How the Server Proxy Solves CORS
Browsers enforce CORS — JavaScript on one site cannot read responses from another site unless that site allows it. For a fuzzer this means direct browser requests get blocked on every external target.
FFUF fixes this with a serverless proxy at /api/proxy. Every fuzz request flows:
The proxy is a Node.js server function on Vercel. Server-to-server requests have no CORS restrictions — so you get real 200 OK, 301 Moved, 403 Forbidden, 404 Not Found on every single request, for any target.
Usage Guide
Step 1 — Enter Target URL
Place FUZZ where wordlist entries inject: https://example.com/FUZZ or https://example.com/api/FUZZ/v2
Step 2 — Choose Wordlist
Built-in (2,800+ URL paths) for directory and endpoint discovery. Upload custom .txt for IDOR IDs, passwords, usernames, parameter values — anything non-path.
Step 3 — Rate Control
Set burst size and delay. Keep burst size ≤5 on Vercel free tier (10s function timeout). Increase delay for large scans to avoid triggering the target server rate limits.
Step 4 — Response Filters
Toggle status groups. 404s hidden by default. 401 and 403 always shown — they mean a path exists but is protected.
Step 5 — Analyse Results
Results stream in real-time showing real status codes, size, timing, redirect URL, content type. Filter by status or search. Export all to CSV.
Responsible Use
FFUF is for authorised security testing only. Only scan systems you own or have explicit written permission to test. Unauthorised scanning is illegal in most jurisdictions. If you find a vulnerability, follow responsible disclosure — contact the organisation privately before public disclosure.