I've been using ffuf for bug bounty hunting for a while and kept running into the same problem when showing it to people — you need a terminal, you need to install Go, you need to know the flags. There's a real barrier before someone can run their first scan.
So I built a browser version. You open the page, put FUZZ in the URL, pick a wordlist, and click start. Results stream in with real status codes.
The interesting technical part was CORS. A naive browser-based fuzzer is useless because browsers block reading cross-origin responses. The fix was a serverless proxy — every request goes through a Next.js API route that makes the real HTTP call server-side and returns the full response. Status code, headers, body size, redirect location, all of it.
The tool has four modes. Directory fuzzing with 2,800+ built-in paths. Number range generation for IDOR testing without needing to upload a file. POST body fuzzing where you write a template with FUZZ as the placeholder. And brute force where you combine POST body fuzzing with an uploaded wordlist and look for the response that stands out.
Built with Next.js.
Live at ffuf.codewithneo.com.
Happy to answer questions about the proxy implementation or anything else.