← retour aux outils back to tools

# ffuf

Fuzzer web rapide écrit en Go. Excelle dans la découverte de répertoires/fichiers, le fuzzing de paramètres, l'énumération de vhosts et la découverte de endpoints API. Fast web fuzzer written in Go. Excels at directory/file discovery, parameter fuzzing, vhost enumeration, and API endpoint discovery.

↗ https://github.com/ffuf/ffuf

## Overview

ffuf (Fuzz Faster U Fool) is the go-to web fuzzer for modern pentests. It uses the `FUZZ` keyword as a placeholder in any part of the request (URL, headers, POST body) and replaces it with wordlist entries at high speed.

## Common Usage

Directory/file discovery

    ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt

With file extensions

    ffuf -u https://target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt -e .php,.html,.bak,.txt

POST body fuzzing (login brute-force)

    ffuf -u https://target.com/login -X POST -d "username=admin&password=FUZZ" \
      -w /usr/share/wordlists/rockyou.txt -H "Content-Type: application/x-www-form-urlencoded"

Virtual host / subdomain enumeration

    ffuf -u https://target.com -H "Host: FUZZ.target.com" \
      -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

    # Filter by response size/words/lines to remove noise
    ffuf -u https://target.com/FUZZ -w wordlist.txt -fs 4242
    ffuf -u https://target.com/FUZZ -w wordlist.txt -fw 12
    ffuf -u https://target.com/FUZZ -w wordlist.txt -fc 404,403

Multiple wordlists (cluster bomb)

    ffuf -u https://target.com/FUZZ1/FUZZ2 -w users.txt:FUZZ1 -w paths.txt:FUZZ2

API parameter fuzzing

    ffuf -u https://target.com/api/v1/user?FUZZ=test -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt

Match only specific status codes

    ffuf -u https://target.com/FUZZ -w wordlist.txt -mc 200,301,302

## Output & Rate Control

Save to JSON for later parsing

    ffuf -u https://target.com/FUZZ -w wordlist.txt -o results.json -of json

Rate limiting (requests per second)

    ffuf -u https://target.com/FUZZ -w wordlist.txt -rate 100

Threads

    ffuf -u https://target.com/FUZZ -w wordlist.txt -t 50

Delay between requests (milliseconds range)

    ffuf -u https://target.com/FUZZ -w wordlist.txt -p 0.1

## Tips

- Start with `-fc 404` then adjust once you see the baseline response
- Use `-ac` (auto-calibrate) to automatically filter false positives based on baseline responses
- `-recursion` + `-recursion-depth 2` enables recursive directory discovery
- Pair with `SecLists` (`/usr/share/seclists/`) — `raft-medium-words.txt` and `directory-list-2.3-medium.txt` are solid starting points

Help / Man page

    ffuf -h

    -u URL            Target URL with FUZZ keyword
    -w wordlist       Wordlist file path (or stdin with -)
    -H header         Header "Name: Value" (repeatable)
    -X method         HTTP method (default: GET)
    -d data           POST data
    -b cookie         Cookie data
    -r                Follow redirects
    -t threads        Number of concurrent threads (default: 40)
    -rate             Rate of requests/sec
    -p delay          Seconds of delay between requests
    -mc codes         Match HTTP status codes (default: 200,204,301,302,307,401,403,405,500)
    -ms size          Match response size
    -mw words         Match response word count
    -fc codes         Filter HTTP status codes
    -fs size          Filter response size
    -fw words         Filter response word count
    -ac               Auto-calibrate filtering
    -recursion        Recursive mode (dirs)
    -recursion-depth  Max recursion depth
    -e extensions     Comma-separated file extensions
    -o file           Output file
    -of format        Output format: json, ejson, html, md, csv, ecsv

## Vue d’ensemble

ffuf (Fuzz Faster U Fool) est le fuzzer web de référence pour les pentests modernes. Il utilise le mot-clé `FUZZ` comme placeholder dans n’importe quelle partie de la requête (URL, headers, corps POST) et le remplace par les entrées d’une wordlist à haute vitesse.

## Utilisation courante

    # Découverte de répertoires/fichiers
    ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt

    # Avec extensions de fichiers
    ffuf -u https://target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt -e .php,.html,.bak,.txt

    # Fuzzing du corps POST (brute-force de login)
    ffuf -u https://target.com/login -X POST -d "username=admin&password=FUZZ" \
      -w /usr/share/wordlists/rockyou.txt -H "Content-Type: application/x-www-form-urlencoded"

    # Énumération de vhost / sous-domaine
    ffuf -u https://target.com -H "Host: FUZZ.target.com" \
      -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

    # Filtrer par taille/nombre de mots/lignes de réponse pour réduire le bruit
    ffuf -u https://target.com/FUZZ -w wordlist.txt -fs 4242
    ffuf -u https://target.com/FUZZ -w wordlist.txt -fw 12
    ffuf -u https://target.com/FUZZ -w wordlist.txt -fc 404,403

    # Wordlists multiples (cluster bomb)
    ffuf -u https://target.com/FUZZ1/FUZZ2 -w users.txt:FUZZ1 -w paths.txt:FUZZ2

    # Fuzzing de paramètres API
    ffuf -u https://target.com/api/v1/user?FUZZ=test -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt

    # Ne matcher que des codes de statut spécifiques
    ffuf -u https://target.com/FUZZ -w wordlist.txt -mc 200,301,302

## Sortie et contrôle du débit

    # Sauvegarder en JSON pour un traitement ultérieur
    ffuf -u https://target.com/FUZZ -w wordlist.txt -o results.json -of json

    # Limitation de débit (requêtes par seconde)
    ffuf -u https://target.com/FUZZ -w wordlist.txt -rate 100

    # Threads
    ffuf -u https://target.com/FUZZ -w wordlist.txt -t 50

    # Délai entre les requêtes (plage en millisecondes)
    ffuf -u https://target.com/FUZZ -w wordlist.txt -p 0.1

## Conseils

- Commencer avec `-fc 404` puis ajuster une fois la réponse de base observée
- Utiliser `-ac` (auto-calibrate) pour filtrer automatiquement les faux positifs à partir des réponses de référence
- `-recursion` + `-recursion-depth 2` active la découverte récursive de répertoires
- Associer avec `SecLists` (`/usr/share/seclists/`) : `raft-medium-words.txt` et `directory-list-2.3-medium.txt` sont de bons points de départ

Aide / Page de manuel

    ffuf -h

    -u URL            Target URL with FUZZ keyword
    -w wordlist       Wordlist file path (or stdin with -)
    -H header         Header "Name: Value" (repeatable)
    -X method         HTTP method (default: GET)
    -d data           POST data
    -b cookie         Cookie data
    -r                Follow redirects
    -t threads        Number of concurrent threads (default: 40)
    -rate             Rate of requests/sec
    -p delay          Seconds of delay between requests
    -mc codes         Match HTTP status codes (default: 200,204,301,302,307,401,403,405,500)
    -ms size          Match response size
    -mw words         Match response word count
    -fc codes         Filter HTTP status codes
    -fs size          Filter response size
    -fw words         Filter response word count
    -ac               Auto-calibrate filtering
    -recursion        Recursive mode (dirs)
    -recursion-depth  Max recursion depth
    -e extensions     Comma-separated file extensions
    -o file           Output file
    -of format        Output format: json, ejson, html, md, csv, ecsv