ffuf/ffuf

Health v2 · maintenance only

Adoption not part of the score

16593 stars · 1595 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

ffuf is a fast web fuzzer written in Go used for discovering directories, virtual hosts, and parameters by brute-forcing HTTP requests. It supports wordlist-based fuzzing of URLs, headers, GET/POST data, and external mutators.

Use cases

• brute-force hidden directories and files on a web server
• discover virtual hosts without DNS records
• fuzz GET and POST parameters for hidden values
• enumerate subdomains via Host header fuzzing
• test web endpoints with custom wordlists during a pentest

When to choose

• you need a fast, scriptable CLI fuzzer for web content discovery
• you want a mature, widely used tool with active releases and community guides
• you need flexible fuzzing of URLs, headers, and request bodies

When to avoid

• you need a GUI-based vulnerability scanner
• you want automated exploitation rather than fuzzing/discovery
• you need application-layer DAST scanning with vulnerability detection logic

Facets

cli-tool · maturity stable

penetration-testing http-client web-scraping security penetration-testing web-development windows cli cross-platform fuzzer content-discovery vhost-discovery parameter-fuzzing directory-bruteforce pentesting command-line linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="ffuf/ffuf")