ffuf

Overview

ffuf (Fuzz Faster U Fool) is the go-to web fuzzer for modern pentests. It uses the FUZZ keyword as a placeholder in any part of the request (URL, headers, POST body) and replaces it with wordlist entries at high speed.

Common Usage

Directory/file discovery

ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt

With file extensions

ffuf -u https://target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt -e .php,.html,.bak,.txt

POST body fuzzing (login brute-force)

ffuf -u https://target.com/login -X POST -d "username=admin&password=FUZZ" \
  -w /usr/share/wordlists/rockyou.txt -H "Content-Type: application/x-www-form-urlencoded"

Virtual host / subdomain enumeration

ffuf -u https://target.com -H "Host: FUZZ.target.com" \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Filter by response size/words/lines to remove noise
ffuf -u https://target.com/FUZZ -w wordlist.txt -fs 4242
ffuf -u https://target.com/FUZZ -w wordlist.txt -fw 12
ffuf -u https://target.com/FUZZ -w wordlist.txt -fc 404,403

Multiple wordlists (cluster bomb)

ffuf -u https://target.com/FUZZ1/FUZZ2 -w users.txt:FUZZ1 -w paths.txt:FUZZ2

API parameter fuzzing

ffuf -u https://target.com/api/v1/user?FUZZ=test -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt

Match only specific status codes

ffuf -u https://target.com/FUZZ -w wordlist.txt -mc 200,301,302

Output & Rate Control

Save to JSON for later parsing

ffuf -u https://target.com/FUZZ -w wordlist.txt -o results.json -of json

Rate limiting (requests per second)

ffuf -u https://target.com/FUZZ -w wordlist.txt -rate 100

Threads

ffuf -u https://target.com/FUZZ -w wordlist.txt -t 50

Delay between requests (milliseconds range)

ffuf -u https://target.com/FUZZ -w wordlist.txt -p 0.1

Tips

• Start with -fc 404 then adjust once you see the baseline response
• Use -ac (auto-calibrate) to automatically filter false positives based on baseline responses
• -recursion + -recursion-depth 2 enables recursive directory discovery
• Pair with SecLists (/usr/share/seclists/) — raft-medium-words.txt and directory-list-2.3-medium.txt are solid starting points

ffuf -h

-u URL            Target URL with FUZZ keyword
-w wordlist       Wordlist file path (or stdin with -)
-H header         Header "Name: Value" (repeatable)
-X method         HTTP method (default: GET)
-d data           POST data
-b cookie         Cookie data
-r                Follow redirects
-t threads        Number of concurrent threads (default: 40)
-rate             Rate of requests/sec
-p delay          Seconds of delay between requests
-mc codes         Match HTTP status codes (default: 200,204,301,302,307,401,403,405,500)
-ms size          Match response size
-mw words         Match response word count
-fc codes         Filter HTTP status codes
-fs size          Filter response size
-fw words         Filter response word count
-ac               Auto-calibrate filtering
-recursion        Recursive mode (dirs)
-recursion-depth  Max recursion depth
-e extensions     Comma-separated file extensions
-o file           Output file
-of format        Output format: json, ejson, html, md, csv, ecsv

Vue d’ensemble

ffuf (Fuzz Faster U Fool) est le fuzzer web de référence pour les pentests modernes. Il utilise le mot-clé FUZZ comme placeholder dans n’importe quelle partie de la requête (URL, headers, corps POST) et le remplace par les entrées d’une wordlist à haute vitesse.

Utilisation courante

# Découverte de répertoires/fichiers
ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt

# Avec extensions de fichiers
ffuf -u https://target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt -e .php,.html,.bak,.txt

# Fuzzing du corps POST (brute-force de login)
ffuf -u https://target.com/login -X POST -d "username=admin&password=FUZZ" \
  -w /usr/share/wordlists/rockyou.txt -H "Content-Type: application/x-www-form-urlencoded"

# Énumération de vhost / sous-domaine
ffuf -u https://target.com -H "Host: FUZZ.target.com" \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Filtrer par taille/nombre de mots/lignes de réponse pour réduire le bruit
ffuf -u https://target.com/FUZZ -w wordlist.txt -fs 4242
ffuf -u https://target.com/FUZZ -w wordlist.txt -fw 12
ffuf -u https://target.com/FUZZ -w wordlist.txt -fc 404,403

# Wordlists multiples (cluster bomb)
ffuf -u https://target.com/FUZZ1/FUZZ2 -w users.txt:FUZZ1 -w paths.txt:FUZZ2

# Fuzzing de paramètres API
ffuf -u https://target.com/api/v1/user?FUZZ=test -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt

# Ne matcher que des codes de statut spécifiques
ffuf -u https://target.com/FUZZ -w wordlist.txt -mc 200,301,302

Sortie et contrôle du débit

# Sauvegarder en JSON pour un traitement ultérieur
ffuf -u https://target.com/FUZZ -w wordlist.txt -o results.json -of json

# Limitation de débit (requêtes par seconde)
ffuf -u https://target.com/FUZZ -w wordlist.txt -rate 100

# Threads
ffuf -u https://target.com/FUZZ -w wordlist.txt -t 50

# Délai entre les requêtes (plage en millisecondes)
ffuf -u https://target.com/FUZZ -w wordlist.txt -p 0.1

Conseils

• Commencer avec -fc 404 puis ajuster une fois la réponse de base observée
• Utiliser -ac (auto-calibrate) pour filtrer automatiquement les faux positifs à partir des réponses de référence
• -recursion + -recursion-depth 2 active la découverte récursive de répertoires
• Associer avec SecLists (/usr/share/seclists/) : raft-medium-words.txt et directory-list-2.3-medium.txt sont de bons points de départ

ffuf -h

-u URL            Target URL with FUZZ keyword
-w wordlist       Wordlist file path (or stdin with -)
-H header         Header "Name: Value" (repeatable)
-X method         HTTP method (default: GET)
-d data           POST data
-b cookie         Cookie data
-r                Follow redirects
-t threads        Number of concurrent threads (default: 40)
-rate             Rate of requests/sec
-p delay          Seconds of delay between requests
-mc codes         Match HTTP status codes (default: 200,204,301,302,307,401,403,405,500)
-ms size          Match response size
-mw words         Match response word count
-fc codes         Filter HTTP status codes
-fs size          Filter response size
-fw words         Filter response word count
-ac               Auto-calibrate filtering
-recursion        Recursive mode (dirs)
-recursion-depth  Max recursion depth
-e extensions     Comma-separated file extensions
-o file           Output file
-of format        Output format: json, ejson, html, md, csv, ecsv