// what it is
Description
ffuf reads a wordlist + a URL with a `FUZZ` keyword and blasts requests. Handles path, parameter, header, and POST-body fuzzing. The bug-bounty community's go-to since 2019.
// use cases
What people use it for
- Discover hidden parameters
- Brute-force directories and files
- Fuzz request bodies / headers for IDORs
// commands
The commands you'll type
Directory brute
$ ffuf -u https://target/FUZZ -w wordlist.txt -mc 200,403POST body fuzz
$ ffuf -u https://target/login -X POST -d 'user=admin&pass=FUZZ' -w pass.txt -fc 401Header fuzz
$ ffuf -u https://target -H 'X-Forwarded-For: FUZZ' -w ips.txt