Pentesting.Site - ffuf Cheat Sheet

Ffuf (Fuzz Faster U Fool) is a high-performance web fuzzer written in Go, specifically designed for directory discovery, virtual host enumeration, and fuzzing of HTTP parameters. Known for its speed and flexibility, it allows security researchers to quickly identify hidden resources and potential vulnerabilities by testing large wordlists against web applications using highly customizable filters and matchers.

Download ffuf

Installation

1
sudo apt install ffuf

1
sudo apt install ffuf

1
go install github.com/ffuf/ffuf/v2@latest

1
brew install ffuf

1
sudo snap install ffuf

1
wget https://github.com/ffuf/ffuf/releases/latest/download/ffuf_Linux_amd64.tar.gz
2
tar -xvf ffuf_Linux_amd64.tar.gz
3
chmod +x ffuf
4
sudo mv ffuf /usr/local/bin/

1
wget https://github.com/ffuf/ffuf/releases/latest/download/ffuf_Windows_amd64.zip

1
git clone https://github.com/ffuf/ffuf.git
2
cd ffuf
3
go build
4
ffuf -h
5
ffuf -V

Basic Usage

1
ffuf -u https://target.com/FUZZ -w wordlist.txt                     #Basic directory fuzzing
2
ffuf -u https://target.com/FUZZ -w wordlist.txt -mc 200             #Show only successful results
3
ffuf -u https://target.com/FUZZ -w wordlist.txt -mc 200,301,302     #Show successful results and 30x redirects
4
ffuf -u https://target.com/FUZZ -w wordlist.txt -s                  #Silent mode
5
ffuf -u https://target.com/FUZZ -w wordlist.txt -v                  #Verbose output
6
ffuf -u https://target.com/FUZZ -w wordlist.txt -o results.json     #Save results

Directory & File Discovery

1
ffuf -u https://target.com/FUZZ -w directories.txt                        #Directory brute force
2
ffuf -u https://target.com/FUZZ -w directories.txt -mc 200,301,302,403    #Directory scan with common status codes
3
ffuf -u https://target.com/FUZZ.bak -w wordlist.txt                       #Scan for backup files
4
ffuf -u https://target.com/FUZZ.conf -w wordlist.txt                      #Scan for config files
5
ffuf -u https://target.com/.FUZZ -w wordlist.txt                          #Find hidden files

Recursive Directory Discovery

1
ffuf -u https://target.com/FUZZ -w directories.txt -recursion                       #Enable recursion
2
ffuf -u https://target.com/FUZZ -w directories.txt -recursion -recursion-depth 3    #Recursive scan with depth
3
ffuf -u https://target.com/FUZZ -w directories.txt -recursion -mc 200,301,302       #Recursive scan with filtering

Virtual Host Discovery

1
ffuf -u https://target.com -H "Host: FUZZ.target.com" -w subdomains.txt              #Vhost fuzzing
2
ffuf -u https://target.com -H "Host: FUZZ.target.com" -w subdomains.txt -mc 200      #Vhost discovery with filtering
3
ffuf -u https://target.com -H "Host: FUZZ.target.com" -w subdomains.txt -fs 4242     #Vhost fuzzing with size filter

Subdomain Fuzzing

1
ffuf -u https://FUZZ.target.com -w subdomains.txt               #Subdomain brute force
2
ffuf -u https://FUZZ.target.com -w subdomains.txt -mc 200       #Subdomain scan with status filter
3
ffuf -u https://FUZZ.target.com -w subdomains.txt -fs 1234      #Subdomain scan ignoring page size

GET Parameter Fuzzing

1
ffuf -u "https://target.com/page.php?id=FUZZ" -w payloads.txt             #Fuzz GET parameter values
2
ffuf -u "https://target.com/page.php?id=FUZZ&cat=test" -w payloads.txt    #Fuzz multiple parameters
3
ffuf -u "https://target.com/page.php?FUZZ=test" -w params.txt             #Fuzz parameter names

