ffuf-skill

Generate and execute ffuf commands for web parameter fuzzing.

1|Updated Jun 26, 2026

Search Tags:#security testing #ffuf #web fuzzing #vulnerability identification #parameter fuzzing

Ready to run

npx skills add https://github.com/xijunww/Pentest --skill ffuf-skill

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ffuf-skill
Source: https://github.com/xijunww/Pentest/tree/main/packages/core/src/config/skills/builtin/ffuf-skill
Command: npx skills add https://github.com/xijunww/Pentest --skill ffuf-skill

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill streamlines the process of creating and executing ffuf-based web parameter fuzzing commands, making it easier to identify potential vulnerabilities in web applications.

Core Features & Use Cases

Automated Command Generation: Converts web fuzzing goals into practical ffuf commands.
Focused Fuzzing: Supports fuzzing of URL paths, query parameters, headers, POST bodies, JSON fields, and raw HTTP requests.
Safety and Authorization: Ensures that assistance is provided only for authorized testing and user-owned systems.
Matcher/Filter Tuning: Offers guidance on reducing false positives and validating hits.

Quick Start

Use the ffuf-skill to generate a ffuf command for fuzzing the 'X-Forwarded-For' header value on a target website.

Frequently Asked Questions about ffuf-skill

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I generate ffuf commands for web parameter fuzzing?▼

To generate ffuf commands for web parameter fuzzing, define your target and fuzzing goals. The skill converts these inputs into practical ffuf commands to identify potential vulnerabilities in web applications.

What web fuzzing targets can I scan using ffuf?▼

Web fuzzing targets supported include URL paths, query parameters, headers, POST bodies, JSON fields, and raw HTTP requests. This allows comprehensive coverage of various application input vectors during security testing.

How do I reduce false positives during web fuzzing?▼

To reduce false positives during web fuzzing, tune your matchers and filters. The skill provides specific guidance on adjusting these settings to validate hits and minimize invalid vulnerability identification results.

Do I need authorization to perform vulnerability identification on a target?▼

Yes, authorization is required for vulnerability identification. The skill ensures assistance is provided only for authorized testing and user-owned systems to maintain safety and compliance during web fuzzing.

Can I fuzz the X-Forwarded-For header value on a target website?▼

Yes, you can fuzz the X-Forwarded-For header value on a target website. The skill generates the specific ffuf command needed to test header values and identify potential security vulnerabilities.