ffuf-od
A fast web fuzzer written in Go.
Details
Category: Fuzzing
Publisher: trickest-mhmdiaa
Created Date: 2/9/2022
Container: quay.io/trickest/ffuf:v2.1.0
Source URL: https://github.com/ffuf/ffuf
Parameters
raw
boolean
Command:
-raw
- Do not encode URI (default: false)sni
string
Command:
-sni
- Target TLS SNI, does not support FUZZ keywordurl
string
requiredCommand:
-u
- Target URLjson
boolean
Command:
-json
- JSON output, printing newline-delimited JSON records (default: false)mode
string
Command:
-mode
- Multi-wordlist operation mode. Available modes: clusterbomb, pitchfork, sniper (default: clusterbomb)rate
string
Command:
-rate
- Rate of requests per second (default: 0)delay
string
Command:
-p
- Seconds of `delay` between requests, or a range of random delay. For example 0.1 or 0.1-2.0http2
boolean
Command:
-http2
- Use HTTP2 protocol (default: false)config
file
Command:
-config
- Load configuration from a fileheader
string
Command:
-H
- Header `Name: Value`, separated by colonsearch
string
Command:
-search
- Search for a FFUFHASH payload from ffuf historysilent
boolean
Command:
-s
- Do not print additional information (silent mode) (default: false)maxtime
string
Command:
-maxtime
- Maximum running time in seconds for entire process. (default: 0)request
file
Command:
-request
- File containing the raw http requestthreads
string
Command:
-t
- Number of concurrent threads. (default: 40)timeout
string
Command:
-timeout
- HTTP request timeout in seconds. (default: 10)verbose
boolean
Command:
-v
- Verbose output, printing full URL and redirect location (if any) with the results. (default: false)encoders
string
Command:
-enc
- Encoders for keywords, eg. 'FUZZ:urlencode b64encode'scrapers
string
Command:
-scrapers
- Active scraper groups (default: all)wordlist
file
requiredCommand:
-w
- Wordlist file path and (optional) keyword separated by colon.input-cmd
string
Command:
-input-cmd
- Command producing the input. --input-num is required when using this input method. Overrides -w.input-num
string
Command:
-input-num
- Number of inputs to test. Used in conjunction with --input-cmd. (default: 100)post-data
string
Command:
-d
- POST datarecursion
boolean
Command:
-recursion
- Scan recursively. Only FUZZ keyword is supported, and URL (-u) has to end in it. (default: false)client-key
file
Command:
-ck
- Client key for authentication. Client certificate needs to be defined as well for this to workextensions
string
Command:
-e
- Comma separated list of extensions. Extends FUZZ keyword.match-time
string
Command:
-mt
- Match how many milliseconds to the first response byte, either greater or less than. EG: >100 or <100client-cert
file
Command:
-cc
- Client cert for authentication. Client key needs to be defined as well for this to workcookie-data
string
Command:
-b
- Cookie datafilter-mode
string
Command:
-fmode
- Filter set operator. Either of: and, or (default: or)filter-time
string
Command:
-ft
- Filter by number of milliseconds to the first response byte, either greater or less than. EG: >100 or <100http-method
string
Command:
-X
- HTTP method to use (default: GET)ignore-body
boolean
Command:
-ignore-body
- Do not fetch the response content. (default: false)input-shell
string
Command:
-input-shell
- Shell to be used for running commandmatch-lines
string
Command:
-ml
- Match amount of lines in responsematch-words
string
Command:
-mw
- Match amount of words in responsemaxtime-job
string
Command:
-maxtime-job
- Maximum running time in seconds per job. (default: 0)scraperfile
file
Command:
-scraperfile
- Custom scraper file pathcolor-output
boolean
Command:
-c
- Colorize outputfilter-lines
string
Command:
-fl
- Filter by amount of lines in response. Comma separated list of line counts and rangesfilter-words
string
Command:
-fw
- Filter by amount of words in response. Comma separated list of word counts and rangesmatch-regexp
string
Command:
-mr
- Match regexpmatcher-mode
string
Command:
-mmode
- Matcher set operator. Either of: and, or (default: or)replay-proxy
string
Command:
-replay-proxy
- Replay matched requests using this proxy.filter-regexp
string
Command:
-fr
- Filter regexpoutput-format
string
Command:
-of
- Output file format. Available formats: json, ejson, html, md, csv, ecsv (default: json)request-proto
string
Command:
-request-proto
- Protocol to use along with raw request (default: https)http-proxy-url
string
Command:
-x
- Proxy URL (SOCKS5 or HTTP). For example: http://127.0.0.1:8080 or socks5://127.0.0.1:8080autocalibration
boolean
Command:
-ac
- Automatically calibrate filtering options (default: false)recursion-depth
string
Command:
-recursion-depth
- Maximum recursion depth. (default: 0)follow-redirects
boolean
Command:
-r
- Follow redirects (default: false)stop-on-forbidden
boolean
Command:
-sf
- Stop when > 95% of responses return 403 Forbidden (default: false)match-status-codes
string
Command:
-mc
- Match HTTP status codes, or all for everything. (default: 200,204,301,302,307,401,403recursion-strategy
string
Command:
-recursion-strategy
- Recursion strategy: default for a redirect based, and greedy to recurse on all matches (default: default)stop-on-all-errors
boolean
Command:
-sa
- Stop on all error cases. Implies -sf and -se. (default: false)filter-status-codes
string
Command:
-fc
- Filter HTTP status codes from response. Comma separated list of codes and rangesmatch-response-size
string
Command:
-ms
- Match HTTP response sizefilter-response-size
string
Command:
-fs
- Filter HTTP response size. Comma separated list of sizes and rangeshost-autocalibration
boolean
Command:
-ach
- Per host autocalibration (default: false)custom-autocalibration
string
Command:
-acc
- Custom auto-calibration string. Can be used multiple times. Implies -acoutput-skip-empty-file
boolean
Command:
-or
- Don't create the output file if we don't have results (default: false)autocalibration-keyword
string
Command:
-ack
- Autocalibration keyword (default: FUZZ)stop-on-spurious-errors
boolean
Command:
-se
- Stop on spurious errors (default: false)autocalibration-strategy
string
Command:
-acs
- Custom auto-calibration strategies. Can be used multiple times. Implies -acdont-fetch-response-body
boolean
Command:
-ignore-body
- Do not fetch the response content. (default: false)ignore-wordlist-comments
boolean
Command:
-ic
- Ignore wordlist comments (default: false)dirsearch-wordlist-compatibility-mode
boolean
Command:
-D
- DirSearch wordlist compatibility mode. Used in conjunction with -e flag. (default: false)