How to Install and Use ffuf in Linux for Fast Web Fuzzing and API Discovery

In modern web application security auditing and API development, discovery tools must keep pace with high-concurrency cloud environments. While older fuzzing utilities like wfuzz or Python-based scripts struggle with single-threaded bottlenecks, modern penetration testers require multi-threaded speed, raw socket efficiency, and granular response filtering.

ffuf (Fuzz Faster U Fool) is a blistering-fast open-source web fuzzer written in Go. By placing keyword place-markers (most commonly FUZZ) anywhere within target URLs, HTTP request headers, POST bodies, or JSON payloads, ffuf allows security engineers and system administrators to discover hidden paths, enumerate API parameters, brute-force login endpoints, and identify subtle server responses. This guide explains how to install ffuf on Linux, construct fuzzing commands, apply precision response filters, and automate API parameter discovery.

How ffuf Operates: The Keyword Placement Model

Unlike traditional directory brute-forcers that only append words to the end of a URL path, ffuf evaluates the exact location of the string FUZZ (or any custom identifier) inside your request:

• Directory Discovery: https://example.com/FUZZ
• Subdomain Enumeration: https://FUZZ.example.com
• Parameter Discovery: https://example.com/api/users?FUZZ=test
• POST Data Fuzzing: {"username": "admin", "password": "FUZZ"}
• Virtual Host Fuzzing: -H "Host: FUZZ.example.com"

Installing ffuf on Linux

ffuf is distributed via native package managers and pre-compiled binaries.

Method 1: Install via Package Managers

Ubuntu and Debian (including Kali Linux & Parrot OS):

sudo apt update
sudo apt install ffuf

Arch Linux:

sudo pacman -S ffuf

Fedora:

sudo dnf install ffuf

Method 2: Install via Go

If you have Go installed on your machine:

go install github.com/ffuf/ffuf/v2@latest

Confirm the binary is operational:

ffuf -V

Basic Directory and File Fuzzing

To run a standard directory discovery scan against a target web server using a wordlist:

ffuf -u http://192.168.1.50/FUZZ -w /usr/share/wordlists/dirb/common.txt

To fuzz for specific file extensions alongside directory names, append the -e parameter:

ffuf -u http://192.168.1.50/FUZZ -w /usr/share/wordlists/dirb/common.txt -e .php,.html,.json,.txt

Filtering Noise with Match and Filter Flags

Web applications frequently return HTTP 200 or custom 404 pages with uniform character lengths, cluttering scan results. ffuf solves this with precision filtering switches:

Flag Category	Switch	Description
Match Status	-mc <codes>	Match only specific HTTP status codes (e.g. -mc 200,301,403)
Filter Status	-fc <codes>	Filter out specific status codes (e.g. -fc 404,403)
Filter Size	-fs <size>	Filter responses by exact byte size (eliminates false-positive soft 404s)
Filter Words	-fw <words>	Filter responses by word count
Filter Lines	-fl <lines>	Filter responses by line count
Filter Regex	-fr <regex>	Filter responses matching an on-screen regular expression string

Example of filtering out custom 404 pages that measure exactly 4,210 bytes:

ffuf -u https://example.com/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -fc 404 -fs 4210

Fuzzing API Parameters and POST Bodies

To discover hidden GET parameters accepted by an API endpoint:

ffuf -u "https://example.com/api/v1/user?FUZZ=1" -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -fs 312

To fuzz JSON POST payloads (e.g. discovering valid user IDs or testing authentication inputs):

ffuf -u https://example.com/api/login -X POST \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "token": "FUZZ"}' \
  -w tokens.txt -mc 200,302

Performance and Rate-Limiting Controls

When auditing production servers or applications protected by Web Application Firewalls (WAF):

• -t <threads>: Number of concurrent workers (default: 40). Reduce to 5 or 10 to avoid overwhelming target services.
• -p <seconds>: Pause duration between requests (e.g. -p 0.1 adds a 100ms delay).
• -rate <req/sec>: Throttle requests to a strict ceiling (e.g. -rate 50 enforces 50 requests per second maximum).
• -o output.json -of json: Export structured results to JSON for CI/CD reporting and vulnerability tracking.