ff. Schnelle Web Fuzzer Cheat Blatt
Überblick
ffuf (Fuzz Faster U Fool) ist ein schnelles Web Fuzzer geschrieben in Go. Es ist ein vielseitiges Werkzeug für Web-Anwendung Sicherheitstests, in der Lage zu fuzzing Verzeichnisse, Dateien, Parameter, Kopfzeilen und mehr. ffuf ist bekannt für seine Geschwindigkeit, Flexibilität und umfangreiche Filterfähigkeiten.
ZEIT Warnung: Dieses Tool ist nur für autorisierte Penetrationstests und Sicherheitsbewertungen gedacht. Stellen Sie sicher, dass Sie eine ordnungsgemäße Autorisierung vor der Verwendung gegen jedes Ziel haben.
Installation
Zur Installation
```bash
Install via Go
go install github.com/ffuf/ffuf/v2@latest
Verify installation
ffuf -V ```_
Installation des Paketmanagers
```bash
Ubuntu/Debian
sudo apt update sudo apt install ffuf
Arch Linux
sudo pacman -S ffuf
macOS with Homebrew
brew install ffuf
Kali Linux (pre-installed)
ffuf -h ```_
Manuelle Installation
```bash
Download latest release
wget https://github.com/ffuf/ffuf/releases/download/v2.1.0/ffuf_2.1.0_linux_amd64.tar.gz tar -xzf ffuf_2.1.0_linux_amd64.tar.gz sudo mv ffuf /usr/local/bin/
Make executable
sudo chmod +x /usr/local/bin/ffuf ```_
Docker Installation
```bash
Pull Docker image
docker pull ffuf/ffuf
Run with Docker
docker run --rm ffuf/ffuf -h ```_
Basisnutzung
Befehlsstruktur
```bash
Basic syntax
ffuf -u URL -w WORDLIST
Get help
ffuf -h
Check version
ffuf -V ```_
Beispiele
```bash
Basic directory fuzzing
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt
File fuzzing with extensions
ffuf -u http://target.com/FUZZ.php -w /usr/share/wordlists/dirb/common.txt
Multiple FUZZ keywords
ffuf -u http://target.com/FUZZ/FUZ2Z -w wordlist1.txt:FUZZ -w wordlist2.txt:FUZ2Z ```_
Verzeichnis und Datei Fuzzing
Basic Directory Fuzzing
```bash
Directory enumeration
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt
With specific extensions
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -e .php,.html,.txt
Multiple extensions
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -e .php,.html,.txt,.js,.css,.xml,.json ```_
Erweiterte Verzeichnisoptionen
```bash
Increase threads
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -t 100
Add delay between requests
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -p 0.1
Follow redirects
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -r
Recursion
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -recursion -recursion-depth 2 ```_
Dateierweiterung Fuzzing
```bash
Fuzz file extensions
ffuf -u http://target.com/index.FUZZ -w extensions.txt
Common web extensions
echo -e "php\nhtml\nhtm\ntxt\njs\ncss\nxml\njson\nasp\naspx\njsp" > extensions.txt ffuf -u http://target.com/index.FUZZ -w extensions.txt
Backup file extensions
echo -e "bak\nold\ntmp\nbackup\n~\nswp" > backup_extensions.txt ffuf -u http://target.com/index.FUZZ -w backup_extensions.txt ```_
Parameter Fuzzing
GET Parameter Fuzzing
```bash
Basic GET parameter fuzzing
ffuf -u http://target.com/page.php?FUZZ=value -w parameters.txt
Multiple parameters
ffuf -u http://target.com/page.php?param1=FUZZ¶m;2=FUZ2Z -w values1.txt:FUZZ -w values2.txt:FUZ2Z
Parameter name fuzzing
ffuf -u http://target.com/page.php?FUZZ=test -w /usr/share/wordlists/SecLists/Discovery/Web-Content/burp-parameter-names.txt ```_
POST Parameter Fuzzing
```bash
POST data fuzzing
ffuf -u http://target.com/login.php -w /usr/share/wordlists/SecLists/Passwords/Common-Credentials/10-million-password-list-top-1000.txt -X POST -d "username=admin&password;=FUZZ" -H "Content-Type: application/x-www-form-urlencoded"
JSON POST data fuzzing
ffuf -u http://target.com/api/login -w passwords.txt -X POST -d '\\{"username":"admin","password":"FUZZ"\\}' -H "Content-Type: application/json"
Multiple POST parameters
ffuf -u http://target.com/login.php -w usernames.txt:USER -w passwords.txt:PASS -X POST -d "username=USER&password;=PASS" -H "Content-Type: application/x-www-form-urlencoded" ```_
Parameter Wert Fuzzing
```bash
