_ ReconLab
Commands  / Web Application  / ffuf

ffuf

Fuzz Faster U Fool — high-speed web fuzzer.

KaliParrotmedium

pkg: ffuf

ffuf fuzzes any part of a request (path, params, headers, host) using the FUZZ keyword and powerful matchers/filters.

Syntax

ffuf -u {url with FUZZ} -w {wordlist}

Example

ffuf -u https://example.com/FUZZ -w wordlist.txt -mc 200,301

Fuzzes the path, matching only 200 and 301 responses (-mc).

Options & flags

What each switch does. Toggle them in the builder below to assemble a command.

-u <https://target.tld/FUZZ>URL with the FUZZ keyword where the wordlist is injected.
-w <wordlist.txt>Wordlist (add :KEYWORD for multiple wordlists).
-mc <200,301,302,401,403>Match these HTTP status codes.
-fc <404>Filter out (hide) these status codes.
-fs <0>Filter out responses of this size (calibrate false positives).
-X <POST>HTTP method (GET/POST).
-H <Header: value>Add a header, e.g. "Authorization: Bearer x".
-t <40>Concurrent threads.
-sSilent mode (results only).

Command builder

Tick options (and fill any values) to build a ready-to-copy command.

ffuf

Usage examples

ffuf -u https://target.tld/FUZZ -w wordlist.txt -mc 200,301

Directory fuzzing, matching 200/301.

ffuf -u https://target.tld/api?FUZZ=1 -w params.txt -fs 0

Parameter fuzzing, filtering empty responses.

ffuf -u https://FUZZ.target.tld -w subs.txt -H "Host: FUZZ.target.tld"

Virtual-host / subdomain fuzzing.

Advantages
  • Extremely fast and flexible
  • Fuzz paths, params, headers, vhosts
  • Rich matcher/filter calibration
Disadvantages
  • Easy to overwhelm a target
  • Needs filter tuning (-fs/-fc)
  • High request volume
Tags
#web#fuzzing

Official docs: ffuf ↗

Related commands

feroxbuster

Fast, recursive content discovery in Rust.

Gobuster

Fast directory/DNS/vhost brute-forcer.

Wfuzz

Web application fuzzer for content & parameters.

Frequently asked questions

What is ffuf used for?
ffuf fuzzes any part of a request (path, params, headers, host) using the FUZZ keyword and powerful matchers/filters.
What is an example ffuf command?
A common example is: ffuf -u https://example.com/FUZZ -w wordlist.txt -mc 200,301 — Fuzzes the path, matching only 200 and 301 responses (-mc).
Is ffuf part of Kali Linux?
Yes. ffuf ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install ffuf.
What category of security tool is ffuf?
ffuf is a Web Application tool with a medium-risk profile when run against a live target.

Try recon tools live

Run real scans against a domain you control, stage by stage.

Open the lab →