ffuf-web-fuzzing
Expert guidance for ffuf web fuzzing during penetration testing, including authenticated fuzzing with raw requests, auto-calibration, and result analysis
Profile →npx skills add sickn33/agentic-awesome-skills --skill ffuf-web-fuzzing --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
What it does
Guides the agent to perform ffuf web fuzzing for penetration testing, covering directory, subdomain, parameter, and authenticated fuzzing, with emphasis on auto-calibration and results interpretation.
How it works
- Provides installation instructions for ffuf via Go, Homebrew, or binary download.
- Describes core concepts, notably the FUZZ keyword placement across URLs, headers, and POST data, and multi-wordlist modes (clusterbomb, pitchfork, sniper).
- Offers practical usage examples for directory discovery, subdomain enumeration, parameter fuzzing, POST data fuzzing, and header fuzzing.
- Emphasizes auto-calibration (-ac) as default and recommended, including per-host calibration (-ach) and custom calibration (-acc).
- Details advanced techniques: using raw HTTP requests with --request, and the workflow to fuzz authenticated endpoints; also covers proxy usage, cookies/auth, encoding, and common testing payloads.
- Contains guidance on rate limiting, time limits, and multiple output formats (-o, -of).
- Provides troubleshooting tips, configuration guidance, and numerous example one-liners for common scenarios.
When to use it
Use when fuzzing web targets in authorized security testing or penetration testing, especially for content discovery, subdomain enumeration, parameter fuzzing, or authenticated request fuzzing, and when guidance on wordlists, filtering, calibration, and interpreting results is needed.
What it can touch
- Tools: "ffuf" commands and related flags as shown in examples (e.g., -w, -u, -ac, --request, -t, -rate, -d, -X, -H).
- Input modalities include wordlists, endpoints, and raw HTTP request files (req.txt).
- Output options include various formats and files via -o and -of.
Caveats
- Requires explicit, written authorization before probing a target.
- Recommends using auto-calibration by default to reduce noise and false positives.
- Contains risk disclaimer and a mandatory confirmation gate before running any probing commands.
- Some phrasing instructs on potentially sensitive actions (authenticated fuzzing, IDOR testing) but always within authorized contexts.
> **⚠️ AUTHORIZED USE ONLY** > This skill is for educational purposes or authorized security assessments only. > You must have explicit, written permission from the system owner before using this tool. > Misuse of this tool is illegal and strictly prohibited. > **Mandatory confirmation gate** > Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target: > 1. Ask the user to state the exact target URL, IP, account, or resource. > 2. Ask the user to confirm written authorization and the permitted scope. > 3. Show the exact command(s) and explain their expected effect. > 4. Wait for explicit confirmation in the current conversation. > > Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab. # FFUF (Fuzz Faster U Fool) Skill ## When to Use - You are fuzzing web targets with `ffuf` during authorized security testing or penetration testing. - The task involves content discovery, subdomain enumeration, parameter fuzzing, or authenticated request fuzzing. - You need guidance on wordlists, filtering, calibration, and interpreting ffuf
- When to Use
- Overview
- Installation
- Core Concepts
- The FUZZ Keyword
- Multi-wordlist Modes
- Common Use Cases
- 1. Directory and File Discovery
- 2. Subdomain Enumeration
- 3. Parameter Fuzzing
- 4. POST Data Fuzzing
- 5. Header Fuzzing
- Filtering and Matching
- Matchers (Include Results)
Using Go go install github.com/ffuf/ffuf/v2@latest Using Homebrew (macOS) brew install ffuf Binary download Download from: https://github.com/ffuf/ffuf/releases/latest Basic directory fuzzing ffuf -w /path/to/wordlist.txt -u https://target.com/FUZZ With file extensions ffuf -w /path/to/wordlist.txt -u https://target.com/FUZZ -e .php,.html,.txt,.pdf
What does the ffuf-web-fuzzing skill do?
Expert guidance for ffuf web fuzzing during penetration testing, including authenticated fuzzing with raw requests, auto-calibration, and result analysis
How do I install it?
Run `npx skills add sickn33/agentic-awesome-skills --skill ffuf-web-fuzzing --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From sickn33/agentic-awesome-skills, a repository with 44,414 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.