ffuf (Fuzz Faster U Fool) is a command-line web fuzzer written in Go. It helps security testers discover hidden web resources and investigate how applications respond to different HTTP request parameters and input values.
The software uses wordlists and configurable injection points to generate HTTP requests. Test values can be inserted into URLs, headers, POST data and other request components, allowing users to investigate directories, virtual hosts, authentication fields and application parameters.
ffuf provides extensive response filtering to help distinguish interesting results from ordinary error pages. Responses can be matched or excluded using HTTP status codes, response sizes, word counts and other characteristics. Its calibration facilities help reduce false positives caused by inconsistent server responses.
The software also supports recursive content discovery, multiple wordlists and interactive control of running scans. Configuration files allow commonly used settings to be reused across security assessments.
This is free and open source software.
Key Features
- Generate HTTP requests using wordlists and configurable injection points.
- Discover hidden web directories, files and other resources.
- Test virtual hosts through HTTP Host header fuzzing.
- Fuzz GET and POST parameters and request bodies.
- Test custom HTTP headers and authentication-related fields.
- Use multiple wordlists with clusterbomb and pitchfork processing modes.
- Filter responses by status code, size, word count and line count.
- Calibrate scans automatically to reduce false-positive results.
- Follow redirects and configure HTTP request behaviour.
- Support recursive content discovery with configurable depth limits.
- Control concurrency, request rate and execution time.
- Use external payload generators and mutation tools.
- Configure upstream proxies and custom request headers.
- Adjust active scans through an interactive command-line mode.
- Export scan results in structured formats for further analysis.
Website: github.com/ffuf/ffuf
Support:
Developer: Joona Hoikkala
License: MIT License
ffuf is written in Go. Learn Go with our recommended free books and free tutorials.
Related Software
| Security Testing | |
|---|---|
| ZAP | Web app scanner |
| mitmproxy | Interactive HTTPS proxy |
| ffuf | Fast web fuzzer for discovering hidden paths, virtual hosts and parameters |
| Wfuzz | Web application fuzzer and Python library for security assessments |
| sqlmap | Penetration testing tool |
| Dalfox | Identify cross-site scripting vulnerabilities in web applications |
| Commix | Python-based penetration testing tool |
| jwt_tool | Toolkit for auditing JSON Web Tokens and testing security weaknesses |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.