ffuf
ffuf replaces the FUZZ keyword in the URL, a header or the body with each line of the wordlist. The key is not running it but filtering well: by status (-mc/-fc), size (-fs), words (-fw) or lines (-fl) so you only keep what is different.
- Platform
- Linux · Windows · macOS (Go)
- Official site
- github.com/ffuf/ffuf
- On HTB
- 17 machines
Install
sudo apt install ffufffuf cheat sheet
Your values
Saved in this browser and applied to every cheatsheet.
Filters and tricks
Drop responses of a given size (false positives)
ffuf -u http://box.htb/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -fs 1234
Only some status codes
ffuf -u http://box.htb/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -mc 200,204,301,302,403
Recursive
ffuf -u http://box.htb/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -recursion -recursion-depth 2
From a request saved in Burp
ffuf -request peticion.txt -request-proto http -w /usr/share/seclists/Fuzzing/special-chars.txtPut FUZZ wherever you want to test inside the request file.
Slower (if the site falls over or blocks you)
ffuf -u http://box.htb/FUZZ -w lista.txt -rate 50 -t 10In our cheatsheets
Web enumeration › Fuzzing
Directories with ffuf
ffuf -u http://box.htb/FUZZ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -ic -t 100
Files with extensions
ffuf -u http://box.htb/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt -e .php,.txt,.bak,.zip -ic -t 100
Vhosts with ffuf
ffuf -u http://10.10.11.20 -H 'Host: FUZZ.box.htb' -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -fs 0Run it once, note the default response size and filter it out with -fs.
GET parameter names
ffuf -u 'http://box.htb/index.php?FUZZ=test' -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -fs 0
POST values
ffuf -u http://box.htb/api/user -X POST -H 'Content-Type: application/x-www-form-urlencoded' -d 'id=FUZZ' -w ids.txt -fs 0No command matches.
HTB machines where ffuf is used
Taken from the chapters of IppSec videos where ffuf shows up. The ▶ link jumps to the minute of that part.
- Vhost and subdomain fuzzing
- Default credentials
- Insecure deserialization
- Command injection
- Password spraying and valid users
- Credentials in files
- Internal services and port forwarding
- Weak or homemade cryptography
- Backups and archives
- Saved credentials / DPAPI
- AppLocker and Constrained Language Mode
Guides that use ffuf
- Web fuzzing: directories, extensions, subdomains and vhosts with ffuf, gobuster and feroxbuster 3 min read Find hidden paths, backups, vhosts and exposed .git repos with ffuf and gobuster: which wordlist to use and how to filter out false positives.
- IDOR, mass assignment and APIs: the access control flaws scanners miss 3 min read Enumerate an API (Swagger, hidden routes, versions), find IDORs by changing IDs, become admin with mass assignment and test access control with two users.
- LFI: from reading /etc/passwd to running commands 4 min read Local file inclusion step by step: path traversal and its bypasses, PHP wrappers, which files to read on Linux and Windows, and the routes to turn an LFI into RCE.
- SSRF: using the server to reach internal services and the cloud 4 min read SSRF step by step: detect it, scan internal ports, bypass localhost filters with redirects and alternative IPs, read AWS metadata and attack Redis with gopher.