ffuf

Directory Enumeration

ffuf -ic -w /usr/share/wordlists/SecLists/Discovery/Web-Content/medium.txt -u http://[MACHINE_IP]

Flag	Description
-e	file extensions to scan for: .php, .js, .txt, .html
-H	Set header to pass along.
-recursion	to follow the redirect that it received as a response to the sent request.
-recursion-depth 2	Limits fuzzing to 2 levels deep
-rate 100	Requests per second
-timeout	Set timeout time for each request
-ic	Ignore comments

Parameter and Value Fuzzing

GET

Add FUZZ in the URL itself (escape & with \ if needed: \&param=FUZZ )

POST: additional headers with data

-X POST
-H "Content-Type: application/x-www-form-urlencoded"
-d "param=FUZZ"

Subdomain Enumeration

ffuf -ic -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt -H "Host: FUZZ.[domain]" -u http://[MACHINE_IP]
use ip address, sometimes the name wont work even after adding it to /etc/hosts

Filter by size of response:
ffuf -ic -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt -fs {size} -H "Host: FUZZ.[domain]" -u http://[MACHINE_IP]