Ffuf

FFUF

FFUF (Fuzz Faster U Fool) is a fast and flexible web fuzzer used for discovering hidden files, directories, subdomains, GET and POST parameters, and more. It is widely used in web application testing, especially during active reconnaissance and content discovery phases.

Common Options

Target & Wordlist

These two options are required to run ffuf. You must provide a target URL with the keyword FUZZ (`-u`) and a wordlist file (`-w`) for fuzzing to begin.

Command	Description	Usage
-u [URL]	Target URL with the keyword FUZZ where payloads will be injected	ffuf -u https://target.com/FUZZ
-w [FILE]	Wordlist file to use for fuzzing	ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt

Input Options

Command	Description	Usage
-D	DirSearch wordlist compatibility mode, use with -e	ffuf -u https://target.com/FUZZ -w dirs.txt -D -e php,html
-e [EXT]	Comma-separated list of extensions to append	ffuf -u https://target.com/FUZZ -w dirs.txt -e php,txt
-ic	Ignore comment lines in wordlist	ffuf -u https://target.com/FUZZ -w dict.txt -ic
--input-cmd	Use output from a command as input	ffuf --input-cmd "seq 1 100" --input-num 100 -u https://target.com/id=FUZZ
--input-num [NUM]	Number of values from input-cmd	ffuf --input-cmd "cat users.txt" --input-num 50 -u https://target.com/FUZZ
--input-shell [SHELL]	Shell used to run input-cmd	ffuf --input-shell /bin/zsh --input-cmd "printf '%s\n' {A..Z}" --input-num 26 -u https://target.com/FUZZ
-mode [TYPE]	Multi-wordlist mode: clusterbomb or pitchfork	ffuf -w users.txt:USER -w pass.txt:PASS -mode pitchfork -u https://target.com/login?u=USER&p=PASS
-request [FILE]	Use raw HTTP request from file	ffuf -request raw.txt -w dict.txt -u FUZZ
-request-proto [PROTO]	Protocol to use with raw request	ffuf -request raw.txt -request-proto http -w dict.txt

Filtering & Matching

Command	Description	Usage
-fc [CODE]	Filter out responses with the given HTTP status code	ffuf -u https://target.com/FUZZ -w wordlist.txt -fc 404
-mc [CODE]	Only show responses with specific HTTP status codes	ffuf -u https://target.com/FUZZ -w wordlist.txt -mc 200
-fw [WORDS]	Filter responses by word count	ffuf -u https://target.com/FUZZ -w wordlist.txt -fw 0
-ml [LINES]	Match only responses with specific number of lines	ffuf -u https://target.com/FUZZ -w wordlist.txt -ml 10
-fs [BYTES]	Filter by response size	ffuf -u https://target.com/FUZZ -w wordlist.txt -fs 1234
--filter-regex	Filter responses based on regular expression in the body	ffuf -u https://target.com/FUZZ -w wordlist.txt --filter-regex "Not Found"
-mr [REGEX]	Match responses with regex in body	ffuf -u https://target.com/FUZZ -w list.txt -mr "^Admin"
-ms [BYTES]	Match responses by exact size	ffuf -u https://target.com/FUZZ -w list.txt -ms 1024
-mw [WORDS]	Match responses by word count	ffuf -u https://target.com/FUZZ -w list.txt -mw 50
-fl [LINES]	Filter out by number of lines	ffuf -u https://target.com/FUZZ -w list.txt -fl 0
-fr [REGEX]	Filter responses using regex	ffuf -u https://target.com/FUZZ -w list.txt -fr "Not Found"