SQL injection payloads
ffuf -u http://target.com/page.php?id=FUZZ -w /usr/share/wordlists/SecLists/Fuzzing/SQLi/Generic-SQLi.txt
XSS payloads
ffuf -u http://target.com/search.php?q=FUZZ -w /usr/share/wordlists/SecLists/Fuzzing/XSS/XSS-Jhaddix.txt
Command injection payloads
ffuf -u http://target.com/ping.php?host=FUZZ -w /usr/share/wordlists/SecLists/Fuzzing/command-injection-commix.txt ```_
Header Fuzzing
Basic Header Fuzzing
```bash
User-Agent fuzzing
ffuf -u http://target.com/ -w user-agents.txt -H "User-Agent: FUZZ"
Custom header fuzzing
ffuf -u http://target.com/ -w header-values.txt -H "X-Custom-Header: FUZZ"
Authorization header fuzzing
ffuf -u http://target.com/admin -w tokens.txt -H "Authorization: Bearer FUZZ" ```_
HTTP Methode Fuzzing
```bash
HTTP method fuzzing
ffuf -u http://target.com/api/endpoint -w methods.txt -X FUZZ
Create methods wordlist
echo -e "GET\nPOST\nPUT\nDELETE\nPATCH\nHEAD\nOPTIONS\nTRACE\nCONNECT" > methods.txt ```_
Host Header Fuzzing
```bash
Host header fuzzing for virtual hosts
ffuf -u http://target.com/ -w subdomains.txt -H "Host: FUZZ.target.com"
IP-based host header fuzzing
ffuf -u http://192.168.1.100/ -w subdomains.txt -H "Host: FUZZ.target.com" ```_
Subdomain Fuzzing
Grundlegende Subdomain Fuzzing
```bash
Subdomain enumeration via Host header
ffuf -u http://target.com/ -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt -H "Host: FUZZ.target.com"
HTTPS subdomain fuzzing
ffuf -u https://target.com/ -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt -H "Host: FUZZ.target.com"
Filter by response size
ffuf -u http://target.com/ -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt -H "Host: FUZZ.target.com" -fs 1234 ```_
Advanced Subdomain Techniques
```bash
Multiple subdomain levels
ffuf -u http://target.com/ -w subdomains.txt:SUB1 -w subdomains.txt:SUB2 -H "Host: SUB1.SUB2.target.com"
Subdomain with specific ports
ffuf -u http://target.com:8080/ -w subdomains.txt -H "Host: FUZZ.target.com"
Custom subdomain patterns
ffuf -u http://target.com/ -w patterns.txt -H "Host: FUZZ-api.target.com" ```_
Filtern und Passieren
Antwort Code Filtern
```bash
Match specific status codes
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -mc 200,301,302
Filter out status codes
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -fc 404,403
Match successful responses
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -mc 200-299 ```_
Antwort Größe Filter
```bash
Filter by response size
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -fs 1234
Filter by size range
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -fs 1000-2000
Match specific size
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -ms 5678 ```_
Antwort Inhalt filtern
```bash
Filter by response words
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -fw 100
Match specific word count
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -mw 50-100
Filter by response lines
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -fl 10 ```_
Antwort Text filtern
```bash
Filter responses containing specific text
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -fr "Not Found"
Match responses containing text
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -mr "Welcome"
Filter using regex
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -fr "Error.*404" ```_
Ausgabe und Reporting
Ausgabeformate
```bash
Save to file
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -o results.txt
JSON output
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -o results.json -of json
CSV output
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -o results.csv -of csv
HTML output
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -o results.html -of html ```_
Verbose Ausgang
```bash
Verbose mode
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -v
Silent mode (only results)
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -s
Color output
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -c ```_
