Ffuf

Ffuf

Purpose

Use this skill when the methodology calls for controlled discovery of hidden web paths or API routes.

Phase Fit

• Primary: Discovery and Reconnaissance, Vulnerability Analysis
• Secondary: Validation and Controlled Impact Demonstration, Retest and Closure

Use When

• Need to discover content paths, API routes, or administrative endpoints.
• Need to validate whether exposed functionality is broader than the visible application map.
• Need to retest whether sensitive routes were removed or protected.

Avoid When

• Rate limits, lockout behavior, or fragile backends are not understood.
• Broad wordlist-driven traffic would exceed the approved impact level.

Inputs

• Confirmed base URLs and authentication context
• Narrow wordlists aligned to the app type
• Rate limits, exclusions, and lockout considerations

Procedure

1. Start with the smallest path set that matches the current hypothesis.
2. Separate authenticated and unauthenticated coverage.
3. Triage responses for real exposure, not just status code noise.
4. Hand material findings to burp-suite for manual confirmation.
5. Preserve the exact route and context needed for retest.

Command Syntax

Replace sample targets with approved in-scope assets.

# Directory/path fuzzing with all response codes
ffuf -u https://portal.contoso.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt -mc all -o contoso-dirs.json

# Filter out 404 and 0-byte responses
ffuf -u https://portal.contoso.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt -fc 404 -fs 0

# API route fuzzing with bearer token
ffuf -u https://api.contoso.com/v1/FUZZ -w api-routes.txt -H "Authorization: Bearer <token>" -mc 200,400,403

# Subdomain/vhost fuzzing
ffuf -u https://FUZZ.contoso.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -H "Host: FUZZ.contoso.com" -mc 200

# POST body parameter fuzzing
ffuf -u https://portal.contoso.com/login -X POST -d "username=FUZZ&password=admin" -w users.txt -mc 302

# Rate-limited scan to avoid lockouts
ffuf -u https://portal.contoso.com/FUZZ -w paths.txt -rate 50 -mc 200,301,302,403

Evidence to Capture

• Newly discovered paths or routes
• Authentication boundary differences
• Patterns that suggest hidden admin or debug functionality

Safety Boundaries

• Throttle traffic and respect lockout risks.
• Avoid payloads or route sets that exceed the agreed impact level.