Guide · Open source
How to use ffuf: install, FUZZ keyword and filtering examples
Updated · written with AI from the project's own documentation and checked against our catalogue data
ffuf is a command-line web fuzzer written in Go. You give it a wordlist and mark where each word should go with the FUZZ keyword, and it sends a request for each word and reports the responses. This guide shows how to install it, run the basic scan types people use it for, and filter the output, so you can run simple, authorized tests yourself.
ffufffuf/ffuf · ★ 17k · MIT Install options & downloads Quick start
- 1Install ffuf. Use Homebrew on macOS, Scoop or Winget on Windows, or go install if you have Go 1.20 or greater.
- 2Pick a wordlist. Choose a wordlist file for the names you want to guess, such as paths or parameter names.
- 3Mark the FUZZ keyword. Place FUZZ in the URL, a header or the POST data where each word should go.
- 4Run the scan. Pass the wordlist with -w and the URL with -u, then run the command against a target you are allowed to test.
- 5Filter the results. Use flags such as -fs or -fc to hide responses you do not need, like a known default response size or status code.
- 6Limit the run. Add -maxtime to stop the run after a set number of seconds.
Install ffuf on macOS, Windows or with Go
The README lists several ways to get ffuf. On macOS with Homebrew, you can install it with a single package-manager command. On Windows you can use Scoop or Winget. You can also download a prebuilt binary from the releases page, unpack it and run it.
If you have a recent Go compiler, you can install ffuf with go install. The README says Go 1.20 or greater is required, and this is only needed for the go install route or for building from source. The same command works for updating.
- macOS with Homebrew: use the brew command below
- Windows with Scoop or Winget: scoop install ffuf or winget install ffuf.ffuf
- Any platform with Go 1.20+: use the go install command below
- Prebuilt binary: download from the releases page, unpack and run
brew install ffuf
go install github.com/ffuf/ffuf/v2@latestUnderstand the FUZZ keyword
ffuf works by replacing a marker with each word from your list. To define the test case, use the keyword FUZZ anywhere in the URL (-u), headers (-H), or POST data (-d). ffuf sends one request per word and records the response for each.
Only test servers you have permission to test. ffuf sends large numbers of requests, so use it only on your own systems, practice targets such as the ffuf.me lessons, or targets where you have written authorization.
Find hidden directories on a web server
The most common use is content discovery. Put FUZZ at the end of the URL and pass a wordlist with -w. ffuf requests each path and lists the responses it gets back.
Replace /path/to/wordlist with the location of your own wordlist file and https://target with a server you are allowed to test.
ffuf -w /path/to/wordlist -u https://target/FUZZDiscover virtual hosts and filter noise
To find virtual hosts without DNS records, fuzz the Host header with -H. The README example assumes the default virtual host response is 4242 bytes, so it filters out responses of that size with -fs 4242. Change that value to match the default response size on your target.
Filtering is how you cut noise. The README also shows -fc 401 to hide responses with HTTP code 401.
- -fs filters out responses of a given size
- -fc filters out responses with a given status code
ffuf -w /path/to/vhost/wordlist -u https://target -H "Host: FUZZ" -fs 4242Fuzz GET and POST parameters
Parameter fuzzing works like directory discovery. Put FUZZ in the query string to guess parameter names. If the name is known, put FUZZ where the value goes to guess values.
For POST requests, use -X POST and -d. The README example fuzzes only the password field of a login form and hides 401 responses.
ffuf -w /path/to/paramnames.txt -u https://target/script.php?FUZZ=test_value -fs 4242
ffuf -w /path/to/postdata.txt -X POST -d "username=admin\&password=FUZZ" -u https://target/login.php -fc 401Limit run time and use configuration files
Use -maxtime to stop the whole run after a number of seconds. Use -maxtime-job with -recursion and -recursion-depth to limit each recursive job instead. ffuf also reads a default ffufrc file at $XDG_CONFIG_HOME/ffuf/ffufrc, and -config lets you pick a different file. Command-line options override the file, except repeated flags such as -H, which are appended.
ffuf -w /path/to/wordlist -u https://target/FUZZ -maxtime 60What people use it for
- Finding hidden directories on a web server you are authorized to test
- Discovering virtual hosts by fuzzing the Host header
- Guessing GET parameter names or values on your own script
- Fuzzing a POST login form field during an authorized assessment
- Practising web fuzzing on the ffuf.me lessons
Frequently asked questions
How do I install ffuf?
On macOS you can run brew install ffuf with Homebrew. On Windows you can use Scoop or Winget, and with a recent Go compiler you can run go install github.com/ffuf/ffuf/v2@latest. You can also download a prebuilt binary from the releases page.
What are the requirements for ffuf?
The README says ffuf depends on Go 1.20 or greater. That requirement applies only if you install with go install or build from source, not if you use a prebuilt binary or a package manager.
Is ffuf free to use?
ffuf is released under the MIT licence, as listed on its project page. Check the licence file in the repository for the full terms.
What is the FUZZ keyword in ffuf?
FUZZ is the marker ffuf replaces with each word from your wordlist. You can place it in the URL, headers or POST data, and ffuf sends one request per word.
Can ffuf be used with a graphical interface?
No. ffuf is a command-line tool. The README describes an interactive mode, but it does not describe a graphical interface.
How does ffuf compare to gobuster, feroxbuster or wfuzz?
gobuster, feroxbuster and wfuzz are comparable projects in the same area of web fuzzing. This guide does not benchmark them, so test each tool against your own target to see which fits your workflow.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
ffuf suits security testers doing authorized web content discovery, developers checking what their own server accepts, and students practising on legal lab targets. It is a good fit if you want a scriptable command-line tool with response filtering. If you need a graphical interface or you do not have permission to test a target, pick a different approach.
Install options & downloads