ffuf cheatsheet

# Show only 200 responses
ffuf -u http://target.com/FUZZ -w wordlist.txt -mc 200

# Filter out 404 and 400
ffuf -u http://target.com/FUZZ -w wordlist.txt -fc 404,400

# Filter by exact response size (remove identical error pages)
ffuf -u http://target.com/FUZZ -w wordlist.txt -fs 1234

# Filter by multiple sizes (comma-separated)
ffuf -u http://target.com/FUZZ -w wordlist.txt -fs 1234,5678

# Match by regex - finds pages mentioning admin
ffuf -u http://target.com/FUZZ -w wordlist.txt -mr "(?i)admin|dashboard"

# Filter pages that contain "not found" text
ffuf -u http://target.com/FUZZ -w wordlist.txt -fr "(?i)not found|page not found"

# Time-based match for slow SQL injection responses (>2000ms)
ffuf -u "http://target.com/item?id=FUZZ" -w sqli.txt -mt ">2000"

# Combine matchers: 200 AND response size > 500 (use -mmode and)
ffuf -u http://target.com/FUZZ -w wordlist.txt -mc 200 -ms 500 -mmode and

# CLUSTERBOMB (default): all combinations - W1*W2 total requests
ffuf -u http://target.com/FUZZ1/FUZZ2 \
  -w dirs.txt:FUZZ1 \
  -w files.txt:FUZZ2

# PITCHFORK: lockstep - pairs line 1 with line 1, etc.
# Use for username:password pairs from breach data
ffuf -u http://target.com/login -X POST \
  -d "user=USER&pass=PASS" \
  -w usernames.txt:USER \
  -w passwords.txt:PASS \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -mode pitchfork -fc 401

# SNIPER: one wordlist, injected at each position in sequence
ffuf -u http://target.com/FUZZ1/FUZZ2 \
  -w payloads.txt \
  -mode sniper

# URL-encode the payload (e.g. for path traversal or SQLi)
ffuf -u "http://target.com/FUZZ" -w traversal.txt -enc "FUZZ:urlencode"

# Base64-encode the payload
ffuf -u "http://target.com/api?token=FUZZ" -w tokens.txt -enc "FUZZ:b64encode"

# Chain encoders - URL-encode then base64
ffuf -u "http://target.com/FUZZ" -w payloads.txt -enc "FUZZ:urlencode b64encode"

# Multiple keywords with different encoders
ffuf -u "http://target.com/path?id=ID&token=TOK" \
  -w ids.txt:ID \
  -w tokens.txt:TOK \
  -enc "ID:urlencode" \
  -enc "TOK:b64encode"

Available encoders: urlencode, urldoubleencode, b64encode, md5, sha256

# Fuzz HTTP methods on a known endpoint
ffuf -u http://target.com/api/v1/users \
  -w methods.txt \
  -X FUZZ \
  -mc 200,201,204,400,401,403,405,500

# Quick inline method list (no wordlist file needed)
for m in GET POST PUT DELETE PATCH HEAD OPTIONS TRACE CONNECT; do
  printf "$m\n"
done | ffuf -u http://target.com/api/v1/users \
  -w -:FUZZ \
  -X FUZZ \
  -mc 200,201,204,400,405,500 -c

# Method + endpoint combo (clusterbomb)
ffuf -u http://target.com/api/v1/ENDPOINT \
  -w endpoints.txt:ENDPOINT \
  -w methods.txt:METHOD \
  -X METHOD \
  -mode clusterbomb \
  -mc 200,201,204,400,401,403,405

Methods wordlist content: GET POST PUT DELETE PATCH OPTIONS HEAD TRACE CONNECT

# Fuzz a JSON field value
ffuf -u http://target.com/api/v1/login \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"username":"FUZZ","password":"password"}' \
  -w /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt \
  -mc 200 -c

# Fuzz a JSON field name (key discovery)
ffuf -u http://target.com/api/v1/user/profile \
  -X PUT \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <token>" \
  -d '{"FUZZ":"test"}' \
  -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
  -mc 200,400 -fr '"error"' -c

