Ffuf – Fuzz Faster U Fool is a great tool used for fuzzing. It has become really popular lately with bug bounty hunters. Ffuf is used for fuzzing Get and Post data but can also be used for finding hidden files, directories or subdomains.
Read more: 5 of the Most Popular Website Hacking Tools Found in Kali Linux
Installation and usage
- Clone the Github repository and change the current directory
- Install golang
- Run the script with the FUZZ word, URL and a wordlist at least
On Kali you can easily install golang:
apt-get install golang
Then you can run a directory discovery which finishes the whole 200k wordlists under 30 seconds which is an impressive performance:
go run main.go -u http://localhost/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
The tool is also great when you have to test for vulnerabilities: SQLi, XSS, command injection, LDAP injection, NoSQL, etc. For example, if you come across a search get parameter you could use this command to test for SQLi (if you expect a different response length where you get a SQL error, opposed to the response where the parameter is just invalid):
Ffuf -w sqli.txt -u https://vitim/script.php?id=FUZZ -fs
Read more: 5 of the Most Popular Website Hacking Tools Found in Kali Linux
What Star rating does it get?
Pros
- Ffuf is probably the fastest web fuzzer
- It has a lot of really useful options for parameters and filtering out the response
Cons
- In some cases, it can miss results if the threads and filtering are not properly set up, so it boils down to trial and error which is a small con for any fuzzer.
Based on these pros and cons I will award this tool with 5/5 stars.
In summary, this is our review on the Ffuf tool and if you are planning on taking a journey on bug bounty or pen-testing, kindly ensure you have this tool.
Read more on 5 of the Most Popular Website Hacking Tools Found in Kali Linux to build your ethical hacking skills
You’re free to share this tip to help us serve you more and do follow us on the various social media sites; Facebook, Twitter, LinkedIn, Pinterest, Instagram, YouTube & Google News.