Why is auto-calibration (-ac) emphasized in this skill?

Auto-calibration is critical because it filters out dynamic noise and false positives, allowing the AI to focus on meaningful anomalies and real vulnerabilities in web responses.

What is the benefit of using this FFUF skill with Claude Code?

The skill provides specialized guidance on complex FFUF syntax and configuration, particularly for authenticated fuzzing and result analysis, ensuring more accurate and efficient security audits.

Does this skill cover subdomain enumeration?

Yes, it includes specific commands and filtering techniques for virtual host discovery and subdomain enumeration using the Host header and various wordlists.

Can this skill help with fuzzing authenticated endpoints?

Yes, it provides detailed patterns for using raw HTTP request files, which is the most reliable way to fuzz endpoints requiring cookies, JWTs, or custom authorization headers.

FFUF Web Fuzzing

Name: FFUF Web Fuzzing
Author: BbgnsurfTech

byBbgnsurfTech

•

安全与测试

Guides users through advanced web fuzzing and discovery using FFUF for comprehensive security testing and reconnaissance.

This skill empowers Claude to provide expert-level guidance on using FFUF (Fuzz Faster U Fool), a high-speed web fuzzer written in Go. It specializes in directory and file discovery, subdomain enumeration, and parameter fuzzing, with a particular focus on advanced techniques like authenticated fuzzing via raw HTTP requests and automated noise reduction using auto-calibration. Whether you are performing a routine security audit or deep penetration testing, this skill helps configure optimal commands, analyze results, and identify hidden vulnerabilities effectively.

主要功能

01Multi-mode fuzzing strategies including clusterbomb and pitchfork

02Automated directory and file discovery guidance

03Security-focused parameter and header fuzzing techniques

04Smart result filtering and noise reduction with auto-calibration

05Advanced authenticated fuzzing using raw HTTP requests

063 GitHub stars

使用场景

01Automating subdomain enumeration for large-scale infrastructure reconnaissance

02Discovering hidden API endpoints and administrative panels during security audits

03Testing for IDOR and access control vulnerabilities using authenticated sessions

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add bbgnsurftech/claude-skills-collection ffuf-skill

For use in Claude.ai and ChatGPT

Download Skill