Recursive fuzzing is the process of automatically fuzzing every new directory discovered during a scan. Instead of stopping after finding a directory, the fuzzer continues scanning inside it, allowing it to uncover deeply nested directories and files.

How it works:

1. Start fuzzing the target directory (e.g., /FUZZ).
2. When a valid directory is found (e.g., /admin), ffuf automatically starts fuzzing inside it (/admin/FUZZ).
3. This process repeats until no more directories are found or the maximum recursion depth is reached.

Advantages:

• Saves time by automating nested directory discovery.
• Thoroughly explores the application's directory structure.
• Reduces manual effort.
• Ideal for large and complex web applications.

Key ffuf options:

• recursion – Enables recursive fuzzing.
• recursion-depth – Limits how deep ffuf will recurse.
• rate – Controls the number of requests per second.
• timeout – Sets the maximum wait time for each request.
• ic – Ignores commented lines in the wordlist.

Example:

ffuf -w wordlist.txt -u http://IP:PORT/FUZZ -e .html -recursion

Key takeaway: Recursive fuzzing allows ffuf to automatically explore every discovered directory, making it much faster and more effective at finding hidden resources than manually fuzzing each directory.