FFUF Web Fuzzing Skill
Turns Claude into an expert ffuf operator for discovering hidden directories, subdomains, and authenticated endpoints while auto-filtering false positives.
SKILL.md recommends rate limiting and includes authorization disclaimers (README safety/ethics section); commands are generated transparently, main risks visible. Deducted for: no least-privilege scoping, no target-confirmation gate, weak handling guidance for sensitive tokens in req.txt examples, no rollback/abort guidance.
Internally consistent docs; examples match known ffuf usage; helper script simple and readable; troubleshooting section present. Deducted for: no tests, thin edge-case handling (JSON parse failures, simplistic URL parsing in create-req), key paths not reproduced, static cap 10.
Clear scenario (authenticated fuzzing, directory/subdomain/parameter discovery), reasonable trigger conditions with natural-language examples in README. Deducted for: no declared non-fit boundaries (e.g., unauthenticated targets), no Chinese support, wordlist dependencies (GitHub/Kali) reachability from mainland China uncertain.
Well-layered docs (SKILL.md + resources + helper), install notes, troubleshooting, quick reference; MIT license declared in README. Deducted for: no versioning/changelog, no maintenance ownership statement, duplicate numbering in Best Practices section.
Comprehensive coverage (authenticated fuzzing, auto-calibration, result analysis) with real marginal value for Claude-assisted fuzzing; helper script reduces manual analysis. Deducted for: knowledge-only skill, user could read the ffuf wiki directly; direct usability unverified, static cap 7.
Cites primary sources (ffuf official, SecLists, ffuf.me) and commands are independently checkable. Deducted for: no test suite, no CI evidence, no third-party execution proof, example outputs illustrative rather than demonstrated; below static cap 5.
- This is a static source review; nothing was executed and confidence is low.
- req.txt templates involve real tokens/cookies — avoid committing credentials to repos or logs.
- Skill targets penetration testing; only use on authorized targets. The skill itself has no built-in authorization check.
- Wordlists depend on GitHub/SecLists and Kali packages, which may be hard to reach from mainland-China networks.
- No versioning or changelog; diff the repository manually when updating.
- Publisher is unverified by the FollowSkills registry; identity is unknown.
What does this skill do, and when should you use it?
This is a Claude Code skill that wraps ffuf, the fast Go-based web fuzzer, so you can drive it through natural language. Its documentation covers directory discovery, subdomain enumeration, parameter and POST data fuzzing, and authenticated testing via raw HTTP request replay. It insists on the -ac auto-calibration flag as a default to eliminate noise, and ships helper resources including a Python script for analyzing results, building request templates, and generating IDOR wordlists. It is aimed at security testers with proper authorization.
Provides Claude with a comprehensive ffuf playbook: installation methods (go install / brew / binary), the FUZZ keyword placement in URLs, headers, and POST data, clusterbomb/pitchfork/sniper multi-wordlist modes, matchers and filters (-mc/-fc/-fs etc.), rate control, recursion, replaying captured authenticated requests via the --request flag, and JSON/HTML/CSV output. It bundles a resources/ directory with WORDLISTS.md (SecLists recommendations), REQUEST_TEMPLATES.md (templates for JWT, OAuth, session cookies, and API keys), and ffuf_helper.py, which analyzes JSON results for anomalies, creates req.txt templates, and generates numeric IDOR wordlists. The skill itself is instructional; ffuf commands are actually executed by Claude in a shell-enabled environment.
- A penetration tester on an authorized engagement needs to quickly enumerate hidden directories and files on a target site and wants Claude to construct and interpret ffuf commands.
- A bug bounty hunter needs vhost-based subdomain enumeration and wants anomalies surfaced from noisy results.
- A web security engineer has captured an authenticated request with a JWT or session cookie from Burp Suite and needs to fuzz authenticated API endpoints or run IDOR tests.
- A tester needs a POST brute-force command against a login endpoint with rate limiting to avoid triggering a WAF.
- Anyone wanting to run ffuf_helper.py against results. to automatically flag anomalies in status codes, response sizes, or timing.
What are this skill's strengths and limitations?
- Extremely thorough documentation covering everything from basic directory scans to authenticated IDOR testing, with command templates and a quick-reference card.
- Mandates -ac auto-calibration by default, which dramatically reduces false positives and makes Claude's result analysis far more reliable.
- Ships genuinely useful resources: a SecLists wordlist guide, authenticated request templates, and a result-analysis helper script.
- Built-in safety considerations: rate limiting advice, sensible defaults, and explicit authorization/ethics guidance.
- Simple installation — just copy the folder and have ffuf pre-installed.
- Entirely dependent on the external ffuf binary; without it, the skill cannot perform any actual scanning.
- Repository metadata lists license as unknown, though the README claims MIT — verify the LICENSE file yourself.
- No test suite or cross-platform validation evidence; output quality depends on how well Claude constructs commands.
- The skill body is instructional prose rather than directly executable scripts, so results hinge on model interpretation.
- Includes offensive capabilities (login brute force, SQLi/XSS payload testing); users must ensure legal authorization on their own.
How do you install this skill?
- Install ffuf:
brew install ffufon macOS,go install github.com/ffuf/ffuf/v2@lateston Linux, or grab a binary from the official releases page. 2. Clone the repo:git clone https://github.com/jthack/ffuf_claude_skill. 3. Copy the skill folder:mkdir -p ~/.claude/skills && cp -r ffuf_claude_skill/ffuf-skill ~/.claude/skills/.
How do you use this skill?
After installation, issue natural-language tasks in Claude Code such as "Fuzz the /api endpoint on example.com for hidden paths", "Enumerate subdomains for target.com", or "Test for backup files on the /admin path". Claude will invoke the skill to build appropriate ffuf commands and interpret results. For authenticated testing, save your captured request as req.txt with the FUZZ keyword inserted, and have Claude run ffuf --request req.txt -w wordlist.txt -ac. You must have authorization to test targets; the README does not document installation on other platforms such as Codex CLI.