Fuzz web applications with ffuf to discover hidden resources and test endpoints.
npx skills add https://github.com/CarbeneAI/Forge --skill ffuf-web-fuzzing-carbeneai
Please help me install this Agent Skill. Skill: ffuf-web-fuzzing Source: https://github.com/CarbeneAI/Forge/tree/main/.claude/skills/Ffuf Command: npx skills add https://github.com/CarbeneAI/Forge --skill ffuf-web-fuzzing-carbeneai
This skill provides expert guidance for ffuf web fuzzing to help security testers discover hidden content and vulnerabilities quickly, including authenticated fuzzing with raw requests, auto-calibration, and structured result analysis.
Start fuzzing by loading a prepared raw HTTP request (req.txt) with FUZZ in the target endpoint, run ffuf with a wordlist and -ac, then review results for anomalies
High-intent search queries and answers about installing and using this skill.
Fuzzing authenticated web endpoints with ffuf involves loading a prepared raw HTTP request containing your session token and placing the FUZZ keyword in the target endpoint path. This method tests protected routes directly using your active credentials.
Auto-calibration is the best way to reduce false positives during web fuzzing. By enabling the auto-calibration flag, ffuf automatically filters out random responses and standardizes templates, ensuring reproducible and accurate vulnerability assessments.
Yes, you can use a raw HTTP request template for API fuzzing with ffuf. Loading a structured request file allows you to inject wordlists into specific API parameters, testing hidden resources and protected endpoints efficiently.
To discover hidden directories and files using ffuf, run the tool against your target URL with a chosen wordlist. Auto-calibration helps filter noise, leaving a structured result analysis of valid paths and web-facing vulnerabilities.
Penetration testing with ffuf requires standard text-based wordlists, where each line represents a potential path or parameter. The tool processes these lists to discover hidden content, with templates provided for common security testing tasks.
MicrockAutomate web content discovery by fuzzing targets with ffuf to reveal hidden resources.
zebbernFuzz web targets to discover hidden endpoints, directories, and misconfigurations.
ivegamsftAutomate penetration testing workflows with Python libraries for vulnerability assessment.
AeonDaveFuzz HTTP endpoints with wordlists to discover directories, parameters, and virtual hosts.