Erweiterte Techniken
Beschränkung und Stealth
```bash
Slow scanning to avoid detection
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -t 1 -p 2
Random delay
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -p 1-3
Custom timeout
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -timeout 30 ```_
Proxy und SSL Optionen
```bash
Use proxy
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -x http://127.0.0.1:8080
Skip SSL verification
ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -k
Custom CA certificate
ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -cert cert.pem ```_
Authentication
```bash
Basic authentication
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -H "Authorization: Basic $(echo -n 'user:pass'|base64)"
Cookie authentication
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -b "PHPSESSID=abc123; auth=token"
Bearer token
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -H "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9..." ```_
Englische Sprache
Erstellen von benutzerdefinierten Wordlisten
```bash
Combine multiple wordlists
cat /usr/share/wordlists/dirb/common.txt /usr/share/wordlists/dirb/big.txt|sort -u > combined.txt
Generate wordlist from website
cewl http://target.com -w custom_wordlist.txt
Technology-specific wordlist
echo -e "admin\napi\nv1\nv2\ntest\ndev\nstaging\nproduction" > custom_dirs.txt ```_
Beliebte Wordlists
```bash
SecLists wordlists
/usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt /usr/share/wordlists/SecLists/Discovery/Web-Content/common.txt /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt
Parameter wordlists
/usr/share/wordlists/SecLists/Discovery/Web-Content/burp-parameter-names.txt /usr/share/wordlists/SecLists/Fuzzing/LFI/LFI-gracefulsecurity-linux.txt
Subdomain wordlists
/usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt /usr/share/wordlists/SecLists/Discovery/DNS/fierce-hostlist.txt ```_
Automatisierungsskripte
Umfassendes Web Fuzzing Script
```bash
!/bin/bash
TARGET=$1 OUTPUT_DIR="ffuf_results_$(date +%Y%m%d_%H%M%S)"
if [ -z "$TARGET" ]; then
echo "Usage: $0
mkdir -p $OUTPUT_DIR
echo "[+] Starting comprehensive web fuzzing for $TARGET"
Directory fuzzing
echo "[+] Directory fuzzing..." ffuf -u $TARGET/FUZZ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -mc 200,301,302,403 -o "$OUTPUT_DIR/directories.json" -of json
File fuzzing with extensions
echo "[+] File fuzzing..." ffuf -u $TARGET/FUZZ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/common.txt -e .php,.html,.txt,.js,.css,.xml,.json,.bak,.old -mc 200 -o "$OUTPUT_DIR/files.json" -of json
Parameter fuzzing
echo "[+] Parameter fuzzing..." ffuf -u $TARGET/index.php?FUZZ=test -w /usr/share/wordlists/SecLists/Discovery/Web-Content/burp-parameter-names.txt -mc 200 -fs 0 -o "$OUTPUT_DIR/parameters.json" -of json
Subdomain fuzzing (if domain provided)
if [[ $TARGET =~ ^https?://([^/]+) ]]; then DOMAIN=$\\{BASH_REMATCH[1]\\} echo "[+] Subdomain fuzzing for $DOMAIN..." ffuf -u $TARGET -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt -H "Host: FUZZ.$DOMAIN" -mc 200 -fs 0 -o "$OUTPUT_DIR/subdomains.json" -of json fi
echo "[+] Fuzzing complete. Results saved in $OUTPUT_DIR/" ```_
API Endpoint Fuzzing Script
```bash
!/bin/bash
API_BASE=$1 OUTPUT_FILE="api_endpoints.json"
if [ -z "$API_BASE" ]; then
echo "Usage: $0
echo "[+] Fuzzing API endpoints for $API_BASE"
API version fuzzing
echo "[+] API version fuzzing..." ffuf -u $API_BASE/FUZZ -w <(echo -e "v1\nv2\nv3\napi\napi/v1\napi/v2\napi/v3") -mc 200,301,302 -o "api_versions.json" -of json
Common API endpoints
echo "[+] Common API endpoints..." ffuf -u $API_BASE/api/FUZZ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/api/api-endpoints.txt -mc 200,301,302 -o "api_endpoints.json" -of json
HTTP methods fuzzing
echo "[+] HTTP methods fuzzing..." ffuf -u $API_BASE/api/users -w <(echo -e "GET\nPOST\nPUT\nDELETE\nPATCH\nHEAD\nOPTIONS") -X FUZZ -mc 200,201,204,301,302,405 -o "api_methods.json" -of json
