Cheatography
Login Register

Attacking Web Application With FFUF Cheat Sheet

A Programming › Security cheat sheet in English by Gossip1185

The cheat sheet is a useful command reference for Ffuf.

Web Hacking Attack Fuzzing Ffuf
2,276 views 435 downloads 30 May 2025 History
PRs

Ffuf

ffuf -h
ffuf help
ffuf -w wordli­st.t­xt­:FUZZ -u http:/­/SE­RVE­R_I­P:P­ORT­/FUZZ
Directory Fuzzing
ffuf -w wordli­st.t­xt­:FUZZ -u http:/­/SE­RVE­R_I­P:P­ORT­/in­dexFUZZ
Extension Fuzzing
Page Fuzzing
ffuf -w wordli­st.t­xt­:FUZZ -u http:/­/SE­RVE­R_I­P:P­ORT­/FUZZ -recursion -recur­sio­n-depth 1 -e .php -v
Recursive Fuzzing
ffuf -w wordli­st.t­xt­:FUZZ -u https:­//F­UZZ.ha­ckt­heb­ox.eu/
Sub-domain Fuzzing
ffuf -w wordli­st.t­xt­:FUZZ -u http:/­/ac­ade­my.h­tb­:PORT/ -H '­Host: FUZZ.a­cad­emy.ht­b' -fs xxx
VHost Fuzzing
Parameter Fuzzing - GET
ffuf -w wordli­st.t­xt­:FUZZ -u http:/­/ad­min.ac­ade­my.h­tb­:PO­RT/­adm­in/­adm­in.php -X POST -d '­FUZ­Z=k­ey' -H '­Con­ten­t-Type: applic­ati­on/­x-w­ww-­for­m-u­rle­nco­ded­' -fs xxx
Parameter Fuzzing - POST
ffuf -w ids.tx­t:FUZZ -u http:/­/ad­min.ac­ade­my.h­tb­:PO­RT/­adm­in/­adm­in.php -X POST -d '­id=­FUZ­Z' -H '­Con­ten­t-Type: applic­ati­on/­x-w­ww-­for­m-u­rle­nco­ded­' -fs xxx
Value Fuzzing

Wordlist

/opt/u­sef­ul/­sec­lis­ts/­Dis­cov­ery­/We­b-C­ont­ent­/di­rec­tor­y-l­ist­-2.3­-s­mal­l.txt
Direct­ory­/Page Wordlist
/opt/u­sef­ul/­sec­lis­ts/­Dis­cov­ery­/We­b-C­ont­ent­/we­b-e­xte­nsi­ons.txt
Extensions Wordlist
/opt/u­sef­ul/­sec­lis­ts/­Dis­cov­ery­/DN­S/s­ubd­oma­ins­-to­p1m­ill­ion­-50­00.txt
Domain Wordlist
/opt/u­sef­ul/­sec­lis­ts/­Dis­cov­ery­/We­b-C­ont­ent­/bu­rp-­par­ame­ter­-na­mes.txt
Parameters Wordlist

Misc

sudo sh -c 'echo "­SER­VER_IP academ­y.h­tb" >> /etc/h­ost­s'
Add DNS entry
for i in $(seq 1 1000); do echo $i >> ids.txt; done
Create Sequence Wordlist
curl http:/­/ad­min.ac­ade­my.h­tb­:PO­RT/­adm­in/­adm­in.php -X POST -d '­id=­key­' -H '­Con­ten­t-Type: applic­ati­on/­x-w­ww-­for­m-u­rle­nco­ded­'
curl w/ POST

Comments

No comments yet.

Cheatography n. The art of mapping complex subjects into clear, instantly navigable reference guides.