ffuf
fast web fuzzer written in Go
TLDR
SYNOPSIS
ffuf [options]
DESCRIPTION
ffuf (Fuzz Faster U Fool) is a fast web fuzzer written in Go. It discovers hidden content, parameters, and vulnerabilities by sending requests with wordlist entries substituted at marked positions.The tool excels at content discovery, parameter fuzzing, and virtual host enumeration. Filtering options allow matching or excluding responses by status, size, words, or lines.ffuf's speed and flexibility make it popular for penetration testing and security assessments.
PARAMETERS
-u URL
Target URL with FUZZ keyword.-w WORDLIST
Wordlist file.-X METHOD
HTTP method.-d DATA
POST data.-H HEADER
Custom header.-fc CODES
Filter out responses by status code.-fs SIZE
Filter out responses by size.-fw COUNT
Filter out responses by word count.-fl COUNT
Filter out responses by line count.-mc CODES
Match status codes (default 200-299,301,302,307,401,403,405,500).-ms SIZE
Match response size.-e EXTENSIONS
Comma-separated extensions to append to each word.-recursion
Scan recursively into discovered directories.-recursion-depth N
Maximum recursion depth.-t N
Number of concurrent threads (default 40).-rate N
Rate limit in requests per second (0 = unlimited).-o FILE
Write results to a file.-of FORMAT
Output format (json, csv, html, md, ...).-c
Colorize output.-s
Silent mode, show only results.--help
Display help information.
CAVEATS
Only use against authorized targets. High thread counts may overwhelm servers. Results need manual verification.
HISTORY
ffuf was created by joohoi as a fast, flexible web fuzzer. Written in Go for performance, it has become a standard tool in web application security testing.