FFUF Deep Dive: Advanced Fuzzing Strategies for Web Attack Surface Discovery

Article Thumbnail

FFUF is a fast web fuzzer written in Go used extensively by penetration testers and bug bounty hunters to discover hidden files, directories, virtual hosts, and vulnerabilities in web applications.

In this article, we will advance the use case of ffuf. How you can use this for other, more advanced meaningful things, from complex fuzzing to multi-parameter fuzzing? We are going to discuss how you can use ffuf to achieve more than just simple directory fuzzing.

Using an HTTP Proxy with FFUF

You can use a simple HTTP proxy with ffuf by pointing ffuf to the proxy address using the -x (proxy) option.

ffuf -u http://target/FUZZ -w wordlist.txt -x http://127.0.0.1:8080

You can also use standard proxy environment variables.

# Export the following variables
export HTTP_PROXY="http://127.0.0.1:8080"
export HTTPS_PROXY="http://127.0.0.1:8080"

# Then run ffuf normally
ffuf -u https://target/FUZZ -w wordlist.txt

FFUF can be connected to Burp Suite or OWASP ZAP using an HTTP proxy, but it can only use one proxy at a time per run. By specifying the proxy with the -x option, ffuf will send all its requests through either Burp or ZAP, allowing you to inspect, log, or passively analyze the traffic; for HTTPS targets, the -k flag is usually required to ignore certificate validation.

Proxy with authentication:

ffuf -u http://target/FUZZ \
     -w wordlist.txt \
     -x http://user:pass@127.0.0.1:8080

Complex filtering in FFUF

FFUF allows precise control over scan results by using matchers and filters. Matchers define which responses should be displayed, while filters define which responses should be hidden. Both can be based on different response attributes such as status code, size, word count, line count, response time, and regex patterns.

Matchers (-m) → Include only responses that match the given condition:

• -mc → Match HTTP status codes (e.g., show only 200 responses)
• -ms → Match response size
• -mw → Match word count
• -ml → Match line count
• -mr → Match responses using regex patterns
• -mt → Match response time

Filters (-f) → Exclude responses that match the given condition:

• -fc → Filter HTTP status codes (e.g., hide 404 responses)
• -fs → Filter response size
• -fw → Filter word count
• -fl → Filter line count
• -fr → Filter responses using regex patterns

More details about available matcher and filter options can be found under “Matcher Options” and “Filter Options” by running:

ffuf -h

Recursive Fuzzing

Recursive fuzzing is used to systematically discover hidden or unknown content that exists in multiple levels of a structure. You can use ffuf to automatically discover directories and then fuzz inside the directories it finds. You can set the recursion depth, control the response trigger, or use filtering (discussed above) to fine-tune output.

ffuf -u https://target.com/FUZZ -w wordlist.txt -recursion

Set recursion depth:

Get Blueorionn’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

This will fuzz:

• /FUZZ
• /found/FUZZ
• /found/subdir/FUZZ

ffuf -u https://target.com/FUZZ -w wordlist.txt -recursion -recursion-depth 3

Multi Parameter Fuzzing

Multi-parameter fuzzing (also called cluster bomb fuzzing) means fuzzing multiple inputs at the same time using different wordlists, trying every possible combination of values. This behavior is equivalent to Burp Suite’s Cluster Bomb attack type. ffuf supports multiple fuzz keywords, each keyword with its own wordlist, and ffuf generates all combinations (Cartesian product).

ffuf -u https://target.com/login \
-X POST \
-d "username=FUZZ&password=FUZZ2" \
-w users.txt:FUZZ \
-w passwords.txt:FUZZ2

Request Scheduling and Throttling

Sending a large number of requests simultaneously can negatively impact the target application by consuming excessive resources, triggering rate limits, causing inaccurate results, or disrupting normal services. FFUF provides options to control request scheduling and traffic flow. The -t option manages concurrency by defining the number of parallel workers, while -rate limits the maximum requests sent per second. The -p option introduces delays between requests, helping create a controlled and stable scanning process. Proper tuning of these parameters improves efficiency while reducing unnecessary load on the target system.

Runs the scan using 20 concurrent workers:

ffuf -u https://example.com/FUZZ -w wordlist.txt -t 20

Limits the scan to 50 requests per second:

ffuf -u https://example.com/FUZZ -w wordlist.txt -rate 50

Add 1-second delay between requests:

ffuf -u https://example.com/FUZZ -w wordlist.txt -p 1

Random delay between 0.1 and 2.0 seconds:

ffuf -w wordlist.txt -u https://target.com -p 0.1-2.0