How to Fuzz Parameters, Directories & More with Ffuf « Null Byte :: WonderHowTo

The art of fuzzing is a vital skill for any penetration tester or hacker to possess. The faster you fuzz, and the more efficiently you are at doing it, the closer you come to achieving your goal, whether that means finding a valid bug or discovering an initial attack vector. A tool called ffuf comes in handy to help speed things along and fuzz for parameters, directors, and more.What Is Fuzzing?Fuzzing, or fuzz testing, is theautomatedprocess of providing malformed or random data to software to discover bugs. Typically, when it comes topentesting, awordlistis used to iterate through values, and the results are observed and analyzed.Fuzzing usually involves testing input — this can be anything from alphanumeric characters to findbuffer overflows, to odd characters to test forSQL injection. Fuzzing is also commonly used to discover hidden directories and files and to determine valid parameter names and values.We will be usingMetasploitable 2as our target andKali Linuxas our local machine to demonstrate ffuf's power at fuzzing.Step 1: Install & Configure FfufThe only requirement to run ffuf is having Go installed, which can easily be done on Kali with thepackage manager.~$ sudo apt install golang

Reading package lists... Done
Building dependency tree
Reading state information... Done
golang is already the newest version (2:1.14~2).
0 upgraded, 0 newly installed, 0 to remove and 17 not upgraded.Next, grab the latest ffuf release fromGitHub. At the time of writing, this is version 1.1.0. We can usewgetto download it.~$ wget https://github.com/ffuf/ffuf/releases/download/v1.1.0/ffuf_1.1.0_linux_amd64.tar.gz

--2020-08-27 11:36:41--  https://github.com/ffuf/ffuf/releases/download/v1.1.0/ffuf_1.1.0_linux_amd64.tar.gz
Resolving github.com (github.com)... 140.82.112.4
Connecting to github.com (github.com)|140.82.112.4|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://github-production-release-asset-2e65be.s3.amazonaws.com/156681830/192d4700-cceb-11ea-97f4-adcd48470676?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20200827%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20200827T163641Z&X-Amz-Expires=300&X-Amz-Signature=493a4881a3e960fb7c29baa5ee999efe96bbb5414fd122355b1ec19fe65d1214&X-Amz-SignedHeaders=host&actor_id=0&repo_id=156681830&response-content-disposition=attachment%3B%20filename%3Dffuf_1.1.0_linux_amd64.tar.gz&response-content-type=application%2Foctet-stream [following]
--2020-08-27 11:36:41--  https://github-production-release-asset-2e65be.s3.amazonaws.com/156681830/192d4700-cceb-11ea-97f4-adcd48470676?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20200827%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20200827T163641Z&X-Amz-Expires=300&X-Amz-Signature=493a4881a3e960fb7c29baa5ee999efe96bbb5414fd122355b1ec19fe65d1214&X-Amz-SignedHeaders=host&actor_id=0&repo_id=156681830&response-content-disposition=attachment%3B%20filename%3Dffuf_1.1.0_linux_amd64.tar.gz&response-content-type=application%2Foctet-stream
Resolving github-production-release-asset-2e65be.s3.amazonaws.com (github-production-release-asset-2e65be.s3.amazonaws.com)... 52.217.37.12
Connecting to github-production-release-asset-2e65be.s3.amazonaws.com (github-production-release-asset-2e65be.s3.amazonaws.com)|52.217.37.12|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3101002 (3.0M) [application/octet-stream]
Saving to: ‘ffuf_1.1.0_linux_amd64.tar.gz’

ffuf_1.1.0_linux_amd64.tar.gz                               100%[========================================================================================================================================>]   2.96M  5.74MB/s    in 0.5s

2020-08-27 11:36:42 (5.74 MB/s) - ‘ffuf_1.1.0_linux_amd64.tar.gz’ saved [3101002/3101002]Now we need to extract the contents of the archive.~$ tar xzf ffuf_1.1.0_linux_amd64.tar.gzWe should now have the ffuf executable in the current working directory, and we can run it with the dot-slash command.~$ ./ffuf

