Cyber Research Wiki

ffuf

ffuf is a fast, flexible web fuzzer for web content discovery and request templating. It automates path, parameter, and virtual host discovery using wordlists and response-based match/filter logic, supporting machine-readable outputs for integration into broader security workflows.

Overview

ffuf (Fuzz Faster U Fool) is a command-line tool written in Go for high-speed web fuzzing and content discovery. It is used in web application and API security testing to enumerate unlinked or protected resources and to probe request elements to observe access control and other security behaviors. The project is actively maintained, provides documentation via a GitHub wiki, and emits multiple output formats suitable for both human review and automated pipelines. Its role is complementary to manual testing and other dynamic analysis tooling, emphasizing input-driven enumeration and response triage rather than full vulnerability scanning.

What It Is

ffuf is a web fuzzer centered on mutating HTTP(S) requests and classifying responses. It substitutes a placeholder keyword within URLs, headers, or bodies with candidate inputs drawn from one or more wordlists. Typical targets include directories and files, parameter names or values, and the Host header for virtual host probing. It is commonly applied to detect forced-browsing exposures and to support assessment of authorization consistency across endpoints. It is not a general-purpose vulnerability scanner and relies on operator-selected inputs and triage criteria.

How It Works

ffuf defines test cases by embedding a placeholder keyword (default: FUZZ) anywhere in a request template and supplying candidate values from wordlists or an external generator. With multiple wordlists, it combines inputs across placeholders using modes such as clusterbomb and pitchfork. Response triage is guided by matchers and filters over status codes, sizes, word and line counts, regular expressions, and timing, with optional auto-calibration to suppress baseline noise. The engine supports recursion to extend discovery depth, virtual host discovery by fuzzing the Host header without DNS lookups, and a replay-proxy that forwards only matched traffic to an intercepting proxy for manual analysis. Results can be exported in machine- and human-readable formats, including JSON, JSONLines for streaming, CSV, HTML, and Markdown.

Core Concepts

Typical Workflow

Use Cases

Limitations

Related Tools

Evidence Gaps

Sources

Confidence

high