ffuf

ffuf is a web fuzzer written in Go that performs HTTP-based fuzzing operations for security testing and reconnaissance. It uses the keyword FUZZ as a placeholder in URLs, headers, or POST data to systematically test different values from wordlists.

The tool supports multiple fuzzing scenarios including directory and file discovery, virtual host enumeration without DNS records, GET and POST parameter fuzzing, and custom HTTP header manipulation. It includes filtering capabilities based on response codes, response sizes, line counts, and response times, allowing users to identify meaningful results by filtering out expected responses.

ffuf provides advanced features like recursion for deeper directory traversal, auto-calibration to automatically determine filter values, external mutators for generating test cases (such as integration with Radamsa), and configuration file support for persistent settings. It supports concurrent threading, request rate limiting, proxy usage, and both HTTP/1.1 and HTTP/2 protocols.

The tool is primarily used by security researchers, penetration testers, and bug bounty hunters for web application reconnaissance and vulnerability discovery. Its Go implementation provides fast execution speeds suitable for large-scale fuzzing operations.

Installation

# via Homebrew
brew install ffuf

# via Go
go install github.com/ffuf/ffuf/v2@latest