Encountered error(s): 2 errors occured.
        * -u flag or -request flag is required
        * Either -w or --input-cmd flag is required

Fuzz Faster U Fool - v1.1.0

HTTP OPTIONS:
  -H               Header `"Name: Value"`, separated by colon. Multiple -H flags are accepted.
  -X               HTTP method to use (default: GET)
  -b               Cookie data `"NAME1=VALUE1; NAME2=VALUE2"` for copy as curl functionality.
  -d               POST data
  -ignore-body     Do not fetch the response content. (default: false)
  -r               Follow redirects (default: false)
  -recursion       Scan recursively. Only FUZZ keyword is supported, and URL (-u) has to end in it. (default: false)
  -recursion-depth Maximum recursion depth. (default: 0)
  -replay-proxy    Replay matched requests using this proxy.
  -timeout         HTTP request timeout in seconds. (default: 10)
  -u               Target URL
  -x               HTTP Proxy URL

GENERAL OPTIONS:
  -V               Show version information. (default: false)
  -ac              Automatically calibrate filtering options (default: false)
  -acc             Custom auto-calibration string. Can be used multiple times. Implies -ac
  -c               Colorize output. (default: false)
  -maxtime         Maximum running time in seconds for entire process. (default: 0)
  -maxtime-job     Maximum running time in seconds per job. (default: 0)
  -p               Seconds of `delay` between requests, or a range of random delay. For example "0.1" or "0.1-2.0"
  -s               Do not print additional information (silent mode) (default: false)
  -sa              Stop on all error cases. Implies -sf and -se. (default: false)
  -se              Stop on spurious errors (default: false)
  -sf              Stop when > 95% of responses return 403 Forbidden (default: false)
  -t               Number of concurrent threads. (default: 40)
  -v               Verbose output, printing full URL and redirect location (if any) with the results. (default: false)

...Running it without any arguments will print the help information and some usage examples. Now let's say we wanted to be able to run this tool from anywhere — all we need to do is move ffuf to any directory in our path.~$ sudo cp ffuf /usr/local/bin/Now we can run it from anywhere without the need to have it in the current directory.~$ ffuf -V

ffuf version: 1.1.0The last step to get up and running is optional. Having a good set ofwordlistsis essential for any security professional, and there is a collection calledSecListsthat has just about anything you need. It is available on GitHub, but we can also install it locally on our machine.~$ sudo apt install seclistsStep 2: Perform Some Basic FuzzingAt the most basic level, we can use ffuf to fuzz forhidden directories or files. There are tools likegobusterout there that are made for this specific purpose, but using something like ffuf has its use cases.For example, let's say you're testing a website that has some sort of rate-limiting in place. With other tools, it can sometimes be challenging to get them to go slower, and this is precisely where tools like ffuf come into play since we can more finely control the rate and timing options. More on that later.Simply provide a wordlist with the-wflag, the URL with the-uflag, and putFUZZwhere we want to insert our fuzzing.~$ ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u http://10.10.0.50/dvwa/FUZZ

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v1.1.0
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.0.50/dvwa/FUZZ
 :: Wordlist         : FUZZ: common.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403
________________________________________________

