ffuf-web-fuzzing

Automate web application fuzzing with FFUF for directory and subdomain discovery.

Updated Mar 1, 2026

Search Tags:#penetration testing #web fuzzing #subdomain enumeration #directory discovery #FFUF

Ready to run

npx skills add https://github.com/cpfcoaching/glowing-palm-tree --skill ffuf-web-fuzzing-cpfcoaching

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ffuf-web-fuzzing
Source: https://github.com/cpfcoaching/glowing-palm-tree/tree/main/.agent/skills/ffuf-web-fuzzing
Command: npx skills add https://github.com/cpfcoaching/glowing-palm-tree --skill ffuf-web-fuzzing-cpfcoaching

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ffuf, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides expert guidance for using FFUF (Fuzz Faster U Fool) during authorized penetration testing, solving the challenge of efficiently discovering vulnerabilities in web applications.

Core Features & Use Cases

Directory Discovery: Quickly identify directory structures in web targets.
Subdomain Enumeration: Enumerate subdomains for a more comprehensive scan.
API Endpoint Discovery: Discover and fuzz API endpoints for potential vulnerabilities.
Authenticated Fuzzing: Perform authenticated fuzzing with raw HTTP requests.
Auto-Calibration: Automatically detect and filter repetitive false-positive responses.
Rate Limiting: Configure rate limits for production targets to avoid triggering WAFs.
Result Analysis: Analyze FFUF JSON output for anomalies and interesting findings.
Use Case: When conducting a penetration test on a web application, use this Skill to automate the fuzzing process and identify potential vulnerabilities.

Quick Start

Run the ffuf-web-fuzzing skill to discover directories and enumerate subdomains for the target 'example.com'.

Frequently Asked Questions about ffuf-web-fuzzing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform web fuzzing for directory discovery and subdomain enumeration?▼

Web fuzzing automates directory discovery and subdomain enumeration using FFUF to identify hidden paths and vulnerabilities. It utilizes auto-calibration to filter false-positive responses during scanning.

Can I use FFUF for authenticated fuzzing with raw HTTP requests?▼

Yes, FFUF supports authenticated fuzzing by sending raw HTTP requests. This enables scanning protected API endpoints and directories behind login pages during authorized penetration testing.

How do I configure rate limiting in FFUF to avoid triggering WAFs?▼

You can configure rate limiting in FFUF to control request speeds and avoid triggering Web Application Firewalls on production targets. This ensures web fuzzing remains stealthy and uninterrupted.

Does FFUF support auto-calibration to reduce noise and false positives?▼

Yes, FFUF features auto-calibration to automatically detect and filter repetitive false-positive responses. This reduces noise in web fuzzing results and highlights actual anomalies.

How do I analyze FFUF JSON output for vulnerabilities after a scan?▼

Analyzing FFUF JSON output involves reviewing captured response data to identify anomalies and interesting findings. This result analysis step helps pinpoint discovered directories and potential vulnerabilities.

What is the best way to discover API endpoints during a penetration test?▼

The best way to discover API endpoints is using FFUF web fuzzing to automate endpoint testing and identify potential vulnerabilities. It handles rate limiting and auto-calibration for accurate results.