FFuf Cheatsheet

Basic Commands

Command	Description
`ffuf -h`	Show ffuf help

Fuzzing Types

Directory Fuzzing

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ

Extension Fuzzing

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/indexFUZZ

Page Fuzzing

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/blog/FUZZ.php

Recursive Fuzzing

ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ -recursion -recursion-depth 1 -e .php -v

Sub-domain Fuzzing

ffuf -w wordlist.txt:FUZZ -u https://FUZZ.hackthebox.eu/

VHost Fuzzing

ffuf -w wordlist.txt:FUZZ -u http://academy.htb:PORT/ -H 'Host: FUZZ.academy.htb' -fs xxx

Parameter Fuzzing - GET

ffuf -w wordlist.txt:FUZZ -u http://admin.academy.htb:PORT/admin/admin.php?FUZZ=key -fs xxx

Parameter Fuzzing - POST

ffuf -w wordlist.txt:FUZZ -u http://admin.academy.htb:PORT/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx

Value Fuzzing

ffuf -w ids.txt:FUZZ -u http://admin.academy.htb:PORT/admin/admin.php -X POST -d 'id=FUZZ' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx

Wordlists

Type	Path
Directory/Page	`/opt/useful/seclists/Discovery/Web-Content/directory-list-2.3-small.txt`
Extensions	`/opt/useful/seclists/Discovery/Web-Content/web-extensions.txt`
Domain	`/opt/useful/seclists/Discovery/DNS/subdomains-top1million-5000.txt`
Parameters	`/opt/useful/seclists/Discovery/Web-Content/burp-parameter-names.txt`

Misc

Add DNS Entry

sudo sh -c 'echo "SERVER_IP academy.htb" >> /etc/hosts'

Create Sequence Wordlist

for i in $(seq 1 1000); do echo $i >> ids.txt; done

curl with POST

curl http://admin.academy.htb:PORT/admin/admin.php -X POST -d 'id=key' -H 'Content-Type: application/x-www-form-urlencoded'

Keyboard shortcuts

notebook