API URL fuzzer that cross-joins hosts and paths into normalized URLs, probes them over HTTP, and reports responding endpoints.

go install github.com/jsmonhq/apiffuf@latest

git clone https://github.com/jsmonhq/apiffuf.git
cd apiffuf
go build -ldflags="-s -w" -o apiffuf .

apiffuf -hosts <host|file> -paths <file> [options]

Single host and paths file:

apiffuf -hosts api.jsmon.sh -paths paths.txt

Hosts file and custom method:

apiffuf -u hosts.txt -w paths.txt -X POST

With headers, concurrency, and rate limit:

apiffuf -hosts https://api.example.com -paths paths.txt -H "Authorization: Bearer token" -t 50 -rate 10

Save results:

apiffuf -hosts api.jsmon.sh -paths paths.txt -o results.txt -oJ results.json -oC results.csv

apiffuf normalizes host/path combinations before probing:

If no protocol is supplied in the host input, https is used by default.

Default terminal output (colored when stdout is a TTY):

https://api.jsmon.sh/api/v2/users [200] [application/json] [12234] [Jsmon API]

Each line includes:

1. URL
2. Status code
3. Content-Type
4. Content-Length
5. Page title (when available)

Only URLs that receive an HTTP response are shown. Connection errors, timeouts, and DNS failures are excluded.

JSON output (-oJ) and CSV output (-oC) are also supported.

When using PUT, PATCH, or DELETE, apiffuf prints a caution warning because these methods can modify or delete data. Only use against targets you are authorized to test.

AGPLv3