skills.rest
AeonDave
AeonDaveCOMMUNITY
Explore all skills by this author →
GitHub

ffuf

Fuzz HTTP endpoints with wordlists to discover directories, parameters, and virtual hosts.

15|1|Updated Feb 12, 2026
Search Tags:#ffuf#discovery#web#enumeration#fuzzing#recon
One-click install
npx skills add https://github.com/AeonDave/malskill --skill ffuf
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ffuf
Source: https://github.com/AeonDave/malskill/tree/main/offensive-tools/recon/ffuf
Command: npx skills add https://github.com/AeonDave/malskill --skill ffuf

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill automates the process of discovering hidden directories, files, parameters, and virtual hosts on web servers by systematically testing various inputs.

Core Features & Use Cases

  • Directory and File Discovery: Fuzz for common or custom file and directory names.
  • Parameter Fuzzing: Identify hidden or unlinked GET/POST parameters.
  • Virtual Host Enumeration: Discover subdomains by fuzzing the Host header.
  • Use Case: When asked to find hidden administration panels or sensitive files on a target website, use this Skill to fuzz common paths and filenames.

Quick Start

Use the ffuf skill to fuzz for directories on http://example.com using the common.txt wordlist.

Frequently Asked Questions about ffuf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I discover hidden directories and files on a web server?▼

Web endpoint discovery systematically fuzzes a target server with a wordlist to identify hidden directories and files. This approach automates testing various path inputs to map the application's attack surface rapidly.

What is HTTP fuzzing for web enumeration?▼

HTTP fuzzing for web enumeration is an automated testing technique that sends rapid, wordlist-based HTTP requests to discover unlinked content. It targets directories, files, and parameters to expose sensitive endpoints like admin panels.

How do I fuzz GET and POST parameters to find hidden inputs?▼

To fuzz GET and POST parameters, you test web endpoints by systematically substituting parameter names with wordlist entries. This automated process identifies hidden or unlinked parameters that the web application processes.

Can I use web fuzzing for virtual host discovery and subdomain enumeration?▼

Yes, web fuzzing supports virtual host discovery by manipulating the Host header in HTTP requests. By systematically testing wordlist entries against the target IP, you can discover subdomains and virtual hosts.

What is the best way to automate web application attack surface testing?▼

Automated web application attack surface testing is best handled by rapid, wordlist-based HTTP fuzzing. This method systematically tests inputs across directories, files, and parameters to identify vulnerabilities efficiently.

Related Skills

Explore More Software Engineering Skills→
MicrockMicrock
322

ffuf-web-fuzzing

Automate web content discovery by fuzzing targets with ffuf to reveal hidden resources.

Community
Advanced
ricardoo022ricardoo022

scan-fase-1

Identify configurations, secrets, and attack-surface exposure from JS-bundled web applications.

Community
Advanced
YukiIto1999YukiIto1999

reconnaissance

Automates domain reconnaissance to inventory subdomains, ports, endpoints, and APIs.

Community
Intermediate
seb1nseb1n
147

dynamic-application-security-testing

Probe live web applications and APIs for vulnerabilities using OWASP ZAP and Nuclei.

Community
Advanced