Ffuf Web Fuzzing

This is a comprehensive reference for ffuf, the Go-based web fuzzer that's faster than dirb or dirbuster. It covers the essentials like directory discovery and subdomain enumeration, but the real value is in the authenticated fuzzing section using raw HTTP requests. You capture a full request from Burp or DevTools, drop in the FUZZ keyword, and test authenticated endpoints with all their tokens and cookies intact. The guide hammers home one critical point: always use auto-calibration (-ac) to filter false positives, especially before having Claude analyze results. Without it, you'll wade through thousands of identical 404s instead of finding the interesting anomalies. Good for penetration testing where you need both speed and precision.

skills.sh installs: 409
GitHub stars: 216
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add jthack/ffuf_claude_skill --skill ffuf-web-fuzzing --agent claude-code

Installs into .claude/skills of the current project.

Files

FFUF (Fuzz Faster U Fool) Skill

Overview

FFUF is a fast web fuzzer written in Go, designed for discovering hidden content, directories, files, subdomains, and testing for vulnerabilities during penetration testing. It's significantly faster than traditional tools like dirb or dirbuster.

Installation

# Using Go
go install github.com/ffuf/ffuf/v2@latest

# Using Homebrew (macOS)
brew install ffuf

# Binary download
# Download from: https://github.com/ffuf/ffuf/releases/latest

Core Concepts

The FUZZ Keyword

The FUZZ keyword is used as a placeholder that gets replaced with entries from your wordlist. You can place it anywhere:

URLs: https://target.com/FUZZ
Headers: -H "Host: FUZZ"
POST data: -d "username=admin&password=FUZZ"
Multiple locations with custom keywords: -w wordlist.txt:CUSTOM then use CUSTOM instead of FUZZ