ffuf(1)

NAME
ffuf - Fast web fuzzer written in Go

SYNOPSIS
     ffuf [options]

DESCRIPTION
ffuf is a fest web fuzzer written in Go that allows typical directory discovery, virtual host discovery (without DNS records) and GET and POST parameter fuzzing.

OPTIONS

HTTP OPTIONS:

    -H  Header "Name: Value", separated by colon. Multiple -H flags are accepted.

    -X  HTTP method to use (default: GET)

    -b  Cookie data "NAME1=VALUE1; NAME2=VALUE2" for copy as curl functionality.

    -d  POST data

    -r  Follow redirects (default: false)

    -recursion
        Scan recursively. Only FUZZ keyword is supported, and URL (-u) has to end in it. (default: false) -recursion-depth Maximum recursion depth. (default: 0)

    -replay-proxy
        Replay matched requests using this proxy.

    -timeout
        HTTP request timeout in seconds. (default: 10)

    -u  Target URL

    -x  HTTP Proxy URL

GENERAL OPTIONS:

    -V  Show version information. (default: false)

    -ac Automatically calibrate filtering options (default: false)

    -acc
        Custom auto-calibration string. Can be used multiple times. Implies -ac

    -c  Colorize output. (default: false)

    -maxtime
        Maximum running time in seconds. (default: 0)

    -p  Seconds of 'delay' between requests, or a range of random delay. For example "0.1" or "0.1-2.0"

    -s  Do not print additional information (silent mode) (default: false)

    -sa Stop on all error cases. Implies -sf and -se. (default: false)

    -se Stop on spurious errors (default: false)

    -sf Stop when > 95% of responses return 403 Forbidden (default: false)

    -t  Number of concurrent threads. (default: 40)

    -v  Verbose output, printing full URL and redirect location (if any) with the results. (default: false)

MATCHER OPTIONS:

    -mc Match HTTP status codes, or "all" for everything. (default: 200,204,301,302,307,401,403)

    -ml Match amount of lines in response

    -mr Match regexp

    -ms Match HTTP response size

    -mw Match amount of words in response

FILTER OPTIONS:

    -fc Filter HTTP status codes from response. Comma separated list of codes and ranges

    -fl Filter by amount of lines in response. Comma separated list of line counts and ranges

    -fr Filter regexp

    -fs Filter HTTP response size. Comma separated list of sizes and ranges

    -fw Filter by amount of words in response. Comma separated list of word counts and ranges

INPUT OPTIONS:

    -D  DirSearch wordlist compatibility mode. Used in conjunction with -e flag. (default: false)

    -e  Comma separated list of extensions. Extends FUZZ keyword.

    -ic Ignore wordlist comments (default: false)

    -input-cmd
        Command producing the input. --input-num is required when using this input method. Overrides -w.

    -input-num
        Number of inputs to test. Used in conjunction with --input-cmd. (default: 100)

    -mode
        Multi-wordlist operation mode. Available modes: clusterbomb, pitchfork (default: clusterbomb)

    -request
        File containing the raw http request

    -request-proto
        Protocol to use along with raw request (default: https)

    -w  Wordlist file path and (optional) keyword separated by colon. eg. '/path/to/wordlist:KEYWORD'

OUTPUT OPTIONS:

    -debug-log
        Write all of the internal logging to the specified file.

    -o  Write output to file

    -od Directory path to store matched results to.

    -of Output file format. Available formats: json, ejson, html, md, csv, ecsv (default: json)

EXAMPLE USAGE:
Fuzz file paths from wordlist.txt, match all responses but filter out those with content-size 42. Colored, verbose output. ffuf -w wordlist.txt -u https://example.org/FUZZ -mc all -fs 42 -c -v

    Fuzz Host-header, match HTTP 200 responses. ffuf -w hosts.txt -u https://example.org/ -H "Host: FUZZ" -mc 200

    Fuzz POST JSON data. Match all responses not containing text "error". ffuf -w entries.txt -u https://example.org/ -X POST -H "Content-Type: application/json" -d '{"name": "FUZZ", "anotherkey": "anothervalue"}' -fr "error"

    Fuzz multiple locations. Match only responses reflecting the value of "VAL" keyword. Colored. ffuf -w params.txt:PARAM -w values.txt:VAL -u https://example.org/?PARAM=VAL -mr "VAL" -c

    More information and examples: https://github.com/ffuf/ffuf

AUTHOR
This manual page was written based on the author's README by Pedro Loami Barbosa dos Santos <pedro@loami.eng.br> for the Debian project (but may be used by others).