ffuf-skill_skill

Overview

This skill provides expert guidance for using ffuf (Fuzz Faster U Fool) during web penetration tests, with a focus on authenticated fuzzing, auto-calibration, and result analysis. It explains practical commands, raw-request workflows, filtering and output options, and timing controls to run reliable, high-value scans. The goal is to help you find hidden endpoints, parameters, and vulnerabilities while minimizing noise and avoiding target disruption.

How this skill works

The skill explains how ffuf replaces the FUZZ placeholder across URLs, headers, and bodies using single or multiple wordlists and modes (clusterbomb, pitchfork, sniper). It shows how to feed raw HTTP requests for authenticated endpoints, how to enable auto-calibration (-ac) to reduce false positives, and how to apply matchers/filters to isolate meaningful responses. It also covers rate control, proxies, encoding, and output formats for automated analysis.

When to use it

• Directory and file discovery on web servers.
• Authenticated API and endpoint fuzzing requiring cookies, tokens, or custom headers.
• Subdomain enumeration using virtual host header fuzzing.
• Parameter and POST field testing for injection or logic flaws.
• Stealth scans against production targets with rate limiting and delays

Best practices

• Always enable auto-calibration (-ac) to remove repetitive false positives and improve analysis quality.
• Capture full authenticated requests and use --request with FUZZ for reliable authenticated fuzzing.
• Save results in JSON/CSV/HTML for post-processing and automated analysis.
• Start with conservative rate/threads (-rate, -t) and increase if safe; use delays (-p) to avoid WAF/IDS.
• Tune filters after observing a default response (use -fs, -fc, -fr) rather than guessing values.

Example use cases

• Find hidden admin panels: ffuf -w wordlist.txt -u https://target.com/FUZZ -ac -mc 200,301,302
• Authenticated IDOR testing: save request with FUZZ in ID, then ffuf --request req.txt -w ids.txt -ac -mc 200
• API endpoint discovery with tokens: ffuf -w api-endpoints.txt -u https://api.target.com/v1/FUZZ -H "Authorization: Bearer TOKEN" -ac -mc 200
• Subdomain enumeration via Host header: ffuf -w subdomains.txt -u https://target.com -H "Host: FUZZ.target.com" -ac
• POST login brute force (stealth): ffuf -w passwords.txt -X POST -d "username=admin&password=FUZZ" -u https://target.com/login -rate 2 -ac -fc 401