ffuf

ffuf is a web fuzzer written in Go that performs HTTP-based discovery and enumeration tasks. It uses the FUZZ keyword as a placeholder in URLs, headers, or POST data to test multiple inputs from wordlists. The tool supports directory discovery by fuzzing URL paths, virtual host discovery by fuzzing HTTP Host headers, and parameter fuzzing for both GET and POST requests.

The tool provides filtering capabilities to exclude unwanted responses based on status codes, response sizes, word counts, or regular expressions. It includes auto-calibration features to automatically determine filter values, recursion support for nested directory discovery, and rate limiting controls. ffuf can handle external mutators like Radamsa for generating test cases and supports configuration files for persistent settings.

ffuf targets security researchers, penetration testers, and web application security professionals who need to discover hidden resources, enumerate subdomains, or test parameter values. It offers concurrent request processing with configurable thread counts, HTTP/2 support, proxy integration, and various output formats including JSON for automation workflows.

Installation

# via Homebrew
brew install ffuf

# via Go
go install github.com/ffuf/ffuf/v2@latest