Fuzzing GET Parameters with ffuf

Suppose the target is:

http://IP:PORT/get.php?x=FUZZ

Here, FUZZ is the value of the GET parameter x.

Run:

ffuf -u "http://IP:PORT/get.php?x=FUZZ" \
-w /usr/share/seclists/Discovery/Web-Content/common.txt \
-mc 200

ffuf replaces FUZZ with every word in the wordlist:

http://IP:PORT/get.php?x=admin
http://IP:PORT/get.php?x=login
http://IP:PORT/get.php?x=orange
...

If most values return "Invalid parameter value" but one returns:

Status: 200
FUZZ: orange

then orange is likely the correct parameter value. Verify it with:

curl "http://IP:PORT/get.php?x=orange"

Fuzzing POST Parameters with ffuf

For a POST parameter y, use:

ffuf -u http://IP:PORT/post.php \
-X POST \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "y=FUZZ" \
-w /usr/share/seclists/Discovery/Web-Content/common.txt \
-mc 200

Here:

• X POST → Use the POST method.
• d "y=FUZZ" → Send the payload in the request body.
• w → Wordlist containing possible values.