delay<\/code> between requests, or a range of random delay. For example “0.1” or “0.1-2.0”
-rate Rate of requests per second (default: 0)
-s Do not print additional information (silent mode) (default: false)
-sa Stop on all error cases. Implies -sf and -se. (default: false)
-scraperfile Custom scraper file path
-scrapers Active scraper groups (default: all)
-se Stop on spurious errors (default: false)
-search Search for a FFUFHASH payload from ffuf history
-sf Stop when > 95% of responses return 403 Forbidden (default: false)
-t Number of concurrent threads. (default: 40)
-v Verbose output, printing full URL and redirect location (if any) with the results. (default: false)<\/p>\n\n\n\nMATCHER OPTIONS:
-mc Match HTTP status codes, or “all” for everything. (default: 200-299,301,302,307,401,403,405,500)
-ml Match amount of lines in response
-mmode Matcher set operator. Either of: and, or (default: or)
-mr Match regexp
-ms Match HTTP response size
-mt Match how many milliseconds to the first response byte, either greater or less than. EG: >100 or <100
-mw Match amount of words in response<\/p>\n\n\n\n
FILTER OPTIONS:
-fc Filter HTTP status codes from response. Comma separated list of codes and ranges
-fl Filter by amount of lines in response. Comma separated list of line counts and ranges
-fmode Filter set operator. Either of: and, or (default: or)
-fr Filter regexp
-fs Filter HTTP response size. Comma separated list of sizes and ranges
-ft Filter by number of milliseconds to the first response byte, either greater or less than. EG: >100 or <100
-fw Filter by amount of words in response. Comma separated list of word counts and ranges<\/p>\n\n\n\n
INPUT OPTIONS:
-D DirSearch wordlist compatibility mode. Used in conjunction with -e flag. (default: false)
-e Comma separated list of extensions. Extends FUZZ keyword.
-enc Encoders for keywords, eg. ‘FUZZ:urlencode b64encode’
-ic Ignore wordlist comments (default: false)
-input-cmd Command producing the input. –input-num is required when using this input method. Overrides -w.
-input-num Number of inputs to test. Used in conjunction with –input-cmd. (default: 100)
-input-shell Shell to be used for running command
-mode Multi-wordlist operation mode. Available modes: clusterbomb, pitchfork, sniper (default: clusterbomb)
-request File containing the raw http request
-request-proto Protocol to use along with raw request (default: https)
-w Wordlist file path and (optional) keyword separated by colon. eg. ‘\/path\/to\/wordlist:KEYWORD’<\/p>\n\n\n\n
OUTPUT OPTIONS:
-debug-log Write all of the internal logging to the specified file.
-o Write output to file
-od Directory path to store matched results to.
-of Output file format. Available formats: json, ejson, html, md, csv, ecsv (or, ‘all’ for all formats) (default: json)
-or Don’t create the output file if we don’t have results (default: false)<\/p>\n\n\n\n
EXAMPLE USAGE:
Fuzz file paths from wordlist.txt, match all responses but filter out those with content-size 42.
Colored, verbose output.
ffuf -w wordlist.txt -u https:\/\/example.org\/FUZZ -mc all -fs 42 -c -v<\/p>\n\n\n\n
Fuzz Host-header, match HTTP 200 responses.
ffuf -w hosts.txt -u https:\/\/example.org\/ -H “Host: FUZZ” -mc 200<\/p>\n\n\n\n
Fuzz POST JSON data. Match all responses not containing text “error”.
ffuf -w entries.txt -u https:\/\/example.org\/ -X POST -H “Content-Type: application\/json” \\
-d ‘{“name”: “FUZZ”, “anotherkey”: “anothervalue”}’ -fr “error”<\/p>\n\n\n\n
Fuzz multiple locations. Match only responses reflecting the value of “VAL” keyword. Colored.
ffuf -w params.txt:PARAM -w values.txt:VAL -u https:\/\/example.org\/?PARAM=VAL -mr “VAL” -c<\/p>\n\n\n\n
More information and examples: https:\/\/github.com\/ffuf\/ffuf<\/p>\n","protected":false},"excerpt":{"rendered":"
Fuzzing with Ffuf Github: https:\/\/github.com\/ffuf\/ffuf In a word full of web-fuzzing tools, everyone has a favorite and mine happens to be Ffuf. It might not be as robust as some competitors, but it just freaking works really well and I like the clean output. Here’s some of the common commands…<\/p>\n","protected":false},"author":1,"featured_media":121,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[17],"tags":[6,7],"class_list":["post-120","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cheat-sheets","tag-ffuf","tag-fuzzing"],"_links":{"self":[{"href":"https:\/\/zerotoghost.com\/index.php?rest_route=\/wp\/v2\/posts\/120","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zerotoghost.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zerotoghost.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zerotoghost.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zerotoghost.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=120"}],"version-history":[{"count":2,"href":"https:\/\/zerotoghost.com\/index.php?rest_route=\/wp\/v2\/posts\/120\/revisions"}],"predecessor-version":[{"id":123,"href":"https:\/\/zerotoghost.com\/index.php?rest_route=\/wp\/v2\/posts\/120\/revisions\/123"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/zerotoghost.com\/index.php?rest_route=\/wp\/v2\/media\/121"}],"wp:attachment":[{"href":"https:\/\/zerotoghost.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=120"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zerotoghost.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=120"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zerotoghost.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=120"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"https:\/\/zerotoghost.com\/wp-content\/uploads\/2026\/03\/ffuf_run_logo_600.png\"){kind=logo}
<\/figure>\n\n\n\n