Menu
ffuf fuzzing syntax with matcher/filter strategy and non-interactive defaults.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | ffuf-tooling |
| description | ffuf fuzzing syntax with matcher/filter strategy and non-interactive defaults. |
penkit51 AI — professional penetration testing skill pack. Authorized testing only.
Official docs:
Canonical syntax:
ffuf -w <wordlist> -u <url_with_FUZZ> [flags]
High-signal flags:
-u <url> target URL containing FUZZ-w <wordlist> wordlist input (supports KEYWORD mapping via -w file:KEYWORD)-mc <codes> match status codes-fc <codes> filter status codes-fs <size> filter by body size-ac auto-calibration-t <n> threads-rate <n> request rate-timeout <seconds> HTTP timeout-x <proxy_url> upstream proxy (HTTP/SOCKS)-ignore-body skip downloading response body-noninteractive disable interactive console mode-recursion and -recursion-depth <n> recursive discovery-H <header> custom headers-X <method> and -d <body> for non-GET fuzzing-o <file> -of <json|ejson|md|html|csv|ecsv> structured outputAgent-safe baseline for automation:
ffuf -w wordlist.txt -u https://target.tld/FUZZ -mc 200,204,301,302,307,401,403,405 -ac -t 20 -rate 50 -timeout 10 -noninteractive -of json -o ffuf.json
Common patterns:
ffuf -w /path/wordlist.txt -u https://target.tld/FUZZ -mc 200,204,301,302,307,401,403 -ac -t 40 -rate 200 -noninteractiveffuf -w vhosts.txt -u https://target.tld -H 'Host: FUZZ.target.tld' -fs 0 -ac -noninteractiveffuf -w values.txt -u 'https://target.tld/search?q=FUZZ' -mc all -fs 0 -ac -t 30 -noninteractiveffuf -w payloads.txt -u https://target.tld/login -X POST -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=admin&password=FUZZ' -fc 401 -noninteractiveffuf -w dirs.txt -u https://target.tld/FUZZ -recursion -recursion-depth 2 -ac -t 30 -noninteractiveffuf -w wordlist.txt -u https://target.tld/FUZZ -x http://127.0.0.1:48080 -mc 200,301,302,403 -ac -noninteractiveCritical correctness rules:
FUZZ must appear exactly at the mutation point in URL/header/body.-w file:KEYWORD, that same KEYWORD must be present in URL/header/body.-noninteractive in agent/script execution to prevent ffuf console mode from swallowing subsequent shell commands.-of json -o <file> for deterministic parsing.Usage rules:
-mc/-fc/-fs) over default-only output.-rate, -t) and scale only if target tolerance is known.-h/--help during normal execution unless absolutely necessary.Failure recovery:
C-c and rerun with -noninteractive.-mc/-fc/-fs instead of increasing load.-rate/-t and tighten scope.If uncertain, query web_search with:
site:github.com/ffuf/ffuf <flag> README
Alternate tool for path/file enumeration: dirsearch -u <url> -e php,html,js,json
ships with curated wordlists, sane defaults, and built-in recursion. Reach
for ffuf when you need surgical fuzzing of any input position (header,
body, vhost) or precise filter control; reach for dirsearch for a quick
broad sweep with no setup.
penkit51 AI — professional penetration testing skill pack. Authorized testing only.
Official docs:
Canonical syntax:
ffuf -w <wordlist> -u <url_with_FUZZ> [flags]
High-signal flags:
-u <url> target URL containing FUZZ-w <wordlist> wordlist input (supports KEYWORD mapping via -w file:KEYWORD)-mc <codes> match status codes-fc <codes> filter status codes-fs <size> filter by body size-ac auto-calibration-t <n> threads-rate <n> request rate-timeout <seconds> HTTP timeout-x <proxy_url> upstream proxy (HTTP/SOCKS)-ignore-body skip downloading response body-noninteractive disable interactive console mode-recursion and -recursion-depth <n> recursive discovery-H <header> custom headers-X <method> and -d <body> for non-GET fuzzing-o <file> -of <json|ejson|md|html|csv|ecsv> structured outputAgent-safe baseline for automation:
ffuf -w wordlist.txt -u https://target.tld/FUZZ -mc 200,204,301,302,307,401,403,405 -ac -t 20 -rate 50 -timeout 10 -noninteractive -of json -o ffuf.json
Common patterns:
ffuf -w /path/wordlist.txt -u https://target.tld/FUZZ -mc 200,204,301,302,307,401,403 -ac -t 40 -rate 200 -noninteractiveffuf -w vhosts.txt -u https://target.tld -H 'Host: FUZZ.target.tld' -fs 0 -ac -noninteractiveffuf -w values.txt -u 'https://target.tld/search?q=FUZZ' -mc all -fs 0 -ac -t 30 -noninteractiveffuf -w payloads.txt -u https://target.tld/login -X POST -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=admin&password=FUZZ' -fc 401 -noninteractiveffuf -w dirs.txt -u https://target.tld/FUZZ -recursion -recursion-depth 2 -ac -t 30 -noninteractiveffuf -w wordlist.txt -u https://target.tld/FUZZ -x http://127.0.0.1:48080 -mc 200,301,302,403 -ac -noninteractiveCritical correctness rules:
FUZZ must appear exactly at the mutation point in URL/header/body.-w file:KEYWORD, that same KEYWORD must be present in URL/header/body.-noninteractive in agent/script execution to prevent ffuf console mode from swallowing subsequent shell commands.-of json -o <file> for deterministic parsing.Usage rules:
-mc/-fc/-fs) over default-only output.-rate, -t) and scale only if target tolerance is known.-h/--help during normal execution unless absolutely necessary.Failure recovery:
C-c and rerun with -noninteractive.-mc/-fc/-fs instead of increasing load.-rate/-t and tighten scope.If uncertain, query web_search with:
site:github.com/ffuf/ffuf <flag> README
Alternate tool for path/file enumeration: dirsearch -u <url> -e php,html,js,json
ships with curated wordlists, sane defaults, and built-in recursion. Reach
for ffuf when you need surgical fuzzing of any input position (header,
body, vhost) or precise filter control; reach for dirsearch for a quick
broad sweep with no setup.
record_vulnerability when running inside the penkit51 platformrecord_vulnerability when running inside the penkit51 platformAuthorized AI penetration testing assistant for web applications, APIs, and infrastructure. Performs reconnaissance, vulnerability assessment, PoC validation, exploit chaining, and professional reporting. Use when the user asks for pentest, penetration test, security assessment, vulnerability scan, bug bounty research, authorized hacking, SQLi/XSS/IDOR/SSRF testing, API security audit, or exploit validation.
Authorized AI penetration testing for web apps, APIs, cloud, and infrastructure. Full kill-chain methodology with PoC validation, vulnerability chaining, and professional reporting. Triggers on: pentest, penetration test, security assessment, vuln scan, bug bounty, red team, authorized hack, SQL injection test, XSS test, IDOR, SSRF, API security, exploit validation, security audit.
Authorized AI penetration testing assistant — full-spectrum security testing with deep exploitation skills and integrated tooling. Use for web app pentests, API security, vuln validation, PoC development, bug bounty, and security assessments. Triggers on pentest, penetration test, security audit, exploit, SQLi, XSS, IDOR, SSRF.
API安全测试的专业技能和方法论
JWT and OIDC security testing covering token forgery, algorithm confusion, and claim manipulation
AWS cloud security testing covering IAM misconfigurations, S3 exposure, metadata abuse, and privilege escalation paths