How to Use SecLists with ffuf for Web Fuzzing and Enumeration

Point ffuf to SecLists wordlists using the -w flag and replace the FUZZ placeholder in your target URL with entries from curated lists like Discovery/Web-Content/Directory-Listing/dirbuster-medium.txt to perform automated directory brute-forcing, file discovery, and parameter fuzzing.

ffuf (Fuzz Faster U Fool) is a high-performance HTTP fuzzing tool that drives attacks by reading plain-text wordlists line-by-line and substituting the FUZZ keyword with each entry. When integrated with the danielmiessler/SecLists repository—a continuously updated collection of over 10 GB of security testing payloads—the tool becomes a comprehensive web enumeration platform. This guide explains exactly how to use SecLists with ffuf to identify hidden directories, sensitive files, and injection points without crafting custom wordlists from scratch.

Understanding the ffuf and SecLists Integration

The danielmiessler/SecLists repository organizes wordlists into thematic folders that align with common ffuf use cases. The tool consumes these newline-delimited text files natively, requiring no conversion or preprocessing.

Key architectural points:

• Wordlist Structure: SecLists stores payloads in directories like Fuzzing/, Discovery/, and Passwords/, with each list containing newline-separated entries that ffuf processes sequentially.
• Placeholder Substitution: ffuf replaces the FUZZ keyword in your target URL with each line from the supplied SecLists file, enabling automated payload insertion.
• Extension Mutations: Use the -e flag to append file extensions (sourced from Fuzzing/File-Extensions/file-extensions.txt) to every wordlist entry for comprehensive file discovery.

Essential SecLists Paths for ffuf Workflows

Different testing scenarios require specific SecLists directories. Reference these paths directly in your ffuf commands.

Directory and File Discovery

For brute-forcing web directories and files, use the Discovery/Web-Content/ directory. The Discovery/Web-Content/Directory-Listing/dirbuster-medium.txt file contains common directory names like /admin and /phpmyadmin optimized for web servers. Consult Discovery/Web-Content/README.md for detailed descriptions of each list's intended use case.

File Extension Enumeration

When hunting for backup files or hidden extensions, reference Fuzzing/File-Extensions/file-extensions.txt. This exhaustive list pairs with ffuf's -e flag to test combinations like config.php, config.bak, and config.old.

Subdomain Enumeration

For DNS fuzzing, use Discovery/DNS/FUZZSUBS_CYFARE_2.txt. Target the URL pattern https://FUZZ.example.com to identify valid subdomains rapidly.

Parameter and Template Fuzzing

The Fuzzing/template-engines-special-vars.txt list contains Server-Side Template Injection (SSTI) payloads ideal for parameter value testing. The Fuzzing/1-4_all_letters_a-z.txt file provides alphabetic permutations useful for generic fuzzing tasks.

Practical ffuf Commands Using SecLists

Below are production-ready commands demonstrating how to use SecLists with ffuf. Replace http://example.com with your target.

Basic Directory Brute-Force

Use this command to discover hidden directories using the medium-sized directory list:

ffuf -u http://example.com/FUZZ \
     -w /path/to/SecLists/Discovery/Web-Content/Directory-Listing/dirbuster-medium.txt \
     -t 100 -mc 200,204,301,302,403,404

The -t 100 flag launches 100 concurrent workers for high-speed scanning, while -mc filters responses by HTTP status codes.

Subdomain Enumeration

Discover subdomains by fuzzing the DNS namespace with the specialized CYFARE list:

ffuf -u https://FUZZ.example.com \
     -w /path/to/SecLists/Discovery/DNS/FUZZSUBS_CYFARE_2.txt \
     -t 200 -mc 200,301,302

File Discovery with Extension Mutations

This approach combines a wordlist with multiple file extensions to locate hidden configuration files:

ffuf -u http://example.com/FUZZ \
     -w /path/to/SecLists/Fuzzing/1-4_all_letters_a-z.txt \
     -e php,txt,bak,old \
     -t 150 -recursion -recursion-depth 2

The -e flag appends each extension to every wordlist entry, and -recursion enables directory traversal up to two levels deep.

Parameter Value Testing for SSTI

Test for template injection vulnerabilities using specialized payloads:

ffuf -u "http://example.com/page?template=FUZZ" \
     -w /path/to/SecLists/Fuzzing/template-engines-special-vars.txt \
     -t 150 -mr "root:"

The -mr (match-regex) flag surfaces responses containing specific strings like "root:", indicating successful template execution.

Combining Multiple Wordlists

Merge multiple SecLists files for comprehensive coverage:

cat /path/to/SecLists/Discovery/Web-Content/Directory-Listing/dirbuster-medium.txt \
    /path/to/SecLists/Fuzzing/Wordlists/common.txt > /tmp/combined.lst

ffuf -u http://example.com/FUZZ \
     -w /tmp/combined.lst \
     -e php,asp,aspx,txt \
     -t 250 -fc 404

The -fc 404 flag filters out 404 responses, displaying only valid hits.

Using Mutation Scripts from SecLists

Leverage the repository's helper scripts to generate specialized wordlists. The .bin/os-names-mutate.py script creates case variations of operating system names:

python3 /path/to/SecLists/.bin/os-names-mutate.py
ffuf -u http://example.com/FUZZ \
     -w /path/to/SecLists/Fuzzing/os-names-mutated.txt \
     -t 120 -mc 200,301,302

This generates variations like Linux, LINUX, and linux for OS-specific path discovery. The Fuzzing/README.md file documents additional helper scripts available in the .bin/ directory.

Summary

• Point ffuf to SecLists using the -w flag followed by the absolute path to any wordlist in the repository.
• Use the FUZZ placeholder in your target URL to mark where ffuf should insert wordlist entries.
• Reference thematic directories: Discovery/Web-Content/ for directories, Fuzzing/File-Extensions/ for suffixes, and Discovery/DNS/ for subdomains.
• Apply extension mutations with the -e flag and combine multiple lists using standard Unix tools like cat for comprehensive coverage.
• Leverage helper scripts in .bin/ (such as os-names-mutate.py) to generate specialized payload variations.

Frequently Asked Questions

Can I use multiple wordlists simultaneously in a single ffuf command?

Yes, ffuf supports multiple wordlists using multiple -w flags with named keywords. For example: -w /path/to/dirs.txt:DIR -w /path/to/extensions.txt:EXT and use http://example.com/DIR.EXT in your URL. This tests every directory against every extension combination.

How do I choose the right SecLists wordlist for my ffuf scan?

Consult the README.md files in each SecLists directory. The Fuzzing/README.md and Discovery/Web-Content/README.md documents describe the source and intended use case for each list. For general directory brute-forcing, start with dirbuster-medium.txt; for comprehensive DNS enumeration, use lists in Discovery/DNS/.

Does ffuf require any special formatting for SecLists wordlists?

No, ffuf reads SecLists wordlists natively. All SecLists files are plain-text, newline-delimited UTF-8 files, which ffuf processes sequentially without preprocessing. Ensure you download the raw text files rather than HTML versions from GitHub.

How can I speed up ffuf when using large SecLists wordlists?

Increase the thread count using the -t flag (default is 40). For million-line lists like those in Discovery/DNS/, use -t 200 or higher depending on your system resources and the target's rate limits. Consider using -fc to filter common status codes early, reducing output noise.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}