Alternatives to ffuf
Test variations in HTTP requests with a command-line fuzzer. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
ffuf
Test variations in HTTP requests with a command-line fuzzer.
Replacements
Listings that take over the same core job as ffuf.
Feroxbuster
Discover web content during an authorized application assessment.
Feroxbuster focuses on recursive web content discovery rather than general request fuzzing, and keeps the MIT license and cross-platform support.
Gobuster
Check candidate web paths and network names during security testing.
Gobuster offers fixed discovery modes for web paths and network names instead of arbitrary request fuzzing, under the Apache-2.0 license.
dirsearch
Web path scanner for discovering hidden directories and files.
dirsearch is a web path scanner with recursion and report formats, narrower than general HTTP fuzzing, and licensed GPL-2.0.
Burp Suite Community Edition
PortSwigger's free web security testing toolkit, for intercepting, inspecting and modifying HTTP traffic by hand.
Burp Suite Community is a closed-source graphical proxy whose Intruder fuzzing tool is rate-limited in the free edition, alongside manual interception and repeater.
Similar software
Related functionality, not a direct replacement.
SecLists
Find reusable test data for authorized security assessments.
ZAP
Inspect and test web applications with the ZAP security proxy.
Caido
Web security testing proxy for auditing web applications.
Dalfox
Check web applications for cross-site scripting issues.
sqlmap
Automates detecting and exploiting SQL injection flaws, for testing your own applications before someone else does.
Nuclei
A fast vulnerability scanner driven by YAML templates contributed by thousands of security researchers.
