Ultimate Ffuf Cheat Sheet

Samir KC
March 15, 2026


Ultimate Ffuf Cheat Sheet

The fastest web fuzzer. Master the "FUZZ" keyword.

1. Basic Fuzzing

Ffuf works by replacing the keyword FUZZ in your command with words from your list.

Directory Fuzzing

The most common usage. Find hidden directories.

ffuf -u http://target.com/FUZZ -w wordlist.txt

Multiple Wordlists (Clusterbomb)

You can define multiple variables (FUZZ, W2, etc.).

ffuf -u http://target.com/FUZZ/W2 -w dirs.txt:FUZZ -w files.txt:W2

Colors & Verbosity

-c enables color output. -v prints the full URL of matches.

ffuf -u http://target.com/FUZZ -w wordlist.txt -c -v

2. Matchers (mc) & Filters (fc)

By default, Ffuf matches 200, 204, 301, 302, 307, 401, 403. You often need to filter noise.

Filter Status Codes (-fc)

Hide 404 Not Found and 403 Forbidden responses.

ffuf -u http://target.com/FUZZ -w wordlist.txt -fc 404,403

Filter by Response Size (-fs)

Crucial for VHosts. If every failure is 1234 bytes, filter that size out.

ffuf -u http://target.com/FUZZ -w wordlist.txt -fs 1234

Match Specific Codes (-mc)

Only show me 200 OK responses.

ffuf -u http://target.com/FUZZ -w wordlist.txt -mc 200

Auto-Calibration (-ac)

Pro Tip: Use -ac to let Ffuf automatically detect and hide "generic" error responses.

ffuf -u http://target.com/FUZZ -w wordlist.txt -ac

3. Recursion & Extensions

Recursive Fuzzing

If a directory is found, automatically fuzz inside it. (e.g., found /admin/, start fuzzing /admin/FUZZ).

ffuf -u http://target.com/FUZZ -w wordlist.txt -recursion -recursion-depth 2

File Extensions (-e)

Append extensions to every word in the list.

ffuf -u http://target.com/FUZZ -w wordlist.txt -e .php,.html,.bak

4. Parameters & POST Data

GET Parameter Fuzzing

Find hidden parameters like ?debug=true or ?id=1.

ffuf -u http://target.com/page.php?FUZZ=key -w params.txt -fs 0

POST Data Fuzzing

Brute force forms or JSON APIs. Use -d for data and -X POST.

ffuf -u http://target.com/login -w pass.txt -X POST -d "user=admin&pass=FUZZ" -H "Content-Type: application/x-www-form-urlencoded"

5. VHost & Header Fuzzing

Subdomain / VHost Discovery

Fuzz the Host header. Use -fs to hide the default page size.

ffuf -u http://target.com -w subdomains.txt -H "Host: FUZZ.target.com" -fs [SIZE]

Header Fuzzing

Fuzz headers to find internal routing headers (like X-Forwarded-For).

ffuf -u http://target.com -w headers.txt -H "FUZZ: 127.0.0.1"

6. Request File (Advanced)

Instead of typing complex commands, save a raw HTTP request from Burp Suite to a file and tell Ffuf where to fuzz.

1. Save Request

Save to req.txt. Put FUZZ where you want to inject.

POST /login HTTP/1.1
Host: target.com
Content-Type: application/json

{"username": "admin", "password": "FUZZ"}

2. Run Ffuf

ffuf -request req.txt -w passwords.txt
⇧