Last year, a bug bounty hunter found a hidden /admin-backup/ endpoint on a Fortune 500 company's forgotten staging server. The payout was $15,000. The tool that found it? A single ffuf command that ran for 47 seconds.
ffuf (Fuzz Faster U Fool) isn't new, but it's become the de facto standard for web content discovery and parameter fuzzing in the bug bounty and penetration testing communities. If you're still using DirBuster or Dirbuster-ng with their clunky Java GUIs, this post is your migration guide.
What Problem Does ffuf Solve?
Web applications hide content. Admin panels, backup files, API endpoints, debug pages, forgotten staging routes — they exist on the server, but no link points to them. Fuzzing systematically tests thousands of potential paths against a web server to find what's hidden.
ffuf does this faster than any competitor. Written in Go, it's a single binary with zero dependencies, supports multiple fuzzing modes, handles complex filtering, and processes thousands of requests per second without breaking a sweat.
Where it fits in your workflow: after subdomain enumeration (with Subfinder) and HTTP probing (with httpx), ffuf is the tool that turns a list of live hosts into a map of discoverable content. It sits right before vulnerability scanning with tools like Nuclei.
An architectural workflow diagram illustrating web content discovery with ffuf filtering out noise.
Installation
ffuf is a single Go binary. Install it with:
# Install via Go (recommended — always gets the latest version)
P
Written by
pranay
Ethical Hacker & Cybersecurity Educator
Cybersecurity enthusiast focused on ethical hacking, penetration testing, bug bounty hunting, and security education. Founder of CyberBlockz, sharing practical cybersecurity knowledge, CTF challenges, and hands-on training to help learners develop real-world security skills and stay updated with the latest threats and vulnerabilities.
The most common use case. You have a target web application and want to find hidden directories, files, and endpoints.
# Basic directory fuzzing against a target# FUZZ is the placeholder that ffuf replaces with each wordlist entryffuf -u https://example.com/FUZZ -w ~/SecLists/Discovery/Web-Content/common.txt
# Filter out 404 responses (most results will be 404s)ffuf -u https://example.com/FUZZ \-w ~/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt \-fc404# Filter by response size (useful when the server returns custom 404 pages)# First, check what size a known-bad response returns, then filter itffuf -u https://example.com/FUZZ \-w ~/SecLists/Discovery/Web-Content/common.txt \-fs4242# Filter responses with exactly 4242 bytes
The -fc (filter code) and -fs (filter size) flags are where ffuf separates itself from older tools. Real web applications rarely return clean 404 status codes. They return 200 with a custom "page not found" body. Filtering by response size lets you cut through that noise instantly.
Parameter Fuzzing — Finding Hidden GET and POST Parameters
This is where most bug bounty hunters underuse ffuf. Beyond directory discovery, you can fuzz for hidden parameters that accept user input — potential injection points.
# GET parameter fuzzing# Find hidden parameters on a known endpointffuf -u"https://example.com/api/users?FUZZ=test"\-w ~/SecLists/Discovery/Web-Content/burp-parameter-names.txt \-fs4242# Filter the default response size# POST parameter fuzzing with JSON bodyffuf -u https://example.com/api/login \-X POST \-H"Content-Type: application/json"\-d'{"username": "admin", "FUZZ": "value"}'\-w ~/SecLists/Discovery/Web-Content/burp-parameter-names.txt \-fc400
Finding a hidden debug=true parameter or an undocumented role field in a registration endpoint has led to some of the highest-paid bug bounty reports. ffuf makes this systematic rather than guesswork.
Virtual Host (VHost) Discovery
Many organizations host multiple applications on the same IP address, differentiated only by the Host header. ffuf can enumerate these.
Virtual Host discovery reveals hidden applications sharing the same infrastructure.
# VHost fuzzing — discover hidden subdomains on the same IPffuf -u http://10.10.10.10 \-H"Host: FUZZ.example.com"\-w ~/SecLists/Discovery/DNS/subdomains-top1million-5000.txt \-fs4242# Filter the default vhost response size
This technique is especially powerful during internal penetration tests and HackTheBox/CTF challenges where DNS might not resolve all hostnames. It's also how testers find staging, dev, and internal application instances that share infrastructure with production.
