ffuf
ffuf is a fast web fuzzer used to discover hidden directories, files, virtual hosts and parameters.
Legal & ethical use. Use this tool only on systems, networks and data that you own or have explicit written permission to test. Unauthorised access or scanning can break computer-misuse laws (for example Pakistan's Prevention of Electronic Crimes Act, 2016, and equivalents elsewhere). Practise in your own lab or in authorised environments such as CTFs.
What it is used for
- Find unlinked paths on your own test site
- Fuzz parameter names or virtual hosts in a lab
Key features
- FUZZ keyword placeholders
- Filtering by status, size and words
- Recursion and rate control
Installation
Install a release binary or via Go, or from your distribution package.
Beginner usage guide
Use a small wordlist first and always filter noisy responses (for example by size) so real hits stand out.
Example commands
Run these only against your own lab or authorised targets. Placeholder addresses such as 192.0.2.x are documentation ranges.
Directory discovery with a wordlist
ffuf -u http://127.0.0.1:8081/FUZZ -w /usr/share/wordlists/dirb/common.txtFUZZ is replaced with each word from the wordlist; add -fc 404 to hide Not Found responses.
References
Source verification
Last reviewed: 2026-10-27
Links checked over HTTP: 2026-10-27 07:51 UTC — official: 200, docs: 200, repo: 200
Command flags checked against the real binary ffuf (ffuf version: 2.1.0-dev) on 2026-10-27.