What is FFUF?
FFUF is a web fuzzing tool — it automatically sends hundreds or thousands of requests to a website, replacing a placeholder (FUZZ) with words from a list, and shows you which ones got a real response.
Think of it like trying every key on a keyring to find which ones open a door. The "keys" are your wordlist entries. The "doors" are hidden web paths, parameters, or login credentials.
What makes FFUF different from other tools: It runs in your browser but sends requests through a server-side proxy — so you get real HTTP status codes (200, 403, 404) on any target, without CORS blocking you.
I want to…
Find hidden pages/directories
→ Use: Directory Fuzzing
Card: Built-in Wordlist
I want to…
Test if user IDs are exposed
→ Use: Number Range (IDOR)
Card: Advanced → Number Range
I want to…
Brute force a login password
→ Use: POST Body Fuzzing
Card: Advanced → POST Body
I want to…
Find hidden files (.env, .git)
→ Use: Directory Fuzzing
Card: Built-in → Sensitive Files
I want to…
Enumerate usernames
→ Use: POST Body Fuzzing
Card: Advanced → POST Body
I want to…
Test OTP or PIN codes
→ Use: Number Range
Card: Advanced → Number Range
Step 1 — Directory & Path Fuzzing
This is the most common use. You give FFUF a website URL with FUZZ in it, and it tries every path from the built-in wordlist to find hidden pages.
In Card 01 — Target, enter the URL with FUZZ where you want paths tested:
https://example.com/FUZZ ← finds hidden directories
https://example.com/api/FUZZ ← finds hidden API endpoints
https://example.com/FUZZ.php ← finds PHP files specifically
💡 FUZZ is the placeholder — it gets replaced by each wordlist entry. /admin, /login, /.env etc.
2
Choose the Built-in WordlistIn Card 02 — Wordlist, keep Built-in selected. Choose a category:
All (2,800+ paths)Best starting point — covers everything
Common DirectoriesFor general directory discovery
Admin PanelsLooking for /admin, /phpmyadmin, /jenkins etc.
Sensitive FilesLooking for /.env, /.git, /wp-config.php etc.
API EndpointsFor APIs — /api/v1, /api/users etc.
CMS PathsFor WordPress, Joomla, Drupal sites
💡 You can also add Extensions in Card 01 — e.g. type .php .html .bak and FFUF will try every path with those extensions appended.
Click Start Fuzzing. Results stream in real time. Look for:
200 OKPath exists and is accessible — most interesting
301/302Redirects — path exists but moves you elsewhere
403 ForbiddenPath exists but access is blocked — still interesting!
401 UnauthorizedPath exists but requires login — very interesting!
404 Not FoundPath doesn't exist — expected and boring
Step 2 — Number Range (IDOR Testing)
IDOR (Insecure Direct Object Reference) is when a website uses predictable numbers in URLs for private data — like /api/users/1, /api/users/2etc. If the site doesn't check permissions properly, you can access other users' data just by changing the number.
The Number Range feature generates a list of numbers automatically — no file upload needed.
1
Set up URL with FUZZ where the number goeshttps://target.com/api/users/FUZZ ← user ID
https://target.com/invoice?id=FUZZ ← invoice number
https://target.com/order/FUZZ/details ← order ID
2
Card 05 → Number Range tabStep
1
How much to increment (1 = every number)
Click Generate & Use as Wordlist — this overrides the built-in wordlist. You'll see "Range active" confirmed.
💡 Enable Zero Padding if the site uses IDs like 001, 002 instead of 1, 2.
200 OKThat ID exists — check the SIZE column. Different sizes = different data
403 ForbiddenID exists but you can't access it — still confirms it's real
404 Not FoundNo record at this ID — expected for gaps
Step 3 — POST Body Fuzzing
Use this when you want to inject wordlist entries into the body of a POST request — for example, testing different passwords on a login form, or different values in an API parameter.
1
Set URL (no FUZZ needed), Method = POSTURL: https://target.com/api/login ← no FUZZ in URL
Method: POST
💡 When body fuzzing is ON, you don't need FUZZ in the URL. The URL stays the same for every request — only the body changes.
