# ffuf-web-fuzzing

This skill guides ffuf scans for directories, parameters, and subdomains. It also covers fuzzing requests that carry authentication.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · ★ 214
- Author: jthack
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/jthack/ffuf_claude_skill/tree/HEAD/ffuf-skill/SKILL.md
- Updated: 2025-10-16
- HTML: https://affpapa.org/en/nevibecode/skills/ffuf-web-fuzzing

## What it does

The skill shows how to put `FUZZ` in a URL, header, or request body, and how to choose a mode when working with multiple wordlists. Its examples cover directory and file discovery, parameter tests, POST data, and virtual-host checks. Results can be narrowed by response code, size, or a regular expression.

For authenticated tests, ffuf can read a saved raw HTTP request through `--request`. Capture the request, save it to a file, then replace the value under test with `FUZZ`. The guidance recommends `-ac` when reviewing results. ffuf itself is installed separately; the source gives `go install github.com/ffuf/ffuf/v2@latest` and `brew install ffuf` as options. Without a captured request containing the required headers and tokens, that authenticated workflow will not work.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add jthack/ffuf_claude_skill --skill ffuf-skill -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/ffuf-skill/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/ffuf-skill/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add jthack/ffuf_claude_skill --skill ffuf-skill -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/ffuf-skill/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add jthack/ffuf_claude_skill --skill ffuf-skill -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/ffuf-skill/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install jthack/ffuf_claude_skill ffuf-skill
```

2. **Manually: put the files in place**
- File: `.github/skills/ffuf-skill/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add jthack/ffuf_claude_skill --skill ffuf-skill -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/jthack/ffuf_claude_skill --path ffuf-skill
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/ffuf-skill/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add jthack/ffuf_claude_skill --skill ffuf-skill -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/jthack/ffuf_claude_skill/tree/HEAD/ffuf-skill/SKILL.md

## When to use it
- discover hidden site directories and files
- test GET parameter names and values
- check virtual hosts against a subdomain list
- fuzz fields in POST requests
- filter repetitive ffuf responses during result review

## Example prompts
- Show me an ffuf command to find directories from a wordlist and reduce repetitive responses.
- Help me test possible values for the `id` GET parameter with ffuf.
- Build an authenticated ffuf command using the request saved in `req.txt`.

## Similar
- [find-skills](https://affpapa.org/en/nevibecode/skills/find-skills.md) — skill · 4000000 installs
- [frontend-design](https://affpapa.org/en/nevibecode/skills/frontend-design.md) — skill · 1025790 installs
- [grill-me](https://affpapa.org/en/nevibecode/skills/grill-me.md) — skill · 1424476 installs
- [grill-with-docs](https://affpapa.org/en/nevibecode/skills/grill-with-docs.md) — skill · 1219756 installs
- [improve-codebase-architecture](https://affpapa.org/en/nevibecode/skills/improve-codebase-architecture.md) — skill · 1163035 installs
- [design-taste-frontend](https://affpapa.org/en/nevibecode/skills/design-taste-frontend.md) — skill · 678700 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md