ffuf-fuzz

# ffuf-fuzz ## When to Use - When directory and file enumeration is needed on web targets - When discovering hidden endpoints, paths, or backup files - When fuzzing GET or POST parameters for injection points - When enumerating virtual hosts (vhost discovery) - When brute-forcing login forms or authentication endpoints - When testing for parameter tampering vulnerabilities - When discovering API endpoints or routes - When extension-based file discovery is required ## Quick Start Basic directory fuzzing against a target: ```bash ffuf -w /usr/share/wordlists/dirb/common.txt -u https://example.com/FUZZ ``` ## Step-by-Step Process 1. **Install ffuf** (if needed): ```bash go install github.com/ffuf/ffuf/v2@latest ``` 2. **Basic Directory Discovery**: ```bash ffuf -w wordlist.txt -u https://target.com/FUZZ ``` 3. **Filter False Positives** using auto-calibration: ```bash ffuf -w wordlist.txt -u https://target.com/FUZZ -ac ``` 4. **Save Results** in structured format: ```bash ffuf -w wordlist.txt -u https://target.com/FUZZ -o results.json -of json ``` 5. **Review and Refine** with specific filters: ```bash ffuf -w wordlist.txt -u https://target.com/FUZZ -mc 200,301,302 -fs 0 ``` ## Examples ### Example 1: Basic Directory Discovery **Scenario:** Find hidden directories on a web server **Command:** ```bash ffuf -w /usr/share/wordlists/dirb/common.txt -u https://example.com/FUZZ -c ``` **Output:** ``` admin [Status: 301, Size: 178, Words: 6, Lines: 8] api [Status: 200, Size: 1245, Words: 89, Lines: 42] backup [Status: 403, Size: 276, Words: 20, Lines: 10] config [Status: 301, Size: 178, Words: 6, Lines: 8] uploads [Status: 301, Size: 178, Words: 6, Lines: 8] ``` ### Example 2: Extension-Based File Discovery **Scenario:** Find files with specific extensions **Command:** ```bash ffuf -w wordlist.txt -u https://example.com/FUZZ -e .php,.bak,.txt,.old,.zip -c ``` **Output:** ``` config.php [Status: 200, Size: 0, Words: 1, Lines: 1] database.bak [Status: 200, Size: 45678, Words: 2341, Lines: 890] readme.txt [Status: 200, Size: 1234, Words: 200, Lines: 45] backup.zip [Status: 200, Size: 89012, Words: 1, Lines: 1] ``` ### Example 3: Virtual Host Discovery **Scenario:** Enumerate subdomains/vhosts via Host header fuzzing **Command:** ```bash ffuf -w subdomains.txt -u https://10.10.10.10 -H "Host: FUZZ.example.com" -fs 4242 ``` **Output:** ``` admin [Status: 200, Size: 8901, Words: 456, Lines: 123] api [Status: 200, Size: 2345, Words: 89, Lines: 34] dev [Status: 200, Size: 6789, Words: 321, Lines: 98] staging [Status: 200, Size: 5432, Words: 234, Lines: 67] ``` ### Example 4: GET Parameter Name Fuzzing **Scenario:** Discover hidden GET parameters **Command:** ```bash ffuf -w params.txt -u "https://example.com/page?FUZZ=test" -fs 4242 -c ``` **Output:** ``` id [Status: 200, Size: 5678, Words: 234, Lines: 78] debug [Status: 200, Size: 8901, Words: 456, Lines: 123] admin [Status: 200, Size: 2345, Words: 89, Lines: 34] redirect [Status: 302, Size: 0, Words: 1, Lines: 1] ``` ### Example 5: GET Parameter Value Fuzzing **Scenario:** Fuzz values for a known parameter **Command:** ```bash ffuf -w values.txt -u "https://example.com/user?id=FUZZ" -fc 404,401 -c ``` **Output:** ``` 1 [Status: 200, Size: 1234, Words: 89, Lines: 23] 100 [Status: 200, Size: 1456, Words: 92, Lines: 25] admin [Status: 200, Size: 2345, Words: 156, Lines: 45] ``` ### Example 6: POST Data Fuzzing **Scenario:** Fuzz POST body parameters for authentication bypass **Command:** ```bash ffuf -w passwords.txt -X POST -d "username=admin&password=FUZZ" \ -H "Content-Type: application/x-www-form-urlencoded" \ -u https://example.com/login -fc 401 -c ``` **Output:** ``` admin123 [Status: 302, Size: 0, Words: 1, Lines: 1] password1 [Status: 302, Size: 0, Words: 1, Lines: 1] ``` ### Example 7: JSON Body Fuzzing **Scenario:** Fuzz JSON API parameters **Command:** ```bash ffuf -w payloads.txt -X POST -H "Content-Type: application/json" \ -d '{"username":"admin","role":"FUZZ"}' \ -u https://example.com/api/user -mr "success" -c ``` **Output:** ``` admin [Status: 200, Size: 234, Words: 12, Lines: 5] superuser [Status: 200, Size: 234, Words: 12, Lines: 5] ``` ### Example 8: Multi-Wordlist Clusterbomb **Scenario:** Test all username/password