# Mass assignment: fuzz privilege escalation fields
ffuf -u http://target.com/api/v1/user/update \
  -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <token>" \
  -d '{"FUZZ":"true"}' \
  -w priv-params.txt \
  -mc 200 -c

# Common GraphQL endpoint paths
ffuf -u http://target.com/FUZZ \
  -w /usr/share/seclists/Discovery/Web-Content/graphql.txt \
  -mc 200,400,405 -c

# Also try these manually after discovery:
# /graphql  /graphiql  /api/graphql  /v1/graphql
# /graphql/console  /playground  /api/explorer

# Probe for introspection - POST a basic introspection query
curl -s -X POST http://target.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{ __schema { types { name } } }"}' | jq .

# Confirm endpoint is live (any GraphQL error = valid endpoint)
ffuf -u http://target.com/FUZZ \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"query":"{__typename}"}' \
  -w graphql-paths.txt \
  -mr '"data"' -c

JWT fuzzing targets the payload claims to find privilege escalation, IDOR via sub/user_id, or broken authorization logic. You need a valid baseline token.

# Step 1 - decode existing JWT to understand claim structure
echo "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0IiwicGxhbiI6ImZyZWUifQ.sig" \
  | cut -d. -f2 | base64 -d 2>/dev/null | jq .
# Output: {"sub":"1234","plan":"free"}

# Step 2 - fuzz the Authorization header with a pre-built token wordlist
ffuf -u http://target.com/api/v1/admin \
  -H "Authorization: Bearer FUZZ" \
  -w jwt-tokens.txt \
  -mc 200 -c

# Fuzz sub claim (IDOR via user ID in JWT)
# Generate tokens with different sub values using a script, then:
ffuf -u http://target.com/api/v1/profile \
  -H "Authorization: Bearer FUZZ" \
  -w generated-jwts.txt \
  -mc 200 -c

# Fuzz role/plan claim via pre-generated tokens
# python3 gen_jwts.py --claim role --values admin,superuser,staff > role-tokens.txt
ffuf -u http://target.com/api/v1/admin \
  -H "Authorization: Bearer FUZZ" \
  -w role-tokens.txt \
  -mc 200 -fc 401,403 -c

# Fuzz session cookie value (session fixation / brute-force)
ffuf -u http://target.com/dashboard \
  -b "PHPSESSID=FUZZ" \
  -w /usr/share/seclists/Fuzzing/alphanum-case.txt \
  -mc 200 -fs 4242 -c

# Fuzz a specific cookie parameter name
ffuf -u http://target.com/dashboard \
  -H "Cookie: FUZZ=admin" \
  -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
  -mc 200 -fc 302,401,403 -c

# Fuzz cookie role/privilege value
ffuf -u http://target.com/admin \
  -H "Cookie: session=abc123; role=FUZZ" \
  -w roles.txt \
  -mc 200 -fc 302,403 -c

# Path traversal bypass via header
ffuf -u http://target.com/admin \
  -H "X-Original-URL: FUZZ" \
  -w /usr/share/seclists/Discovery/Web-Content/raft-small-directories.txt \
  -mc 200 -c

# Fuzz admin path via X-Rewrite-URL
ffuf -u http://target.com/ \
  -H "X-Rewrite-URL: FUZZ" \
  -w /usr/share/seclists/Discovery/Web-Content/quickhits.txt \
  -mc 200 -c

# Basic auth brute-force via Authorization header
ffuf -u http://target.com/admin \
  -H "Authorization: Basic FUZZ" \
  -w /usr/share/seclists/Miscellaneous/BasicAuthenticationCredentials.txt \
  -mc 200 -c

# Fuzz password reset tokens
ffuf -u "http://target.com/reset?token=FUZZ" \
  -w /usr/share/seclists/Fuzzing/alphanum-case-extra.txt \
  -mc 200,302 -c

# Basic directory fuzzing
ffuf -u http://target.com/FUZZ \
  -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
  -ac -c

