A Web Fuzzing tool written in Go.
For fuzzing methods that can be used with FFUF, see Web Fuzzing.
Commands
ffuf -w <wordlist.txt>:<KEYWORD> -u <URL>/<KEYWORD> [OPTIONS]It is mandatory to specify:
- Wordlist followed by
:and a keyword written in capital letters to associate with the inputs from the wordlist. Multiple wordlists can be defined by multiple-w <wordlist1>:<KEYWORD1>, where each keyword must be placed in the URL. - A URL of the target host. Unless header fuzzing is used (
-H), the URL must have the keyword(s) placed somewhere, which is the place in the web request that the fuzzer place its inputs from the wordlist.
Options
-ic: ignore copyright comments in wordlists, that might clutter the results.-e <.ext>: specify extension to files.-recursion -recursion-depth <int>: fuzz recursively to search for sub-directories<int>levels below.-v: verbose mode that output the full URLs of the found pages.-t <int>: use<int>threads.-r: follow redirects.-H "<header> <KEYWORD>": fuzz header in HTTP request instead of URL.-fs <int>: filter out results with a size of<int>.-H "Host: FUZZ.target": fuzz for VHosts