What is the primary benefit of the FFUF skill for Claude?

It provides optimized command-line patterns and analysis strategies for fast, efficient web fuzzing during security assessments, reducing manual setup time.

Can I use this for subdomain discovery?

Absolutely. The skill covers virtual host discovery and subdomain enumeration techniques using wordlists and custom Host headers.

Does this skill support authenticated fuzzing?

Yes, it includes detailed workflows for using raw HTTP requests to fuzz endpoints behind logins, sessions, and JWT tokens.

Is this skill suitable for beginners in security?

Yes, it provides a structured path from basic installation to advanced one-liners, making it accessible for those new to security fuzzing.

Why is auto-calibration (-ac) emphasized in this skill?

Auto-calibration is critical because it automatically filters out repetitive false positives, allowing both the user and Claude to focus on significant anomalies.

FFUF Web Fuzzing Skill

Name: FFUF Web Fuzzing Skill
Author: Microck

byMicrock

•

セキュリティとテスト

Provides expert guidance for high-performance web fuzzing and directory discovery during security penetration testing.

概要

The FFUF Web Fuzzing Skill equips Claude with specialized knowledge to assist in web security audits and penetration testing. It focuses on the 'Fuzz Faster U Fool' (ffuf) tool, offering precise implementation patterns for discovering hidden directories, subdomains, and parameters. The skill emphasizes critical best practices such as auto-calibration to reduce noise, authenticated fuzzing via raw HTTP requests, and strategic result analysis. It is an essential resource for security professionals and developers looking to identify vulnerabilities, undocumented API endpoints, and sensitive files efficiently.

主な機能

Auto-calibration strategies to filter false positives and reduce noise
Authenticated fuzzing workflows using raw HTTP request files
Expert directory and file discovery using specialized wordlist patterns
Advanced subdomain enumeration and virtual host discovery techniques
81 GitHub stars
Multi-mode fuzzing including clusterbomb, pitchfork, and sniper methods

ユースケース

Discovering undocumented API endpoints and parameter vulnerabilities
Identifying hidden administrative panels, backup files, and sensitive directories
Mapping attack surfaces through large-scale subdomain and vhost enumeration

概要

主な機能

Auto-calibration strategies to filter false positives and reduce noise
Authenticated fuzzing workflows using raw HTTP request files
Expert directory and file discovery using specialized wordlist patterns
Advanced subdomain enumeration and virtual host discovery techniques
81 GitHub stars
Multi-mode fuzzing including clusterbomb, pitchfork, and sniper methods

ユースケース

Discovering undocumented API endpoints and parameter vulnerabilities
Identifying hidden administrative panels, backup files, and sensitive directories
Mapping attack surfaces through large-scale subdomain and vhost enumeration