Security tool · discovery

ffuf

Fast web fuzzer for directories, files, vhosts, and parameters. The de-facto content discovery tool.

fuzzingcontent-discoverygofast
Stable IDtool:ffufLast updatedLast verifiedLegacy review pendingProvenanceSource-linked

Where ffuf fits

Fast web fuzzer for directories, files, vhosts, and parameters. The de-facto content discovery tool.

Detection-first use

Start with the least intrusive template that can distinguish your hypothesis from a normal response. Preserve raw output and a negative control.

Installation references

Install with goAuthorization required
go install github.com/ffuf/ffuf/v2@latest
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Install with aptAuthorization required
sudo apt install -y ffuf
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.

Command templates

Directory bruteAuthorization required

Populate placeholders only with assets that are explicitly in scope.

ffuf -u {url}/FUZZ -w {wordlist} -mc {codes} -o {output}
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
VHost fuzzAuthorization required

Populate placeholders only with assets that are explicitly in scope.

ffuf -u {url} -H 'Host: FUZZ.{domain}' -w {wordlist} -fs {filtersize}
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.

Continue the workflow

Attribution and verification

Version history: normalized permanent page created 2026-08-20. Upstream activity and popularity are separate signals and do not establish tool safety.