# How to Use SecLists with ffuf for Web Fuzzing and Enumeration

> Learn to use SecLists with ffuf for powerful web fuzzing and enumeration. Discover directories, files, and parameters automatically by pointing ffuf to curated SecLists wordlists.

- Repository: [Daniel Miessler 🛡️/SecLists](https://github.com/danielmiessler/SecLists)
- Tags: how-to-guide
- Published: 2026-03-03

---

**Point ffuf to SecLists wordlists using the `-w` flag and replace the `FUZZ` placeholder in your target URL with entries from curated lists like [`Discovery/Web-Content/Directory-Listing/dirbuster-medium.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/Web-Content/Directory-Listing/dirbuster-medium.txt) to perform automated directory brute-forcing, file discovery, and parameter fuzzing.**

 ffuf (Fuzz Faster U Fool) is a high-performance HTTP fuzzing tool that drives attacks by reading plain-text wordlists line-by-line and substituting the `FUZZ` keyword with each entry. When integrated with the danielmiessler/SecLists repository—a continuously updated collection of over 10 GB of security testing payloads—the tool becomes a comprehensive web enumeration platform. This guide explains exactly how to use SecLists with ffuf to identify hidden directories, sensitive files, and injection points without crafting custom wordlists from scratch.

 ## Understanding the ffuf and SecLists Integration

 The danielmiessler/SecLists repository organizes wordlists into thematic folders that align with common ffuf use cases. The tool consumes these newline-delimited text files natively, requiring no conversion or preprocessing.

 Key architectural points:

 - **Wordlist Structure**: SecLists stores payloads in directories like `Fuzzing/`, `Discovery/`, and `Passwords/`, with each list containing newline-separated entries that ffuf processes sequentially.
 - **Placeholder Substitution**: ffuf replaces the `FUZZ` keyword in your target URL with each line from the supplied SecLists file, enabling automated payload insertion.
 - **Extension Mutations**: Use the `-e` flag to append file extensions (sourced from [`Fuzzing/File-Extensions/file-extensions.txt`](https://github.com/danielmiessler/SecLists/blob/main/Fuzzing/File-Extensions/file-extensions.txt)) to every wordlist entry for comprehensive file discovery.

 ## Essential SecLists Paths for ffuf Workflows

 Different testing scenarios require specific SecLists directories. Reference these paths directly in your ffuf commands.

 ### Directory and File Discovery

 For brute-forcing web directories and files, use the `Discovery/Web-Content/` directory. The [`Discovery/Web-Content/Directory-Listing/dirbuster-medium.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/Web-Content/Directory-Listing/dirbuster-medium.txt) file contains common directory names like `/admin` and `/phpmyadmin` optimized for web servers. Consult [`Discovery/Web-Content/README.md`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/Web-Content/README.md) for detailed descriptions of each list's intended use case.

 ### File Extension Enumeration

 When hunting for backup files or hidden extensions, reference [`Fuzzing/File-Extensions/file-extensions.txt`](https://github.com/danielmiessler/SecLists/blob/main/Fuzzing/File-Extensions/file-extensions.txt). This exhaustive list pairs with ffuf's `-e` flag to test combinations like [`config.php`](https://github.com/danielmiessler/SecLists/blob/main/config.php), `config.bak`, and `config.old`.

 ### Subdomain Enumeration

 For DNS fuzzing, use [`Discovery/DNS/FUZZSUBS_CYFARE_2.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/DNS/FUZZSUBS_CYFARE_2.txt). Target the URL pattern `https://FUZZ.example.com` to identify valid subdomains rapidly.

 ### Parameter and Template Fuzzing

 The [`Fuzzing/template-engines-special-vars.txt`](https://github.com/danielmiessler/SecLists/blob/main/Fuzzing/template-engines-special-vars.txt) list contains Server-Side Template Injection (SSTI) payloads ideal for parameter value testing. The [`Fuzzing/1-4_all_letters_a-z.txt`](https://github.com/danielmiessler/SecLists/blob/main/Fuzzing/1-4_all_letters_a-z.txt) file provides alphabetic permutations useful for generic fuzzing tasks.

 ## Practical ffuf Commands Using SecLists

 Below are production-ready commands demonstrating how to use SecLists with ffuf. Replace `http://example.com` with your target.

 ### Basic Directory Brute-Force

 Use this command to discover hidden directories using the medium-sized directory list:

 ```bash
 ffuf -u http://example.com/FUZZ \
      -w /path/to/SecLists/Discovery/Web-Content/Directory-Listing/dirbuster-medium.txt \
      -t 100 -mc 200,204,301,302,403,404
 ```

 The `-t 100` flag launches 100 concurrent workers for high-speed scanning, while `-mc` filters responses by HTTP status codes.

