ffuf-fuzz

Complete reference for the ffuf fuzzing tool

ffuf (Fuzz Faster U Fool) is the most flexible web fuzzing tool. Core concept: use the FUZZ keyword to mark the positions to be replaced.

Phase 1: Directory/file discovery (most commonly used)

# 基础目录扫描
ffuf -u http://target/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt

# 指定扩展名
ffuf -u http://target/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt \
    -e .php,.html,.txt,.bak,.zip

# 递归扫描（发现目录后继续深入）
ffuf -u http://target/FUZZ -w wordlist.txt -recursion -recursion-depth 2

Large wordlist deep scan

ffuf -u http://target/FUZZ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
-e .php,.asp,.jsp -t 50


### 字典选择

| 场景 | 推荐字典 |
|------|----------|
| 快速扫描 | `Discovery/Web-Content/common.txt` (4660) |
| 中等扫描 | `Discovery/Web-Content/directory-list-2.3-small.txt` (87k) |
| 深度扫描 | `Discovery/Web-Content/directory-list-2.3-medium.txt` (220k) |
| 备份文件 | `Discovery/Web-Content/common-and-backup.txt` |
| API 路径 | `Discovery/Web-Content/api/api-endpoints.txt` |
| CTF 常见 | `/pentest/AboutSecurity/Dic/web/ctf/` |

---

## Phase 2: 参数 Fuzz（发现隐藏参数）

```bash
# GET 参数发现
ffuf -u 'http://target/page.php?FUZZ=test' \
    -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
    -fs 4242  # 过滤默认响应大小

# GET 参数值 Fuzz
ffuf -u 'http://target/page.php?id=FUZZ' \
    -w /usr/share/seclists/Fuzzing/integers-1-1000.txt

# POST 参数发现
ffuf -u 'http://target/api' -X POST \
    -d 'FUZZ=test' \
    -H 'Content-Type: application/x-www-form-urlencoded' \
    -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
    -fs 4242

# JSON 参数 Fuzz
ffuf -u 'http://target/api' -X POST \
    -d '{"FUZZ":"test"}' \
    -H 'Content-Type: application/json' \
    -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
    -fs 4242

CTF-specific parameter wordlist：/pentest/AboutSecurity/Dic/web/ctf/param.txt

Phase 3: Virtual host / subdomain enumeration

# 虚拟主机枚举（通过 Host 头）
ffuf -u http://target/ -H 'Host: FUZZ.target.com' \
    -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
    -fs 4242  # 过滤默认页面大小

Phase 4: Multi-position fuzzing

ffuf supports multiple FUZZ keywords (distinguished by different names):

# 用户名+密码爆破
ffuf -u http://target/login -X POST \
    -d 'username=HFUZZ&password=WFUZZ' \
    -H 'Content-Type: application/x-www-form-urlencoded' \
    -w users.txt:HFUZZ -w passwords.txt:WFUZZ \
    -fc 401  # 过滤 401 响应

# 目录+扩展名组合
ffuf -u http://target/W1FUZZ.W2FUZZ \
    -w dirs.txt:W1FUZZ -w extensions.txt:W2FUZZ \
    -mode clusterbomb  # 所有组合（笛卡尔积）

Fuzz mode

Mode	Description	Scenario
`clusterbomb`	All combinations (default)	Username x Password
`pitchfork`	One-to-one correspondence	Known paired credentials
`sniper`	Single wordlist per position	Single parameter multiple positions

Phase 5: Filtering and matching (critical!)

ffuf displays all responses by default, so noise needs to be filtered:

Filter (exclude unwanted)

Parameter	Function	Example
`-fc`	Filter status code	`-fc 404,403,500`
`-fs`	Filter response size	`-fs 4242`
`-fw`	Filter response word count	`-fw 12`
`-fl`	Filter response line count	`-fl 5`
`-fr`	Filter regex match	`-fr 'not found'`
`-ft`	Filter response time	`-ft '>3000'`(>3 seconds)

Match (only show wanted)

Parameter	Function	Example
`-mc`	Match status code	`-mc 200,301,302`
`-ms`	Match response size	`-ms 1234`
`-mw`	Match response word count	`-mw 100-500`
`-mr`	Match regex	`-mr 'flag\{.*\}'`

Tip: run once without filters first, observe the default response size, then useto filter it out. -fs Tip: run once without filters first, observe the default response size, then use -fs to filter it out.

Phase 6: Common options

# 线程数（默认 40，可调高）
-t 100

# 延迟（避免被封，单位秒；0.1 = 100ms）
-p 0.1

# 请求速率限制（每秒请求数）
-rate 50

# 自定义 Cookie
-b 'session=abc123; token=xyz'

# 自定义 Header
-H 'Authorization: Bearer TOKEN'
-H 'X-Forwarded-For: 127.0.0.1'

# 代理
-x http://127.0.0.1:8080
-x socks5://127.0.0.1:1080

# 输出到文件
-o results.json -of json
-o results.csv -of csv
-o results.html -of html

# 自动校准（自动检测过滤基线）
-ac

# 跟随重定向
-r

# 超时（秒）
-timeout 10

# 静默模式（只输出结果）
-s

Real-world scenario quick reference

Scenario	Command
Quick directory scan	`ffuf -u URL/FUZZ -w common.txt -mc 200,301,302`
Scan for PHP files	`ffuf -u URL/FUZZ -w common.txt -e .php -mc 200`
Find hidden parameters	`ffuf -u 'URL?FUZZ=1' -w burp-parameter-names.txt -fs SIZE`
LFI parameter fuzzing	`ffuf -u 'URL?FUZZ=../../../etc/passwd' -w param.txt -mr 'root:'`
Subdomain enumeration	`ffuf -u URL -H 'Host: FUZZ.target' -w subdomains.txt -fs SIZE`
Brute-force login	`ffuf -u URL -X POST -d 'user=admin&pass=FUZZ' -w passwords.txt -fc 401`
API endpoint discovery	`ffuf -u URL/api/FUZZ -w api-endpoints.txt -mc 200,401,403`
Backup file search	`ffuf -u URL/FUZZ -w common.txt -e .bak,.zip,.tar.gz,.sql -mc 200`

Notes

-ac automatic calibrationVery practical—automatically detects the default response and filters it, reducing the hassle of manually setting -fs -ac automatic calibration is very practical—automatically detects the default response and filters it, reducing the hassle of manually setting -fs
ffuf defaults to 40 threads, which may be too fast for weak targets and cause 429s/IP bans; lower it to -t 10 -p 0.1
Wordlist paths: SecLists is usually at /usr/share/seclists/, AboutSecurity wordlists are at /pentest/AboutSecurity/Dic/
POST fuzzing must specify the Content-Type header, otherwise the server may not parse it
Multi-position fuzzing defaults to clusterbomb (Cartesian product); with large wordlists the number of combinations explodes, so pay attention to wordlist size