echo "[+] API fuzzing complete." ```_
Parameter Brute Force Script
```bash
!/bin/bash
TARGET_URL=$1 PARAM_NAME=$2 WORDLIST=$3
| if [ -z "$TARGET_URL" ] | | [ -z "$PARAM_NAME" ] | | [ -z "$WORDLIST" ]; then |
echo "Usage: $0
echo "[+] Brute forcing parameter $PARAM_NAME on $TARGET_URL"
GET parameter brute force
ffuf -u "$TARGET_URL?$PARAM_NAME=FUZZ" -w $WORDLIST -mc 200 -fs 0 -o "param_bruteforce_get.json" -of json
POST parameter brute force
ffuf -u $TARGET_URL -w $WORDLIST -X POST -d "$PARAM_NAME=FUZZ" -H "Content-Type: application/x-www-form-urlencoded" -mc 200 -fs 0 -o "param_bruteforce_post.json" -of json
echo "[+] Parameter brute force complete." ```_
Integration mit anderen Tools
Integration von Burp Suite
```bash
Use Burp as proxy
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -x http://127.0.0.1:8080
Export Burp findings to wordlist
From Burp: Target > Site map > Right-click > Copy URLs
Process URLs to create custom wordlist
```_
Nucles Integration
```bash
Run ffuf first, then nuclei on found endpoints
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -mc 200 -o found_endpoints.json -of json
Extract URLs from ffuf results
jq -r '.results[].url' found_endpoints.json > found_urls.txt
Run nuclei on found URLs
nuclei -l found_urls.txt -t /path/to/nuclei-templates/ ```_
Nmap Integration
```bash
Discover web services first
nmap -p 80,443,8080,8443 target.com --open -oG web_ports.txt
Extract hosts and ports, then fuzz
| grep "80/open\ | 443/open\ | 8080/open\ | 8443/open" web_ports.txt | awk '\\{print $2\\}' | while read host; do | ffuf -u "http://$host/FUZZ" -w /usr/share/wordlists/dirb/common.txt -mc 200,301,302 done ```_
Leistungsoptimierung
Gewinde und Geschwindigkeit
```bash
Optimal thread count (usually 40-100)
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -t 50
Adjust timeout for slow servers
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -timeout 10
Silent mode for better performance
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -s ```_
Speicherverwaltung
```bash
For large wordlists, use streaming
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-big.txt -t 30
Monitor memory usage
watch -n 1 'ps aux|grep ffuf' ```_
Fehlerbehebung
Gemeinsame Themen
```bash
SSL certificate issues
ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -k
Connection timeout
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -timeout 30
Rate limiting
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -t 1 -p 2
DNS resolution issues
ffuf -u http://192.168.1.100/FUZZ -w /usr/share/wordlists/dirb/common.txt -H "Host: target.com" ```_
Debug Mode
```bash
Verbose output for debugging
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -v
Test single request
ffuf -u http://target.com/test -w <(echo "test") -v ```_
Best Practices
Fuzzing Strategie
- *Start mit gemeinsamen Wortlisten: Verwenden Sie zunächst kleine, gezielte Wortlisten
- *Benutze geeignete Filter: Filtern Sie Geräusche aus, um sich auf interessante Ergebnisse zu konzentrieren
- *Technologiespezifische Fuzzing: Verwenden Sie relevante Wortlisten für die Zieltechnologie
- *Recursive fuzzing: Fuzz fand Verzeichnisse für tiefere Aufzählungen
- ** Entdeckung des Parameters*: Vergessen Sie nicht, Fuzz für versteckte Parameter
Stealth Überlegungen
```bash
Slow and stealthy fuzzing
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -t 1 -p 2-5 -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
Use proxy for anonymity
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -x http://proxy:8080
Random user agent
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -H "User-Agent: $(shuf -n1 user_agents.txt)" ```_
Ressourcen
- ffuf GitHub Repository
- (__LINK_4___)
- (__LINK_4___)
- Web Application Fuzzing
--
*Dieses Betrügereiblatt bietet eine umfassende Referenz für die Verwendung von ffuf. Stellen Sie immer sicher, dass Sie eine ordnungsgemäße Berechtigung haben, bevor Sie Web-Anwendung Sicherheitstests durchführen. *