Headers, Cookies & Methods

Command	Description	Usage
-H "Header: Value"	Add custom HTTP headers to the request	ffuf -u http://127.0.0.1/ -H "Host: FUZZ.target.com" -w subdomains.txt
-X [METHOD]	HTTP method to use (e.g. GET, POST)	ffuf -X POST -d "username=admin&password=FUZZ" -u https://target.com/login -w rockyou.txt
-d "DATA"	Data to include in request body	ffuf -X POST -d "q=FUZZ" -u https://target.com/search -w payloads.txt
-b "COOKIE=VALUE"	Send cookies with request	ffuf -u https://target.com/dashboard -b "SESSION=FUZZ" -w tokens.txt
-ignore-body	Skip response body content	ffuf -u https://target.com/FUZZ -w list.txt -ignore-body
-r	Follow HTTP redirects	ffuf -u https://target.com/FUZZ -w list.txt -r
-recursion	Recursively scan directories (FUZZ must be at end)	ffuf -u https://target.com/FUZZ -w dirs.txt -recursion
-recursion-depth [N]	Max recursion depth for scanning	ffuf -u https://target.com/FUZZ -w dirs.txt -recursion -recursion-depth 2
-recursion-strategy [STR]	Recursion strategy: default or greedy	ffuf -u https://target.com/FUZZ -w dirs.txt -recursion-strategy greedy
-replay-proxy [URL]	Proxy to replay matched requests	ffuf -u https://target.com/FUZZ -w list.txt -replay-proxy http://127.0.0.1:8081
-x [PROXY]	Proxy URL to route requests through	ffuf -u https://target.com/FUZZ -w list.txt -x socks5://127.0.0.1:9050

Output & Format

Command	Description	Usage
-o [FILE]	Write output to file	ffuf -u https://target.com/FUZZ -w wordlist.txt -o results.txt
-of [FORMAT]	Output file format (json, html, csv, etc.)	ffuf -u https://target.com/FUZZ -w wordlist.txt -of json -o output.json
-or	Don't create output file if no results	ffuf -u https://target.com/FUZZ -w wordlist.txt -o results.txt -or
-debug-log [FILE]	Write internal log to file	ffuf -u https://target.com/FUZZ -w list.txt -debug-log ffuf.log
-od [DIR]	Output directory for matched results	ffuf -u https://target.com/FUZZ -w list.txt -od ./matched

Performance

Command	Description	Usage
-t [NUM]	Number of concurrent threads	ffuf -u https://target.com/FUZZ -w wordlist.txt -t 100
-p [SECONDS]	Delay between each request	ffuf -u https://target.com/FUZZ -w wordlist.txt -p 0.5
-rate [NUM]	Max requests per second	ffuf -u https://target.com/FUZZ -w wordlist.txt -rate 200
--timeout [SEC]	Set timeout for individual requests	ffuf -u https://target.com/FUZZ -w wordlist.txt --timeout 5
-maxtime [SEC]	Maximum total run time in seconds	ffuf -u https://target.com/FUZZ -w wordlist.txt -maxtime 300
-s	Silent mode. Suppresses banner, progress bar, and stats output	ffuf -u https://target.com/FUZZ -w wordlist.txt -s
-maxtime-job [SEC]	Maximum time per job	ffuf -u https://target.com/FUZZ -w wordlist.txt -maxtime-job 60

Status Codes

HTTP status codes returned during fuzzing give insight into how the server responds to various inputs. Understanding these codes helps identify valid endpoints, error states, redirects, and more.

Status Code	Description
200	OK – The request was successful. Often indicates a valid page or endpoint.
204	No Content – The server processed the request but returned no content. Often used to detect hidden but functional endpoints.
301	Moved Permanently – The resource has been permanently moved to a new URL. May indicate URL redirection behavior.
302	Found – The resource temporarily resides under a different URL. Can be used to detect login redirects or session handling.
307	Temporary Redirect – Similar to 302 but the method is preserved. Indicates temporary redirection.
401	Unauthorized – Authentication is required. Useful for identifying protected areas.
403	Forbidden – Access is denied. Often reveals restricted endpoints that exist but are off-limits.
404	Not Found – The requested resource does not exist. A common baseline for filtering invalid responses.
405	Method Not Allowed – The method (e.g., POST, GET) is not allowed for the requested resource.
500	Internal Server Error – The server encountered an unexpected condition. May indicate exploitable flaws.
502	Bad Gateway – The server received an invalid response from the upstream server.
503	Service Unavailable – The server is currently unavailable. May suggest rate limiting or maintenance.
504	Gateway Timeout – The upstream server failed to send a request in time. May indicate backend issues.

