Quick Reference
FFUF & Gobuster Quick Reference
Hackers Manifest - hackersmanifest.com
Directory brute-forcing, virtual host discovery, and web fuzzing reference.
🚀 ffuf - Basic Usage
| Directory fuzz | ffuf -u URL/FUZZ -w wordlist.txt |
| With extensions | ffuf -u URL/FUZZ -w list.txt -e .php,.html |
| POST data | ffuf -u URL -X POST -d "user=FUZZ" -w list.txt |
| Header fuzz | ffuf -u URL -H "X-Header: FUZZ" -w list.txt |
| Cookie fuzz | ffuf -u URL -b "session=FUZZ" -w list.txt |
| Multiple wordlists | ffuf -u URL/W1/W2 -w u.txt:W1 -w p.txt:W2 |
🔍 ffuf - Filters
| Filter status code | -fc 404 |
| Filter size | -fs 1234 |
| Filter words | -fw 100 |
| Filter lines | -fl 10 |
| Filter regex | -fr "not found" |
| Match status | -mc 200,301,302 |
| Match size | -ms 0-1000 |
| Auto-calibrate | -ac |
⚡ ffuf - Advanced
| Recursion | -recursion -recursion-depth 2 |
| Rate limit | -rate 100 |
| Threads | -t 50 |
| Timeout | -timeout 10 |
| Output JSON | -o results.json -of json |
| Silent mode | -s |
| Verbose | -v |
🌐 ffuf - VHost Discovery
| Subdomain enum | ffuf -u URL -H "Host: FUZZ.target.com" -w subs.txt |
| With auto-calibrate | ffuf -u URL -H "Host: FUZZ.target.com" -w subs.txt -ac |
| Filter false positives | ffuf -u URL -H "Host: FUZZ.target.com" -w subs.txt -fs 1234 |
📁 Gobuster - Directory Mode
| Basic dir scan | gobuster dir -u URL -w wordlist.txt |
| With extensions | gobuster dir -u URL -w list.txt -x php,html |
| Status codes | -s 200,204,301,302,307,401,403 |
| Threads | -t 50 |
| Follow redirects | -r |
| Cookies | -c "session=abc123" |
| Headers | -H "Authorization: Bearer token" |
| Output | -o results.txt |
🔎 Gobuster - DNS & VHost
| DNS enum | gobuster dns -d target.com -w subs.txt |
| Show CNAME | gobuster dns -d target.com -w subs.txt -c |
| Show IPs | gobuster dns -d target.com -w subs.txt -i |
| VHost enum | gobuster vhost -u URL -w subs.txt |
| Append domain | --append-domain |
📚 Common Wordlists (SecLists)
/Discovery/Web-Content/common.txt/Discovery/Web-Content/directory-list-2.3-medium.txt/Discovery/Web-Content/raft-large-directories.txt/Discovery/Web-Content/raft-large-files.txt/Discovery/DNS/subdomains-top1million-5000.txt/Discovery/DNS/bitquark-subdomains-top100000.txt🎯 Common Scan Profiles
Quick Dir Scan
ffuf -u URL/FUZZ -w common.txt -fc 404 -t 100 Full Dir + Extensions
ffuf -u URL/FUZZ -w medium.txt -e .php,.html,.js,.txt -fc 404 -t 50 Subdomain Discovery
ffuf -u http://FUZZ.target.com -w subs.txt -ac Parameter Fuzzing
ffuf -u URL?FUZZ=test -w params.txt -fc 404 -fs 1234 Generated from Hackers Manifest | For authorized security testing only | hackersmanifest.com