I’ve seen ffuf and Rentgen mentioned in the same breath a few times, which kind of makes sense on the surface: both deal with HTTP, both involve changing inputs, both can produce weird responses.
But they’re not really for the same job.
ffuf is mainly a discovery tool. You use it when you want to find things: paths, subdomains or vhosts, parameters, files, endpoints, response differences that might point to something interesting. It’s great when the question is basically, “what’s here?”
Rentgen starts from a different place. You already have a working API request. You paste in the cURL, and then the tool starts checking how that endpoint behaves when the input stops being clean or expected.
Things like:
- missing fields
- wrong data types
- broken or invalid auth
- malformed JSON
- oversized values
- unsupported methods
- other not-quite-valid input
- So even though both tools touch HTTP and mutate requests in some way, the goal is different.
With ffuf, you’re exploring the surface area.
With Rentgen, you’re poking at the behavior of something you already know exists.
That’s why comparing them directly never felt quite right to me. One helps you figure out where to look. The other helps you understand how a known API handles bad input.
Same general space, different phase of the work.
Full story here: https://rentgen.io/api-stories/ffuf-and-Rentgen-web-fuzzing-and-API-hygiene-are-not-same-planet.html