# File fuzzing with common extensions
ffuf -u http://target.com/FUZZ \
  -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt \
  -e .php,.html,.bak,.txt,.conf,.log,.xml,.json \
  -ac -c

# DirSearch compatibility mode (-D appends extensions without dot duplication)
ffuf -u http://target.com/FUZZ \
  -w wordlist.txt \
  -D -e php,html,bak,txt \
  -ac -c

# Recursive fuzzing with depth limit
ffuf -u http://target.com/FUZZ \
  -w /usr/share/seclists/Discovery/Web-Content/raft-small-directories.txt \
  -recursion -recursion-depth 3 \
  -ac -e .php,.html -c

# Greedy recursion - recurse into all matches, not just redirects
ffuf -u http://target.com/FUZZ \
  -w wordlist.txt \
  -recursion -recursion-strategy greedy \
  -recursion-depth 2 -ac -c

# VHost enumeration via Host header (internal apps on shared IP)
ffuf -u http://10.10.10.100 \
  -H "Host: FUZZ.target.com" \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  -fs 4242 -c

# Subdomain-style URL fuzzing
ffuf -u http://FUZZ.target.com \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  -ac -c

# Large subdomain list for bug bounty
ffuf -u http://FUZZ.target.com \
  -w /usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt \
  -ac -t 100 -c

# Per-host autocalibration (each vhost gets its own baseline)
ffuf -u http://10.10.10.100 \
  -H "Host: FUZZ.target.com" \
  -w subdomains.txt \
  -ach -c

# GET parameter name fuzzing
ffuf -u "http://target.com/page.php?FUZZ=test" \
  -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
  -fs 1234 -c

# GET parameter value fuzzing (IDOR)
ffuf -u "http://target.com/profile?id=FUZZ" \
  -w /usr/share/seclists/Fuzzing/4-digits-0000-9999.txt \
  -mc 200 -c

# POST parameter name fuzzing
ffuf -u http://target.com/api/action \
  -X POST \
  -d "FUZZ=test" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
  -fs 1234 -c

# Hard rate limit (50 req/s)
ffuf -u http://target.com/FUZZ -w wordlist.txt -rate 50

# Random delay 0.5-3 seconds per request (IDS/WAF evasion)
ffuf -u http://target.com/FUZZ -w wordlist.txt -p 0.5-3.0

# Low-and-slow: 5 threads + delay
ffuf -u http://target.com/FUZZ -w wordlist.txt -t 5 -p 1.0-5.0 -rate 2

# Realistic browser User-Agent
ffuf -u http://target.com/FUZZ -w wordlist.txt \
  -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"

# Randomize User-Agent from a list using input-cmd
ffuf -u http://target.com/FUZZ \
  -w wordlist.txt \
  -H "User-Agent: $(shuf -n1 user-agents.txt)" \
  -rate 10 -p 0.2-1.0

# Stop if the target starts blocking (>95% 403s)
ffuf -u http://target.com/FUZZ -w wordlist.txt -sf -rate 20

# JSON output - parse with jq
ffuf -u http://target.com/FUZZ -w wordlist.txt -o results.json -of json

# Extract just the URLs from JSON output
jq -r '.results[].url' results.json

# Extract URL + status + size
jq -r '.results[] | "\(.status) \(.length) \(.url)"' results.json | sort -n

# Filter results by status in jq
jq -r '.results[] | select(.status==200) | .url' results.json

# Newline-delimited JSON to stdout (pipe to other tools)
ffuf -u http://target.com/FUZZ -w wordlist.txt -json \
  | jq -r 'select(.status==200) | .url'

# HTML report
ffuf -u http://target.com/FUZZ -w wordlist.txt -o report.html -of html

# Generate all formats at once
ffuf -u http://target.com/FUZZ -w wordlist.txt -o results -of all

# Save matched response bodies to directory
ffuf -u http://target.com/FUZZ -w wordlist.txt -od ./responses/ -ac

# Pipe results into nuclei for immediate vuln scanning
ffuf -u http://target.com/FUZZ -w wordlist.txt -json \
  | jq -r 'select(.status==200) | .url' \
  | nuclei -t /path/to/templates/

