u https://example.com/login -X POST -d "user=admin&password=FUZZ" -w passwords.txt -fc 401

Virtual host enumeration

ffuf -u https://example.com -H "Host: FUZZ.example.com" -w vhosts.txt -fc 200

Extension-based directory discovery

ffuf -u https://example.com/FUZZ -w wordlist.txt -e .php,.html,.asp -t 50

Recursive scan with auto-calibration

ffuf -u https://example.com/FUZZ -w wordlist.txt -recursion -recursion-depth 3 -ac

Output to JSON with status code filtering

ffuf -u https://example.com/FUZZ -w wordlist.txt -o results.json -of json -fc 404,403

Through Burp proxy

ffuf -u https://example.com/FUZZ -w wordlist.txt -p http://127.0.0.1:8080

Documentation

FFUF — Fast Web Fuzzer

FFUF (Fuzz Faster U Fool) is a fast web fuzzer written in Go. It is designed for directory discovery, parameter fuzzing, virtual host enumeration, and value brute-forcing with advanced filtering capabilities.

Key Features

Multi-Mode Fuzzing: Directory, parameter, vhost, and value fuzzing
Advanced Filtering: Filter by status code, size, words, or lines
Recursion: Automatically fuzz discovered directories
Auto-Calibration: Intelligent baseline detection
Multiple Output Formats: JSON, CSV, HTML, Markdown

Fuzzing Modes

Mode	Example
Directory	`ffuf -u https://target/FUZZ -w wordlist.txt`
Parameter	`ffuf -u https://target/page?FUZZ=1 -w params.txt`
VHost	`ffuf -u https://target -H "Host: FUZZ.target" -w hosts.txt`
POST data	`ffuf -u https://target/login -X POST -d "user=FUZZ" -w users.txt`

Basic Usage

# Directory discovery
ffuf -u https://example.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -t 50

# VHost enumeration
ffuf -u https://example.com -H "Host: FUZZ.example.com" -w vhosts.txt -fc 200

# Parameter fuzzing with filtering
ffuf -u https://example.com/page?FUZZ=1 -w params.txt -fc 404 -fs 0