Interactive ffuf Menu

A Python command-line menu for common ffuf web-enumeration workflows. It helps build the correct ffuf command for directory and file discovery, virtual-host enumeration, and GET parameter fuzzing without requiring every flag to be memorized.

The generated command is shown before ffuf starts, making the project useful both as a practical wrapper and as a way to learn ffuf syntax.

Use scanning tools only on systems you own or have explicit permission to test. Enumeration can create significant traffic and security alerts.

Features

• Directory and endpoint enumeration
• File discovery with selectable extensions
• Virtual-host discovery through the HTTP Host header
• GET parameter-name discovery
• GET parameter-value fuzzing
• Automatic ffuf response calibration
• Redirect following and recursive content discovery
• Status-code and response-size matching/filtering
• Configurable threads, rate limit, and timeout
• JSON, HTML, Markdown, CSV, eCSV, and other ffuf report formats
• Input validation and readable errors
• Safe process execution without shell command interpolation

Requirements

• Python 3.9 or newer
• ffuf installed and available through PATH
• A suitable wordlist for the selected enumeration mode

The Python program uses only the standard library, so there is no pip install step.

Verify both programs:

python --version
ffuf -V

Installation

Clone the repository and enter it:

git clone https://github.com/AryanSecOps/ffuf-menu.git
cd ffuf-menu

Run the program:

python FFUF_Enum.py

On systems where Python is exposed as python3:

python3 FFUF_Enum.py

How the program flows

Choose enumeration type
        ↓
Enter target URL
        ↓
Choose a wordlist
        ↓
Answer the mode-specific prompt
        ↓
Select optional ffuf settings
        ↓
Optionally configure a report
        ↓
Review the displayed command while ffuf runs

Understanding FUZZ

FUZZ is ffuf's replacement keyword. Each word from the selected wordlist is inserted wherever FUZZ appears.

Given this wordlist:

admin
login
uploads

The URL:

https://example.test/FUZZ

causes ffuf to request:

https://example.test/admin
https://example.test/login
https://example.test/uploads

The Python program places FUZZ automatically according to the chosen mode.

Enumeration modes

1. Directory / endpoint enumeration

Discovers paths such as /admin, /api, /login, or /uploads.

Example input:

Select scan type: 1
Target URL: http://127.0.0.1:8000
Wordlist path: C:\Wordlists\common.txt

Resulting command structure:

ffuf -w C:\Wordlists\common.txt -u http://127.0.0.1:8000/FUZZ

Entering a path such as https://example.test/api scans https://example.test/api/FUZZ.

2. File enumeration

Adds selected extensions to wordlist entries. The default extensions are:

php,html,txt,js

If the wordlist contains config, ffuf can test /config, /config.php, /config.html, and the other selected extensions.

Example custom extensions:

File extensions [php,html,txt,js]: asp,aspx,config,bak

Choose extensions that make sense for the target technology. A shorter, relevant list is usually faster and easier to interpret.

3. Virtual-host enumeration

Discovers websites that share an IP address but respond to different HTTP Host headers.

Example:

Select scan type: 3
Target URL: http://10.10.10.10
Wordlist path: C:\Wordlists\subdomains.txt
Domain [10.10.10.10]: example.test

The important generated argument is:

-H "Host: FUZZ.example.test"

If the wordlist contains admin, ffuf sends a request with Host: admin.example.test.

Use a hostname or subdomain wordlist for this mode rather than a directory wordlist.

4. GET parameter-name enumeration

Discovers parameter names understood by a page.

For the target:

https://example.test/search

the program builds:

https://example.test/search?FUZZ=test

A parameter-name wordlist containing q, search, debug, and page makes ffuf test each as the parameter name. The fixed value defaults to test.

5. GET parameter-value enumeration

Keeps a known parameter name fixed while testing different values.

Example:

Select scan type: 5
Target URL: https://example.test/product
Wordlist path: C:\Wordlists\values.txt
Parameter name: id

The program builds:

https://example.test/product?id=FUZZ

This mode requires a value-oriented wordlist appropriate for the parameter being tested.

Choosing a wordlist

A wordlist is a plain text file containing one candidate per line:

admin
login
dashboard
uploads
api

Different modes benefit from different content:

Mode	Example wordlist entries
Directory	admin, login, api, uploads
File	config, backup, database, index
Virtual host	admin, dev, staging, portal
Parameter name	id, q, search, debug
Parameter value	Values relevant to the known parameter

The program verifies that the wordlist path exists before starting ffuf. Paths surrounded by double quotes are accepted, which is useful on Windows when folders contain spaces.

