> For the complete documentation index, see [llms.txt](https://heinosass.gitbook.io/leet-sheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/enumeration/web-fuzzing.md).

# Web Fuzzing

## Ffuf

{% embed url="<https://allabouttesting.org/top-25-example-usage-of-ffuf-web-fuzzer/>" %}

Using ffuf to fuzz a POST payload with two wordlists at once:

```
ffuf -w ./dirs.txt:DIR -w filenames.txt:FILENAME \
     -u http://backend/api/v1/admin/file \
     -H 'Content-Type: application/json' \
     -X POST \
     -d '{"file":"/var/www/DIR/FILENAME.py"}'
```