Attacking Web Applications with Ffuf¶

What Is Ffuf?¶

Ffuf (Fuzz Faster U Fool) is a fast, flexible web fuzzer written in Go. It accepts one or more wordlists and injects each entry at positions you mark with the FUZZ keyword — in the URL path, query string, headers, POST body, or anywhere else in the HTTP request. Its speed (multithreaded, compiled binary) and filtering power make it the go-to tool for OSCP/CPTS-level web enumeration.

Unlike tools that are locked into a single fuzzing mode (e.g., directory brute-forcing only), ffuf is a generic HTTP fuzzer. You define where the payload goes and how to identify hits. That flexibility is what makes it a core exam tool.

Installation¶

# Kali / Parrot (pre-installed)
which ffuf

# Manual install (latest)
go install github.com/ffuf/ffuf/v2@latest

# Verify
ffuf -V

Core Syntax¶

Every ffuf command follows the same pattern:

ffuf -w <wordlist>:FUZZ -u http://target/FUZZ

The FUZZ keyword is a placeholder that ffuf replaces with each line from the wordlist. You can place it anywhere in the request:

You can also use multiple keywords (e.g., W1, W2) for multi-position fuzzing:

ffuf -w users.txt:W1 -w passwords.txt:W2 -u http://10.10.10.5/login -d "user=W1&pass=W2"

Common Flags Reference¶

Methodology¶

The fuzzing workflow follows a logical escalation from broad discovery to targeted exploitation:

graph LR
    A[Directory<br>Fuzzing] --> B[Extension<br>Fuzzing]
    B --> C[Page<br>Fuzzing]
    C --> D[Recursive<br>Fuzzing]
    D --> E[Subdomain<br>Fuzzing]
    E --> F[VHost<br>Fuzzing]
    F --> G[Parameter<br>Fuzzing]
    G --> H[Value<br>Fuzzing]

Each phase builds on the previous:

1. Directory Fuzzing — Find top-level directories on the target
2. Extension Fuzzing — Determine what tech stack / file types the server uses
3. Page Fuzzing — Combine directories + extensions to find actual pages
4. Recursive Fuzzing — Automatically spider nested directories
5. Subdomain Fuzzing — Discover DNS-resolvable subdomains
6. VHost Fuzzing — Find virtual hosts that don't have DNS entries
7. Parameter Fuzzing — Discover hidden GET/POST parameters on known pages
8. Value Fuzzing — Brute-force parameter values for exploitation

Series Navigation¶

References¶

• Ffuf GitHub Repository
• SecLists — Discovery Wordlists
• Ffuf Documentation Wiki