ffuf-web-fuzzing — Claude Code skill: features and setup
This skill guides ffuf scans for directories, parameters, and subdomains. It also covers fuzzing requests that carry authentication.
npx skills add jthack/ffuf_claude_skill --skill ffuf-skill -a claude-codeWhat ffuf-web-fuzzing does
The skill shows how to put FUZZ in a URL, header, or request body, and how to choose a mode when working with multiple wordlists. Its examples cover directory and file discovery, parameter tests, POST data, and virtual-host checks. Results can be narrowed by response code, size, or a regular expression.
For authenticated tests, ffuf can read a saved raw HTTP request through --request. Capture the request, save it to a file, then replace the value under test with FUZZ. The guidance recommends -ac when reviewing results. ffuf itself is installed separately; the source gives go install github.com/ffuf/ffuf/v2@latest and brew install ffuf as options. Without a captured request containing the required headers and tokens, that authenticated workflow will not work.
What it helps with
- discover hidden site directories and files
- test GET parameter names and values
- check virtual hosts against a subdomain list
- fuzz fields in POST requests
- filter repetitive ffuf responses during result review
Example prompts for the agent
- Show me an ffuf command to find directories from a wordlist and reduce repetitive responses.
- Help me test possible values for the
idGET parameter with ffuf. - Build an authenticated ffuf command using the request saved in
req.txt.
How to install ffuf-web-fuzzing
1Skills CLI (Vercel)
npx skills add jthack/ffuf_claude_skill --skill ffuf-skill -a claude-code2Manually: put the files in place
~/.claude/skills/ffuf-skill/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/ffuf-skill/
1Skills CLI (Vercel)
npx skills add jthack/ffuf_claude_skill --skill ffuf-skill -a codex2Manually: put the files in place
.agents/skills/ffuf-skill/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add jthack/ffuf_claude_skill --skill ffuf-skill -a cursor2Manually: put the files in place
.cursor/skills/ffuf-skill/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install jthack/ffuf_claude_skill ffuf-skill2Manually: put the files in place
.github/skills/ffuf-skill/SKILL.md1Skills CLI (Vercel)
npx skills add jthack/ffuf_claude_skill --skill ffuf-skill -a gemini-cli2Platform CLI
gemini skills install https://github.com/jthack/ffuf_claude_skill --path ffuf-skillManually: put the files in place
.devin/skills/ffuf-skill/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add jthack/ffuf_claude_skill --skill ffuf-skill -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about ffuf-web-fuzzing
How do I install ffuf-web-fuzzing in Claude Code?
Run npx skills add jthack/ffuf_claude_skill --skill ffuf-skill -a claude-code. The skill file is placed at ~/.claude/skills/ffuf-skill/SKILL.md.
What does ffuf-web-fuzzing do?
It guides ffuf use for testing URLs, parameters, headers, and POST data, and explains filtering and auto-calibration for reviewing scan results.
How can I use ffuf with an authenticated request?
Save a captured HTTP request to a file, put FUZZ in the value to test, then pass the file with --request. The skill recommends adding -ac when analyzing results.
