Tools & Commands · Ethical Hacking Tools
ffuf
Web testing · Advanced
A fast web fuzzer that sends many variant requests and filters the responses by status, size, or words so interesting results stand out. It is for applications you are allowed to test.
It tries many small variations and then hides the boring responses. Filtering is its distinctive feature. Like other discovery tools, it belongs only on in-scope applications.
Example: A test filters out the common 404 page size and keeps one response whose size is different. A person then reviews that URL.
Git in the Zone explains security tools and attack terminology so you can recognize them and defend against them. Practice only on systems you own or have written permission to test. Nothing on this site runs a command or an exploit.
What it is for
Send many request variants and filter responses during an authorized test.
Authorized use: Use it only on systems you own or have written permission to test. Git in the Zone explains the tool; it does not launch it.
Operating systems: Windows, Linux, and macOS.
Language you will see
- filter
- response size
- fuzzing
How to read the options
- Filter: A rule that hides responses you already understand, such as a repeated not-found page.
- Response size: The length of the reply. A sudden difference can mean the server took a different path.
Common misconception
- A different response size is a clue, not proof of a flaw. Someone still has to look at it.