# ffuf

> Fast web fuzzer written in Go for directory discovery, virtual host discovery, and parameter fuzzing

Stars: 17.0k · Categories: Network

- Repository: https://github.com/ffuf/ffuf
- Page: https://www.trmn.sh/tools/ffuf

## Install

- Homebrew: `brew install ffuf`
- Go: `go install github.com/ffuf/ffuf/v2@latest`

## Overview

ffuf is a web fuzzer written in Go that performs HTTP-based fuzzing operations for security testing and reconnaissance. It uses the keyword `FUZZ` as a placeholder in URLs, headers, or POST data to systematically test different values from wordlists.

The tool supports multiple fuzzing scenarios including directory and file discovery, virtual host enumeration without DNS records, GET and POST parameter fuzzing, and custom HTTP header manipulation. It includes filtering capabilities based on response codes, response sizes, line counts, and response times, allowing users to identify meaningful results by filtering out expected responses.

ffuf provides advanced features like recursion for deeper directory traversal, auto-calibration to automatically determine filter values, external mutators for generating test cases (such as integration with Radamsa), and configuration file support for persistent settings. It supports concurrent threading, request rate limiting, proxy usage, and both HTTP/1.1 and HTTP/2 protocols.

The tool is primarily used by security researchers, penetration testers, and bug bounty hunters for web application reconnaissance and vulnerability discovery. Its Go implementation provides fast execution speeds suitable for large-scale fuzzing operations.

### Installation

```bash
# via Homebrew
brew install ffuf
```

```bash
# via Go
go install github.com/ffuf/ffuf/v2@latest
```

![Directory discovery example](https://asciinema.org/a/211350.png)

![Virtual host discovery example](https://asciinema.org/a/211360.png)

## Alternatives

- [katana](https://www.trmn.sh/tools/katana.md): Go-based web crawler from ProjectDiscovery with standard and headless Chrome modes, JavaScript endpoint parsing, scope control, and JSON output for pipelines. (Go, 17.8k stars)
- [monolith](https://www.trmn.sh/tools/monolith.md): CLI tool that bundles web pages into single HTML files with all CSS, images, and JavaScript embedded inline (Rust, 15.6k stars)
- [dirsearch](https://www.trmn.sh/tools/dirsearch.md): Web path brute-forcer that discovers hidden directories and files on web servers using customizable wordlists (15.0k stars)
- [subfinder](https://www.trmn.sh/tools/subfinder.md): Passive subdomain enumeration tool written in Go that queries online sources, with JSON output, wildcard elimination, and STDIN/STDOUT support. (Go, 14.7k stars)
- [Gobuster](https://www.trmn.sh/tools/gobuster.md): Go-based brute-forcing tool for web directories/files, DNS subdomains, virtual hosts, S3/GCS buckets, TFTP files, and custom fuzzing. (Go, 14.3k stars)

---

Canonical: https://www.trmn.sh/tools/ffuf