What problem does it solve? Penetration testers need to discover hidden directories, files, subdomains, and API endpoints quickly, but raw ffuf output is noisy and authenticated fuzzing with complex headers is hard to configure. This Skill provides expert command patterns, filtering strategies, and helper tooling to run productive ffuf scans. ## Core Features & Use Cases - Fuzzing Command Patterns: Ready-to-use ffuf commands for directory discovery, subdomain enumeration, parameter fuzzing, POST data fuzzing, and header fuzzing with mandatory auto-calibration (-ac). - Authenticated Fuzzing via Raw Requests: Capture full HTTP requests (JWT, session cookies, CSRF tokens, API keys) into req.txt templates and fuzz any position with the FUZZ keyword. - Result Analysis Helper: A Python script that analyzes ffuf JSON output for status code anomalies, response size outliers, interesting keywords, and slow responses, plus generates request templates and IDOR number wordlists. - Use Case: During an authorized web application assessment, capture an authenticated API request from Burp Suite, save it as req.txt with FUZZ in the user ID parameter, then run ffuf --request req.txt -w ids.txt -ac to test for IDOR vulnerabilities. ## Quick Start Ask the AI to help you run an ffuf directory discovery scan against your authorized target with auto-calibration and JSON output.
