Ffuf Web Fuzzing

This is a comprehensive reference for ffuf, the Go-based web fuzzer that's faster than dirb or dirbuster. It covers the essentials like directory discovery and subdomain enumeration, but the real value is in the authenticated fuzzing section using raw HTTP requests. You capture a full request from Burp or DevTools, drop in the FUZZ keyword, and test authenticated endpoints with all their tokens and cookies intact. The guide hammers home one critical point: always use auto-calibration (-ac) to filter false positives, especially before having Claude analyze results. Without it, you'll wade through thousands of identical 404s instead of finding the interesting anomalies. Good for penetration testing where you need both speed and precision.