# Generate sequential IDs with seq
ffuf -u "http://target.com/api/v1/user/FUZZ" \
  -input-cmd "seq 1 10000" \
  -input-num 10000 \
  -mc 200 -c

# Generate GUIDs with Python
ffuf -u "http://target.com/api/items/FUZZ" \
  -input-cmd "python3 -c \"import uuid; [print(uuid.uuid4()) for _ in range(1000)]\"" \
  -input-num 1000 \
  -mc 200 -c

# Read from stdin (use - as wordlist with pipe)
cat wordlist.txt | ffuf -u http://target.com/FUZZ -w -

# Generate JWT tokens on the fly
ffuf -u http://target.com/api/admin \
  -H "Authorization: Bearer FUZZ" \
  -input-cmd "python3 gen_jwts.py --claim role --values admin,superuser,staff,root" \
  -input-num 4 \
  -mc 200 -c

# Use a custom config file for a specific engagement
ffuf -config /path/to/engagement.ffufrc -u http://target.com/FUZZ -w wordlist.txt

# Override a config file setting from command line
# (command-line always wins except -H which appends)
ffuf -config ~/.config/ffuf/ffufrc \
  -u http://target.com/FUZZ \
  -w wordlist.txt \
  -rate 100    # overrides config rate value

# Engagement-specific config example: slow/stealthy preset
# slow.ffufrc
# [general]
# rate = 5
# threads = 5
# [http]
# proxyurl = "http://127.0.0.1:8080"

# Quick grep on default output (use -c for colors)
ffuf -u http://target.com/FUZZ -w wordlist.txt -ac -c 2>&1 | grep "200"

# Pipe to tee for live output + save
ffuf -u http://target.com/FUZZ -w wordlist.txt -ac -c 2>&1 | tee ffuf_output.txt

# Extract URLs from text output
grep -oP 'http[s]?://[^\s]+' ffuf_output.txt

# Count results per status code
ffuf -u http://target.com/FUZZ -w wordlist.txt -ac -o results.json -of json
jq -r '.results[] | .status' results.json | sort | uniq -c | sort -rn

When a path returns 403 Forbidden, try bypass techniques.

# Path traversal bypasses
ffuf -u http://target.com/FUZZ/admin \
  -w /usr/share/seclists/Fuzzing/403-bypass.txt \
  -mc 200,301,302 -c

# Header-based bypasses (X-Forwarded-For, X-Original-URL, etc.)
ffuf -u http://target.com/admin \
  -w /usr/share/seclists/Discovery/Web-Content/common.txt \
  -H "X-Forwarded-For: 127.0.0.1" \
  -H "X-Original-URL: /FUZZ" \
  -ac -c -mc 200

# Case and encoding variations
ffuf -u http://target.com/FUZZ \
  -w - <<EOF
/admin
/Admin
/ADMIN
/%61dmin
/admin/
/admin/.
/./admin
//admin
/admin%20
/admin%09
EOF

# Verbose mode (show all responses including filtered)
ffuf -u http://target.com/FUZZ -w wordlist.txt -v

# Debug mode with request/response details
ffuf -u http://target.com/FUZZ -w wordlist.txt -debug-log debug.txt

# Silent mode (no banner, minimal output)
ffuf -u http://target.com/FUZZ -w wordlist.txt -s

# Show only the URLs (for piping)
ffuf -u http://target.com/FUZZ -w wordlist.txt -s -ac | tee urls.txt

• ffuf GitHub
• ffuf Wiki
• SecLists
• OneListForAll
• Assetnote Wordlists
• HackTricks
• PayloadsAllTheThings

• Nmap (Network scanning)
• SQLmap (SQL injection)
• Gobuster (Directory brute-force)
• Metasploit (Exploitation framework)
• Web Toolkit (XSS, SSTI, SSRF, Upload)
• Pentest Toolkit (Methodology)
• Bug Bounty (Platforms and workflows)