.hta                    [Status: 403, Size: 292, Words: 22, Lines: 11]
.htpasswd               [Status: 403, Size: 297, Words: 22, Lines: 11]
.htaccess               [Status: 403, Size: 297, Words: 22, Lines: 11]
README                  [Status: 200, Size: 4934, Words: 637, Lines: 120]
config                  [Status: 301, Size: 319, Words: 21, Lines: 10]
docs                    [Status: 301, Size: 317, Words: 21, Lines: 10]
about                   [Status: 302, Size: 0, Words: 1, Lines: 1]
external                [Status: 301, Size: 321, Words: 21, Lines: 10]
favicon.ico             [Status: 200, Size: 1405, Words: 5, Lines: 2]
php.ini                 [Status: 200, Size: 148, Words: 17, Lines: 5]
index                   [Status: 302, Size: 0, Words: 1, Lines: 1]
robots                  [Status: 200, Size: 26, Words: 3, Lines: 2]
robots.txt              [Status: 200, Size: 26, Words: 3, Lines: 2]
instructions            [Status: 302, Size: 0, Words: 1, Lines: 1]
index.php               [Status: 302, Size: 0, Words: 1, Lines: 1]
logout                  [Status: 302, Size: 0, Words: 1, Lines: 1]
phpinfo                 [Status: 302, Size: 0, Words: 1, Lines: 1]
login                   [Status: 200, Size: 1289, Words: 83, Lines: 66]
phpinfo.php             [Status: 302, Size: 0, Words: 1, Lines: 1]
setup                   [Status: 200, Size: 3549, Words: 182, Lines: 81]
security                [Status: 302, Size: 0, Words: 1, Lines: 1]
:: Progress: [4658/4658] :: Job [1/1] :: 388 req/sec :: Duration: [0:00:12] :: Errors: 0 ::You'll notice the usage is very similar towfuzz, so new users of the tool will feel somewhat familiar with its operation.After the nice little banner, we can see therequest method, URL, and some other options that are set. When ffuf comes across something in the wordlist, it will give us the name of the file or directory, the HTTP status code, and some information about the request length.We can also include any necessary cookies in our request using the-bflag.~$ ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -b "PHPSESSID=a4885a1d1802209109693054d94ae214; security=low" -u http://10.10.0.50/dvwa/FUZZ

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v1.1.0
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.0.50/dvwa/FUZZ
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/common.txt
 :: Header           : Cookie: PHPSESSID=a4885a1d1802209109693054d94ae214; security=low
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403
________________________________________________

.hta                    [Status: 403, Size: 292, Words: 22, Lines: 11]
.htaccess               [Status: 403, Size: 297, Words: 22, Lines: 11]
README                  [Status: 200, Size: 4934, Words: 637, Lines: 120]

...Along the same lines, we can include any custom headers we want with the-Hflag.~$ ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -H "Host: 10.10.0.50" -u http://10.10.0.50/dvwa/FUZZ

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v1.1.0
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.0.50/dvwa/FUZZ
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/common.txt
 :: Header           : Host: 10.10.0.50
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403
________________________________________________

.hta                    [Status: 403, Size: 292, Words: 22, Lines: 11]
.htaccess               [Status: 403, Size: 297, Words: 22, Lines: 11]
.htpasswd               [Status: 403, Size: 297, Words: 22, Lines: 11]
README                  [Status: 200, Size: 4934, Words: 637, Lines: 120]

...Instead of doing the default GET request, we can also send POST requests. Use the-Xflag to specify the request type, in this case, POST, and include the data for the request with the-dflag.~$ ffuf -w /usr/share/seclists/Passwords/darkweb2017-top100.txt -X POST -d "username=admin\&password=FUZZ\&Login=Login" -u http://10.10.0.50/dvwa/login.php

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v1.1.0
________________________________________________

 :: Method           : POST
 :: URL              : http://10.10.0.50/dvwa/login.php
 :: Wordlist         : FUZZ: /usr/share/seclists/Passwords/darkweb2017-top100.txt
 :: Data             : username=admin\&password=FUZZ\&Login=Login
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403
________________________________________________

123abc                  [Status: 200, Size: 1289, Words: 83, Lines: 66]
123456789               [Status: 200, Size: 1289, Words: 83, Lines: 66]
123321                  [Status: 200, Size: 1289, Words: 83, Lines: 66]

...We can use ffuf to fuzz for parameters as well — simply replace the parameter name to fuzz for with the FUZZ keyword.~$ ffuf -w /usr/share/seclists/Fuzzing/fuzz-Bo0oM.txt -u http://10.10.0.50/dvwa/instructions.php?FUZZ=readme

