How to play

Ten challenges. Bring ffuf.

This host is a fuzzing target. Nothing here is real and nothing here is fragile, so point ffuf at it and see what falls out. There are ten things to find, and between them they cover most of what the tool does: wordlists and where the keyword goes, matching against filtering, calibration, recursion, virtual hosts, parameters, raw requests, reading a wordlist off stdin, and requests that have to be built from a previous response.

Answers are meant to be shared. Everyone is solving the same range with the same solutions, so tell the person next to you what you worked out, and ask them when you are stuck.

The challenges

#	Challenge	Goal	Flags in play
C1	Content discovery	Find the paths that exist but are not linked from anywhere.	-w, -mc, -fw, -ac
C2	The interesting non-200	Two planted paths do not answer 200. One of them a default run will not even consider.	-mc all, -fc
C3	Recursion	The wordlist holds names, not paths, so C1 found you 13 things and none of them nested. Descending finds more.	-recursion, -recursion-depth
C4	Virtual hosts	Three hostnames under ffuf.io.fi serve different content from this same address. Find all three.	-H "Host: FUZZ.ffuf.io.fi", -fw
C5	API versions	There is more than one version of the API, and only one of them is alive.	-w, -mc all
C6	Parameter discovery	One endpoint returns more data when you pass the right query parameter. Find the parameter.	-u '.../FUZZ=1', -fw
C7	The credential chain	One of the files you found in C1 contains a key. Something else on this host wants that key.	-H, -mc
C8	Complex requests	Fuzz the body of a POST that needs a header and a JSON payload. Four queries return documents, the rest return nothing.	-request, -request-proto, -fr
C9	The login you cannot replay	Get into the admin account. A plain password fuzz returns 403 forever, however long you run it.	-preflight, -preflight-var, -preflight-mode
C10	Numeric enumeration	Document ids under /enumerate/ are sequential. Six are readable, three exist but are not, and four thousand are nothing. Find all nine.	-w -, -fs, -ac -acc, -mc 403

Hints

C1 Unknown paths answer 200, not 404, so a default run matches every word you send. The response size moves on every request. The word count does not.
C2 ffuf matches 200,204,301,302,307,401,403,405,500 by default. Anything outside that list is invisible and nothing tells you it was skipped. Match everything, then filter down.
C3 Directories redirect to their trailing-slash form, which is the signal ffuf's default strategy keys off. Recursion reuses the same wordlist, so it can only descend into a name the list contains.
C4 The keyword does not have to go in the URL. Point -u at the bare domain and put FUZZ in a Host header. Do not point -u at the subdomain: the certificate only covers the bare name, so the handshake is refused and you get no HTTP at all. Everything that is not one of the three falls through to the default site, so you need a filter.
C5 The dead one tells you where to go if you bother to read it.
C6 Put the keyword in the query string and separate on response size.
C7 Read what you find. The planted files are not decoration.
C8 Stop building the request on the command line. Save it to a file and let ffuf read it.
C9 Every form carries a CSRF token that works exactly once. Fetch a fresh one before each attempt instead of replaying a stale one.
C10 The wordlist is not a file: pipe seq into ffuf with -w -. Misses answer 200, so status will not separate them. Note that -ac alone fails here, because its probes are not numeric and land on a different error, and a numeric probe still has to have the same digit count as the real ids.

Getting started

curl -O https://ffuf.io.fi/wordlists/content.txt
curl -O https://ffuf.io.fi/wordlists/passwords.txt

ffuf -w content.txt -u https://ffuf.io.fi/FUZZ

C9, spelled out

Every other challenge is one flag and a filter. This one needs four flags working together, so here is the shape of it rather than leaving you to assemble it from the hint. The password is one of the 2000 entries in passwords.txt, the username is admin, and a successful sign-in answers 302 with the flag in the X-Flag response header.

The form carries a CSRF token that is valid for exactly one request, so replaying a stale one returns 403 forever. Fetch a fresh one before every attempt.

cat > login.raw <<'EOF'
GET /login HTTP/1.1
Host: ffuf.io.fi
Accept: text/html

EOF

ffuf -w passwords.txt -u https://ffuf.io.fi/login -X POST \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "csrf_token=CSRFTOKEN&username=admin&password=FUZZ" \
  -preflight login.raw \
  -preflight-var 'CSRFTOKEN:name="csrf_token" value="([a-f0-9]+)"' \
  -preflight-mode per-request \
  -mc 302

Note per-request: the token is single use, so per-thread would reuse a spent one and put the 403s straight back.

Requirements

-preflight shipped in ffuf v2.3.0. Older builds do not have the flag at all: ffuf -h | grep -c preflight should not print 0.