skills.rest
AgentSecOps
AgentSecOpsOFFICIAL
Explore all skills by this author →
GitHub

dast-ffuf

Fuzz web applications to uncover hidden directories and endpoints with ffuf.

183|35|Updated Nov 19, 2025
Search Tags:#ffuf#reconnaissance#web-fuzzing#dast#subdomain#virtual-host#directory-enumeration
One-click install
npx skills add https://github.com/AgentSecOps/SecOpsAgentKit --skill dast-ffuf
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dast-ffuf
Source: https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/appsec/dast-ffuf
Command: npx skills add https://github.com/AgentSecOps/SecOpsAgentKit --skill dast-ffuf

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) and assets (resource) components.

What problem does it solve?

Fuzzes web applications to uncover hidden directories, endpoints, and misconfigurations.

Core Features & Use Cases

  • Directory and File Discovery: Enumerate directories and files to map the application surface.
  • Parameter Fuzzing: Test GET/POST parameters for input validation and injection vulnerabilities.
  • Virtual Host/Subdomain Discovery: Identify additional hosts and service exposure across environments.
  • Authentication Endpoint Testing: Assess login forms and token handling for weaknesses.
  • Recursive Scanning: Traverse discovered resources for deeper coverage.

Quick Start

Run a basic fuzzing pass against your target using a wordlist to discover directories and endpoints.

Frequently Asked Questions about dast-ffuf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I discover hidden directories and endpoints during web reconnaissance?▼

Web fuzzing uncovers hidden directories and endpoints by systematically probing a target application with wordlists, mapping the application surface to expose misconfigurations and unlinked resources for security testing.

What is the best way to fuzz GET and POST parameters for input validation issues?▼

Parameter fuzzing tests GET and POST parameters by injecting various payloads to identify input validation flaws and potential injection vulnerabilities, using multiple fuzzing modes like clusterbomb and pitchfork to automate payload combinations.

Can I use ffuf for virtual host and subdomain discovery?▼

Yes, ffuf supports virtual host and subdomain discovery by fuzzing the Host header against target IP addresses, identifying additional hosts and service exposure across diverse web environments during reconnaissance.

Does web fuzzing support recursive scanning to find deeper resources?▼

Recursive scanning traverses newly discovered directories to perform deeper fuzzing passes automatically, increasing coverage by continuously probing found resources for nested directories and hidden endpoints.

Do I need ffuf installed to run directory enumeration and authentication endpoint testing?▼

Yes, you need ffuf installed as the underlying tool to execute directory enumeration and authentication endpoint testing, as the workflow requires it to assess login forms and token handling for weaknesses.

Related Skills

Explore More Software Engineering Skills→
xijunwwxijunww
1

ffuf-skill

Generate and execute ffuf commands for web parameter fuzzing.

Community
Intermediate
realsigridjinrealsigridjin
20

security-review

Identify and prioritize security vulnerabilities with OWASP Top 10 analysis.

Community
Advanced
riparinoriparino
1

offensive-bug-identification

Identify and classify software vulnerabilities across source, binary, and runtime contexts.

Community
Advanced
giljaegiljae
1

gstack-canary

Monitor live web apps for console errors, performance, and visual regressions post-deploy.

Community
Intermediate