From ffuf-web-fuzzing
Guides ffuf web fuzzing for authorized pentests: directory/subdomain discovery, parameter fuzzing, authenticated raw requests, auto-calibration, rate limiting, and JSON output analysis. Use for scans, output review, or strategy building.
npx claudepluginhub trailofbits/skills-curated --plugin ffuf-web-fuzzingThis skill is limited to using the following tools:
Guidance for using ffuf (Fuzz Faster U Fool) effectively during authorized penetration testing.
Applies Acme Corporation brand guidelines including colors, fonts, layouts, and messaging to generated PowerPoint, Excel, and PDF documents.
Builds DCF models with sensitivity analysis, Monte Carlo simulations, and scenario planning for investment valuation and risk assessment.
Calculates profitability (ROE, margins), liquidity (current ratio), leverage, efficiency, and valuation (P/E, EV/EBITDA) ratios from financial statements in CSV, JSON, text, or Excel for investment analysis.
Guidance for using ffuf (Fuzz Faster U Fool) effectively during authorized penetration testing.
ffuf must be installed: brew install ffuf (macOS) or go install github.com/ffuf/ffuf/v2@latest
-ac is mandatory. Without it, results are buried in false positives and analysis is wasted effort.-t 200 triggers WAFs, gets you blocked, and may crash staging environments. Start with -t 10 -rate 2 for production targets.--request req.txt is simpler and more reliable than chaining -H and -b flags. Capture once, fuzz many times.-ac (auto-calibration) unless you have a specific, documented reason not to-o results.json for later analysis-rate and -t flags--request for auth -- raw request files beat command-line header chains# In URL path
ffuf -w wordlist.txt -u https://target.com/FUZZ -ac
# In headers
ffuf -w wordlist.txt -u https://target.com -H "Host: FUZZ.target.com" -ac
# In POST body
ffuf -w wordlist.txt -X POST -d "user=admin&pass=FUZZ" -u https://target.com/login -ac
# Multiple positions with custom keywords
ffuf -w endpoints.txt:EP -w ids.txt:ID -u https://target.com/EP/ID -mode pitchfork -ac
-ac automatically detects and filters repetitive false-positive responses. It adapts to the target's specific behavior and removes noise from dynamic content.
ffuf -w wordlist.txt -u https://target.com/FUZZ -ac # Standard
ffuf -w wordlist.txt -u https://target.com/FUZZ -ach # Per-host (multi-host scans)
ffuf -w wordlist.txt -u https://target.com/FUZZ -acc "404" # Custom calibration string
ffuf -w /opt/SecLists/Discovery/Web-Content/raft-large-directories.txt \
-u https://target.com/FUZZ -e .php,.html,.txt,.bak \
-ac -c -v -o results.json
ffuf -w /opt/SecLists/Discovery/DNS/subdomains-top1million-5000.txt \
-u https://FUZZ.target.com -ac -c -v -o results.json
ffuf -w /opt/SecLists/Discovery/Web-Content/api/api-endpoints.txt \
-u https://api.target.com/v1/FUZZ \
-H "Authorization: Bearer YOUR_TOKEN_HERE" -mc 200,201 -ac -c
Capture a full authenticated request, save to req.txt, insert FUZZ:
POST /api/v1/users/FUZZ HTTP/1.1
Host: target.com
Authorization: Bearer YOUR_TOKEN_HERE
Cookie: session=YOUR_SESSION_ID
Content-Type: application/json
{"action":"view","id":"1"}
ffuf --request req.txt -w wordlist.txt -ac -o results.json
See references/request-templates.md for pre-built templates covering bearer tokens, session cookies, API keys, and GraphQL.
Authenticated fuzzing requires real credentials that the agent cannot obtain independently. When the user asks for authenticated fuzzing:
req.txt) with auth headers already includedreq.txt format)req.txtffuf --request req.txt -w <(seq 1 10000) -ac -mc 200 -o idor_results.json
| Environment | Flags | Notes |
|---|---|---|
| Production (stealth) | -rate 2 -t 10 | Avoid WAF triggers |
| Production (normal) | -rate 10 -t 20 | Balanced |
| Staging/Dev | -rate 50 -t 40 | Faster |
| Local/Lab | No limit, -t 100 | Maximum speed |
Save output as JSON (-o results.json), then read the file and focus on:
Use -fs to filter by response size and -fc to filter by status code when auto-calibration isn't sufficient. Run ffuf -h for the full list of match/filter flags.