FFUF Web Fuzzing

Guidance for using ffuf (Fuzz Faster U Fool) effectively during authorized penetration testing.

Prerequisites

ffuf must be installed: brew install ffuf (macOS) or go install github.com/ffuf/ffuf/v2@latest

When to Use

• Running directory, file, or subdomain discovery against web targets
• Fuzzing API endpoints, parameters, or POST data
• Authenticated fuzzing with raw HTTP requests
• Analyzing ffuf JSON output for anomalies and interesting findings
• Building fuzzing strategies (wordlist selection, filtering, rate limiting)
• IDOR testing with authenticated sessions

When NOT to Use

• Target system is not in scope or authorization is unclear
• Passive reconnaissance is more appropriate (use OSINT tools instead)
• The target is a production system and rate limiting hasn't been configured
• You need a full vulnerability scanner (use Burp Suite, Nuclei, etc.)
• Testing for logic flaws that require multi-step interaction

Rationalizations to Reject

• "Auto-calibration is optional" -- -ac is mandatory. Without it, results are buried in false positives and analysis is wasted effort.
• "More threads = faster results" -- Hammering a target with -t 200 triggers WAFs, gets you blocked, and may crash staging environments. Start with -t 10 -rate 2 for production targets.
• "I'll filter later" -- Set up filtering before the scan. Running a 220k wordlist without filters and then trying to grep through the noise is backwards.
• "The default wordlist is fine" -- Wordlist selection is the most important decision. A generic wordlist misses technology-specific paths. See references/wordlists.md.
• "Raw requests are too much work" -- For authenticated fuzzing, --request req.txt is simpler and more reliable than chaining -H and -b flags. Capture once, fuzz many times.

Critical Rules