2
Card 05 → POST Body Fuzzing → EnableChoose Content-Type and write a body template with FUZZ where the value gets injected:
JSON API login
Content-Type: application/json
{"email":"admin@site.com","password":"FUZZ"}
HTML form login
Content-Type: application/x-www-form-urlencoded
username=admin&password=FUZZ
Username enumeration
Content-Type: application/json
{"username":"FUZZ","password":"wrongpassword"}
OTP brute force
Content-Type: application/json
{"otp":"FUZZ"}
3
Upload your wordlist fileIn Card 02 → Upload Custom Wordlist, upload a .txt file with one value per line. Examples:
📄 passwords.txt
password
admin
admin123
letmein
123456
qwerty
welcome1
password123
📄 usernames.txt
admin
root
user
test
guest
operator
staff
manager
Step 4 — Brute Force Login
Brute forcing a login combines POST body fuzzing with a password wordlist. The tool sends every password from your list to the login endpoint and you look for the one that succeeds.
⚠ Only do this on systems you own or have permission to test. Unauthorised brute forcing is illegal. Use practice labs like PortSwigger, TryHackMe, or DVWA.
✓
Full example — brute force a loginCard 01 — Target
URL: https://target.com/login
Method: POST
Card 02 — Wordlist
Upload: passwords.txt (one password per line)
Card 03 — Rate
Burst size: 1 ← one at a time (avoids lockout)
Delay: 1000ms ← 1 second between each
Max: 100 ← limit total attempts
Card 05 — POST Body Fuzzing
Enable: ON
Type: JSON
Body: {"username":"admin","password":"FUZZ"}
What to look for in results:
Different SIZEMost logins return the same error page size for wrong passwords. The correct one returns a different, often larger, response.
200 OK vs 401Wrong password = 401. Correct password = 200. Filter by 2xx to find the hit instantly.
302 RedirectSome sites redirect on successful login. If others return 200 and one returns 302, that's your password.
Choosing a Wordlist
Directory discovery
→ Built-in → All or Common
No upload needed
Admin panels
→ Built-in → Admin Panels
No upload needed
Sensitive files
→ Built-in → Sensitive Files
No upload needed
API endpoints
→ Built-in → API Endpoints
No upload needed
Password brute force
→ Upload rockyou.txt or custom
From SecLists on GitHub
Username enum
→ Upload names.txt
From SecLists /Usernames
IDOR / IDs
→ Advanced → Number Range
No file needed — generate in-app
OTP / PIN codes
→ Advanced → Number Range
e.g. 000000 → 999999, zero pad ON
📚 Best wordlist resource: SecLists on GitHub — github.com/danielmiessler/SecLists — thousands of curated wordlists for every scenario.
Reading Results
The SIZE column is your best friend
When status codes are the same for everything, compare response sizes. A page that's a different size is returning different content — that's your signal something is there.
Filter tabs
ALLEvery result including errors
FOUND ✓Only results marked as found (200/301/401/403)
2XXSuccessful responses only
3XXRedirects only
4XXClient errors — includes useful 401 and 403
ERRORSNetwork errors — timeouts, DNS failures etc.
Always Hide Specific Codes
Type codes you want to always suppress. For example type 404 to hide all Not Found responses and keep results clean. Leave empty to see everything.
Rate Control — Don't Get Blocked
Burst Size
3–5
Requests fired at once. Lower = safer.
Delay
500–1200ms
Wait between bursts. Higher = safer.
Max Requests
200–500
Hard cap. Prevents runaway scans.
Quick scan (local)Burst: 10 · Delay: 0ms — no rate limiting on your own machine
Gentle scan (external)Burst: 3 · Delay: 1000ms — avoids triggering WAFs
Brute force (login)Burst: 1 · Delay: 1500ms — avoids account lockout
Large wordlist (5000+)Burst: 3 · Delay: 800ms — steady and sustainable
Practice Labs — Safe Targets
Always practice on systems designed for it. Never fuzz systems without permission.
PortSwigger Web Security AcademyFREE
→ Best for: Brute force, IDOR, directory traversal labs
The best free resource. Browser-based labs, no setup. Purpose-built for exactly what FFUF does.
portswigger.net/web-securityTryHackMe — FFUF RoomFREE
→ Best for: Directory fuzzing, vhost discovery
A room dedicated to ffuf. Guided, beginner-friendly, VPN or browser-based machine.
tryhackme.com/room/ffufDVWA (Docker)FREE
→ Best for: Login brute force, local testing
Run locally in Docker. No internet needed. Great for testing brute force without rate limits.
docker run -p 80:80 vulnerables/web-dvwaOWASP Juice Shop (Docker)FREE
→ Best for: IDOR, brute force, API fuzzing
A full fake e-commerce app with 100+ vulnerabilities. Perfect for testing all FFUF features.
docker run -p 3001:3000 bkimminich/juice-shopHackTheBoxPAID
→ Best for: Real-world style machines
Free tier available. Most machines have hidden directories and login pages to brute force.
hackthebox.com