ffuf

v2.1.0Joona Hoikkala

Substitutes each wordlist entry into the FUZZ marker in a URL and reports the responses that survive the match/filter rules. The range's ffuf fuzzes the authored path table and honors -mc, -fc and -fs the way the real tool does.

Category: Web application security testing
Package: ffuf
Runs on: Linux · Windows
Commands: ffuf

Responses come from the authored web fixture only — no socket is opened and no traffic leaves the browser.

Install it

The scripts below install the real Joona Hoikkala package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-ffuf.sh

Windows installer (PowerShell)

Install-ffuf.ps1

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```
Install ffuf
```
sudo apt install -y ffuf
```

RHEL, Fedora (dnf)

Install ffuf
```
sudo dnf install -y ffuf
```
Package names drift between distributions; search first if this one misses.

Arch (pacman)

Install ffuf
```
sudo pacman -S --noconfirm ffuf
```

Alpine (apk)

Install ffuf
```
sudo apk add ffuf
```
Package names drift between distributions; search first if this one misses.

Check it worked

Confirm it landed on PATH
```
which ffuf
```
Check the version
```
ffuf --version
```
The range reports 2.1.0.

Remove it

Take it off again
```
sudo apt remove --purge ffuf
```

On Windows

Windows Package Manager (winget)

Search the catalog
```
winget search ffuf
```
Install ffuf
```
winget install --id ffuf -e
```
Package names drift between distributions; search first if this one misses.

Chocolatey (choco)

Install ffuf
```
choco install ffuf -y
```
Run the shell as administrator.

Check it worked

Confirm it resolves
```
where ffuf
```
Check the version
```
ffuf --version
```
The range reports 2.1.0.

Remove it

Take it off again
```
winget uninstall --id ffuf
```

Inside the range

Tick it on the launch screen
Under ffuf's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y ffuf
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use ffuf

Pentest: External Recon to FootholdEnumerate a customer's public perimeter from an approved scan window, chain a stale service to a foothold, and file the first finding with CVSS and remediation before you touch anything else.
Pentest: Web App Assessment (OWASP Top 10)Assess a storefront with the Burp-lite workbench at /pentest/proxy: repeat a login, fuzz an id parameter, catch an IDOR and a stored XSS, and file each finding under its OWASP Top 10 category.