CheckOps home

Tools directory

F

CheckOps

ffuf

ffuf is a fast, MIT-licensed web fuzzer written in Go for content discovery, virtual host discovery and parameter fuzzing during authorised security testing.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

ffuf (Fuzz Faster U Fool) is a fast web fuzzer written in Go. Testers use it to discover hidden directories and files, virtual hosts and parameters by replacing a FUZZ keyword in requests with entries from wordlists.

The source code is at ffuf/ffuf on GitHub under the MIT licence, with about 17,000 stars; the most recent commit was on 26 September 2026.

Features

  1. FUZZ keyword: Fuzz any part of a request.
  2. Filters and matchers: By status, size, words and more.
  3. Multiple wordlists: Combine inputs.
  4. Recursion: Recursive content discovery.
  5. Output formats: JSON, CSV, HTML and more.

Pros

  1. Free to use: Open source under MIT.
  2. Maintained: Commits as recent as 26 September 2026.
  3. Community: About 17,000 GitHub stars.

Cons

  1. Authorised use only: Only test systems you are permitted to.
  2. Wordlist dependent: Results depend on wordlists.
ffuf -w wordlist.txt -u https://staging.example.com/FUZZ -mc 200,301

Resources:

Pricing

ffuf is free and open source under the MIT licence.

  1. Penetration testers doing content discovery.
  2. Bug bounty hunters with authorisation.
  3. Not a fit for automated CI scanning of business logic.

Conclusion

ffuf is the fast, flexible web fuzzer most testers reach for.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with ffuf side by side.