Ffuf Claude Skill

Ffuf Claude Skill

Overview

This skill supports authorized web fuzzing with ffuf using a workflow that is practical for operators and safe for review and handoff.

Use it when you need to:

• discover directories, files, parameters, or virtual hosts with ffuf
• establish a baseline response before choosing filters
• use explicit matcher/filter logic instead of guessing from one-off responses
• bound scan runtime with rate, timeout, recursion, and max-time controls
• preserve machine-readable output for later review, triage, or merge handoff

This enhanced version keeps the upstream identity and intent, but rewrites the operational guidance into a clearer English workflow.

When to Use

Use this skill when all of the following are true:

• you have authorization to test the target
• the task is content discovery, forced browsing, virtual host discovery, or similarly scoped web fuzzing
• ffuf is the right tool for the job, rather than a browser-only review or a full scanner
• you need output that another operator can reproduce from the command line

Typical triggers:

• “Find hidden directories or admin panels on this app.”
• “Enumerate virtual hosts behind this IP or reverse proxy.”
• “Fuzz a parameter or endpoint with a controlled request template.”
• “Run a safe, bounded ffuf pass and give me the results in JSON.”

Do not use this skill when:

• the user lacks permission to test the target
• the task requires exploitation rather than discovery
• the target is too fragile for active fuzzing
• a different protocol or tool family is required

Workflow

1. Confirm scope and safety constraints

   • Verify target hosts, paths, methods, allowed rate, and time window.
   • Prefer the smallest wordlist and narrowest target that can answer the question.
   • Decide whether the job is path discovery, file extension discovery, parameter fuzzing, or vhost enumeration.

2. Collect a baseline response before fuzzing

   • Fetch the target with curl or a browser once.
   • Note status code, content length, line count, word count, redirects, and any common error body.
   • If the application uses wildcard routing, soft-404 pages, or a WAF banner, record that before choosing ffuf filters.

3. Choose a minimal first-pass ffuf command

   • Start with one focused wordlist and one fuzz position.
   • Use explicit rate, timeout, and max-time controls.
   • Write output to a machine-readable format such as JSON.
   • Avoid recursion until the first pass shows that recursion is justified.

4. Calibrate matchers and filters

   • Compare results to the baseline.
   • Use status, size, words, or lines to keep true positives and suppress the baseline noise pattern.
   • If auto-calibration helps, verify that it behaves sensibly for the target rather than assuming it is correct.
   • For multi-domain or vhost work, treat calibration carefully because shared filters can hide valid responses.

5. Run a bounded scan

   • Add recursion only when you have evidence that discovered directories are worth descending into.
   • Set sensible limits for threads, delay, rate, timeout, and total run time.
   • Preserve the exact command you used so another operator can reproduce the run.

6. Review and validate findings

   • Re-check high-signal results with curl or a browser.
   • Confirm whether hits differ by status, body, title, redirect target, or content length.
   • Separate real discoveries from wildcard responses, login redirects, and generic error pages.

7. Prepare handoff-ready output

   • Save JSON output and summarize the command, filters, wordlist, target, and notable hits.
   • Call out any caveats: wildcard routing, redirect-heavy behavior, Host-header dependence, or possible false positives.

Examples

1) Baseline directory discovery

curl -i https://target.example/
ffuf -u https://target.example/FUZZ -w wordlists/common.txt \
  -mc all -fs 4242 -rate 50 -timeout 10 -maxtime 300 \
  -of json -o out/dirs.json

Expected outcome:

• curl establishes the baseline response characteristics.
• ffuf keeps all status codes visible with -mc all while filtering the known baseline size with -fs 4242.
• out/dirs.json can be reviewed or handed off.

2) Extension-aware file discovery

ffuf -u https://target.example/FUZZ -w wordlists/files.txt \
  -e .php,.txt,.bak -mc 200,204,301,302,307,401,403 \
  -rate 40 -timeout 10 -maxtime 300 \
  -of json -o out/files.json

Expected outcome:

• finds file-like resources without scanning every possible path shape
• keeps redirects and access-controlled hits that may still matter operationally

3) Virtual host discovery

ffuf -u https://target.example/ -H 'Host: FUZZ.target.example' \
  -w wordlists/vhosts.txt -mc all -fs 1690 \
  -rate 25 -timeout 10 -maxtime 300 \
  -of json -o out/vhosts.json

Expected outcome:

• uses the Host header fuzz position instead of path fuzzing
• filters the known default vhost body size
• preserves results for manual follow-up on any differing hostnames

4) Parameter fuzzing with a request template

ffuf -request req.txt -request-proto https \
  -w wordlists/params.txt:PARAM -w wordlists/values.txt:VAL \
  -mc all -fc 400 -rate 20 -timeout 10 -maxtime 300 \
  -of json -o out/params.json

Expected outcome:

• reuses a captured request where headers, cookies, or method matter
• filters obvious bad-request noise while preserving unusual behavior for review

For a worked end-to-end exercise with command selection and result interpretation, open examples/worked-example.md.

Best Practices

Do:

• Start with a baseline before selecting matchers or filters.
• Use one fuzz dimension at a time unless a multi-wordlist job is clearly required.
• Prefer machine-readable output such as JSON for review and handoff.
• Bound runtime with -rate, -timeout, and -maxtime.
• Re-validate promising hits with curl or a browser before reporting them as findings.
• Record the exact command and any assumptions about wildcard responses or redirects.
• Use the smallest effective wordlist first, then expand only if justified.

Do not:

• do unauthenticated or unauthorized scanning
• run recursion by default on a broad target
• assume 200 means success or 403 means uninteresting
• rely on a single signal when the app clearly uses soft-404s or generic redirects
• hand off screenshots alone when JSON output and the exact command are available
• let auto-calibration hide target-specific behavior without spot-checking the results

Troubleshooting

Symptoms: Almost every payload returns a match.

Solution: Establish a real baseline first. Compare size, word count, line count, redirect behavior, and body shape. Then switch from broad matching to explicit filters such as response size or word count. If the application uses wildcard routing or a custom 404 page, status code alone is usually insufficient.

Symptoms: Valid findings disappear after enabling auto-calibration or shared filters.

Solution: Re-test with narrower scope and inspect whether the baseline differs by host, path, or redirect target. In vhost or multi-domain workflows, shared calibration can suppress legitimate variants. Prefer per-target review over blind trust in automatic suppression.

Symptoms: Recursion causes the scan to grow too large or too noisy.

Solution: Remove recursion and rerun the first pass. Only recurse into directories that clearly produce distinct responses and operational value. Also reduce rate, set -maxtime, and use a smaller wordlist before expanding again.

Symptoms: The target starts timing out or behaving inconsistently.

Solution: Lower concurrency or request rate, increase timeout carefully, and shorten the scan scope. Confirm with curl whether the application is unstable, rate-limited, or fronted by a control layer such as a WAF.

Symptoms: Vhost results look inconsistent or all resemble the default site.

Solution: Verify DNS resolution and Host-header behavior manually with curl. Check whether TLS, SNI, reverse proxy configuration, or a default vhost page is masking differences. Filter against the true default body only after that baseline is confirmed.

Additional Resources

• references/domain-notes.md — open this for compact operator guidance on calibration, matcher/filter selection, recursion decisions, output strategy, and known ffuf caveats.
• examples/worked-example.md — open this for a concrete start-to-finish directory discovery exercise with baseline analysis and result triage.

Related Skills

No confirmed local related skills were provided in the source context.