# Pentest Fuzz Skill

> Help with authorized Web pentest, Web fuzzing, and CTF-style vulnerability analysis. Use this skill whenever the user wants payload ideas, fuzz dictionaries, quick probe strings, test methodology, response-difference heuristics, or per-vulnerability checklists for common Web bugs such as SQL injection, XSS, SSTI, SSRF, XXE, file inclusion, IDOR, JWT weaknesses, deserialization, auth bypass, or command injection. Make sure to use it when the user asks how to test a Web bug, what characters or tokens to fuzz, how to organize notes by vulnerability type, or which vulnerability family a behavior most likely belongs to, even if they do not explicitly mention a skill.

- Skill: `m-sec-org/pentest-fuzz-skill` (Agent Skill, multi-file: 43 files)
- Install (CLI): `npx skillmds@latest add m-sec-org/pentest-fuzz-skill`
- Raw SKILL.md: https://api.skillmd.com/api/skills/m-sec-org/pentest-fuzz-skill/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Data & Analytics
- Author: m-sec-org (https://skillmd.com/u/m-sec-org)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/m-sec-org/pentest-fuzz-skill

---


# pentest-fuzz-skill

Use this skill to route a Web security question into the right vulnerability family, then give short, practical, test-oriented guidance.

Keep the scope on authorized testing, labs, demos, CTFs, or systems the user is permitted to assess.

## Safety boundary

- Help only with authorized testing.
- If authorization is unclear and the request is target-specific, ask one short clarification.
- Do not pretend a random public target is in scope.

## What this skill should do

1. Identify the likely vulnerability family.
2. Route to the closest directory in this skill.
3. Give a compact answer with:
   - what the bug is
   - quick payload examples
   - how to test it safely
   - what response differences matter
   - what to fuzz next
4. Stay practical. Avoid long theory unless the user asks.

## Suggested response shape

### Likely issue

Name the most likely bug family and why it matches the request.

### Quick tests

Give 2-5 lightweight probes or payloads.

### What to compare

Point out useful signals such as:
- status code changes
- body length or word-count changes
- reflected characters or encoded output
- stack traces, SQL errors, template errors, XML parser errors
- timing differences
- privilege or data exposure changes

### Next fuzz ideas

Recommend the next character set, payload family, or request mutation to try.

## Directory map

- `sqli/`: SQL injection basics, fuzzing cues, and `fuzz.txt`
- `xss/`: reflected, stored, and DOM XSS basics, fuzzing cues, and `fuzz.txt`
- `ssti/`: template injection basics, engine probes, and `fuzz.txt`
- `ssrf/`: server-side request forgery checks, SSRF-oriented fuzzing, and `fuzz.txt`
- `xxe/`: XML external entity testing, parser-oriented fuzzing, and `fuzz.txt`
- `lfi-rfi/`: file inclusion, traversal notes, and `fuzz.txt`
- `idor/`: object access control, identifier enumeration notes, and `fuzz.txt`
- `jwt/`: JWT inspection, weakness checks, and `fuzz.txt`
- `rce/`: command injection, code execution notes, and `fuzz.txt`
- `deserialization/`: unsafe deserialization notes and `fuzz.txt`

Each vulnerability directory should be treated as a small bundle:
- `README.md` for navigation
- `overview.md` for bug summary and sample payloads
- `fuzzing.md` for testing heuristics
- `fuzz.txt` for a compact wordlist or token list to reuse in manual or scripted probing

## Routing hints

- SQL errors, quote handling, login bypass, UNION behavior: start with `sqli/`.
- Reflection into HTML, attributes, JS, or admin bot flows: start with `xss/`.
- `{{7*7}}`, `${7*7}`, or template syntax: start with `ssti/`.
- URL fetchers, webhooks, image importers, PDF renderers, metadata lookups: start with `ssrf/`.
- XML bodies, SOAP, SVG, DOCX/XLSX import, SAML: start with `xxe/`.
- File paths, traversal, include parameters, download/read endpoints: start with `lfi-rfi/`.
- Numeric IDs, UUIDs, object keys, other-user data exposure: start with `idor/`.
- Bearer tokens, `alg`, `kid`, weak secrets, JWT parsing: start with `jwt/`.
- Shell metacharacters, OS commands, image/document converters, wrapper abuse: start with `rce/`.
- Serialized blobs, signed cookies, Java/PHP/Python object restore paths: start with `deserialization/`.

## Relationship to `fuzz-skill`

Use `pentest-fuzz-skill` for vulnerability reasoning and test ideas.

If the user specifically wants a tuned `ffuf` command, matcher/filter advice, or raw-request fuzzing, `fuzz-skill` is the better follow-up.