FFUF
FFUF (Fuzz Faster U Fool) is a fast and flexible web fuzzer used for discovering hidden files, directories, subdomains, GET and POST parameters, and more.
It is widely used in web application testing, especially during active reconnaissance and content discovery phases.
Common Options
Target & Wordlist
| Option |
Description
|
| -u [URL] |
Target URL with the keyword FUZZ where payloads will be injected
|
| -w [FILE] |
Wordlist file to use for fuzzing
|
| --input-cmd |
Use the output of a command as input (e.g. seq 1 100)
|
| --input-num |
Fuzz with a range of numbers (e.g. 1-100)
|
Filtering & Matching
| Option |
Description
|
| -fc [CODE] |
Filter out responses with the given HTTP status code
|
| -mc [CODE] |
Only show responses with specific HTTP status codes
|
| -fw [WORDS] |
Filter responses by word count
|
| -ml [LINES] |
Match only responses with specific number of lines
|
| -fs [BYTES] |
Filter by response size
|
| --filter-regex |
Filter responses based on regular expression in the body
|
Output & Format
| Option |
Description
|
| -o [FILE] |
Save output to file
|
| -of [FORMAT] |
Specify output format (json, html, csv, etc.)
|
| -or |
Show redirect location in results
|
| Option |
Description
|
| -H "Header: Value" |
Add custom HTTP headers to the request
|
| -X [METHOD] |
HTTP method to use (e.g. GET, POST)
|
| -d "DATA" |
Data to include in request body (use FUZZ inside the string)
|
Performance
Examples
Target URL
ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt
# Output:
# /admin [Status: 301, Size: 0, Words: 1, Lines: 1]
# /login [Status: 200, Size: 1024, Words: 132, Lines: 15]
↑ Options
Wordlist Option
ffuf -u https://target.com/FUZZ -w wordlist.txt
# Output:
# /secret [Status: 403, Size: 512, Words: 22, Lines: 4]
↑ Options
Input from Command
ffuf -u https://target.com/FUZZ --input-cmd "seq 1 100"
# Output:
# /12 [Status: 200, Size: 900, Words: 100, Lines: 10]
↑ Options
Fuzz Numeric Range
ffuf -u https://target.com/user?id=FUZZ --input-num 1-100
# Output:
# user?id=42 [Status: 200, Size: 1500, Words: 150, Lines: 20]
↑ Options
Filter by Status Code
ffuf -u https://target.com/FUZZ -w wordlist.txt -fc 404
# Output:
# All 404 responses are hidden
↑ Options
Match Specific Status Code
ffuf -u https://target.com/FUZZ -w wordlist.txt -mc 200
# Output:
# /dashboard [Status: 200, Size: 2048, Words: 250, Lines: 25]
↑ Options
Filter by Word Count
ffuf -u https://target.com/FUZZ -w wordlist.txt -fw 0
# Output:
# Only responses with more than 0 words are shown
↑ Options
Match by Line Count
ffuf -u https://target.com/FUZZ -w wordlist.txt -ml 10
# Output:
# /help [Status: 200, Size: 850, Words: 90, Lines: 10]
↑ Options
Filter by Size
ffuf -u https://target.com/FUZZ -w wordlist.txt -fs 1234
# Output:
# /about [Status: 200, Size: 1234, Words: 140, Lines: 12]
↑ Options
Filter by Regex
ffuf -u https://target.com/FUZZ -w wordlist.txt --filter-regex "Not Found"
# Output:
# Only responses that do not contain "Not Found" in the body are shown
↑ Options
Output to File
ffuf -u https://target.com/FUZZ -w wordlist.txt -o results.txt
# Output:
# Results saved to results.txt
↑ Options
Specify Output Format
ffuf -u https://target.com/FUZZ -w wordlist.txt -o results.json -of json
# Output:
# Results saved in JSON format to results.json
↑ Options
Show Redirect Location
ffuf -u https://target.com/FUZZ -w wordlist.txt -or
# Output:
# /old-page [Status: 301, Redirect: /new-page]
↑ Options
ffuf -u http://127.0.0.1/ -H "Host: FUZZ.target.com" -w subdomains.txt
# Output:
# Host: admin.target.com [Status: 200, Size: 5120, Words: 500, Lines: 30]
↑ Options
Use POST Method
ffuf -X POST -d "username=admin&password=FUZZ" -u https://target.com/login -w rockyou.txt
# Output:
# Password guess "letmein" returns Status: 302 (Login success redirect)
↑ Options
POST Data with FUZZ
ffuf -X POST -d "q=FUZZ" -u https://target.com/search -w payloads.txt
# Output:
# Payload "admin" produces search results page (Status: 200)
↑ Options
Threads for Speed
ffuf -u https://target.com/FUZZ -w wordlist.txt -t 100
# Output:
# Much faster scan due to increased concurrency
↑ Options
Delay Between Requests
ffuf -u https://target.com/FUZZ -w wordlist.txt -p 0.5
# Output:
# Slower scan with 0.5s delay between requests (useful to avoid rate limits)
↑ Options
Set Request Timeout
ffuf -u https://target.com/FUZZ -w wordlist.txt --timeout 5
# Output:
# Requests that take more than 5 seconds will be skipped
↑ Options
See Also