Tools & Techniques: ffuf for Content Discovery
ffuf replaced a generation of go-to fuzzers because it's fast and script-friendly. It's also easy to generate 10,000 lines of noise without `-fc` and friends.
Content discovery finds paths; your brain decides if they matter.
ffuf rewards patience with filters more than aggression with wordlists. A quiet ten-minute run with tuned flags beats an hour of scrolling junk responses.
Review ffuf JSON in a spreadsheet when hits exceed fifty—sorting beats scrolling.
Filters that save you
Filter by status code, size, words, lines, or regex when baseline responses are huge. Auto-calibration helps on inconsistent apps.
Start small wordlists tailored to stack—admin panels for Java shops differ from SPA hashes.
Modes beyond directories
Vhost fuzzing when authorized on IP targets, parameter name fuzzing on interesting endpoints, POST body field discovery.
Log commands for reproducibility
Respect rate limits—add `-rate`
Don't fuzz auth endpoints into lockouts
Pairing with manual work
Promote interesting 403/401 hits to manual probing. ffuf won't read JavaScript routers for you.
Fuzzing is authorized only within scope and ROE.
If the program forbids brute force, don't rename ffuf and hope nobody notices.
After ffuf, confirm interesting paths manually in browser context—bots miss auth walls that change status codes mid-session.
Small habits compound—what feels like overhead early becomes speed when deadlines hit.
Save ffuf command lines in notes—retests should reuse flags exactly.
Wordlist curation
Build target-specific wordlists from JS and sitemap before reaching for million-line defaults.
Log response sizes in CSV—spreadsheets beat terminal scrollback for pattern spotting.
Collaborative wordlists
Merge team wordlists from unique client findings—sanitized, not raw paths with PII.
Use ffuf recursion cautiously; depth without scope checks causes OOS pain.
Compare ffuf hits with manual sitemap entries—gaps imply routing magic.
Worth reading next
Directory Discovery, Fingerprinting, and Service Enumeration
Tools & Techniques: gf Patterns for URL Triage
Essential Recon Tools for Web App Pentesting
Comments