ffuf Commands for Beginners: Find Hidden Web Paths in a Lab

Many web applications have pages nobody links to: admin panels, old backups, test files. ffuf is a fast tool that guesses those paths from a wordlist. It is a standard step in web testing and in hands-on web exams. Run it only against your own lab or systems you have written permission to test.

Set Up a Target

Run a deliberately vulnerable application such as DVWA or OWASP Juice Shop in a virtual machine, as in our home lab guide. In the examples, 192.168.56.20 is the lab web server; replace it with yours. Kali Linux includes ffuf and wordlists; see Kali Linux for beginners.

Your First Scan

The word FUZZ marks where ffuf places each wordlist entry:

• ffuf -u http://192.168.56.20/FUZZ -w /usr/share/wordlists/dirb/common.txt

Each line of output shows a path, its HTTP status and its size. Status 200 means the page exists, 301 or 302 is a redirect and 403 means it exists but you may not open it.

Cut the Noise

• -mc 200,301,403 shows only those status codes.
• -fc 404 hides a status code. -fs 1234 hides responses of one size, useful when a site returns the same page for every wrong path.
• -e .php,.txt,.bak also tries each word with those extensions.
• -t 20 -rate 50 limits threads and requests per second, so you do not overload a fragile lab machine.

Reading Results

Open each interesting path in your browser or in Burp Suite. A found path is a lead, not a vulnerability. Ask what it exposes: a login page, a backup file, a version number. Write the finding with the request, the response and why it matters.

Cheat Sheet

• ffuf -u http://TARGET/FUZZ -w wordlist.txt finds paths.
• -e .php,.txt,.bak adds file extensions.
• -mc 200,301 matches codes; -fc 404 hides a code; -fs SIZE hides a response size.
• -t 20 -rate 50 limits speed.
• -H "Cookie: SESSION=value" sends a header such as a session cookie.
• -u "http://TARGET/page?id=FUZZ" -w numbers.txt fuzzes a parameter value.
• -o results.json -of json saves the output.

We ran these ffuf options against a local test web server before publishing. Flags can differ between versions, so check ffuf -h.

Where It Fits

Content discovery sits at the mapping stage of web testing, before injection and access control checks. See penetration testing phases explained and OWASP Top 10 explained. It is practiced in our Application Security course and is useful preparation for WAHS.

Sources and Further Reading

• ffuf project and documentation