Post cover image

July 31, 2026

What is Ffuf And How we can use it.

Here is your comprehensive guide to mastering FFUF.

By PWNXOTUS

6 min read

The Ultimate Guide to Web Fuzzing with FFUF

When diving into web application security, bug bounty hunting, or penetration testing, one of the most critical phases is discovery. You cannot attack what you cannot see. While spidering and crawling will find linked pages, they miss the hidden, unlinked, and forgotten assets that often harbor the most critical vulnerabilities.

This is where fuzzing comes in.

Introduction to Fuzzing

In the context of web security, fuzzing (or directory brute-forcing) is the process of sending automated, massive volumes of requests to a web server to discover hidden directories, files, parameters, subdomains, and virtual hosts. By cycling through a dictionary of common names (a "wordlist"), we observe the server's HTTP responses to figure out what exists and what doesn't.

What is FFUF?

FFUF stands for Fuzz Faster U Fool. Written in Go, it has become the industry standard web fuzzer, largely replacing older tools like DirBuster, Dirb, and even giving GoBuster a run for its money.

Why is it so popular?

  • Blazing Fast: Thanks to Go's concurrency model, it can send thousands of requests per second.
  • Highly Flexible: It allows you to place the FUZZ keyword anywhere—URLs, headers, POST data, and even JSON bodies.
  • Smart Filtering: It has powerful mechanisms to filter out false positives and custom "404 Not Found" pages.
None

Installation

Because FFUF is written in Go, it is cross-platform and incredibly easy to install

Linux (Debian/Kali/Ubuntu)

On modern security distributions like Kali Linux or Parrot OS, FFUF is usually pre-installed. If not, or if you are using Ubuntu/Debian:

sudo apt update && sudo apt install ffuf

Alternatively, if you have Go installed, you can build the latest version from source:

go install github.com/ffuf/ffuf/v2@latest

macOS

The easiest way to install FFUF on macOS is via Homebrew:

brew install ffuf

Windows

You can download the pre-compiled Windows binaries from the FFUF GitHub Releases page. Extract the .exe file and add it to your system's PATH. Alternatively, you can use Go:

go install github.com/ffuf/ffuf/v2@latest

Understanding Wordlists

A fuzzer is only as good as its wordlist. Sending millions of random characters is inefficient; instead, we use curated lists of common web directories, file names, and parameters.

The gold standard for wordlists is SecLists (maintained by Daniel Miessler).

  • To install on Kali/Debian: sudo apt install seclists
  • Location: Usually /usr/share/seclists/

Recommended Wordlists for FFUF:

  • Directories: SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt
  • Subdomains: SecLists/Discovery/DNS/subdomains-top1million-110000.txt
  • Parameters: SecLists/Discovery/Web-Content/burp-parameter-names.txt

Setting up a Practice Lab

None

Before pointing a fuzzer at a live target (which is illegal without permission), you need a safe environment to practice.

  1. ffuf.me: This is a fantastic, free online platform specifically designed for practicing FFUF. It provides various endpoints meant to teach you specific flags.
  2. OWASP Juice Shop: A purposely vulnerable web application. You can run it via Docker:

docker run --rm -p 3000:3000 bkimminich/juice-shop

(Note: The commands below will use [http://target.com](http://target.com) as a placeholder. Replace this with your practice lab URL).

Basic Directory Fuzzing

The most fundamental use of FFUF is finding hidden directories. You need two flags: -w for the wordlist and -u for the target URL. The keyword FUZZ tells FFUF exactly where to inject the words.

ffuf -w /path/to/wordlist.txt -u http://target.com/FUZZ

FFUF will replace FUZZ with every word in your list (e.g., /admin, /login, /api) and report back anything that returns a successful HTTP status code.

File Extension Discovery

Sometimes you aren't looking for directories, but specific files (like .php, .txt, or .bak). You can use the -e flag to append extensions to every word in your list.

ffuf -w /path/to/wordlist.txt -u http://target.com/FUZZ -e .php,.txt,.bak

If the wordlist contains index, FFUF will check /index, /index.php, /index.txt, and /index.bak.

Recursive Enumeration

None

When you find a directory, you often want to look inside that directory. The -recursion flag automates this. If FFUF finds a directory (usually indicated by a 301 redirect or a specific 200 response), it will launch another fuzzing job inside it.

ffuf -w /path/to/wordlist.txt -u http://target.com/FUZZ -recursion -recursion-depth 2

Tip: Always use -recursion-depth to prevent FFUF from getting stuck in infinite loops on heavily redirected sites.

Filtering False Positives

Many modern web servers are configured to return a 200 OK status code even if a page doesn't exist (a "soft 404"). This will flood your terminal with false positives. FFUF offers robust filtering (-f) and matching (-m) options:

  • -mc: Match Status Code (Default is 200,204,301,302,307,401,403,405)
  • -fc: Filter Status Code
  • -fs: Filter Size (Filter out responses of a specific byte size)
  • -fl: Filter Lines (Filter by amount of lines in the response)
  • -fw: Filter Words (Filter by amount of words in the response)

Example: If every failed request redirects to a standard error page that is exactly 4242 bytes, filter it out:

ffuf -w wordlist.txt -u http://target.com/FUZZ -fs 4242

Auto Calibration

Filtering manually is tedious. FFUF has a brilliant feature called Auto Calibration (-ac).

