ffuf
A fast command-line tool that guesses hidden web paths, parameters and hostnames by trying many inputs.
- Stars
- 17k
- Forks
- 1.6k
- Licence
- MIT
- Language
- Go
- Last update
- 1 months ago
- Type
- CLI
What it is
ffuf is a command-line web fuzzer written in Go. You give it a wordlist and mark where the word should go with the FUZZ keyword in a URL, header or POST body, and it sends a request for each word and reports the responses. People use it to find hidden directories, virtual hosts, and parameter names on web servers they are allowed to test.
- Discover directories on a target using a wordlist: ffuf -w /path/to/wordlist -u https://target/FUZZ
- Find virtual hosts by fuzzing the Host header and filtering a known default response size
- Fuzz GET parameter names or values, or POST form fields
- Limit run time with -maxtime or -maxtime-job, including with recursion
Great for
- Security testers doing authorized web content discovery
- Developers checking which paths or parameters their own server accepts
- Students practising web fuzzing on legal practice targets such as the ffuf.me lessons mentioned in the README
- People who want a scriptable command-line tool with response filtering
Not ideal for
- Anyone testing sites they do not have permission to test, since it sends large numbers of requests
- People who want a graphical interface; the README describes a command-line tool with an interactive mode, not a GUI
How to get it
- 1
Install with a package manager
You'll need: Go 1.20 or greater (only if installing with go install or building from source)
Install with Go
go install github.com/ffuf/ffuf/v2@latestInstall with Homebrew on macOS
brew install ffuf - 2
Run it
- Install ffuf using one of the methods in the README or download a release binary
- Prepare a wordlist file
- Run ffuf -w /path/to/wordlist -u https://target/FUZZ on a host you are authorized to test
- Add -fs or -fc to filter out the default responses
- 3
Get the most out of it
- Use a configuration file at $XDG_CONFIG_HOME/ffuf/ffufrc to set options that apply to every run
- Use -config to switch between different configuration files for different tasks
- Use -recursion with -recursion-depth to scan subdirectories, and -maxtime-job to cap each job
- Use --input-cmd with an external mutator such as Radamsa to generate test payloads
Downloads
Strengths
- Written in Go and distributed as prebuilt binaries for many platforms, per the release assets
- Flexible filtering of responses by size, status code and other criteria, shown in the README examples
- Supports configuration files and an external mutator via --input-cmd
Trade-offs
- Its power is aimed at security testing, so it needs care and permission to use responsibly
- Detailed documentation lives in an external wiki and a third-party guide rather than the README alone
- Building from a git checkout needs Go 1.20 or greater, and local builds are not official releases
How it compares
| Project | Stars | Type | Level | Updated | Best for |
|---|---|---|---|---|---|
| ffuf (this) | 17k | CLI | intermediate | 1 months ago | Security testers doing authorized web content discovery |
| spiderfoot | 24.2k | App | intermediate | 7 months ago | Security professionals doing reconnaissance during penetration tests or red team exercises |
| hetty | 12.5k | App | intermediate | 4 months ago | Security researchers testing web applications |
| angular | 101k | Framework | intermediate | 5 days ago | Developers building larger, multi-screen web applications |
| webpack | 66k | Dev tool | intermediate | 4 days ago | Frontend developers building single-page or multi-page web apps |
| expo | 53.3k | Framework | intermediate | 4 days ago | Developers who want to build iOS and Android apps with React and JavaScript |
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.