# Ffuf

> Use for controlled web content discovery, endpoint enumeration, and narrow retest of hidden routes during authorized pentests. Trigger on finding directories, files, API routes, and admin paths within approved web scope.

- Skill: `timsonner/ffuf` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/ffuf`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/ffuf/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/ffuf

---


# Ffuf

## Purpose

Use this skill when the methodology calls for controlled discovery of hidden web paths or API routes.

## Phase Fit

- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Validation and Controlled Impact Demonstration, Retest and Closure

## Use When

- Need to discover content paths, API routes, or administrative endpoints.
- Need to validate whether exposed functionality is broader than the visible application map.
- Need to retest whether sensitive routes were removed or protected.

## Avoid When

- Rate limits, lockout behavior, or fragile backends are not understood.
- Broad wordlist-driven traffic would exceed the approved impact level.

## Inputs

- Confirmed base URLs and authentication context
- Narrow wordlists aligned to the app type
- Rate limits, exclusions, and lockout considerations

## Procedure

1. Start with the smallest path set that matches the current hypothesis.
2. Separate authenticated and unauthenticated coverage.
3. Triage responses for real exposure, not just status code noise.
4. Hand material findings to `burp-suite` for manual confirmation.
5. Preserve the exact route and context needed for retest.

## Command Syntax

Replace sample targets with approved in-scope assets.

```bash
# Directory/path fuzzing with all response codes
ffuf -u https://portal.contoso.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt -mc all -o contoso-dirs.json

# Filter out 404 and 0-byte responses
ffuf -u https://portal.contoso.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt -fc 404 -fs 0

# API route fuzzing with bearer token
ffuf -u https://api.contoso.com/v1/FUZZ -w api-routes.txt -H "Authorization: Bearer <token>" -mc 200,400,403

# Subdomain/vhost fuzzing
ffuf -u https://FUZZ.contoso.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -H "Host: FUZZ.contoso.com" -mc 200

# POST body parameter fuzzing
ffuf -u https://portal.contoso.com/login -X POST -d "username=FUZZ&password=admin" -w users.txt -mc 302

# Rate-limited scan to avoid lockouts
ffuf -u https://portal.contoso.com/FUZZ -w paths.txt -rate 50 -mc 200,301,302,403
```

## Evidence to Capture

- Newly discovered paths or routes
- Authentication boundary differences
- Patterns that suggest hidden admin or debug functionality

## Safety Boundaries

- Throttle traffic and respect lockout risks.
- Avoid payloads or route sets that exceed the agreed impact level.