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v1.1.0
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.0.50/dvwa/instructions.php?FUZZ=readme
 :: Wordlist         : FUZZ: /usr/share/seclists/Fuzzing/fuzz-Bo0oM.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403
________________________________________________

!.htpasswd              [Status: 302, Size: 0, Words: 1, Lines: 1]
.AppleDouble            [Status: 302, Size: 0, Words: 1, Lines: 1]
.AppleDesktop           [Status: 302, Size: 0, Words: 1, Lines: 1]
.bak                    [Status: 302, Size: 0, Words: 1, Lines: 1]
!.htaccess              [Status: 302, Size: 0, Words: 1, Lines: 1]

...Fuzzing for parameter values works the same way.~$ ffuf -w /usr/share/seclists/Fuzzing/fuzz-Bo0oM.txt -u http://10.10.0.50/dvwa/instructions.php?doc=FUZZ

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v1.1.0
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.0.50/dvwa/instructions.php?FUZZ=readme
 :: Wordlist         : FUZZ: /usr/share/seclists/Fuzzing/fuzz-Bo0oM.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403
________________________________________________

!.htpasswd              [Status: 302, Size: 0, Words: 1, Lines: 1]
.AppleDouble            [Status: 302, Size: 0, Words: 1, Lines: 1]
.AppleDesktop           [Status: 302, Size: 0, Words: 1, Lines: 1]
.bak                    [Status: 302, Size: 0, Words: 1, Lines: 1]
!.htaccess              [Status: 302, Size: 0, Words: 1, Lines: 1]

...Step 3: Try the Filtering & Timing OptionsFfuf can perform matching and filtering, depending on what you want to see in the results. For instance, if we only wanted to see results with a 200 status code, we could use the-mcswitch to match.~$ ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u http://10.10.0.50/dvwa/FUZZ -mc 200

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v1.1.0
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.0.50/dvwa/FUZZ
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/common.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200
________________________________________________

README                  [Status: 200, Size: 4934, Words: 637, Lines: 120]
favicon.ico             [Status: 200, Size: 1405, Words: 5, Lines: 2]
php.ini                 [Status: 200, Size: 148, Words: 17, Lines: 5]
robots                  [Status: 200, Size: 26, Words: 3, Lines: 2]
robots.txt              [Status: 200, Size: 26, Words: 3, Lines: 2]

...On the flip side, we can also filter certain status codes using the-fcswitch.~$ ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u http://10.10.0.50/dvwa/FUZZ -fc 403

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v1.1.0
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.0.50/dvwa/FUZZ
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/common.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403
 :: Filter           : Response status: 403
________________________________________________

README                  [Status: 200, Size: 4934, Words: 637, Lines: 120]
config                  [Status: 301, Size: 319, Words: 21, Lines: 10]
docs                    [Status: 301, Size: 317, Words: 21, Lines: 10]
external                [Status: 301, Size: 321, Words: 21, Lines: 10]
favicon.ico             [Status: 200, Size: 1405, Words: 5, Lines: 2]
php.ini                 [Status: 200, Size: 148, Words: 17, Lines: 5]
about                   [Status: 302, Size: 0, Words: 1, Lines: 1]

...This will hide any results with a 403 status code. Multiple codes for wither matching or filtering can be used as long as they are comma-separated.We can perform similar matching and filtering with request size and the number of words or lines. For example, to filter any results returning with request size 0, do the following.~$ ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u http://10.10.0.50/dvwa/FUZZ -fs 0

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v1.1.0
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.0.50/dvwa/FUZZ
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/common.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403
 :: Filter           : Response size: 0
________________________________________________

