ffuf — Web Fuzzer Guideffuf Guide - step-by-step reference to use ffuf for web content discovery, parameter fuzzing and login brute force. Educational purposes only, online free.FAQ

What is ffuf?

ffuf (Fuzz Faster U Fool) is a fast web fuzzer written in Go. It sends thousands of requests with a wordlist substituted into a FUZZ keyword and reports which ones return real, interesting responses.

Is ffuf illegal?

No, ffuf is a legitimate open-source tool used for authorized web content discovery and penetration testing. Using it against a website you do not own or lack written permission to test is illegal. Only run it on systems you own or are authorized to assess.

How does the FUZZ keyword work?

ffuf replaces the literal word FUZZ anywhere in the URL, headers or body with each word from the wordlist. For example ffuf -u https://site.com/FUZZ -w words.txt tests every word at that path.

What do -mc and -fc do?

-mc sets which HTTP status codes to match (show), and -fc sets codes to filter out (hide). You use them to reduce noise and only surface real pages — e.g. -mc 200,301 or -fc 404.

Can ffuf fuzz more than paths?

Yes. FUZZ can appear in query parameters, headers, cookies or POST bodies, so you can fuzz parameters, subdomains, virtual hosts and login forms too.

What is parameter fuzzing?

You place FUZZ in a query string or body field to discover hidden inputs the app accepts, like ffuf -u https://site.com/page?FUZZ=1 -w params.txt. Hidden parameters can expose debug or admin functionality.

How do I brute-force a login with ffuf?

Fuzz the password field in a POST body and filter out the failed-login status code: ffuf -X POST -d "user=admin&pass=FUZZ" -w passwords.txt -fc 401. A different status/size reveals a valid credential.

How can I defend against fuzzing?

Remove unused endpoints, restrict admin and debug paths, use a WAF to rate-limit fuzz traffic, and monitor access logs for unusual request patterns.

All tools · Sitemap · Games