← All Kali Commands
🌐 Web Application ffuf

Credential fuzzing

ffuf command for credential fuzzing. Copy the command below and use it in your terminal.

ffuf — terminal
┌──(kali㉿kali)-[~]
└─$ ffuf -w user.txt:W1 -w pass.txt:W2 -u http://target/login -d "user=W1&pass=W2"
Tool
ffuf
Category
Web Application
Purpose
Credential fuzzing

🛡️ Usage Tips

  • Always ensure you have proper authorization before using ffuf against any target
  • Replace target with the actual IP address or hostname you are testing
  • Run this command from a Kali Linux terminal or any system with ffuf installed
  • Combine with other ffuf commands for more comprehensive results
  • Pipe output to a file with > output.txt for later analysis

🔗 More ffuf Commands

ffuf -w wordlist.txt -u http://target/FUZZ
Directory fuzzing
ffuf -w wordlist.txt -u http://target/FUZZ -e .php,.html,.txt
With extensions
ffuf -w wordlist.txt -u http://target -H "Host: FUZZ.target.com"
Vhost fuzzing
ffuf -w wordlist.txt -u http://target/page?param=FUZZ
Parameter value fuzzing
ffuf -w wordlist.txt -u http://target/FUZZ -fc 404
Filter 404s
ffuf -w wordlist.txt -u http://target/FUZZ -mc 200,301
Match codes
ffuf -w wordlist.txt -u http://target/FUZZ -rate 100
Rate limit 100/s
ffuf -w wordlist.txt -u http://target/FUZZ -t 100
100 threads
ffuf -w wordlist.txt -u http://target/FUZZ -o output.json -of json
JSON output
ffuf -w wordlist.txt -u http://target/FUZZ -fs 4242
Filter by response size
ffuf -w wordlist.txt -u http://target/FUZZ -fw 100
Filter by word count
ffuf -w wordlist.txt -u http://target/FUZZ -fl 50
Filter by line count

🌐 Other Web Application Tools

SQLMap Gobuster Nikto WPScan BurpSuite OWASP ZAP
📚 Learn Kali Linux — Free Course