FFUF: Fuzzing for Hidden Web Paths Like a Pro

When it comes to web fuzzing, ffuf is that blunt instrument sharpened to a scalpel’s edge. It’s a lightning-fast tool used to find hidden directories, files, subdomains, parameters, and more — the kind of things developers meant to hide but left hanging like a secret door in plain sight.

This post breaks down everything a pentester needs to know to master ffuf.

What Is FFUF?

ffuf (Fuzz Faster U Fool) is a flexible and insanely fast web fuzzer written in Go. It’s designed for brute-forcing things like:

Directories and files
Subdomains
GET/POST parameters
Virtual hosts
JSON keys
Custom wordlist attacks

It’s built for speed, customizability, and precision — exactly what you want when you’re hunting for the unknown.

Installing FFUF

Kali/Parrot usually come with it, but if not:

sudo apt install ffuf

Or use Go:

go install github.com/ffuf/ffuf/v2@latest

Basic Directory Fuzzing

ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt
# Fuzzes for hidden directories and files

-u: The URL, with FUZZ as the injection point
-w: Wordlist

Filter Results

ffuf -u http://target.com/FUZZ -w common.txt -fc 404
# Filters out 404 responses

You can filter by:

-fc: HTTP status codes (e.g. -fc 403,404)
-fs: Response size
-fw: Number of words in response
-fl: Number of lines in response

File Extension Fuzzing

ffuf -u http://target.com/FUZZ.php -w common.txt -fc 404
# Tries .php files

Or multiple extensions:

ffuf -u http://target.com/FUZZ -w common.txt -e .php,.bak,.txt -fc 404

POST Parameter Fuzzing

ffuf -u http://target.com/login -X POST -d "username=admin&password=FUZZ" -w passwords.txt -fc 401
# Brute-forces the password field

Header Fuzzing

ffuf -u http://target.com/ -H "X-Forwarded-For: FUZZ" -w ips.txt
# Fuzzes header values to bypass IP restrictions

Subdomain Fuzzing

ffuf -u http://FUZZ.target.com -w subdomains.txt -H "Host: FUZZ.target.com" -fs 1234
# Brute-forces subdomains (need DNS resolution or custom /etc/hosts)

Recursive Fuzzing

ffuf doesn’t do this automatically, but you can script it:

ffuf -u http://target.com/FUZZ -w common.txt -o output.json -of json
# Save results, then extract new directories and re-fuzz them

Or use tools like ffuf-scripts, ffufplus, or recursive wrappers to chain deeper.

Use Custom Wordlists

Combine SecLists, project-specific terms, or fuzzing-focused lists:

ffuf -u http://target.com/FUZZ -w /path/to/custom-list.txt

Pro tip: Use targeted wordlists based on developer habits, frameworks (e.g., Laravel, WordPress), or parameter names found in JS files.

Example: Find Admin Panels

ffuf -u http://target.com/FUZZ -w admin-panels.txt -fc 404

Look for:

/admin
/control
/dashboard
/cms
/login.php

These can lead to juicy privilege escalation points.

Example: Fuzzing Parameters in a URL

ffuf -u "http://target.com/page.php?FUZZ=test" -w params.txt -fs 2345
# Brute-forces parameter names

Output Options

-of json -o output.json
-of html -o results.html
-of csv

Useful for chaining with other tools or importing into reporting workflows.

Tips and Best Practices

Speed it up: Use -t to set threads (-t 100)
Stealth? Not really. Use passive recon first — ffuf is fast and noisy
Use multiple wordlists: Combine dirbuster, common.txt, and custom lists
Filter aggressively: Avoid sifting through noise by using response filters
Target tech stacks: Guess Laravel? Add .env, routes, .blade.php to your list

Final Thoughts

Fuzzing is about knowing where to knock and what to knock with. ffuf is your battering ram, precision scalpel, and recon drone — all rolled into one. Mastering it can be the difference between missing a hidden admin panel and catching a misconfigured backend wide open.

Keep your wordlists sharp, your filters tight, and your targets scoped. Fuzz fast, fuzz smart.