0xIncaInsider
← Blog
2026-07-31 · 10 min

Using FFUF with Burp

Guide

Using FFUF with Burp Suite for Smarter Web Fuzzing

When performing web application security assessments, FFUF (Fuzz Faster U Fool) and Burp Suite complement each other extremely well. FFUF provides fast and flexible fuzzing capabilities, while Burp Suite allows you to intercept, inspect, modify, and analyze every HTTP request and response.

Instead of treating them as separate tools, combining them creates a much more efficient workflow for discovering hidden endpoints, testing authentication, and analyzing complex applications.

Why combine FFUF and Burp Suite?

FFUF excels at sending thousands of requests quickly using wordlists, making it ideal for tasks such as:

  • Directory and file discovery
  • Parameter fuzzing
  • Virtual host enumeration
  • Header fuzzing
  • Authentication testing
  • API endpoint discovery

Meanwhile, Burp Suite provides visibility into every request, allowing you to:

  • Inspect raw HTTP traffic
  • Modify requests manually
  • Replay interesting requests
  • Analyze responses
  • Send requests to Repeater or Intruder
  • Debug authentication flows

Together, they give you both speed and visibility.

Method 1: Fuzz using a request exported from Burp Suite

One of the most useful FFUF features is the ability to fuzz an existing HTTP request instead of constructing one manually.

This is especially valuable when the application contains:

  • Numerous headers
  • Authentication cookies
  • CSRF tokens
  • Custom request formats
  • Multiple POST parameters

Instead of recreating everything in FFUF, simply capture the request in Burp Suite and reuse it.

Step 1: Capture the request

Intercept the desired request in Burp Suite.

Right-click the request and choose:

Save Item

or copy the raw HTTP request into a text file.

For example:

POST /login HTTP/1.1
Host: example.com
Content-Type: application/x-www-form-urlencoded
Cookie: session=abc123

username=FUZZUSR&password=FUZZPW

Notice that the values to fuzz have been replaced with custom keywords.

Step 2: Replace values with FFUF keywords

FFUF searches for keywords inside the request.

The default keyword is:

FUZZ

However, you can create multiple independent keywords.

Example:

username=FUZZUSR
password=FUZZPW

This allows different wordlists to be assigned to each field.

Step 3: Run FFUF

Load the request using the -request option.

ffuf -request request.txt \
-w usernames.txt:FUZZUSR \
-w passwords.txt:FUZZPW \
-request-proto http

Explanation

  • -request loads the raw HTTP request.
  • -w usernames.txt:FUZZUSR assigns the username dictionary.
  • -w passwords.txt:FUZZPW assigns the password dictionary.
  • -request-proto http forces HTTP instead of HTTPS.

This approach avoids manually recreating complex requests while preserving all headers and cookies exactly as captured.

Using multiple wordlists

One of FFUF's strengths is supporting multiple fuzzing variables simultaneously.

Example request:

username=FUZZUSR
password=FUZZPW

Command:

ffuf \
-request login.txt \
-request-proto http \
-w users.txt:FUZZUSR \
-w passwords.txt:FUZZPW

Each keyword is replaced using its corresponding dictionary.

This is particularly useful for:

  • Login forms
  • API authentication
  • Token testing
  • Multi-parameter fuzzing

Method 2: Route FFUF through Burp Suite

Another powerful workflow is configuring FFUF to send every request through Burp Suite.

Instead of targeting the application directly, FFUF sends traffic to Burp's proxy listener.

Burp then forwards the request to the real target.

This gives complete visibility into every fuzzed request.

Configure the Burp proxy

Inside Burp Suite:

  1. Create a Proxy Listener.
  2. Configure the listener address and port.
  3. Enable Request Handling.
  4. Configure the destination host and destination port so Burp forwards requests to the target application.

Burp now behaves like a transparent proxy between FFUF and the target.

Configure FFUF

Instead of targeting the application directly:

ffuf \
-u http://127.0.0.1:8080/FUZZ \
-w wordlist.txt

Here:

  • 127.0.0.1:8080 is the Burp proxy listener.
  • Burp forwards each request to the destination configured in Request Handling.

Why use Burp as a proxy?

This technique offers several advantages.

Inspect every request

You can review all generated requests inside Burp Proxy History.

This is useful when troubleshooting fuzzing results.

Analyze responses

Interesting responses can be sent directly to:

  • Repeater
  • Intruder
  • Comparer
  • Decoder

for further investigation.

Modify requests

You can intercept a request generated by FFUF and alter:

  • Headers
  • Cookies
  • Tokens
  • Parameters

before forwarding it.

Debug authentication

Applications with login sessions often require:

  • Session cookies
  • JWTs
  • CSRF tokens
  • Custom headers

Burp makes it much easier to verify that these values are being transmitted correctly.

Typical workflow

A practical workflow during a penetration test might look like this:

  1. Browse the application using Burp Suite.
  2. Capture a request that represents the functionality you want to fuzz.
  3. Save the raw request to a file.
  4. Replace the values you want to fuzz with FFUF keywords.
  5. Execute FFUF using the -request option.
  6. Alternatively, send all FFUF traffic through Burp's proxy to inspect every request and response.
  7. Investigate interesting findings using Burp Repeater or other tools.

This approach combines FFUF's speed with Burp Suite's rich analysis capabilities.

Best practices

  • Export real requests from Burp instead of rebuilding them manually.
  • Use descriptive keywords such as FUZZUSER, FUZZPASS, or FUZZTOKEN when working with multiple wordlists.
  • Route traffic through Burp when debugging or analyzing unusual responses.
  • Preserve cookies, authentication headers, and CSRF tokens from captured requests whenever possible.
  • Use Burp Repeater to manually validate any interesting responses discovered during fuzzing.

Conclusion

FFUF and Burp Suite form a powerful combination for web application security testing. By exporting requests directly from Burp, you can fuzz complex authenticated requests without rebuilding them from scratch. Routing FFUF traffic through Burp further enhances visibility, enabling detailed inspection and debugging of every request.

Whether you're testing login forms, authenticated APIs, hidden endpoints, or parameter handling, integrating these two tools results in a faster, more accurate, and more efficient fuzzing workflow.