Lion Cipher Lab

Read FFUF results: filter the noise and find the endpoints that matter

• Penetration Testing / Red Team
• Intermediate
• ~30 min
• Free · no account required

Why it matters

Fuzzing a web app is the easy half: one FFUF command and a wordlist do it. The half that earns the finding is triage — and FFUF's superpower over a blunt directory buster is precisely the tool it hands you for triage: filters on response size, word count and line count. A fuzz of a real app returns a screen of rows, and most apps answer EVERY request with a generic 200 page (a single-page-app shell, a soft-404 template), so status-code reading alone marks thousands of dead paths as 'found'. The learner who can calibrate a size/words filter from a known-bad baseline erases that flood in one…

What you'll learn

• reading an ffuf results row: the FUZZ value plus the Status, Size, Words, Lines and Duration columns and what each one tells you
• knowing what 200, 301, 302, 401 and 403 each mean in a content-discovery result
• the difference between MATCHING (-mc/-ms/-mw/-ml, keep) and FILTERING (-fc/-fs/-fw/-fl, drop)
• using Size / Words / Lines — not just Status — to detect and erase a wildcard / soft-404 flood
• calibrating a filter from a known-bad baseline: request a path you know is fake, read its size/words, then filter that exact value
• understanding that ffuf can fuzz an ARBITRARY position — an API path segment, a parameter, or a virtual host via the Host header — not just directory names
• prioritising the real finds by sensitivity: leaked .env / backups / source, then admin and API surface, then auth-gated areas
• judgment: confirming a 200 by hand instead of assuming it means open access
• authorized-testing discipline — you only ever read output from a target you own or are cleared to test

Steps in this lab

1. What this drill is: read the FFUF run, don't fire the fuzzer
2. The run you're triaging — read the columns first
3. What each status code is telling you
4. Match vs filter — FFUF's two ways to cut a result set
5. The core skill: calibrate a size/words filter and erase the flood
6. FFUF fuzzes any position: reading an API-path fuzz
7. The findings that matter — triage by sensitivity
8. Do it better: confirm access, don't assume it
9. Your triage verdict, and what you actually learned

Open the full interactive lab →