POST Parameter Fuzzing

1
ffuf -u https://target.com/login -X POST -d "username=admin&password=FUZZ" -w passwords.txt                                                           #Basic POST fuzzing
2
ffuf -u https://target.com/login -X POST -d "username=admin&password=FUZZ" -H "Content-Type: application/x-www-form-urlencoded" -w passwords.txt      #POST fuzzing with headers
3
ffuf -u https://target.com/login -X POST -d "username=FUZZ&password=test" -w users.txt                                                                #Multiple parameter fuzzing

JSON API Fuzzing

1
ffuf -u https://target.com/api/login -X POST -d '{"username":"admin","password":"FUZZ"}' -H "Content-Type: application/json" -w passwords.txt     #JSON key value fuzzing
2
ffuf -u https://target.com/api/auth -X POST -d '{"token":"FUZZ"}' -H "Content-Type: application/json" -w tokens.txt                               #JSON token fuzzing

HTTP Header Fuzzing

1
ffuf -u https://target.com -H "User-Agent: FUZZ" -w useragents.txt            #User agent Header fuzzing
2
ffuf -u https://target.com -H "Authorization: Bearer FUZZ" -w tokens.txt      #Authorization header fuzzing
3
ffuf -u https://target.com -H "Cookie: session=FUZZ" -w sessions.txt          #Cookie fuzzing

Filtering Results

1
ffuf -u https://target.com/FUZZ -w wordlist.txt -mc 200               #Match status codes
2
ffuf -u https://target.com/FUZZ -w wordlist.txt -mc 200,301,302       #Match multiple status codes
3
ffuf -u https://target.com/FUZZ -w wordlist.txt -fs 4242              #Filter by response size
4
ffuf -u https://target.com/FUZZ -w wordlist.txt -ms 1024              #Match by response size
5
ffuf -u https://target.com/FUZZ -w wordlist.txt -fw 50                #Filter by word count
6
ffuf -u https://target.com/FUZZ -w wordlist.txt -fl 20                #Filter by line count

Rate Limiting & Performance

1
ffuf -u https://target.com/FUZZ -w wordlist.txt -rate 100     #Limit request rate per second
2
ffuf -u https://target.com/FUZZ -w wordlist.txt -t 50         #Set thread count
3
ffuf -u https://target.com/FUZZ -w wordlist.txt -p 0.1        #Delay between requests in seconds
4
ffuf -u https://target.com/FUZZ -w wordlist.txt -timeout 10   #Timeout setting in seconds

Output Options

1
ffuf -u https://target.com/FUZZ -w wordlist.txt -o results.json              #Save results to json file
2
ffuf -u https://target.com/FUZZ -w wordlist.txt -od /home -o results.json    #Save results to json file in custom directory
3
ffuf -u https://target.com/FUZZ -w wordlist.txt -o results.csv -of csv       #Save results in CSV
4
ffuf -u https://target.com/FUZZ -w wordlist.txt -o report.html -of html      #Save results in HTML
5
ffuf -u https://target.com/FUZZ -w wordlist.txt -o results.json -or          #Creates a file only if there are results

Proxy Usage (Burp/ZAP)

1
ffuf -u https://target.com/FUZZ -w wordlist.txt -x http://127.0.0.1:8080      #Send traffic through Burp
2
ffuf -u https://target.com/FUZZ -w wordlist.txt -x socks5://127.0.0.1:9050    #Use SOCKS proxy

Recursive Web Content Discovery

1
ffuf -u https://target.com/FUZZ -w directories.txt -recursion                      #Recursive directory brute force
2
ffuf -u https://target.com/FUZZ -w directories.txt -recursion -recursion-depth 2   #Recursive with depth limit

Multiple Wordlists

1
ffuf -u https://target.com/FUZZ1/FUZZ2 -w directory.txt:FUZZ1 -w file.txt:FUZZ2 -mode clusterbomb     #Clusterbomb attack
2
ffuf -u https://target.com/FUZZ1/FUZZ2 -w directory.txt:FUZZ1 -w file.txt:FUZZ2 -mode pitchfork       #Pitchfork attack