ffuf (Fuzz Faster U Fool) is a fast, open-source web fuzzer written in Go. You give it a wordlist and a URL containing the keyword FUZZ, and it substitutes each wordlist entry into that position, sending requests and reporting the responses. Because FUZZ can go anywhere, in the path, a parameter, a header, a cookie or the POST body, it is used for directory and file discovery, virtual-host discovery, parameter fuzzing and simple brute forcing during web recon.
Last updated: 6 August 2026
ffuf automates the trial-and-error of probing a web app. Point FUZZ at the URL path with a directory wordlist to discover hidden folders and files; put FUZZ in the Host header to enumerate virtual hosts; place it in a query parameter to find valid values or injectable inputs. Its match and filter options (by status code, size, word or line count) cut through noise so real hits stand out, and its speed makes large wordlists practical. It is a core recon tool for finding attack surface that is not linked anywhere on the site.
Linux · Windows · macOS
Open source (MIT License)
ffuf -w wordlist.txt -u https://example.com/FUZZDirectory and file discovery by fuzzing the URL path.
ffuf -w wordlist.txt -u https://example.com/FUZZ -e .php,.html,.txtAppend extensions to each word to find files, not just directories.
ffuf -w hosts.txt -u https://example.com -H "Host: FUZZ.example.com"Virtual-host discovery by fuzzing the Host header.
ffuf -w params.txt -u "https://example.com/api?FUZZ=test"Enumerate valid parameter names on an endpoint.
ffuf -w wordlist.txt -u https://example.com/FUZZ -mc 200,301,302Match only these HTTP status codes to filter results.
ffuf -w wordlist.txt -u https://example.com/FUZZ -fs 4242Filter out responses of a given byte size (for example a soft-404 page).
ffuf -w users.txt:UFUZZ -w pass.txt:PFUZZ -u https://example.com/login -X POST -d "user=UFUZZ&pass=PFUZZ"Use multiple wordlists with named keywords for POST fuzzing.
Fuzzing sends large numbers of real requests, so run ffuf only against web applications you own or are explicitly authorised to test. Hammering a third-party site is active testing and can be treated as unauthorised access, or as a denial-of-service if it overloads the server, under the IT Act 2000. Stay within scope and reasonable request rates.
Results are only as good as the wordlist, so it will not find endpoints that are not in it. Soft-404 pages and dynamic responses cause false positives unless you tune match/filter options carefully. High thread counts can overload targets or trip rate limiting and WAFs, and it discovers surface only, it does not test the logic behind what it finds.
| Tool | Pick it when |
|---|---|
| gobuster | You want a simple, fast directory/DNS/vhost buster with straightforward modes. |
| feroxbuster | You want fast recursive directory brute forcing out of the box. |
| wfuzz | You want the older, flexible Python fuzzer with a similar keyword approach. |
| dirsearch | You want a directory brute-forcer tuned with sensible defaults and extensions. |
| Burp Intruder | You need fuzzing tightly integrated with proxy history and manual testing. |
Ethical Hacking Course (6 months) — web reconnaissance and content discovery module
We are not affiliated with, endorsed by, or a reseller for the vendors of any tool on this site.
Free counselling call. We will tell you honestly whether a full course is worth it for what you actually want to do.
Call +91 75175 72000