ffuf & gobuster

ffuf and gobuster are web fuzzers: they discover hidden content (directories, files), parameters, subdomains, and virtual hosts by testing a dictionary’s words against the target. They’re basics of web enumeration (see recon, Recon automation, ctf).

ffuf (Fuzz Faster U Fool)

# discover directories/files (FUZZ marks where to inject)
ffuf -u https://host/FUZZ -w wordlist.txt
ffuf -u https://host/FUZZ -w wl.txt -e .php,.txt,.bak   # extensions
# filter by size/code/words (remove custom-404 noise)
ffuf -u https://host/FUZZ -w wl.txt -fc 404 -fs 1234
# GET parameter fuzzing
ffuf -u 'https://host/page?FUZZ=x' -w params.txt -fs 0
# virtual hosts (vhost) via the Host header
ffuf -u https://host/ -H 'Host: FUZZ.host' -w subs.txt -fs <baseline>

gobuster

gobuster dir -u https://host -w wl.txt -x php,txt    # directories/files
gobuster dns -d target.com -w subs.txt               # subdomains (DNS)
gobuster vhost -u https://host -w subs.txt            # virtual hosts
# simpler than ffuf; ffuf is more flexible and fast for complex cases

Filtering (the key to not drowning)

-mc / -fc   match/filter by status CODE (e.g. -fc 404)
-ms / -fs   match/filter by response SIZE (remove fixed-size error pages)
-mw / -fw   match/filter by number of WORDS
-ac         auto-calibration (ffuf detects the "not found" pattern itself)
# a custom 404 returns 200: you must filter by size/words, not just code

Dictionaries

SecLists   the standard collection (Discovery/Web-Content/raft-*, common.txt, directory-list)
- choose the dictionary by context (technology, language, size)
- start with medium lists (raft-medium) and refine; don't fire the giant list first

Blue Team / use

Filtering is what makes fuzzing useful: use -fs/-fw/-ac against custom 404s.
SecLists is the standard dictionary set; choose by technology and context.
ffuf for complex cases (parameters, vhost, fast); gobuster for the simple ones.
A central part of web enumeration (recon, Recon automation) and web CTFs (Categories (pwn, web, crypto, forensics)).

Tips and gotchas

Filter by size/code/words (-fc, -fs, -fw) or you’ll drown in false positives; calibrate against a non-existent path first.
Common mistake: not setting the extension (-e .php,.bak) or the right wordlist (SecLists by use case).
For VHosts use -H "Host: FUZZ.domain" and filter the baseline; recurse with -recursion but carefully.
Tune -t (threads) and -rate: going all-out knocks the target over and triggers bans or WAF.

Testing checklist

Fuzz directories/files with extensions
Filter noise (fc/fs/fw or -ac) against custom 404s
Fuzz hidden GET/POST parameters
Discover subdomains (DNS) and virtual hosts (Host header)
Choose the SecLists dictionary suited to the context
Start with medium lists and refine
Work within the authorized scope (Reading the scope & rules)