The ffuf Cheat Sheet: Practical Web Fuzzing for Bug Bounty

ffuf (Fuzz Faster U Fool) is the web fuzzer most bug bounty hunters reach for first. It’s fast, flexible, and does one thing brilliantly: it takes a URL with a FUZZ keyword, swaps in every word from a list, and shows you what comes back. That simple primitive covers content discovery, parameter discovery, virtual-host enumeration, and more. This is a practical cheat sheet you can keep next to your terminal.

The core idea: FUZZ is a placeholder

Wherever you put the word FUZZ in your request, ffuf substitutes each line of your wordlist. Put it in the path and you’re discovering directories. Put it in a parameter name and you’re finding hidden parameters. Put it in the Host header and you’re enumerating virtual hosts. Same tool, different placement.

1. Directory and file discovery

ffuf -u https://target.com/FUZZ -w /path/to/wordlist.txt

Good wordlists matter more than the tool. SecLists is the standard — start with Discovery/Web-Content/raft-medium-directories.txt and raft-medium-files.txt. To find files with specific extensions, use -e:

ffuf -u https://target.com/FUZZ -w wordlist.txt -e .php,.bak,.old,.zip,.txt,.json

2. Filtering the noise (the skill that matters)

The difference between a useful fuzz and a wall of garbage is filtering. If a site returns 200 for every path (a catch-all/SPA), raw results are useless. Filter by response size, word count, or status code:

• -mc 200,301,401,403 — match only these status codes
• -fc 404 — filter out (hide) these status codes
• -fs 1234 — filter out responses of exactly this byte size (great for killing a repeated “not found” page)
• -fw 12 — filter by word count; -fl 5 filters by line count

# Hide the catch-all 200 page that's always 1,782 bytes
ffuf -u https://target.com/FUZZ -w wordlist.txt -fs 1782

A reliable pattern: run once, see what the “boring” response size is, then -fs it away and re-run. What’s left is the interesting stuff.

3. Recursion for nested paths

ffuf -u https://target.com/FUZZ -w wordlist.txt -recursion -recursion-depth 2 -e /

When ffuf finds a directory, recursion automatically fuzzes inside it. Keep the depth shallow (1–2) or you’ll spawn an enormous job.

4. Hidden parameter discovery

Undocumented parameters are a classic path to IDOR, debug modes, and access-control bugs. Fuzz the parameter name:

ffuf -u "https://target.com/api/user?FUZZ=1" -w params.txt -fs 0

Use SecLists/Discovery/Web-Content/burp-parameter-names.txt. Watch for any response that differs from the baseline — a changed size, a new error, a different status. That delta means the server noticed your parameter, which means it does something. (A dedicated tool like arjun automates this, but knowing the ffuf method keeps you flexible.)

5. Virtual host enumeration

One IP can serve many sites based on the Host header. Fuzz it to find internal apps that share the server:

ffuf -u https://target.com/ -H "Host: FUZZ.target.com" -w subdomains.txt -fs 0

6. POST bodies and authenticated fuzzing

# Fuzz a POST body field
ffuf -u https://target.com/api -X POST 
  -H "Content-Type: application/json" 
  -d '{"username":"FUZZ"}' -w users.txt

# Fuzz behind auth — pass your session
ffuf -u https://target.com/FUZZ -w wordlist.txt 
  -H "Authorization: Bearer YOUR_TOKEN"

Rate control — be a good guest

Fuzzing hammers a server. Respect the target (and stay off the WAF’s radar) with -rate (requests per second) and -t (threads):

ffuf -u https://target.com/FUZZ -w wordlist.txt -rate 50 -t 20

On programs with strict rules, dial this down. A blocked IP finds nothing, and aggressive scanning can breach program terms.

The one-line mental model

Every ffuf command is the same shape: a request with FUZZ somewhere, a wordlist, and a filter to cut the noise. Master those three and you can point it at directories, parameters, vhosts, headers, or JSON fields without looking anything up. The tool is easy; the craft is in choosing the right wordlist and reading the deltas.

---

Only fuzz targets you’re authorized to test. Uncontrolled fuzzing against out-of-scope hosts can cause outages and violate the law and program rules.