Advanced Filtering and Output
ffuf's filtering is its superpower. Here's the full toolkit:
# Match only specific status codes (inverse of filter)ffuf -u https://example.com/FUZZ -w wordlist.txt -mc200,301,302
# Filter by word count (useful for WAF-filtered responses)ffuf -u https://example.com/FUZZ -w wordlist.txt -fw42# Filter by number of linesffuf -u https://example.com/FUZZ -w wordlist.txt -fl15# Filter by regex on the response bodyffuf -u https://example.com/FUZZ -w wordlist.txt -fr"Page not found"# Combine multiple filtersffuf -u https://example.com/FUZZ -w wordlist.txt -fc404,403-fs0# Output results to JSON for pipeline integrationffuf -u https://example.com/FUZZ -w wordlist.txt -o results.json -of json
# Rate limit to avoid getting blocked (requests per second)ffuf -u https://example.com/FUZZ -w wordlist.txt -rate50
The -rate flag deserves special attention. Running ffuf at full speed against a production target will get your IP banned within seconds. Modern WAFs (Cloudflare, AWS WAF, Akamai) detect burst-request patterns trivially. A rate of 30-50 requests per second looks like normal browsing traffic. Going higher is for lab environments only.
Strengths and Limitations
Strengths:
Speed. ffuf is consistently 3-5x faster than Gobuster and 10x faster than DirBuster in benchmarks. Go's goroutines handle concurrency natively.
Flexibility. The FUZZ keyword can go anywhere in the URL, headers, POST body, or cookies. This makes it useful far beyond directory brute-forcing.
Filter precision. Five different filter types (status, size, words, lines, regex) mean you can zero in on real results even against noisy custom error pages.
Single binary. No Python dependencies, no Java runtime, no Docker. Copy the binary and run.
Silent and scriptable. JSON output pipes cleanly into jq, Nuclei, or custom scripts.
Limitations:
No built-in recursive scanning. Unlike Feroxbuster, ffuf won't automatically fuzz discovered directories. You need to script this or run multiple passes.
No automatic calibration. Tools like Feroxbuster auto-detect the "default" response and filter it. With ffuf, you manually identify the filter size/code on the first run, then add the flag. This is a feature for experienced users but a friction point for beginners.
No GUI. If you want visual results, you'll need to pipe output to a reporting tool.
Alternatives Worth Knowing
Gobuster — Simpler syntax, slightly slower, good for beginners. Lacks POST fuzzing and advanced filters.
Feroxbuster — Rust-based, has automatic recursion and auto-calibration. Better for "set and forget" directory scanning. Slightly slower than ffuf on large wordlists.
Dirsearch — Python-based, good default wordlists, but slower and heavier on dependencies.
For most practitioners, ffuf is the daily driver for targeted fuzzing, and Feroxbuster is the backup for recursive directory crawling. They complement each other.
Maintenance and Maturity
ffuf is maintained by Joona Hoikkala and has been actively developed since 2019. As of mid-2026, the repository has 12,000+ GitHub stars, regular releases, and an active community. The v2 branch introduced significant performance improvements and a plugin system. The MIT license makes it free for any use.
The tool is mature, battle-tested, and isn't going anywhere. It's the kind of project where the codebase is clean enough that even if the maintainer stepped away, the community would carry it forward.
Putting It All Together — A Real Workflow
Here's how ffuf fits into a complete authorized web assessment. Imagine you've been given *.example.com as your bug bounty scope:
# Step 1: Find live subdomains (using Subfinder)subfinder -d example.com -silent-o subs.txt
# Step 2: Probe for live HTTP hostscat subs.txt | httpx -silent-o live_hosts.txt
# Step 3: Fuzz each host for hidden contentwhilereadhost;doecho"[*] Fuzzing $host" ffuf -u"${host}/FUZZ"\-w ~/SecLists/Discovery/Web-Content/common.txt \-fc404,403\-rate30\-o"results_$(echo $host |tr'/:''_').json"\-of json \-s# Silent mode, only output resultsdone< live_hosts.txt
# Step 4: Scan discovered paths with Nucleicat results_*.json | jq -r'.results[].url'| nuclei -t cves/ -t exposures/
This four-step pipeline — enumerate, probe, fuzz, scan — is the backbone of modern web reconnaissance. Each tool does one job well and feeds into the next. For a complete walkthrough of this workflow, read our Modern Web Recon Workflow.
The Verdict
ffuf is the fastest, most flexible web fuzzer available today. It won't hold your hand with auto-calibration or recursive crawling, but it gives you surgical precision in exchange. If you're doing bug bounty, web penetration testing, or CTF challenges, ffuf should be the first fuzzer you reach for.
Install it, pair it with SecLists, and start finding what other hunters miss.
All techniques described here are for authorized testing only — within the scope of a bug bounty program or on infrastructure you own. Check out our cybersecurity courses to learn these skills hands-on with guided labs and CTF challenges.
An architectural workflow diagram illustrating web content discovery with ffuf filtering out noise.
Virtual Host discovery reveals hidden applications sharing the same infrastructure.