FFUF Automation Guide

Why FFUF Content Discovery Matters

Subdomain enumeration gives you the hosts. Live host probing confirms they're running web services. But neither tells you what's actually on those hosts. FFUF fills that gap — it brute-forces paths, parameters, and virtual host headers to surface the content that's present but not linked.

The highest-value targets in any bug bounty scope aren't the main application endpoints you can see. They're the /admin panels that weren't removed, the .env files left in web roots, the /api/v1/internal endpoints that were never deprecated, and the backup archives that someone uploaded once and forgot. FFUF finds all of them.

Essential FFUF Flags for Automation

Most FFUF guides show the basic -u URL/FUZZ -w wordlist.txt pattern and stop there. Automation requires understanding the filtering and output flags that make FFUF usable at scale — especially across dozens of targets where manual review of every response is impossible.

Real FFUF Automation Workflows

These are production-grade FFUF patterns used in real bug bounty pipelines. Each builds on the previous — start with the one-liner for quick sweeps, use the full script for targets you're actively hunting.

One-liner: Fast directory sweep

The minimum viable content discovery run. Auto-calibration handles false positive filtering automatically. Output goes to JSON for downstream processing.

ffuf \
  -u https://target.com/FUZZ \
  -w /opt/homebrew/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
  -ac \
  -mc 200,201,204,301,302,307,401,403 \
  -t 50 \
  -rate 100 \
  -o dirs.json \
  -of json \
  -s

Backup and sensitive file detection

Specifically targets files that developers accidentally leave in web roots. High signal-to-noise ratio — a 200 response on any of these is almost always a real finding worth reporting.

# Target: .env, .git, .bak, config files, archives
ffuf \
  -u https://target.com/FUZZ \
  -w /opt/homebrew/share/seclists/Discovery/Web-Content/raft-medium-files.txt \
  -mc 200,204 \
  -ac \
  -t 40 \
  -rate 60 \
  -o backups.json \
  -of json \
  -s

# Extract findings immediately
jq -r '.results[] | [.status, .length, .url] | @tsv' backups.json

Virtual host fuzzing

Discovers internal applications running on the same IP as the main site. Particularly effective on corporate scopes where internal tooling (Jenkins, Grafana, internal APIs) runs on the same server but requires a specific Host header. Requires knowing the baseline response size first.

# Step 1: Get baseline size for a non-existent vhost
curl -s -o /dev/null -w "%{size_download}" \
  -H "Host: nonexistent12345.target.com" \
  https://target.com
# → note the size, use as -fs value below

# Step 2: Fuzz virtual hosts, filter baseline size
ffuf \
  -u https://target.com \
  -H "Host: FUZZ.target.com" \
  -w /opt/homebrew/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  -fs 1234 \
  -mc 200,301,302,401,403 \
  -t 40 \
  -rate 80 \
  -o vhosts.json \
  -of json \
  -s

Parameter fuzzing

Discovers hidden GET parameters on known endpoints. Useful after directory fuzzing — once you've found an interesting path, parameter fuzzing can reveal additional functionality, internal flags, or debug modes that weren't documented.

# Fuzz GET parameters on a discovered endpoint
ffuf \
  -u "https://target.com/api/endpoint?FUZZ=test" \
  -w /opt/homebrew/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
  -ac \
  -mc 200,201,204 \
  -t 30 \
  -rate 50 \
  -o params.json \
  -of json \
  -s

# POST parameter fuzzing
ffuf \
  -u "https://target.com/api/endpoint" \
  -X POST \
  -d "FUZZ=test" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -w /opt/homebrew/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
  -ac \
  -mc 200,201,204 \
  -t 30 \
  -s

Full multi-host FFUF pipeline

The complete automation script — reads a live-hosts.txt from your subdomain recon pipeline, runs directory + backup fuzzing against each host, then chains discovered URLs into Nuclei for vulnerability validation.

