# Ffuf Web Fuzzing

Expert guidance for ffuf web fuzzing during authorized penetration testing.

- Repository: https://github.com/trailofbits/skills-curated (523 stars)
- Category: Testing
- License: CC-BY-SA-4.0
- Last updated: 2026-07-14
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add trailofbits/skills-curated --skill ffuf-web-fuzzing -g -a claude-code -y`
Codex: `npx skills add trailofbits/skills-curated --skill ffuf-web-fuzzing -g -a codex -y`
Cursor: `npx skills add trailofbits/skills-curated --skill ffuf-web-fuzzing -g -a cursor -y`
Gemini CLI: `npx skills add trailofbits/skills-curated --skill ffuf-web-fuzzing -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add trailofbits/skills-curated`

## Description

Expert guidance for ffuf web fuzzing during authorized penetration testing. Covers directory discovery, subdomain enumeration, parameter fuzzing, authenticated fuzzing with raw requests, auto-calibration, and result analysis. Use when running ffuf scans, analyzing ffuf output, or building fuzzing strategies for web targets.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# FFUF Web Fuzzing

Guidance for using ffuf (Fuzz Faster U Fool) effectively during authorized penetration testing.

## Prerequisites

ffuf must be installed: `brew install ffuf` (macOS) or `go install github.com/ffuf/ffuf/v2@latest`

## When to Use

- Running directory, file, or subdomain discovery against web targets
- Fuzzing API endpoints, parameters, or POST data
- Authenticated fuzzing with raw HTTP requests
- Analyzing ffuf JSON output for anomalies and interesting findings
- Building fuzzing strategies (wordlist selection, filtering, rate limiting)
- IDOR testing with authenticated sessions

## When NOT to Use

- Target system is not in scope or authorization is unclear
- Passive reconnaissance is more appropriate (use OSINT tools instead)
- The target is a production system and rate limiting hasn't been configured
- You need a full vulnerability scanner (use Burp Suite, Nuclei, etc.)
- Testing for logic flaws that require multi-step interaction

## Rationalizations to Reject

- "Auto-calibration is optional" -- `-ac` is mandatory. Without it, results are buried in false positives and analysis is wasted effort.
- "More threads = faster results" -- Hammering a target with `-t 200` triggers WAFs, gets you blocked, and may crash staging environments. Start with `-t 10 -rate 2` for production targets.
- "I'll filter later" -- Set up filtering before the scan. Running a 220k wordlist without filters and then trying to grep through the noise is backwards.
- "The default wordlist is fine" -- Wordlist selection is the most important decision. A generic wordlist misses technology-specific paths. See [references/wordlists.md](references/wordlists.md).
- "Raw requests are too much work" -- For authenticated fuzzing, `--request req.txt` is simpler and more reliable than chaining `-H` and `-b` flags. Capture once, fuzz many times.

## Critical Rules

The rest: https://github.com/trailofbits/skills-curated/blob/HEAD/plugins/ffuf-web-fuzzing/skills/ffuf-web-fuzzing/SKILL.md