 ### Subdomain Enumeration

 Discover subdomains by fuzzing the DNS namespace with the specialized CYFARE list:

 ```bash
 ffuf -u https://FUZZ.example.com \
      -w /path/to/SecLists/Discovery/DNS/FUZZSUBS_CYFARE_2.txt \
      -t 200 -mc 200,301,302
 ```

 ### File Discovery with Extension Mutations

 This approach combines a wordlist with multiple file extensions to locate hidden configuration files:

 ```bash
 ffuf -u http://example.com/FUZZ \
      -w /path/to/SecLists/Fuzzing/1-4_all_letters_a-z.txt \
      -e php,txt,bak,old \
      -t 150 -recursion -recursion-depth 2
 ```

 The `-e` flag appends each extension to every wordlist entry, and `-recursion` enables directory traversal up to two levels deep.

 ### Parameter Value Testing for SSTI

 Test for template injection vulnerabilities using specialized payloads:

 ```bash
 ffuf -u "http://example.com/page?template=FUZZ" \
      -w /path/to/SecLists/Fuzzing/template-engines-special-vars.txt \
      -t 150 -mr "root:"
 ```

 The `-mr` (match-regex) flag surfaces responses containing specific strings like "root:", indicating successful template execution.

 ### Combining Multiple Wordlists

 Merge multiple SecLists files for comprehensive coverage:

 ```bash
 cat /path/to/SecLists/Discovery/Web-Content/Directory-Listing/dirbuster-medium.txt \
     /path/to/SecLists/Fuzzing/Wordlists/common.txt > /tmp/combined.lst

 ffuf -u http://example.com/FUZZ \
      -w /tmp/combined.lst \
      -e php,asp,aspx,txt \
      -t 250 -fc 404
 ```

 The `-fc 404` flag filters out 404 responses, displaying only valid hits.

 ### Using Mutation Scripts from SecLists

 Leverage the repository's helper scripts to generate specialized wordlists. The [`.bin/os-names-mutate.py`](https://github.com/danielmiessler/SecLists/blob/main/.bin/os-names-mutate.py) script creates case variations of operating system names:

 ```bash
 python3 /path/to/SecLists/.bin/os-names-mutate.py
 ffuf -u http://example.com/FUZZ \
      -w /path/to/SecLists/Fuzzing/os-names-mutated.txt \
      -t 120 -mc 200,301,302
 ```

 This generates variations like `Linux`, `LINUX`, and `linux` for OS-specific path discovery. The [`Fuzzing/README.md`](https://github.com/danielmiessler/SecLists/blob/main/Fuzzing/README.md) file documents additional helper scripts available in the `.bin/` directory.

 ## Summary

 - **Point ffuf to SecLists** using the `-w` flag followed by the absolute path to any wordlist in the repository.
 - **Use the FUZZ placeholder** in your target URL to mark where ffuf should insert wordlist entries.
 - **Reference thematic directories**: `Discovery/Web-Content/` for directories, `Fuzzing/File-Extensions/` for suffixes, and `Discovery/DNS/` for subdomains.
 - **Apply extension mutations** with the `-e` flag and combine multiple lists using standard Unix tools like `cat` for comprehensive coverage.
 - **Leverage helper scripts** in `.bin/` (such as [`os-names-mutate.py`](https://github.com/danielmiessler/SecLists/blob/main/os-names-mutate.py)) to generate specialized payload variations.

 ## Frequently Asked Questions

 ### Can I use multiple wordlists simultaneously in a single ffuf command?

 Yes, ffuf supports multiple wordlists using multiple `-w` flags with named keywords. For example: `-w /path/to/dirs.txt:DIR -w /path/to/extensions.txt:EXT` and use `http://example.com/DIR.EXT` in your URL. This tests every directory against every extension combination.

 ### How do I choose the right SecLists wordlist for my ffuf scan?

 Consult the [`README.md`](https://github.com/danielmiessler/SecLists/blob/main/README.md) files in each SecLists directory. The [`Fuzzing/README.md`](https://github.com/danielmiessler/SecLists/blob/main/Fuzzing/README.md) and [`Discovery/Web-Content/README.md`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/Web-Content/README.md) documents describe the source and intended use case for each list. For general directory brute-forcing, start with [`dirbuster-medium.txt`](https://github.com/danielmiessler/SecLists/blob/main/dirbuster-medium.txt); for comprehensive DNS enumeration, use lists in `Discovery/DNS/`.

 ### Does ffuf require any special formatting for SecLists wordlists?

 No, ffuf reads SecLists wordlists natively. All SecLists files are plain-text, newline-delimited UTF-8 files, which ffuf processes sequentially without preprocessing. Ensure you download the raw text files rather than HTML versions from GitHub.

 ### How can I speed up ffuf when using large SecLists wordlists?

 Increase the thread count using the `-t` flag (default is 40). For million-line lists like those in `Discovery/DNS/`, use `-t 200` or higher depending on your system resources and the target's rate limits. Consider using `-fc` to filter common status codes early, reducing output noise.