skills.rest
tamagusko
tamaguskoCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

ffuf-web-fuzzing

Guides ffuf web fuzzing for directory, subdomain, and parameter discovery during penetration testing.

Updated Oct 7, 2022
Search Tags:#security#penetration testing#ffuf#reconnaissance#web fuzzing#subdomain enumeration#directory discovery
One-click install
npx skills add https://github.com/tamagusko/linux-cfg --skill ffuf-web-fuzzing-tamagusko
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ffuf-web-fuzzing
Source: https://github.com/tamagusko/linux-cfg/tree/main/dotfiles/claude/skills/ffuf-claude-skill
Command: npx skills add https://github.com/tamagusko/linux-cfg --skill ffuf-web-fuzzing-tamagusko

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Configuring ffuf correctly for web fuzzing is error-prone: without auto-calibration, results drown in false positives, and authenticated fuzzing with complex headers, cookies, or JWT tokens is difficult to express with command-line flags alone. ## Core Features & Use Cases - Fuzzing Command Guidance: Provides tested ffuf command patterns for directory discovery, subdomain enumeration, parameter fuzzing, POST data fuzzing, and header fuzzing, always with auto-calibration (-ac). - Authenticated Fuzzing via Raw Requests: Explains how to capture full HTTP requests into a req.txt file and fuzz them with --request, covering JWT, OAuth, session cookies, and API keys. - Result Analysis Helper: Includes a Python script that analyzes ffuf JSON output for status code anomalies, unusual response sizes, and interesting endpoints like admin, api, or .git paths. - Use Case: During an authorized penetration test, ask for help fuzzing an authenticated API endpoint; the skill produces a req.txt template, the correct ffuf command with rate limiting, and then analyzes the JSON results for anomalies. ## Quick Start Ask the assistant to fuzz hidden directories on an authorized target like https://example.com using ffuf with auto-calibration and save the results to a JSON file.

Frequently Asked Questions about ffuf-web-fuzzing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fuzz directories with ffuf?▼

Run ffuf with a wordlist and place the FUZZ keyword in the URL path, for example ffuf -w wordlist.txt -u https://target.com/FUZZ -ac. The -ac flag enables auto-calibration, which filters out repetitive false positive responses automatically.

How do I fuzz authenticated endpoints with ffuf?▼

Capture the full authenticated HTTP request from Burp Suite or browser DevTools, save it as req.txt, replace the value to fuzz with the FUZZ keyword, then run ffuf --request req.txt -w wordlist.txt -ac. This preserves cookies, JWT tokens, and custom headers.

Why does ffuf return thousands of false positives?▼

False positives occur when the target returns identical responses for missing paths, such as dynamic 404 pages. Use -ac for auto-calibration, or filter manually by response size with -fs, status code with -fc, or regex with -fr.

What wordlists should I use with ffuf?▼

Use SecLists: raft-large-directories.txt or directory-list-2.3-medium.txt for directories, subdomains-top1million-5000.txt for subdomains, and burp-parameter-names.txt for parameters. Install via git clone or apt install seclists on Kali.

How do I avoid getting blocked while fuzzing with ffuf?▼

Reduce the request rate with -rate 2, lower threads with -t 10, and add random delays with -p 0.5-1.5. Routing through a proxy with -x and randomizing the User-Agent also helps avoid WAF and IDS triggers.

Can ffuf fuzz subdomains and virtual hosts?▼

Yes, place FUZZ in the Host header or subdomain position, for example ffuf -w subdomains.txt -u https://target.com -H "Host: FUZZ.target.com" -ac. Auto-calibration filters the default response size of nonexistent hosts.

Related Skills

Explore More Software Engineering Skills→
noname300989noname300989

recon-auto-feed

Automate reconnaissance pipelines for offensive security engagements.

Community
Advanced
braydos-hbraydos-h
4

testing-for-xxe-injection-vulnerabilities

Tests XML endpoints for XXE injection to read files, perform SSRF, and exfiltrate data.

Community
Intermediate
jcastillotxjcastillotx

Burp Suite Web Application Testing

Intercept and analyze HTTP traffic with Burp Suite proxy tools.

Community
Advanced
crazyMarkycrazyMarky
277

recon-dir-scan

Enumerate web application directories and files using ffuf, gobuster, and feroxbuster.

Community
Intermediate