Directory and Vhost Fuzzing

⚠️ Authorized testing only. Everything here is for use only against systems you own or have explicit written permission to test — home labs, CTFs, and authorized engagements. Unauthorized access is illegal. See Rules of Engagement and Authorization.

Web servers hide content that isn't linked anywhere — admin panels, backups, API routes. Fuzzing discovers it by brute-forcing paths and virtual host headers.

#Directory & file fuzzing

ffuf -u https://target/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt \
     -mc 200,204,301,302,401,403 -recursion -recursion-depth 2

Filter noise with -fc (filter code), -fs (size), -fw (words):

ffuf -u https://target/FUZZ -w wordlist.txt -fc 404 -fs 0

#Virtual host fuzzing

Find sites served by Host header on the same IP:

ffuf -u https://target/ -H "Host: FUZZ.example.com" \
     -w subdomains.txt -fs 4242   # filter the default-vhost size

#Extensions & parameters

ffuf -u https://target/FUZZ -w words.txt -e .php,.bak,.zip,.txt
gobuster dir -u https://target -w wordlist.txt -x php,html

Tip: Always calibrate filters against a known-bad path first so you filter the catch-all response. Pairs with Web App Penetration Testing Cheat Sheet.