ffuf

Fast web fuzzing — directories, parameters, vhosts & response filters

ffuf (Web Fuzzing) Cheat Sheet

ffuf ("Fuzz Faster U Fool") is a fast Go web fuzzer for content discovery, parameter/value fuzzing, virtual-host enumeration, and brute forcing — anywhere you can put a FUZZ keyword. For authorized testing only.

1. Basic usage

# Directory / file discovery: FUZZ marks where the wordlist goes
ffuf -u https://target/FUZZ -w /usr/share/wordlists/dirb/common.txt

# With a file extension
ffuf -u https://target/FUZZ -w wordlist.txt -e .php,.html,.txt

# Named keyword instead of FUZZ
ffuf -u https://target/W1 -w wordlist.txt:W1

2. Common flags

Flag	Purpose
`-u`	Target URL (contains `FUZZ`)
`-w`	Wordlist (`-w list.txt:KEYWORD` to name it)
`-e`	Extensions: `.php,.bak,.txt`
`-X`	HTTP method (GET, POST, …)
`-d`	POST body data
`-H`	Header (repeatable)
`-b`	Cookies: `"name=val; n2=v2"`
`-recursion`	Recurse into found dirs
`-recursion-depth`	Max recursion depth
`-t`	Concurrent threads (default 40)
`-p`	Delay between requests, e.g. `-p 0.1` or `-p 0.1-2.0`
`-x`	Upstream proxy (e.g. Burp)
`-o` / `-of`	Output file / format
`-c`	Colorized output
`-v`	Verbose (show full URLs + redirect targets)

3. Filtering & matching responses

Filter OUT noise (-f*) or match only what you want (-m*):

Match	Filter	Meaning
`-mc`	`-fc`	HTTP status code
`-ms`	`-fs`	Response size (bytes)
`-mw`	`-fw`	Word count
`-ml`	`-fl`	Line count
`-mr`	`-fr`	Regex in response
`-mt`	`-ft`	Response time

# Default match is "mc 200-299,301,302,307,401,403,405,500"
ffuf -u https://target/FUZZ -w list.txt -mc 200,204,301,302,307,401,403

# Hide the boilerplate 404 page (e.g. it's always 4242 bytes)
ffuf -u https://target/FUZZ -w list.txt -fs 4242

# Auto-calibrate: learn the "not found" response and filter it
ffuf -u https://target/FUZZ -w list.txt -ac

4. Directory & file discovery

ffuf -u https://target/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -recursion -recursion-depth 2 -e .php,.txt -c

# Trailing-slash dirs only + follow redirects
ffuf -u https://target/FUZZ/ -w dirs.txt -r

5. Virtual-host (vhost) discovery

# Fuzz the Host header; filter by size since the IP responds to all
ffuf -u https://target/ -H "Host: FUZZ.target.com" -w subdomains.txt -fs 0
ffuf -u http://10.10.10.10/ -H "Host: FUZZ.htb" -w vhosts.txt -ac

6. Subdomain / DNS discovery

ffuf -u https://FUZZ.target.com -w subdomains.txt
ffuf -u https://FUZZ.target.com -w subdomains.txt -mc 200,301,302

7. GET / POST parameter fuzzing

# Discover GET parameter NAMES
ffuf -u "https://target/page?FUZZ=1" -w params.txt -fs 1234

# Fuzz a parameter VALUE
ffuf -u "https://target/page?id=FUZZ" -w values.txt

# POST body (e.g. login brute force) — two keywords, clusterbomb is default for multi
ffuf -u https://target/login -X POST \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "username=admin&password=FUZZ" \
     -w passwords.txt -fc 401

8. Multiple wordlists & modes

# Two keywords, two lists
ffuf -u "https://target/USER/FILE" -w users.txt:USER -w files.txt:FILE -mode clusterbomb

# Modes: clusterbomb (all combos, default for >1 list), pitchfork (parallel)
ffuf -u "https://target/login" -X POST -d "user=USER&pass=PASS" \
     -w users.txt:USER -w pass.txt:PASS -mode pitchfork -fc 401

9. Output & resuming

ffuf -u https://target/FUZZ -w list.txt -o results.json -of json
# Formats (-of): json, ejson, html, md, csv, ecsv, all
ffuf -u https://target/FUZZ -w list.txt -of all -o run

# Pipe through Burp to inspect
ffuf -u https://target/FUZZ -w list.txt -x http://127.0.0.1:8080

10. Tips

Start with -ac (auto-calibration) to auto-filter the soft-404 / catch-all page.
If results are all the same status, filter by size (-fs) or words (-fw) instead.
Throttle on fragile targets: -t 10 -p 0.1 to avoid hammering / rate limits.
SecLists is the go-to wordlist repo: /usr/share/seclists/Discovery/Web-Content/.
Add -r to follow redirects, -v to see the full URL and any redirect location.
Use -fw 1 style filters after a quick run to learn the baseline word count of the 404.

Authorized testing only. Practice on the AYSEC challenges. Related: nmap