.htpasswd               [Status: 403, Size: 297, Words: 22, Lines: 11]
README                  [Status: 200, Size: 4934, Words: 637, Lines: 120]
config                  [Status: 301, Size: 319, Words: 21, Lines: 10]
docs                    [Status: 301, Size: 317, Words: 21, Lines: 10]
external                [Status: 301, Size: 321, Words: 21, Lines: 10]
favicon.ico             [Status: 200, Size: 1405, Words: 5, Lines: 2]
.htaccess               [Status: 403, Size: 297, Words: 22, Lines: 11]
.hta                    [Status: 403, Size: 292, Words: 22, Lines: 11]
php.ini                 [Status: 200, Size: 148, Words: 17, Lines: 5]

...Ffuf has some additional features to controltimingof requests as well. To set a timeout for each individual request, use the-timeoutoption (default is 10 seconds).~$ ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u http://10.10.0.50/dvwa/FUZZ -timeout 5

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v1.1.0
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.0.50/dvwa/FUZZ
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/common.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 5
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403
________________________________________________

.hta                    [Status: 403, Size: 292, Words: 22, Lines: 11]
.htpasswd               [Status: 403, Size: 297, Words: 22, Lines: 11]
.htaccess               [Status: 403, Size: 297, Words: 22, Lines: 11]
README                  [Status: 200, Size: 4934, Words: 637, Lines: 120]
config                  [Status: 301, Size: 319, Words: 21, Lines: 10]

...We can also set a delay between each request with the-pflag. For example, to delay 2 seconds between requests, try the following.~$ ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u http://10.10.0.50/dvwa/FUZZ -p 2

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v1.1.0
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.0.50/dvwa/FUZZ
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/common.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Delay            : 2.00 seconds
 :: Matcher          : Response status: 200,204,301,302,307,401,403
________________________________________________

.hta                    [Status: 403, Size: 292, Words: 22, Lines: 11]
.htaccess               [Status: 403, Size: 297, Words: 22, Lines: 11]
.htpasswd               [Status: 403, Size: 297, Words: 22, Lines: 11]

...This is extremely useful in situations where rate limiting is in place, or when we don't want tohammer a sitewith requests.Another handy feature is the ability to set a maximum time for ffuf to run — this is useful when using a large wordlist, and you don't want to wait around all day for it to finish. Use the-maxtimeoption followed by the number of seconds for ffuf to run before exiting.~$ ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u http://10.10.0.50/dvwa/FUZZ -maxtime 60

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v1.1.0
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.0.50/dvwa/FUZZ
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/common.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403
________________________________________________

.hta                    [Status: 403, Size: 292, Words: 22, Lines: 11]
.htaccess               [Status: 403, Size: 297, Words: 22, Lines: 11]
.htpasswd               [Status: 403, Size: 297, Words: 22, Lines: 11]
README                  [Status: 200, Size: 4934, Words: 637, Lines: 120]

...If we want to run faster, we can set the number of threads to use (default is 40).~$ ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u http://10.10.0.50/dvwa/FUZZ -t 60

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v1.1.0
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.0.50/dvwa/FUZZ
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/common.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 60
 :: Matcher          : Response status: 200,204,301,302,307,401,403
________________________________________________

README                  [Status: 200, Size: 4934, Words: 637, Lines: 120]
.hta                    [Status: 403, Size: 292, Words: 22, Lines: 11]
.htpasswd               [Status: 403, Size: 297, Words: 22, Lines: 11]
.htaccess               [Status: 403, Size: 297, Words: 22, Lines: 11]
config                  [Status: 301, Size: 319, Words: 21, Lines: 10]

...For simpler viewing in the terminal, we can use the-sflag to only print the found objects and none of the other noise.~$ ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u http://10.10.0.50/dvwa/FUZZ -s

.htpasswd
README
config
docs
external
favicon.ico
about

...This is useful if we wanted to grep any output or use the results in ascriptor something, not to mention it's just a bit cleaner.We can also save any results to a file using the-oswitch.~$ ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u http://10.10.0.50/dvwa/FUZZ -o results.txt

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v1.1.0
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.0.50/dvwa/FUZZ
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/common.txt
 :: Output file      : results.txt
 :: File format      : json
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403
________________________________________________

