BeginnerTools

Ffuf Guide: Fast Web Fuzzing Tool

Learn Ffuf for fast web fuzzing including directory discovery, parameter fuzzing, subdomain enumeration, and virtual host discovery.

#ffuf#web fuzzing#directory busting#parameter fuzzing#content discovery

Why You Need FFUF

You need to discover hidden endpoints, parameters, or subdomains on a web application — FFUF fuzzes URLs faster than most alternatives. Written in Go for high concurrency, it supports directory discovery, parameter fuzzing, POST data fuzzing, and virtual host enumeration in a single tool.

Prerequisites

Basic understanding of HTTP and web applications

Familiarity with wordlists

Explicit permission to test the target

Installation

sudo apt install ffuf
# From source
go install github.com/ffuf/ffuf/v2@latest

Basic Usage

ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt

The FUZZ keyword marks where wordlist entries are inserted.

Key Options

| Option | Description |

|--------|-------------|

| -u URL | Target URL with FUZZ |

| -w WORDLIST | Wordlist file |

| -c | Colorize output |

| -fc STATUS | Filter by status code |

| -fs SIZE | Filter by response size |

| -r | Follow redirects |

| -t THREADS | Number of threads |

Fuzzing Techniques

# Directory discovery
ffuf -u http://target.com/FUZZ -w wordlist.txt -c

# File extension fuzzing
ffuf -u http://target.com/indexFUZZ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/web-extensions.txt

# POST parameter fuzzing
ffuf -u http://target.com/login.php -X POST -d "user=FUZZ&pass=test" -w users.txt -fc 200

# Subdomain enumeration
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://FUZZ.target.com

# Virtual host discovery
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://target.com -H "Host: FUZZ.target.com"

Using Filters

ffuf -u http://target.com/FUZZ -w wordlist.txt -fc 404
ffuf -u http://target.com/FUZZ -w wordlist.txt -fs 0,1234

Common Mistakes

Forgetting the FUZZ keyword. Not using filters. Wrong wordlist selection.

Best Practices

Use output files. Test with -ac (auto-calibration). Start with small wordlists.

Related Tools

**Gobuster**: Directory and DNS brute-forcing

**Dirb**: Web content scanner

**Burp Suite Intruder**: GUI-based fuzzing

[Gobuster Guide](/articles/gobuster-guide)

[Dirb Guide](/articles/dirb-guide)

[Burp Suite Introduction](/articles/burp-suite-introduction)

Summary

Ffuf is a lightning-fast web fuzzer for discovering hidden content, parameters, subdomains, and virtual hosts.

Knowledge Check

What does the FUZZ keyword do?

How to filter out 404 responses?

What is auto-calibration (`-ac`)?

How to scan for specific extensions?

Best output format for analysis?

Frequently Asked Questions

What is ffuf?

FFUF (Fuzz Faster U Fool) is a fast web fuzzer written in Go for discovering hidden directories, files, parameters, subdomains, and virtual hosts. It replaces the FUZZ keyword in URLs with wordlist entries at high speed.

What does the FUZZ keyword do?

The `FUZZ` keyword in the URL marks where ffuf inserts each wordlist entry. For example, `http://target.com/FUZZ` tests words like admin, backup, login against the target.

How do you filter out 404 responses?

Use `-fc 404` to filter by status code. You can also use `-fs 0` to filter by response size or `-fw 5` to filter by word count, which helps eliminate noise from default pages.

What is auto-calibration in ffuf?

Auto-calibration (`-ac`) automatically detects default response patterns and creates filters to exclude them. It compares responses against a baseline and removes false positives from the output.

How do you scan for specific file extensions?

Use a wordlist with extensions like `FUZZ.php` or `FUZZ.html`, or use ffuf's `-e .php,.html,.txt` flag to append multiple extensions to each wordlist entry automatically.

What is the best output format for analysis?

Use `-o results.json -of json` for machine-readable output that tools like JQ can parse. For human review, use `-of html` for a formatted report or `-of csv` for spreadsheet import.

How do you perform subdomain enumeration with ffuf?

Use `ffuf -w wordlist.txt -u http://FUZZ.target.com` where each wordlist entry becomes a subdomain to test. Filter by response size or status code to identify valid subdomains.

What is virtual host discovery?

Use `-H 'Host: FUZZ.target.com'` to send different Host headers while targeting the same IP. The server may respond differently for valid virtual hosts, revealing hidden sites hosted on the same server.

What wordlists work best with ffuf?

For directory discovery, use SecLists wordlists like `Discovery/Web-Content/common.txt` or `raft-medium-directories.txt`. Start small and increase based on results.