How to enumerate users with fuff

Assuming that our login or password reset form isn’t AJAX-y:

ffuf -w /usr/share/wordlists/wfuzz/others/names.txt \
     -X POST -d "$POST_VARS" \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -u $FORM_URL -mr "$ERROR_MEESAGE_SUBSTRING" -s

Here $POST_VARS should look something like username=FUZZ&email=FUZZ@example.com&password=1234&cpassword=1234. The -mr flag instructs ffuf to filter on page text for a “successful hit”; -s supresses all output except successful fuzzes (as defined by -mr).