Which wordlists should I use with FFUF?

The skill recommends using industry-standard wordlists like SecLists for directory discovery, parameter names, subdomains, and common passwords.

Why is auto-calibration (-ac) emphasized in this skill?

Auto-calibration is critical because it automatically filters out repetitive false positives and dynamic noise, ensuring that Claude and security researchers only see meaningful anomalies.

Can I perform authenticated fuzzing with this skill?

Yes, the skill provides specific workflows for using raw HTTP request files, allowing you to fuzz endpoints that require complex authentication headers, cookies, or JWT tokens.

FFUF (Fuzz Faster U Fool) is a high-speed web fuzzer written in Go, primarily used for discovering hidden content, directories, and vulnerabilities during security assessments.

Does this skill help with API testing?

Absolutely. It includes templates for JSON POST data fuzzing, parameter discovery, and testing various HTTP methods like PUT and DELETE.

FFUF Web Fuzzing

Name: FFUF Web Fuzzing
Author: piotroq

bypiotroq

0•

보안 및 테스팅

Simplifies web discovery and penetration testing by providing expert command templates and analysis patterns for the FFUF tool.

The FFUF Web Fuzzing skill equips Claude with specialized knowledge to perform high-speed web discovery and security testing using the FFUF (Fuzz Faster U Fool) tool. It provides ready-to-use command templates for directory discovery, subdomain enumeration, and parameter fuzzing, with a heavy emphasis on authenticated fuzzing using raw HTTP requests. By incorporating auto-calibration best practices, this skill helps security professionals and developers identify hidden endpoints and vulnerabilities while minimizing noise and false positives in their testing workflow.

주요 기능

01Automated templates for directory, file, and subdomain discovery

02Advanced auto-calibration setups to reduce false positive noise

03Expert guidance for authenticated fuzzing using raw HTTP request files

040 GitHub stars

05Support for multi-wordlist modes including clusterbomb and pitchfork

06Strategic result filtering using status codes, size, and regex

사용 사례

01Identifying hidden administrative panels or backup files on a target web server

02Testing API endpoints for IDOR vulnerabilities using authenticated sessions

03Discovering hidden GET/POST parameters to uncover undocumented functionality

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add piotroq/adwokat-trzebnica-html-to-php-com ffuf-skill

For use in Claude.ai and ChatGPT

Download Skill