Skip to content
Home

FFuF: fast web fuzzing

Fuzz paths, headers, POST bodies, or replayed Burp requests

bash·1 min read··INE Certification

FFuF’s edge over a plain directory brute-forcer is that FUZZ can go anywhere in the request (path, header or POST body) and matching/filtering is based on the actual response (size, code, regex). That makes it useful for things like username/login enumeration and not just finding hidden directories.

Fuzzing targets

Paths

# Fuzz file paths, filter out a known "not found" response size
ffuf -w wordlist.txt -u https://example.org/FUZZ -mc all -fs 42 -c -v

Virtual hosts

# Fuzz the Host header (virtual host discovery)
ffuf -w hosts.txt -u https://example.org/ -H "Host: FUZZ" -mc 200

POST bodies

# Fuzz a JSON POST body, filter out responses containing "error"
ffuf -w entries.txt -u https://example.org/ -X POST -H "Content-Type: application/json" \
  -d '{"name": "FUZZ", "anotherkey": "anothervalue"}' -fr "error"

Multiple wordlists

# Multiple wordlists at once (clusterbomb by default: every combination)
ffuf -w params.txt:PARAM -w values.txt:VAL -u "https://example.org/?PARAM=VAL" -mr "VAL" -c

Replaying a Burp request

# Replay a raw request captured from Burp Suite, fuzzing one field in it
ffuf -request captured_request.txt -request-proto http -w b64_userpass.txt:FUZZAUTH -fs 455 -v

Filter flags

FlagFilters out
-fcStatus code
-fsResponse size
-flLine count
-fwWord count
-frRegex match

Filters are usually more useful than match flags (-mc, -mr) once you know what a “wrong answer” looks like, since you filter that out instead of guessing every possible right-answer shape in advance.