FFUF Web Fuzzing

Expert guidance for using ffuf (Fuzz Faster U Fool), a fast web fuzzer designed for discovering hidden content, directories, files, subdomains, and testing for vulnerabilities during penetration testing. Significantly faster than traditional tools like dirb or dirbuster, with a core focus on auto-calibration to dramatically reduce false positives and make results analysis easier for both humans and AI.

The skill emphasizes a best-practices workflow:

1. Always Use Auto-Calibration - The -ac flag is mandatory for productive pentesting. It automatically detects and filters repetitive false positives, removes noise from dynamic websites, and adapts to the target's specific behavior.

2. Basic Discovery - Start with simple directory fuzzing:

   ffuf -w wordlist.txt -u https://target.com/FUZZ -ac
   

3. Authenticated Fuzzing - For complex authentication, use raw requests instead of command-line flags:

   • Capture authenticated request from Burp Suite or DevTools
   • Save to req.txt with FUZZ keyword in desired location
   • Run: ffuf --request req.txt -w wordlist.txt -ac

4. Advanced Scenarios - Subdomain enumeration, parameter fuzzing, API endpoint discovery, and vulnerability testing with appropriate filtering and rate limiting.

Always save results (-o results.json -of json) and use rate limiting for stealth (-rate 2 -t 10).