How do I install the Fuzz skill?

Run npx skillmds@latest add bg-szy/fuzz in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Fuzz?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

bg-szy (@bg-szy) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Fuzz by bg-szy — Agent Skill

Name: Fuzz
Author: bg-szy

File contents

Fuzz — Web Fuzzing with ffuf

Lightweight web application fuzzing using ffuf.

Prerequisites

command -v ffuf && ffuf -V

If not installed:

brew install ffuf    # macOS
# or
go install github.com/ffuf/ffuf/v2@latest

Common Wordlists

/usr/share/wordlists/                          # Kali default
/opt/homebrew/share/wordlists/                 # Homebrew
~/.local/share/wordlists/                      # User-local

# SecLists (install: brew install seclists)
/opt/homebrew/share/seclists/Discovery/Web-Content/common.txt
/opt/homebrew/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
/opt/homebrew/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
/opt/homebrew/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt

If no wordlists found: brew install seclists

Usage Patterns

Directory / File Discovery

ffuf -u https://TARGET/FUZZ -w wordlist.txt -mc 200,301,302,403

API Endpoint Discovery

ffuf -u https://TARGET/api/FUZZ -w wordlist.txt -mc 200,401,403,405

Parameter Fuzzing (GET)

ffuf -u "https://TARGET/page?FUZZ=value" -w params.txt -mc 200 -fs 4242

POST Data Fuzzing

ffuf -u https://TARGET/login -X POST \
  -d "username=admin&password=FUZZ" \
  -w passwords.txt -mc 200 -fc 401

Subdomain Enumeration

ffuf -u https://FUZZ.TARGET.com -w subdomains.txt -mc 200,301,302

Authenticated Fuzzing

ffuf -u https://TARGET/api/FUZZ -w wordlist.txt \
  -H "Authorization: Bearer <token>" \
  -H "Cookie: session=<value>" \
  -mc 200,201,403

Filtering Options

-mc 200,301 — match HTTP status codes
-fc 404,500 — filter (exclude) status codes
-fs 4242 — filter by response size (removes noise)
-fw 12 — filter by word count
-fr "not found" — filter by regex in response

Output

ffuf -u https://TARGET/FUZZ -w wordlist.txt -o results.json -of json

Tips

Start with small wordlists, expand if needed
Use -rate 100 to limit requests per second (avoid DoS)
Use -t 40 to control thread count (default: 40)
Run once without filters, note the common response size, then add -fs
Combine with -recursion -recursion-depth 2 for recursive discovery

---name: fuzzdescription: Lightweight web fuzzing via ffuf — directory discovery, parameter testing, subdomain enumeration.---# Fuzz — Web Fuzzing with ffufLightweight web application fuzzing using [ffuf](https://github.com/ffuf/ffuf).## Prerequisites```bashcommand -v ffuf && ffuf -V```If not installed:```bashbrew install ffuf # macOS# orgo install github.com/ffuf/ffuf/v2@latest```## Common Wordlists```/usr/share/wordlists/ # Kali default/opt/homebrew/share/wordlists/ # Homebrew~/.local/share/wordlists/ # User-local# SecLists (install: brew install seclists)/opt/homebrew/share/seclists/Discovery/Web-Content/common.txt/opt/homebrew/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt/opt/homebrew/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt/opt/homebrew/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt```If no wordlists found: `brew install seclists`## Usage Patterns### Directory / File Discovery```bashffuf -u https://TARGET/FUZZ -w wordlist.txt -mc 200,301,302,403```### API Endpoint Discovery```bashffuf -u https://TARGET/api/FUZZ -w wordlist.txt -mc 200,401,403,405```### Parameter Fuzzing (GET)```bashffuf -u "https://TARGET/page?FUZZ=value" -w params.txt -mc 200 -fs 4242```### POST Data Fuzzing```bashffuf -u https://TARGET/login -X POST \ -d "username=admin&password=FUZZ" \ -w passwords.txt -mc 200 -fc 401```### Subdomain Enumeration```bashffuf -u https://FUZZ.TARGET.com -w subdomains.txt -mc 200,301,302```### Authenticated Fuzzing```bashffuf -u https://TARGET/api/FUZZ -w wordlist.txt \ -H "Authorization: Bearer <token>" \ -H "Cookie: session=<value>" \ -mc 200,201,403```## Filtering Options- `-mc 200,301` — match HTTP status codes- `-fc 404,500` — filter (exclude) status codes- `-fs 4242` — filter by response size (removes noise)- `-fw 12` — filter by word count- `-fr "not found"` — filter by regex in response## Output```bashffuf -u https://TARGET/FUZZ -w wordlist.txt -o results.json -of json```## Tips- Start with small wordlists, expand if needed- Use `-rate 100` to limit requests per second (avoid DoS)- Use `-t 40` to control thread count (default: 40)- Run once without filters, note the common response size, then add `-fs`- Combine with `-recursion -recursion-depth 2` for recursive discovery

Frequently asked questions

Fuzz