Examples

Target URL

ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt
# Output:
# /admin           [Status: 301, Size: 0, Words: 1, Lines: 1]
# /login           [Status: 200, Size: 1024, Words: 132, Lines: 15]

↑ Options

Wordlist Option

ffuf -u https://target.com/FUZZ -w wordlist.txt
# Output:
# /secret          [Status: 403, Size: 512, Words: 22, Lines: 4]

↑ Options

Input from Command

ffuf -u https://target.com/FUZZ --input-cmd "seq 1 100"
# Output:
# /12              [Status: 200, Size: 900, Words: 100, Lines: 10]

↑ Options

Fuzz Numeric Range

ffuf -u https://target.com/user?id=FUZZ --input-num 1-100
# Output:
# user?id=42       [Status: 200, Size: 1500, Words: 150, Lines: 20]

↑ Options

Filter by Status Code

ffuf -u https://target.com/FUZZ -w wordlist.txt -fc 404
# Output:
# All 404 responses are hidden

↑ Options

Match Specific Status Code

ffuf -u https://target.com/FUZZ -w wordlist.txt -mc 200
# Output:
# /dashboard       [Status: 200, Size: 2048, Words: 250, Lines: 25]

↑ Options

Filter by Word Count

ffuf -u https://target.com/FUZZ -w wordlist.txt -fw 0
# Output:
# Only responses with more than 0 words are shown

↑ Options

Match by Line Count

ffuf -u https://target.com/FUZZ -w wordlist.txt -ml 10
# Output:
# /help            [Status: 200, Size: 850, Words: 90, Lines: 10]

↑ Options

Filter by Size

ffuf -u https://target.com/FUZZ -w wordlist.txt -fs 1234
# Output:
# /about           [Status: 200, Size: 1234, Words: 140, Lines: 12]

↑ Options

Filter by Regex

ffuf -u https://target.com/FUZZ -w wordlist.txt --filter-regex "Not Found"
# Output:
# Only responses that do not contain "Not Found" in the body are shown

↑ Options

Output to File

ffuf -u https://target.com/FUZZ -w wordlist.txt -o results.txt
# Output:
# Results saved to results.txt

↑ Options

Specify Output Format

ffuf -u https://target.com/FUZZ -w wordlist.txt -o results.json -of json
# Output:
# Results saved in JSON format to results.json

↑ Options

Show Redirect Location

ffuf -u https://target.com/FUZZ -w wordlist.txt -or
# Output:
# /old-page        [Status: 301, Redirect: /new-page]

↑ Options

Custom Header Fuzzing

ffuf -u http://127.0.0.1/ -H "Host: FUZZ.target.com" -w subdomains.txt
# Output:
# Host: admin.target.com   [Status: 200, Size: 5120, Words: 500, Lines: 30]

↑ Options

Use POST Method

ffuf -X POST -d "username=admin&password=FUZZ" -u https://target.com/login -w rockyou.txt
# Output:
# Password guess "letmein" returns Status: 302 (Login success redirect)

↑ Options

POST Data with FUZZ

ffuf -X POST -d "q=FUZZ" -u https://target.com/search -w payloads.txt
# Output:
# Payload "admin" produces search results page (Status: 200)

↑ Options

Threads for Speed

ffuf -u https://target.com/FUZZ -w wordlist.txt -t 100
# Output:
# Much faster scan due to increased concurrency

↑ Options

Delay Between Requests

ffuf -u https://target.com/FUZZ -w wordlist.txt -p 0.5
# Output:
# Slower scan with 0.5s delay between requests (useful to avoid rate limits)

↑ Options

Set Request Timeout

ffuf -u https://target.com/FUZZ -w wordlist.txt --timeout 5
# Output:
# Requests that take more than 5 seconds will be skipped

↑ Options

See Also

• dirb
• gobuster
• wfuzz
• burpsuite
• httpx