ffuf

ffuf - Flags

ffuf examples

Directory Enumeration

ffuf -ic -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u "http://83.136.248.27:44254/FUZZ"

ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u "http://test.academy.htb:57617/FUZZ"

:Fuzz is not necessary here

ffuf -ic -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-small.txt -u "http://83.136.248.27:44254/FUZZ"

Only match HTTP 200

ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt -u "http://sea.htb/FUZZ" -t 200

Extension fuzzing

ffuf -ic -w /usr/share/wordlists/seclists/Discovery/Web-Content/web-extensions.txt:FUZZ -u "http://83.136.248.27:44254/blog/indexFUZZ"

ffuf -ic -w /usr/share/wordlists/seclists/Discovery/Web-Content/web-extensions.txt:FUZZ -u "http://academy.htb:57617/indexFUZZ"

After confirming extension we can use -e .php,phps,php7

Page fuzzing

ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://83.136.248.27:44254/blog/FUZZ.php

Subdomain Enumeration

ffuf -ic -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://FUZZ.inlanefreight.com

vhost fuzzing

Using /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt

ffuf -ic -u http://linkvortex.htb/ -w /usr/share/amass/wordlists/subdomains-top1mil-5000.txt -H "Host:FUZZ.linkvortex.htb"  -mc 200

ffuf -ic -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://academy.htb:PORT/ -H 'Host: FUZZ.academy.htb'

-recursion -recursion-depth 1

Using /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-small.txt
And -recursion -recursion-depth 1

ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://83.136.248.27:44254/FUZZ -recursion -recursion-depth 1 -e .php -v

ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u "http://faculty.academy.htb:31772/courses/FUZZ" -recursion -recursion-depth 1 -e .php,.php7,.phps

Parameter fuzzing

HTTP GET

ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://admin.academy.htb:PORT/admin/admin.php?FUZZ=key

ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://faculty.academy.htb:31772/courses/linux-security.php7?FUZZ=key

HTTP POST

To fuzz the data field with ffuf, we can use the -d flag
We also have to add -X POST to send POST requests.

ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://admin.academy.htb:44462/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded'

ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://faculty.academy.htb:31772/courses/linux-security.php7 -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded'

Then, use a ids.txt to find out key

ffuf -w ids.txt:FUZZ -u http://admin.academy.htb:44462/admin/admin.php -X POST -d 'id=FUZZ' -H 'Content-Type: application/x-www-form-urlencoded'

Filter out size

Don't contain the specific size

-fs

ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://academy.htb:41028/ -H 'Host: FUZZ.academy.htb' -fs 986

Custom Wordlist

ffuf -w ids.txt:FUZZ -u http://admin.academy.htb:44462/admin/admin.php -X POST -d 'id=FUZZ' -H 'Content-Type: application/x-www-form-urlencoded'

url: https://github.com/ffuf/ffuf
title: "GitHub - ffuf/ffuf: Fast web fuzzer written in Go"
description: "Fast web fuzzer written in Go. Contribute to ffuf/ffuf development by creating an account on GitHub."
host: github.com
favicon: https://github.githubassets.com/favicons/favicon.svg
image: https://opengraph.githubassets.com/7311acf9b56695d19a8f89793365aed7445cd7ff072a66ccb9f947f9e6e63659/ffuf/ffuf