ffuf-web-fuzzing

Web fuzzing with ffuf automates directory and file discovery by sending requests with wordlist variations to a target URL, revealing hidden paths, API endpoints, and resources. Ffuf supports multiple fuzzing modes and output filtering to identify valid content quickly.

Yes, ffuf supports authenticated fuzzing through templates that include session tokens, cookies, and authorization headers. The Skill provides ready-to-use templates for authenticated request scenarios and guidance on maintaining session state across fuzzing runs.

Subdomain enumeration with ffuf uses DNS or HTTP fuzzing modes with FUZZ keyword placement in domain names. Combine wordlists targeting common subdomain patterns and use auto-calibration (-ac) to filter false positives from wildcard responses.

Parameter fuzzing places the FUZZ keyword in query strings, request bodies, or headers, then iterates through wordlists to test parameter acceptance and behavior. Ffuf's multi-wordlist modes (clusterbomb, pitchfork, sniper) enable simultaneous fuzzing of multiple parameter positions.

Yes, ffuf provides rate and timing controls to throttle requests, avoid detection, and respect target resource limits. These controls prevent overwhelming targets and reduce blocking risk during extended fuzzing campaigns.

Auto-calibration (-ac) analyzes baseline responses to filter false positives caused by wildcard DNS or default error pages. Use it when the target returns many misleading responses, ensuring fuzzing results reflect genuine content discovery rather than noise.