Web fuzzing is one of the most effective techniques in a security researcher's toolkit. Tools like the original command-line ffuf have been staples of bug bounty hunting and penetration testing for years. But there's always been one barrier — you need a terminal, you need to install dependencies, and you need to know your way around a command line before you can run your first scan.
Today I'm launching FFUF — a free, browser-based web fuzzing tool that removes that barrier entirely.
What is FFUF?
FFUF (ffuf.codewithneo.com) is a web app that lets you fuzz web targets directly from your browser. No installation. No terminal. No setup. Open the page, enter a URL, and start scanning.
Under the hood it works the same way the original ffuf does — it takes a wordlist, replaces a FUZZ keyword in your target URL or request body with each entry, fires the requests, and shows you which ones got a real response. The difference is that everything happens through a clean UI with real-time results streaming in as they come.
The CORS Problem — and How We Solved It
Browser-based security tools have always faced one fundamental problem: CORS. Browsers block JavaScript from reading responses from other domains, which means a naive browser-based fuzzer would be useless — you'd send requests but never see the status codes.
FFUF solves this with a server-side proxy. Every request goes through a serverless function that makes the real HTTP call server-side, captures the full response — status code, headers, body size, redirect location, content type — and sends it back. No CORS. Real 200s, 403s, 404s, 302s on every request, against any target.
What Can You Do With It?
FFUF covers four main use cases:
Directory and endpoint discovery is the most common. Point it at a target with FUZZ in the URL path, pick a category from the 2,800+ built-in paths (common directories, admin panels, sensitive files, API endpoints, CMS paths, cloud/DevOps paths and more), and let it run. Anything that returns a non-404 response gets flagged.
IDOR testing uses the built-in number range generator. Set a from/to/step range and the tool builds the wordlist in-browser. No file upload needed. Point it at an endpoint like /api/users/FUZZ and it systematically checks every ID in your range for real responses.
POST body fuzzing lets you inject wordlist entries into request bodies. Write a body template with FUZZ as the placeholder — {"username":"admin","password":"FUZZ"} for JSON or username=admin&password=FUZZ for form data — upload your wordlist, and the tool fires each variation as a real POST request.
Brute force combines POST body fuzzing with a password or username wordlist. Filter by 3XX redirects or look for responses with a different size from the rest — that outlier is your successful login.
Follows the File Reader API Method
The wordlist is processed entirely in the browser via the File Reader API — uploaded files never touch any server. The built-in wordlist of 2,800+ paths is compiled from community sources and curated by category.
Try It
The tool is free, requires no account, and works on any device with a browser.
As always — only test systems you own or have explicit permission to scan. FFUF is a security research tool, and responsible use is non-negotiable.
Leave a Reply