Ffuf Cheat Sheet

Ffuf does what gobuster does — directory, subdomain, and vhost discovery — but faster, and with more flexible filtering built in for cutting noise out of large wordlist runs.

Red Team / Offensive Use

Ffuf's real advantage over gobuster is filtering: its response-size, word-count, and status-code filters make it practical to fuzz against noisy targets (ones that return a "soft 200" for every path, for example) without drowning in false positives. It's also more flexible for parameter fuzzing specifically — finding hidden GET/POST parameters an application accepts but doesn't document anywhere.

Established Cheatsheet

Official ffuf wiki — maintained by the project, covers filtering options and advanced usage beyond the basics.

PWNMI's Top 5 Use Cases

• ffuf -w wordlist.txt -u https://target.com/FUZZ — basic directory/file fuzzing, the FUZZ keyword marks where the wordlist gets substituted
• ffuf -w wordlist.txt -u https://target.com/FUZZ -fs 4242 — same, but filtering out responses of a specific size (-fs) — the fix for targets that return a "fake" 200 for every path instead of a proper 404
• ffuf -w wordlist.txt -u https://target.com/script.php?FUZZ=test — parameter name fuzzing, for finding undocumented GET parameters an endpoint actually accepts
• ffuf -w vhosts.txt -u https://target.com -H "Host: FUZZ.target.com" -fs 4242 — virtual host fuzzing, finding applications hosted on the same IP under a different hostname
• ffuf -w wordlist.txt -u https://target.com/FUZZ -mc 200,301,302 — match only specific status codes instead of filtering by size, useful when response sizes vary too much to filter on cleanly

Next step

For a comparison of when to reach for this over gobuster, or vice versa, see the gobuster cheat sheet — in practice, having both in your kit and switching based on target behavior beats picking one permanently.