ffuf
Intermediate
Actively maintained
High-speed fuzzing for content discovery, parameters, and virtual hosts
https://github.com/ffuf/ffufInstallation
go install github.com/ffuf/ffuf/v2@latest
# Wordlists (SecLists is the common source)
git clone --depth 1 https://github.com/danielmiessler/SecLists.gitUsage
Basic Usage
# Directory and file discovery
ffuf -u https://example.com/FUZZ -w /path/to/wordlist.txt
# Filter out the "everything returns 200" case by response size
ffuf -u https://example.com/FUZZ -w wordlist.txt -fs 4242
# Match only interesting status codes, and stay polite
ffuf -u https://example.com/FUZZ -w wordlist.txt -mc 200,204,301,302,401,403 -rate 50
# Virtual host discovery
ffuf -u https://example.com -H "Host: FUZZ.example.com" -w subdomains.txt -fs 0