When you use -ac, FFUF sends a few randomized, non-existent requests before the main scan starts. It analyzes the responses to these fake requests (size, word count, line count) and automatically creates filters to ignore them during the real scan.

ffuf -w wordlist.txt -u http://target.com/FUZZ -ac

Always use -ac when dealing with wildcard DNS or soft 404s.

Parameter Fuzzing (GET & POST)

Sometimes you find an API endpoint or a PHP page, but you don't know what parameters it accepts. You can fuzz parameters to find hidden debug functions or injection points.

GET Parameters:

ffuf -w parameters.txt -u "http://target.com/api/user?FUZZ=1"

POST Parameters:

To fuzz POST data, you need to use the -X flag to change the method and the -d flag for the data.

ffuf -w parameters.txt -u http://target.com/api/login -X POST -d "FUZZ=admin" -H "Content-Type: application/x-www-form-urlencoded"

Header Fuzzing

Fuzzing HTTP headers can reveal hidden bypasses (like X-Forwarded-For to bypass IP restrictions) or trigger Server-Side Request Forgery (SSRF).

ffuf -w headers.txt -u http://target.com/admin -H "FUZZ: 127.0.0.1"

Virtual Host Discovery

Many servers host multiple web applications on the same IP address, distinguishing them by the Host header. If a target is hiding an internal dev site (e.g., dev.target.com), you can find it by fuzzing the Host header.

ffuf -w subdomains.txt -u http://target.com -H "Host: FUZZ.target.com" -ac

Note: Auto-calibration (-ac) is mandatory here, as most servers will return the default website for an invalid Host header, creating thousands of false positives.

Subdomain Fuzzing

While tools like Subfinder or Amass are better for passive DNS subdomain enumeration, FFUF can be used for active brute-forcing if you want to find subdomains that aren't indexed anywhere.

ffuf -w subdomains.txt -u http://FUZZ.target.com

Authenticated Fuzzing

If the directory you want to fuzz is behind a login screen, FFUF needs your session cookie to access it. You can pass cookies using the -b flag or by supplying the full Cookie header.

ffuf -w wordlist.txt -u http://target.com/dashboard/FUZZ -b "session_id=YOUR_COOKIE_HERE"

JSON API Fuzzing

Modern web applications rely heavily on JSON APIs. FFUF handles JSON seamlessly. Just remember to set the correct Content-Type.

ffuf -w wordlist.txt -u http://target.com/api/v1/update -X POST -H "Content-Type: application/json" -d '{"user":"admin", "FUZZ":"test"}'

Performance Optimization

FFUF is fast, but hitting a production server with 10,000 requests a second is a great way to crash it (or get your IP banned instantly).

  • -t 50: Sets the number of concurrent threads (default is 40). Lower this to 10-20 for fragile targets.
  • -p 0.1: Adds a delay (in seconds) between requests. Great for bypassing rate limits.
  • -timeout 5: Sets the HTTP request timeout.

Safe scanning example:

ffuf -w wordlist.txt -u http://target.com/FUZZ -t 10 -p 0.5

Output Formats

For bug bounty workflows, you rarely look at terminal output. You want to save the results to feed into other tools. FFUF supports multiple formats (json, ejson, html, md, csv, ecsv).

ffuf -w wordlist.txt -u http://target.com/FUZZ -o results.json -of json

Tip: The HTML output is beautifully formatted and great for generating reports.

Real Bug Bounty Workflow

In a professional workflow, FFUF is rarely used in isolation. A standard pipeline looks like this:

  1. Recon: Find all subdomains using subfinder and httpx.
  2. Broad Fuzzing: Run FFUF with a small, highly curated wordlist across all live subdomains to find obvious wins (/admin, /.git, /backup.zip).
  3. Deep Fuzzing: Pick the most interesting targets (e.g., a custom API endpoint) and run FFUF with a massive wordlist, utilizing auto-calibration and recursive fuzzing.
  4. Parameter/Header Fuzzing: Once a specific vulnerable-looking page is found, fuzz the inputs.

Common Mistakes to Avoid

  1. Forgetting -ac (Auto Calibration): Resulting in thousands of garbage results.
  2. Using massive wordlists initially: Don't start with a 5-million-word list. Start small (raft-small-directories.txt) to get a lay of the land, then go deep.
  3. Ignoring Rate Limits: Blasting a WAF (Web Application Firewall) at 100 threads will get you blocked in 3 seconds. Slow down.
  4. Missing file extensions: A server might hide /api.php, which you will miss if you only fuzz for /api.

FFUF Cheat Sheet

Basic Directory Fuzzing ffuf -w wordlist.txt -u ``[http://target/FUZZ](http://target/FUZZ)

Extension Discovery ffuf -w wordlist.txt -u http://target/FUZZ -e .php,.txt

Filter by Response Size ffuf -w wordlist.txt -u http://target/FUZZ -fs 1234

Auto-Calibration ffuf -w wordlist.txt -u http://target/FUZZ -ac

VHost Fuzzing ffuf -w vhosts.txt -u http://target -H "Host: FUZZ.target.com" -ac

POST Parameter Fuzzing ffuf -w list.txt -u http://target/login -X POST -d "user=FUZZ"

Authenticated Scan (Cookie) ffuf -w list.txt -u http://target/FUZZ -b "session=123"

Save Results to JSON ffuf -w list.txt -u http://target/FUZZ -o result.json -of json

Rate Limiting & Throttle ffuf -w list.txt -u http://target/FUZZ -t 10 -p 0.5