# Ffuf

> Use this skill when the user wants to fuzz web endpoints for hidden directories, parameters, or content during security testing.

- Skill: `javimosch/ffuf` (Agent Skill)
- Install (CLI): `npx skillmds@latest add javimosch/ffuf`
- Raw SKILL.md: https://api.skillmd.com/api/skills/javimosch/ffuf/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: javimosch (https://skillmd.com/u/javimosch)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/javimosch/ffuf

---


# ffuf Plugin

ffuf is a fast web fuzzer for content discovery.

## Usage Examples

- "fuzz for hidden directories on a target"
- "discover hidden parameters on an endpoint"
- "fuzz subdomains with a custom wordlist"

## Installation

```bash
brew install ffuf
```

## Key Features
- Web directory and file fuzzing
- Parameter and value fuzzing
- Subdomain discovery
- Custom wordlist and filter support
- Recursive fuzzing
- JSON/HTML output formats