Optional settings

Enter one option number or several numbers separated by commas:

Options: 1,6,8,9

Press Enter to use ffuf defaults.

1. Auto-calibration (-ac)

Helps ffuf identify background responses automatically. This is useful when a server returns a successful-looking page for paths that do not exist.

2. Follow redirects (-r)

Follows responses such as /admin → /login instead of only reporting the redirect.

3. Recursive scan (-recursion)

Scans inside discovered directories. It is available only for directory and file modes.

ffuf requires a recursive URL to end in FUZZ. The program therefore rejects recursion when the target contains a trailing query string or fragment.

4. Silent output (-s)

Hides much of ffuf's banner and progress information. Normal output is usually more useful while learning.

5. Match status codes (-mc)

Displays only selected HTTP statuses. Accepted examples include:

200
200,301,403
200-299,301,403
all

6. Filter status codes (-fc)

Hides selected status codes or ranges:

404
400-499

Avoid filtering broad ranges without considering whether useful 401 or 403 responses may be hidden.

7. Filter response size (-fs)

Hides responses with known uninteresting sizes. If every nonexistent path returns the same 1,234-byte page, filtering 1234 can expose meaningful differences.

Accepted examples:

1234
0,1234
100-500,1234

8. Thread count (-t)

Controls concurrent workers. ffuf defaults to 40. More threads are not always better: they increase traffic and can create unreliable results on slow targets.

9. Rate limit (-rate)

Sets the maximum requests per second. A value such as 50 makes traffic more predictable.

10. Request timeout (-timeout)

Sets how long ffuf waits for each response. The program defaults to ten seconds.

Saving reports

After the optional-settings menu, the program can add ffuf's output arguments:

Save results to a report file? (y/N) [n]: y
Output file path [ffuf_results.json]:
Output format [json]: json

Supported formats are:

• json
• ejson
• html
• md
• csv
• ecsv
• all

Selecting all asks ffuf to create every supported report format.

Recommended first scan

For a controlled local lab or other permitted target:

Select scan type: 1
Target URL: http://127.0.0.1:8000
Wordlist path: C:\Wordlists\common.txt
Options: 1,6,8,9
Status codes to hide [404]:
Thread count [40]: 20
Requests per second [100]: 50
Save results to a report file? (y/N) [n]: y
Output file path [ffuf_results.json]:
Output format [json]:

This enables auto-calibration, hides ordinary 404 responses, uses 20 workers, limits the scan to 50 requests per second, and saves JSON results.

Reading ffuf output

A result can look like:

admin    [Status: 301, Size: 178, Words: 6, Lines: 8]

• admin is the word inserted at FUZZ.
• Status is the HTTP response status.
• Size is the response size in bytes.
• Words and Lines describe the response body.

Interesting results often differ from the background responses in status, size, word count, or line count.

How the Python code is organized

The source is divided into small sections so each part has one responsibility:

• ScanType and SCAN_TYPES define the main menu.
• Option and OPTIONS define optional flags and validation.
• format_url() normalizes the target URL.
• add_fuzz_keyword() places FUZZ in the URL path.
• add_query_param() adds fuzzing parameters without damaging fragments.
• build_*_scan() functions construct mode-specific arguments.
• prompt_optional_arguments() converts settings into ffuf flags.
• prompt_output_options() configures reports.
• run_ffuf() displays and launches the command.
• main() coordinates the complete workflow.

The Python program does not implement an HTTP scanner itself. It builds a list of arguments and passes that list directly to the installed ffuf executable.

Troubleshooting

ffuf was not found on PATH

Verify:

ffuf -V

If the command works only in a different terminal, close and reopen PowerShell so it receives the updated PATH.

Wordlist not found

Check the complete path. Surrounding quotes are allowed:

"C:\Users\YourName\Wordlists\common.txt"

Too many identical results

Try auto-calibration (1) or filter the repeated response's status/size using options 6 or 7.

Recursion is rejected

Remove query strings and fragments from the directory/file target. Recursive ffuf URLs must end in FUZZ.

ffuf exits with a nonzero code

Read the ffuf message printed immediately above the exit-code notice. Common causes include an invalid target, unavailable network connection, incompatible flags, or an unwritable report location.

Project files

.
├── FFUF_Enum.py  # Menu application
├── README.md     # Installation, usage, and code explanation
└── .gitignore    # Local Python/editor files excluded from Git