ffuf Claude Skill

The FUZZ keyword acts as a placeholder that is replaced by entries from your wordlist. It can be used in URLs, Headers, or POST data. If you use multiple wordlists, you can define custom keywords using the syntax -w wordlist.txt:CUSTOM and then use CUSTOM in your target string.

FFUF supports three modes for handling multiple wordlists:

• clusterbomb: Tests all possible combinations (Cartesian product). This is the default.
• pitchfork: Iterates through wordlists in parallel (1-to-1 matching).
• sniper: Tests one position at a time for multiple FUZZ positions.

# Example of custom keyword usage
ffuf -w wordlist.txt:CUSTOM -u https://target.com/CUSTOM

# Example of pitchfork mode for multiple fields
ffuf -w users.txt:USER -w passes.txt:PASS -X POST -d "username=USER&password=PASS" -u https://target.com/login -mode pitchfork

Use the -fs flag to filter out responses of specific sizes that represent 'not found' or default error pages. Common baseline sizes include:

• 404 pages: Often consistent sizes like 1234, 4242, 9999
• 403 Forbidden: Check with a known forbidden path first
• Default pages: IIS default is often ~1433 bytes
• Empty responses: 0 bytes

Tip: Always run a test request first to identify the baseline response size, then use -ac to auto-calibrate!

For complex authentication (JWT, cookies, custom headers), capture a raw request from a tool like Burp Suite, save it to a file, and use the --request flag. This allows you to place the FUZZ keyword anywhere in the headers, body, or URL of the captured request.

# 1. Create a file (e.g., req.txt) containing the raw HTTP request with FUZZ keyword
# 2. Run ffuf using the --request flag
ffuf --request req.txt -w /path/to/wordlist.txt -ac

# Example with multiple custom keywords in a raw request
ffuf --request req.txt -w endpoints.txt:ENDPOINT -w ids.txt:ID -mode pitchfork -ac

The -ac flag is critical for reducing false positives. It automatically detects and filters out repetitive responses that don't represent actual content (like custom 404 pages). Always use -ac when using Claude to analyze results to prevent the AI from being overwhelmed by noise.

# Standard auto-calibration
ffuf -w /path/to/wordlist.txt -u https://target.com/FUZZ -ac

# Per-host auto-calibration
ffuf -w /path/to/wordlist.txt -u https://target.com/FUZZ -ach

# Custom auto-calibration string
ffuf -w /path/to/wordlist.txt -u https://target.com/FUZZ -acc "404NotFound"

When working with req.txt templates in ffuf, keep these best practices in mind:

• Content-Length: ffuf will automatically adjust the Content-Length header if you are fuzzing the request body.
• Multiple FUZZ points: Use custom keywords like USER_ID or DOC_ID by passing them via the -w wordlist.txt:KEYWORD flag.
• Testing your req.txt: Before running a large fuzzing job, run the command with a single-value wordlist to verify the request structure and authentication are working correctly.
• Token expiration: Authenticated tokens (JWT, OAuth, etc.) expire. Ensure you have a strategy to refresh tokens if your fuzzing session is long.
• HTTPS by default: If you are targeting an HTTP-only endpoint, use the -request-proto http flag.

SecLists is a collection of wordlists highly recommended for use with FFUF. You can install it by cloning the repository to a directory like /opt/SecLists or by using a package manager on Kali Linux.

Once installed, you can reference the wordlists in your FFUF commands by providing the absolute path to the .txt files.

# Clone the repository
git clone https://github.com/danielmiessler/SecLists.git /opt/SecLists

# Or install via package manager (Kali)
sudo apt install seclists

# Then reference in ffuf:
ffuf -w /opt/SecLists/Discovery/Web-Content/common.txt -u https://target.com/FUZZ -ac

After installation, you do not need to call specific APIs. Instead, you can use natural language to instruct Claude Code to perform web fuzzing, reconnaissance, or security testing tasks. Claude will automatically invoke the ffuf skill and interpret the results.

Example prompts:

• "Fuzz the /api endpoint on example.com for hidden paths"
• "Enumerate subdomains for target.com"
• "Find common directories on https://example.com"
• "Test for backup files on the /admin path"

Adjust -rate and -t based on your target environment to avoid detection or service disruption:

The FFUF Skill requires the ffuf (Fuzz Faster U Fool) binary to be installed on your system before setting up the skill. Use the following commands based on your operating system:

macOS Use Homebrew:

brew install ffuf

Linux Use Go to install the latest version:

go install github.com/ffuf/ffuf/v2@latest

For other operating systems, refer to the official ffuf repository.

You can install ffuf using Go, Homebrew (macOS), or by downloading the binary directly from GitHub releases.

# Using Go
go install github.com/ffuf/ffuf/v2@latest

# Using Homebrew (macOS)
brew install ffuf

To integrate ffuf capabilities into Claude Code, follow these steps:

1. Clone the repository:

git clone https://github.com/jthack/ffuf_claude_skill

2. Create the Claude skills directory if it doesn't exist and copy the skill folder into it:

mkdir -p ~/.claude/skills
cp -r ffuf_claude_skill/ffuf-skill ~/.claude/skills/

Once copied, the skill is automatically available for Claude Code to use.