Web & API
ffuf
Fast web fuzzer for content discovery and parameter enumeration on in-scope applications.
What it is
ffuf is the go-to wordlist fuzzer for directories, vhosts, and parameters. Keep thread counts and rate low on production, filter on size/status so you do not drown in 200s, and never fuzz authentication or payment actions that create real side effects.
Reach for it when
After mapping, when you need to discover hidden routes, backup files, or unlinked API paths on an in-scope host.
Watch-outs
Aggressive wordlists plus high threads will lock accounts, trip WAFs, and fill logs. Exclude logout, password reset, and any route that sends email or SMS. On healthcare jobs, do not discover by downloading file bodies that may contain ePHI.
Typical invocation
ffuf -w wordlists/api-routes.txt -u https://api.example/FUZZ -mc 200,204,401 -t 10 -rate 20
Authorized assessments only. Stay inside the rules of engagement.
Pin to a kit
Open an engagement first.
Related
- katana
Crawler for JavaScript-heavy web apps and APIs to build an authorized URL inventory.
- Burp Suite
Intercepting proxy and scanner for authorized web and API testing, mapping, and manual review.
- nuclei
Template-based vulnerability scanner for known issues on in-scope web, API, and network services.
- httpx
HTTP probe to confirm live web services, titles, status codes, and tech from a host list.