Accelerate Web Target Fuzzing with FFUF

This skill guides authorized web fuzzing with ffuf, a Go tool that substitutes wordlist entries into HTTP requests. It covers directory and file discovery, recursive paths, file extensions, subdomains, virtual hosts, parameter names and values, request headers, POST bodies, and JSON fields. The case-sensitive FUZZ placeholder can appear in a URL, header, or body. Named keywords support multiple wordlists, with clusterbomb for combinations, pitchfork for parallel entries, and sniper for individual positions.

Response matching and filtering use status codes, response size, word and line counts, regular expressions, and timing. Automatic calibration is the default recommendation, with per-host calibration and custom calibration strings available. This reduces repetitive responses that would otherwise look like discoveries. The workflow combines filters instead of treating every successful HTTP status as a meaningful result.

Use it to prepare permitted discovery or assessment of web applications and APIs, including authenticated endpoints whose requests contain cookies, JWTs, CSRF tokens, or custom headers. It includes assessment categories such as access-control issues and injection-related response anomalies. These categories guide interpretation; an unusual response still needs investigation.

The skill requires explicit permission for the target. Commands that send requests to target systems need confirmation in the current conversation before execution. It also requires automatic calibration unless there is a stated reason to disable it. Rate, concurrency, delay, total execution time, and time per recursive job should be bounded to avoid overwhelming the server. It is unsuitable for running unconfirmed target scans or assuming that a large result set is accurate.

Inputs include the approved target, a suitable wordlist, fuzzing locations, HTTP method, authentication context, and baseline response behavior. For complex authenticated requests, capture a complete request with Burp Suite or browser developer tools, save it to a file, and mark the intended substitution positions. Raw requests retain the headers and body needed by the endpoint.

Outputs can be saved as JSON, extended JSON, HTML, Markdown, CSV, extended CSV, all supported formats, or plain results from silent mode. Results should be reviewed for differences in status, size, and timing, as well as exposed errors, stack traces, or version details. Findings can then inform follow-up checks and a report. Saving results also allows later analysis instead of relying on terminal output.

The workflow explains recursion, maximum job time, batch target processing, and interactive controls for adjusting settings, saving results, managing queues, and restarting work. Troubleshooting addresses false positives through calibration and combined filters, slow scans through wordlist and concurrency choices, blocking through rate and delay controls, and missing results through careful filter review.

ffuf can be installed through Go, Homebrew, or release binaries. The Go installation example is:

go install github.com/ffuf/ffuf/v2@latest

The skill covers HTTP and SOCKS5 proxies, replaying matched requests through a proxy, cookie authentication, client certificates, and URL or Base64 encoding. Configuration can be stored in ffufrc for headers, timeouts, colors, threads, and status matching. SecLists supplies wordlists for content discovery, DNS, parameters, and authentication-related inputs.

Supporting materials include WORDLISTS.md, REQUEST_TEMPLATES.md, and ffuf_helper.py for result analysis, request creation, numeric sequences, and wordlist work. Official documentation, a guide, and a practice lab provide additional reference material.

It fits people carrying out authorized web application testing who need a repeatable way to construct fuzzing requests, distinguish interesting responses, and retain results. It is especially relevant when authentication details or multiple input positions make a simple URL-only fuzzing command insufficient.