LOADING N0PERM…
Fast web fuzzer written in Go. Ideal for directory discovery, API parameter fuzzing, and virtual host identification.
A standard WEB_SECURITY utility used across offensive reconnaissance, packet forensics, and defensive system administration.
Direct visibility into network interfaces, protocol frames, access controls, or filesystem structures without graphical overhead.
During live system triage, initial reconnaissance, forensic capture inspection, or baseline configuration auditing.
# Go install
go install github.com/ffuf/ffuf/v2@latest
# Debian / Kali
sudo apt install ffufCommon fuzzing patterns:
- Directory fuzzing: ffuf -u https://target.app/FUZZ -w wordlist.txt -mc 200,301
- Subdomain / vhost fuzzing: ffuf -u https://target.app/ -H 'Host: FUZZ.target.app' -w hosts.txt -fs 1234
- POST parameter fuzzing: ffuf -u https://target.app/login -X POST -d 'user=FUZZ&pass=test' -w users.txt