Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ffuf: add page #6183

Merged
merged 14 commits into from
Jul 15, 2021
24 changes: 24 additions & 0 deletions pages/linux/ffuf.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
# ffuf

> A fast web fuzzer written in Go.
> More information: <https://github.com/ffuf/ffuf>.

- Directory discovery using a wordlist on a target website colorized and verbose:
marchersimon marked this conversation as resolved.
Show resolved Hide resolved
otterbaub marked this conversation as resolved.
Show resolved Hide resolved

`ffuf -w {{/path/to/wordlist}} -u {{https://target/FUZZ}} -c -v`
marchersimon marked this conversation as resolved.
Show resolved Hide resolved

- Host-header fuzzing with host file on a traget website and match HTTP 200 responses:

`ffuf -w {{hosts.txt}} -u {{https://example.org/}} -H "{{Host: FUZZ}}" -mc {{200}}`
marchersimon marked this conversation as resolved.
Show resolved Hide resolved

- Directory discovery using a wordlist on a target website with a max individual job time of 60 seconds and recusrion discovery depth of 2 levels:

`ffuf -w {{/path/to/wordlist}} -u {{https://target/FUZZ}} -maxtime-job {{60}} -recursion -recursion-depth {{2}}`

- GET parameter fuzzing on a target website and filter out message size response of 4242 bytes:

`ffuf -w {{/path/to/param_names.txt}} -u {{https://target/script.php?FUZZ=test_value}} -fs {{4242}}`

- Use POST method with POST data fuzzing of password on a target website and filter out HTTP response code 401:

`ffuf -w {{/path/to/postdata.txt}} -X {{POST}} -d "{{username=admin\&password=FUZZ}}" -u {{https://target/login.php}} -fc {{401}}`