FFUF web fuzzing

FFUF is a web fuzzing tool that replaces the FUZZ keyword with values from a wordlist. By placing FUZZ in different parts of a request, it can be used to discover hidden directories, files, extensions, subdomains, virtual hosts, parameters and parameter values.

Place FUZZ directly in the URL path to test directory or file names from a wordlist. Each word replaces FUZZ and FFUF sends a request for the resulting path.

FUZZ can be placed after a filename to discover valid file extensions. This is useful when the filename is known but its extension is not.

When the application technology or extension is already known, FUZZ can be placed in the filename while keeping the extension fixed.

FFUF can recursively continue fuzzing inside discovered directories. The recursion depth controls how many directory levels are explored, while -e adds extensions to test.

FUZZ can be inserted into the hostname to test possible subdomain names from a DNS wordlist.

Virtual hosts can share the same IP address while responding differently depending on the HTTP Host header. Instead of changing the destination URL, FUZZ is inserted into the Host header.

Fuzzing can generate many responses that look identical. The -fs option filters responses by their size, making it easier to remove known false positives. Replace xxx with the response size that should be ignored.

FUZZ can replace a parameter name in the query string. This allows testing a list of possible parameter names against an endpoint.

POST parameters can be fuzzed by placing FUZZ inside the request body. The request method is defined with -X POST and the form content type is supplied through the HTTP header.

Once a parameter name is known, FUZZ can be placed in its value instead. The wordlist then provides the candidate values that FFUF sends to the application.

Different fuzzing targets benefit from different wordlists. The cheat sheet uses SecLists collections for directories, extensions, subdomains and parameter names.

A simple numeric sequence can be generated when an application uses predictable numerical values such as IDs.

When a lab hostname does not exist in public DNS, it can be mapped manually to a target IP through /etc/hosts.

Before fuzzing a POST request, curl can be used to reproduce and verify the request manually. This helps confirm the endpoint, parameter name, request body and content type.