Fuzz Faster U Fool: the community's speed-demon fuzzer for directories, parameters, vhosts — and a must for CTF rooms where everything is FUZZ.
Follow the steps — click any step card to replay the terminal demo from that point. Everything runs in a lab you control.
FUZZ keyword marks where payloads get planted.
Catch-all apps return identical pages; -fs filters by size.
Hidden params like debug=1 / file= are common CTF keys.
Fuzzing values ≠ paths — same tool, deeper bugs.
Header fuzzing handles vhosts/subdomains too.
| -w | wordlist |
| -u …FUZZ | target + injection point |
| -fs / -fc | filter size / status |
| -H | custom header |
| -recursion | follow found dirs |
| -rate | requests/sec |
| -of json | save results |
Filter first, conclusions second — learn -fs/-fc/-fw before judging 'nothing found'.
SecLists' discovery wordlists are ffuf's natural habitat.
In HTB, always background a vhost fuzz while you work the main site.
Compare two identical-look responses with --md for hidden differences.
Use ffuf only on systems you own or have written permission to test. Your lab: Kali + Metasploitable2, DVWA, TryHackMe & HackTheBox — plenty of legal targets, zero risk.