#!/usr/bin/env bash
# PhantomRed — FFUF Multi-Host Content Discovery Pipeline
# Usage: ./ffuf-pipeline.sh live-hosts.txt
# Requires: ffuf, nuclei, jq, seclists

HOSTS="${1:-live-hosts.txt}"
OUT="./ffuf-results/$(date +%Y%m%d_%H%M%S)"
DIRLIST="/opt/homebrew/share/seclists/Discovery/Web-Content/raft-medium-directories.txt"
FILELIST="/opt/homebrew/share/seclists/Discovery/Web-Content/raft-medium-files.txt"
mkdir -p "$OUT"

echo "[*] FFUF pipeline — $(wc -l < $HOSTS) hosts"

while IFS= read -r HOST; do
  SAFE=$(echo "$HOST" | sed 's|https\?://||' | tr '/:' '__')
  mkdir -p "$OUT/$SAFE"
  echo "  → $HOST"

    # Directory fuzzing
  /opt/homebrew/bin/ffuf \
    -u "${HOST}/FUZZ" \
    -w "$DIRLIST" \
    -ac -mc 200,201,204,301,302,307,401,403 \
    -t 50 -rate 100 -timeout 10 \
    -o "$OUT/$SAFE/dirs.json" -of json -s 2>/dev/null || true

    # Backup file detection
  /opt/homebrew/bin/ffuf \
    -u "${HOST}/FUZZ" \
    -w "$FILELIST" \
    -mc 200,204 \
    -t 30 -rate 50 -timeout 10 \
    -o "$OUT/$SAFE/backups.json" -of json -s 2>/dev/null || true

    # Extract all discovered URLs
  /opt/homebrew/bin/jq -r '.results[].url' \
    "$OUT/$SAFE/dirs.json" "$OUT/$SAFE/backups.json" \
    2>/dev/null \
    >> "$OUT/all-discovered-urls.txt" || true

done < "$HOSTS"

# STAGE 2 — Nuclei validation on discovered endpoints
if [[ -s "$OUT/all-discovered-urls.txt" ]]; then
  sort -u "$OUT/all-discovered-urls.txt" -o "$OUT/all-discovered-urls.txt"
  echo "[*] Discovered URLs: $(wc -l < $OUT/all-discovered-urls.txt)"
  echo "[*] Running Nuclei on discovered endpoints..."

  /opt/homebrew/bin/nuclei \
    -l "$OUT/all-discovered-urls.txt" \
    -t vulnerabilities/,exposures/ \
    -severity medium,high,critical \
    -rl 30 \
    -timeout 10 \
    -silent \
    -json \
    -o "$OUT/nuclei-on-ffuf.json" || true
fi

echo "[✓] Done. Results: $OUT/"

Wordlist Selection for FFUF Automation

The wordlist determines what FFUF finds. Using the wrong wordlist for the wrong target type is the most common reason hunters miss high-value findings. These are the SecLists wordlists that produce the highest signal-to-noise ratio for each use case.

Common FFUF Automation Mistakes

How PhantomRed Automates FFUF Workflows

PhantomRed runs FFUF as part of its autonomous offensive security pipeline. After subdomain enumeration and live host probing, the platform automatically selects wordlists based on detected technology stacks — API endpoint lists for detected API frameworks, CMS-specific wordlists for WordPress or Drupal targets, generic directory lists for unknown stacks.

FFUF-discovered endpoints are automatically fed into the Nuclei scan pipeline for vulnerability validation. You see findings organized by endpoint — not raw FFUF output — with severity scoring applied across the full discovery-to-validation chain. See the Recon Workflow Generator to build custom FFUF pipelines for specific target profiles.

Benefits of Automated FFUF Workflows

• Consistent coverage — automated pipelines run the same wordlists against every host with the same flags, eliminating the variability of manual fuzzing where some hosts get thorough coverage and others get skipped
• Technology-aware targeting — routing wordlists based on detected tech stacks means API hosts get API-specific lists instead of generic directory wordlists that produce mostly 404s
• Discovery-to-validation chain — chaining FFUF output directly into Nuclei turns content discovery into vulnerability discovery without manual file handling between stages
• 403 triage — capturing and separately triaging 403 responses surfaces access-controlled paths worth testing for authorization bypass, a finding category manual hunters consistently miss
• Backup file detection at scale — running raft-medium-files.txt across all live hosts in a program scope finds exposed .env and config files that no other recon stage would surface
• Vhost discovery — fuzzing Host headers against discovered IPs uncovers internal applications running on shared infrastructure that subdomain enumeration alone would never find

Frequently Asked Questions