A fast web fuzzer written in Go.

Wordlists#

Typical fuzzing#

ffuf -u 'http://10.49.149.19:1337/' -d 'email=tester%40hammer.thm&password=FUZZ' -H 'Content-Type: application/x-www-form-urlencoded' -H 'Origin: http://10.49.149.19:1337' -H 'Cookie: PHPSESSID=md4lrhv2gqqains5nsr8j7fns9' -w /usr/share/wordlists/rockyou.txt -t 1000 -fr 'Invalid Email or Password!'

Typical directory discovery#

ffuf -w wordlist.txt -u 'https://ffuf.io.fi/FUZZ'

Custom FUZZ keyword example#

ffuf -w wordlist.txt:MYCUSTOMKEYWORD -u 'https://ffuf.io.fi/MYCUSTOMKEYWORD'

Multi-wordlist example#

ffuf -w domains.txt:DOMAIN -w wordlist.txt:WORD -u 'https://DOMAIN/WORD'

Multi-wordlist clusterbomb example#

This is the default mode for multi-wordlists, and is active if no other -mode is selected.
First word of first wordlist is tested against all the words from the second wordlist before moving along to test the second word in first wordlist against all the words in the second wordlist.
ffuf -mode clusterbomb -w domains.txt:DOMAIN -w wordlist.txt:WORD -u 'https://DOMAIN/WORD'

Pitchfork mode#

When running a pitchfork operation, the words from the wordlists are read in lockstep. This means that the first word from all the wordlists is used in the first request, second word from all of the wordlists is used for the second and so on.
ffuf -mode pitchfork -w usernames.txt:USER -w user_ids.txt:UID -u 'https://example.org/u/UID/profile/USER'

Request configuration#

Raw request example#

lets copy the request information in the text file raq_req.txt and use FUZZ keyword against the field you want to bruteforce.
ffuf -w wordlist.txt -request raw_req.txt

HTTP verb (request type using -X)#

ffuf -X PATCH -w wordlist.txt -u https://ffuf.io.fi/FUZZ

Headers#

Lets fuzz the headers, usefull while bruteforcing against the MFA
ffuf -w wordlist.txt -u 'https://ffuf.io.fi/' -H 'FUZZ: 127.0.0.1'

Request body (data)#

Fuzzing the rbody
ffuf -w sqli_payloads_list.txt -u 'https://ffuf.io.fi/api/v1/users/1'-X PUT -H 'Content-Type: application/json' -d '{"uid":"FUZZ"}'

Proxy#

You can use HTTP or SOCKS proxies with ffuf in case you find yourself needing one. Like in curl, this can be done with a CLI argument -x http://proxy_ip:proxy_port
ffuf -x 'http://127.0.0.1:8080' -w wordlist.txt -u 'https://ffuf.io.fi/FUZZ'

Matching and filtering#

Matcher types#

  • Response code: -mc and -fc: This is the most common matcher/filter that inspects the response HTTP code, and makes decisions based on it. A global default in ffuf is matching response codes 200,204,301,302,307,401,403,405,500 for ease of use. -mc also has a special value “all” to tell ffuf to match everything

    # Example: match all, but filter out all 400 (bad request) responses
ffuf -w wordlist.txt -u 'https://ffuf.io.fi/FUZZ' -mc all -fc 400

  • Response size: -ms and -fs: Matcher and filter based on the response Content-Length

    # Example: match all, but filter out all responses of size 42
ffuf -w wordlist.txt -u 'https://ffuf.io.fi/FUZZ' -mc all -fs 42

  • Number of words: -mw and -fw: Matcher and filter based on number of words (strings terminated by a whitespace) in the response.

    # Example: match all, but filter out all responses of word count 7
ffuf -w wordlist.txt -u 'https://ffuf.io.fi/FUZZ' -mc all -fw 7

  • Number of lines: -ml and -fl : Similar in both uses to -mw and -fw, but counts number of lines in the response instead of number of words

  • Regexp: -mr and -fr: Using this matcher / filter, you can define an regular expression to either match wanted resources or to filter out unsuccessful ones. Regexes are notoriously human-hostlile but very powerful.

  • Time based: -mt and -ft: Response time based matching and filtering works great for timing attacks as well as matching for timing based sql injection attacks.

    # Example timing based sql injection payload
ffuf -w sqli_payloads.txt -u 'https://ffuf.io.fi/api/something' \
    -H 'Content-Type: application/json' -d '{"id":"FUZZ"}' -mt >5000

Output#

  • ffuf has different ways to display output in both - standard output in terminal as well as output files in various file formats.
  • The output file name can be set with a command line argument -o filename.ext and the file format with: -of json
  • The different file types are as follows: json, ejson, html, md, csv, ecsv