Browser-based · Server-proxied · Free
Fuzz endpoints.
Find what's hidden.
A browser-based fuzzing tool with a server-side proxy — bypasses CORS completely. Get real HTTP status codes (200, 403, 404…) on any target. 2,490+ built-in URL paths included.
✅
CORS solved via server proxy. Requests go: Browser →
/api/proxy → Target → back to you. Real status codes on every request, any target.📌
Built-in wordlist = URL paths only (e.g.
/admin, /.env). For IDOR, password brute-force or parameter fuzzing — upload your own wordlist.2,490+ built-in /pathsReal status codes via proxyUpload any custom wordlistBurst rate controlResponse filteringExport to CSV
01 — Target
Place FUZZ where wordlist entries are injected — e.g.
https://target.com/FUZZ or https://target.com/api/FUZZ/v2Comma-separated key: value pairs.
Appended to each path. Space or comma separated.
02 — Wordlist
✅ Use Built-in for:
Directory discovery · Hidden endpoints · Admin panels · Config files · API routes · CMS paths
📂 Upload Custom for:
IDOR IDs · Password brute-force · Username lists · Parameter values · Any non-path fuzzing
2,490 paths in this category
/ /admin /administrator /app /api /assets /auth /backup /bin /cache /cgi-bin /client /cms /config /console /content /core /css /dashboard /data /database /db /debug /default /demo /dev /docs /document /documents /download /downloads /edit /editor /error /files /fonts /forum /forums /git /help /home /html /img /images /includes /index /info /install /js /json /lib /library /log /login /logout /mail /manager /media /mobile /modules /new /old /panel /php /plugins /portal /preview /private /public /resources /scripts /secret /server /services /setup /share /site /src /static /stats …
05 — Advanced FuzzingNEW
Use case: IDOR testing, numeric ID enumeration, OTP brute force, sequential token guessing.
Put
Put
FUZZ in the URL where the number goes — e.g. https://target.com/api/users/FUZZ or https://target.com/invoice?id=FUZZIncrement per step. 1 = every number.
e.g. 001, 002 … 999 instead of 1, 2 … 999
Example — IDOR on user IDs
URL: https://target.com/api/users/FUZZ
Range: 1 → 500, step 1
Method: GET
Result: 200 OK= user exists 404 = no user at that ID
Range: 1 → 500, step 1
Method: GET
Result: 200 OK= user exists 404 = no user at that ID
03 — Rate & Throttle
Requests fired simultaneously per burst. Keep ≤10 for stability.
Wait between each burst. 0 = no delay.
Hard cap. Wordlist truncated to this limit.
3 req · 1200ms gap
⚠ Note: Each proxy request has a 10s function timeout. Keep burst delay ≥500ms and burst size ≤5 for best results. For large scans (1000+ paths), consider increasing delay to avoid rate limits on the target.
04 — Response Filters
401 and 403 always shown — they mean the path exists but is protected.
Comma-separated. Always suppressed from results.
💡 Status code meanings
200–299Path exists ✓ 301–399Redirects ✓ 401Protected ✓ 403Forbidden ✓ 404 Not found ✗
Results
ffuf — output
🎯
Configure your target above and hit Start Fuzzing