.hta                    [Status: 403, Size: 292, Words: 22, Lines: 11]
.htpasswd               [Status: 403, Size: 297, Words: 22, Lines: 11]
README                  [Status: 200, Size: 4934, Words: 637, Lines: 120]

...The default format is JSON, but we can change that with the-offlag. For example, to save the results in HTML format, try:~$ ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u http://10.10.0.50/dvwa/FUZZ -o results.txt -of html

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v1.1.0
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.0.50/dvwa/FUZZ
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/common.txt
 :: Output file      : results.txt
 :: File format      : html
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403
________________________________________________

.htaccess               [Status: 403, Size: 297, Words: 22, Lines: 11]
.hta                    [Status: 403, Size: 292, Words: 22, Lines: 11]
.htpasswd               [Status: 403, Size: 297, Words: 22, Lines: 11]
README                  [Status: 200, Size: 4934, Words: 637, Lines: 120]

...Wrapping UpIn this tutorial, we learned a bit about fuzzing and how to use a tool called ffuf to fuzz for directories, parameters, and more. First, we installed the tool and configured it to run on our system. Next, we covered some basic fuzzing, including fuzzing GET requests, POST requests, and parameters. Finally, we concluded with some filtering and timing options for more fine-grained control. Hopefully, you find ffuf as valuable as we do!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byLogan Kirschner/Pexels; Screenshots by drd_/Null ByteRelatedHack Like a Pro:Exploring Metasploit Auxiliary Modules (FTP Fuzzing)How To:Discover XSS Security Flaws by Fuzzing with Burp Suite, Wfuzz & XSStrikeHack Like a Pro:How to Build Your Own Exploits, Part 3 (Fuzzing with Spike to Find Overflows)How To:The Art of 0-Day Vulnerabilities, Part2: Manually FuzzingHow To:Scan Websites for Interesting Directories & Files with GobusterHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 21 (GRUB Bootloader)How To:Discover Hidden HTTP Parameters to Find Weaknesses in Web AppsHow To:Perform Directory Traversal & Extract Sensitive InformationHow To:Exploit Development-Everything You Need to KnowHow To:Brute-Force Email Using a Simple Bash Script (Ft. THC Hydra)How To:Search in Twitter Using Parameters Without Log InHow To:Search in Twitter Using Parameters Without Sign UpHow To:Circuit bend a Yamaha PortaSound PSS-80 keyboard with 10 modificationsHow To:Create Rainbow Tables for Hashing Algorithms Like MD5, SHA1 & NTLMHow To:Embed & Customize a YouTube Video for Your WebsiteHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 2 (Creating Directories & Files)How To:Audit Web Applications & Servers with TishnaHow To:Create a Metasploit Exploit in Few MinutesHow To:Break into Router Gateways with PatatorHow To:Use Websploit to Scan Websites for Hidden DirectoriesHow To:Use Facial Recognition to Conduct OSINT Analysis on Individuals & CompaniesHow To:Configure a 3D camera rig with the proper interaxial distance and parametersHow To:Find Hidden Web Directories with DirsearchHack Like a Pro:How to Find Directories in Websites Using DirBusterHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 3 (Managing Directories & Files)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 1 (Getting Started)News:Brazil keeps getting away with more than two hands.How To:Start With Site Setting For Snoft Article Directory ScriptNews:Cup Cakes In Trouble A Taveling Night MareNews:First Steps of Compiling a Program in LinuxNews:Blog search directoryGoodnight Byte:HackThisSite Walkthrough, Part 10 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker TrainingRainbow Tables:How to Create & Use Them to Crack PasswordsHow To:Download and Install the Minecraft 1.8 Pre-ReleaseNews:Movie Posters from KoreaNews:Here's Our Answer! It Is Mathematically Impossible That We Are Alone.News:Can bad lawyer commercials turn out any good?How To:Create shared parameters in Revit Architecture