ffuf

ffuf (“Fuzz Faster U Fool”, github.com/ffuf/ffuf) is a fast web fuzzer written in Go by joohoi. Like wfuzz, its core model is a single keyword — FUZZ — that can appear anywhere in a request (URL path, headers, POST body, parameters) and is replaced by each entry of a wordlist. Written in Go with goroutine-based concurrency, it is one of the fastest general-purpose HTTP fuzzers, and has largely displaced wfuzz as the default CLI fuzzer in modern workflows.

Directory/file enumeration

ffuf -w /usr/share/wordlists/dirb/common.txt \
     -u https://$DOMAIN/FUZZ

Virtual host discovery

Fuzzing the Host header brute-forces name-based virtual hosts that have no DNS records:

ffuf -w /usr/share/wordlists/metasploit/namelist.txt \
     -H "Host: FUZZ.$DOMAIN" \
     -u https://$IP -fs $DEFAULT_SIZE

Every unknown Host returns the same default vhost response, so filter it out by response size with -fs $SIZE (match on size is the usual vhost-discovery trick — ffuf also supports -fc status, -fl lines, -fw words).

Username enumeration

Against a non-AJAX login or password-reset form, filter on page text for a “successful hit”:

ffuf -w /usr/share/wordlists/wfuzz/others/names.txt \
     -X POST -d "$POST_VARS" \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -u $FORM_URL -mr "$ERROR_MESSAGE_SUBSTRING" -s

$POST_VARS looks like username=FUZZ&email=FUZZ@example.com&password=1234&cpassword=1234. -mr matches on a regex in the response; -s suppresses everything except successful hits.

Login credential brute-forcing

Multiple wordlists map to multiple placeholders (W1, W2, …):

ffuf -w names.txt:W1,rockyou.txt:W2 \
     -X POST -d "username=W1&password=W2" \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -u $LOGIN_URL -fc 200 -s

-fc 200 filters out the “failed login” status; a success typically redirects (301/302). Warning: ffuf tries the full Cartesian product of the two lists, so combinations grow geometrically — enumerate usernames first (previous section), then brute-force passwords against the short list. For pure credential guessing against login forms, hydra’s http-post-form module is the more specialized tool.

Other capabilities

• -maxtime / -maxtime-job — bound total / per-recursion-job runtime
• -recursion -recursion-depth N — descend into discovered directories
• --input-cmd — pipe payloads from an external mutator (e.g. radamsa) instead of a wordlist; $FFUF_NUM is exposed as a seed
• Configuration files (~/.ffufrc) for default options; interactive mode for tweaking filters mid-run

Relationship to other tools

• wfuzz — the Python predecessor with the same FUZZ model; richer encoders/iterators, slower
• gobuster — Go-based, mode-driven (dir/dns/vhost/fuzz); comparable speed, narrower scope than ffuf’s anything-anywhere fuzzing
• turbo-intruder — Burp-based, optimized for extreme request rates and race conditions
• hydra — online credential brute-forcer; complementary when the target is a login form
• burp-suite Intruder — GUI-driven equivalent

Sources

• ffuf/ffuf — Fast web fuzzer written in Go
• ffuf/ffuf Wiki — Home
• 2020 — Everything you need to know about FFUF | Codingo

Related: wfuzz, gobuster, hydra, turbo-intruder, owasp-zap