combinations **Command:** ```bash ffuf -w users.txt:USER -w passwords.txt:PASS \ -X POST -d "user=USER&pass=PASS" \ -H "Content-Type: application/x-www-form-urlencoded" \ -u https://example.com/login -fc 401 -c ``` **Output:** ``` [USER: admin] [PASS: secret123] [Status: 302, Size: 0, Words: 1, Lines: 1] [USER: test] [PASS: test] [Status: 302, Size: 0, Words: 1, Lines: 1] ``` ### Example 9: Pitchfork Mode (Parallel Lists) **Scenario:** Test paired credentials (username1+password1, username2+password2) **Command:** ```bash ffuf -mode pitchfork -w users.txt:USER -w passwords.txt:PASS \ -X POST -d "user=USER&pass=PASS" \ -u https://example.com/login -fc 401 -c ``` **Output:** ``` [USER: john] [PASS: john123] [Status: 302, Size: 0, Words: 1, Lines: 1] [USER: admin] [PASS: admin456] [Status: 302, Size: 0, Words: 1, Lines: 1] ``` ### Example 10: Recursive Directory Scanning **Scenario:** Discover nested directory structures **Command:** ```bash ffuf -w wordlist.txt -u https://example.com/FUZZ -recursion -recursion-depth 2 -c ``` **Output:** ``` admin [Status: 301, Size: 178, Words: 6, Lines: 8] admin/config [Status: 200, Size: 1234, Words: 89, Lines: 23] admin/users [Status: 301, Size: 178, Words: 6, Lines: 8] admin/users/list [Status: 200, Size: 5678, Words: 234, Lines: 78] api [Status: 301, Size: 178, Words: 6, Lines: 8] api/v1 [Status: 200, Size: 890, Words: 45, Lines: 12] ``` ### Example 11: Auto-Calibration for False Positive Elimination **Scenario:** Let ffuf determine optimal filters automatically **Command:** ```bash ffuf -w wordlist.txt -u https://example.com/FUZZ -ac -c ``` **Output:** ``` [INFO] Auto-calibration: Response size 4242 filtered admin [Status: 200, Size: 8901, Words: 456, Lines: 123] backup [Status: 200, Size: 2345, Words: 89, Lines: 34] ``` ### Example 12: Time-Based Detection (SQL Injection) **Scenario:** Detect time-based vulnerabilities using response timing **Command:** ```bash ffuf -w sqli-payloads.txt -X POST -H "Content-Type: application/json" \ -d '{"id":"FUZZ"}' -u https://example.com/api/lookup -mt ">5000" -c ``` **Output:** ``` ' OR SLEEP(5)-- [Status: 200, Size: 123, Words: 8, Lines: 3, Time: 5234ms] 1; WAITFOR DELAY '0:0:5' [Status: 200, Size: 123, Words: 8, Lines: 3, Time: 5189ms] ``` ### Example 13: Replay Matches Through Proxy **Scenario:** Send matching requests to Burp Suite for analysis **Command:** ```bash ffuf -w wordlist.txt -u https://example.com/FUZZ -replay-proxy http://127.0.0.1:8080 -c ``` **Output:** ``` [INFO] Matched requests will be replayed through proxy admin [Status: 200, Size: 8901, Words: 456, Lines: 123] api [Status: 200, Size: 2345, Words: 89, Lines: 34] ``` ### Example 14: JSON Output for Automation **Scenario:** Export results in JSON for pipeline integration **Command:** ```bash ffuf -w wordlist.txt -u https://example.com/FUZZ -o results.json -of json -c ``` **Output File (results.json):** ```json { "results": [ { "input": { "FUZZ": "admin" }, "position": 45, "status": 200, "length": 8901, "words": 456, "lines": 123, "content-type": "text/html", "redirectlocation": "", "url": "https://example.com/admin", "duration": 234567890, "host": "example.com" } ], "config": { "url": "https://example.com/FUZZ", "method": "GET" } } ``` ## Error Handling | Error | Cause | Resolution | | --------------------------- | ------------------------ | ------------------------------------------------------ | | `Wordlist not found` | Invalid wordlist path | Verify path exists and is readable | | `Connection refused` | Target not reachable | Check target URL and network connectivity | | `Too many open files` | Thread count too high | Reduce threads with `-t 10` or increase ulimit | | `Context deadline exceeded` | Request timeout | Increase timeout with `-timeout 30` | | `No results` | Filters too aggressive | Try `-mc all` to see all responses, then adjust | | `Rate limited (429)` | Too many requests | Add delay with `-p 0.5` or reduce rate with `-rate 50` | | `SSL certificate error` | Invalid/self-signed cert | Target may need `-k` flag (not available, use proxy) | | `403 on all requests` | WAF or firewall blocking | Use `-sf` to stop on 95% 403 responses | ## Matchers and Filters Reference ### Matchers (Include Results) | Flag | Description | Example |