Skip to main content ホーム クリエイター agentsecops secopsagentkit dast-ffuf
dast-ffuf Fast web fuzzer for DAST testing with directory enumeration, parameter fuzzing, and virtual host discovery. Written in Go for high-performance HTTP fuzzing with extensive filtering capabilities. Supports multiple fuzzing modes (clusterbomb, pitchfork, sniper) and recursive scanning. Use when: (1) Discovering hidden directories, files, and endpoints on web applications, (2) Fuzzing GET and POST parameters to identify injection vulnerabilities, (3) Enumerating virtual hosts and subdomains, (4) Testing authentication endpoints with credential fuzzing, (5) Finding backup files and sensitive data exposures, (6) Performing comprehensive web application reconnaissance.
インストールへ移動 Skills Marketplace コミュニティが作成したAIスキルを発見・探索
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/AgentSecOps/SecOpsAgentKit --skill dast-ffufコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
Zipをダウンロード ダウンロード中... このリポジトリの他の Skills Interactive HTTPS proxy for API security testing with traffic interception, modification, and replay capabilities. Supports HTTP/1, HTTP/2, HTTP/3, WebSockets, and TLS-protected protocols. Includes Python scripting API for automation and multiple interfaces (console, web, CLI). Use when: (1) Intercepting and analyzing API traffic for security testing, (2) Modifying HTTP/HTTPS requests and responses to test API behavior, (3) Recording and replaying API traffic for testing, (4) Debugging mobile app or thick client API communications, (5) Automating API security tests with Python scripts, (6) Exporting traffic in HAR format for analysis.
API specification linting and security validation using Stoplight's Spectral with support for OpenAPI, AsyncAPI, and Arazzo specifications. Validates API definitions against security best practices, OWASP API Security Top 10, and custom organizational standards. Use when: (1) Validating OpenAPI/AsyncAPI specifications for security issues and design flaws, (2) Enforcing API design standards and governance policies across API portfolios, (3) Creating custom security rules for API specifications in CI/CD pipelines, (4) Detecting authentication, authorization, and data exposure issues in API definitions, (5) Ensuring API specifications comply with organizational security standards and regulatory requirements.
Fast, template-based vulnerability scanning using ProjectDiscovery's Nuclei with extensive community templates covering CVEs, OWASP Top 10, misconfigurations, and security issues across web applications, APIs, and infrastructure. Use when: (1) Performing rapid vulnerability scanning with automated CVE detection, (2) Testing for known vulnerabilities and security misconfigurations in web apps and APIs, (3) Running template-based security checks in CI/CD pipelines with customizable severity thresholds, (4) Creating custom security templates for organization-specific vulnerability patterns, (5) Scanning multiple targets efficiently with concurrent execution and rate limiting controls.
name dast-ffuf description Fast web fuzzer for DAST testing with directory enumeration, parameter fuzzing, and virtual host discovery. Written in Go for high-performance HTTP fuzzing with extensive filtering capabilities. Supports multiple fuzzing modes (clusterbomb, pitchfork, sniper) and recursive scanning. Use when: (1) Discovering hidden directories, files, and endpoints on web applications, (2) Fuzzing GET and POST parameters to identify injection vulnerabilities, (3) Enumerating virtual hosts and subdomains, (4) Testing authentication endpoints with credential fuzzing, (5) Finding backup files and sensitive data exposures, (6) Performing comprehensive web application reconnaissance.
version 0.1.0 maintainer SirAppSec category appsec tags ["dast","fuzzing","web-fuzzer","directory-enumeration","parameter-fuzzing","vhost-discovery","ffuf","reconnaissance"] frameworks ["OWASP"] dependencies {"tools":["ffuf"]} references ["https://github.com/ffuf/ffuf"]
ffuf - Fast Web Fuzzer
Overview
ffuf is a fast web fuzzer written in Go designed for discovering hidden resources, testing parameters, and performing comprehensive web application reconnaissance. It uses the FUZZ keyword as a placeholder for wordlist entries and supports advanced filtering, multiple fuzzing modes, and recursive scanning for thorough security assessments.
Installation
go install github.com/ffuf/ffuf/v2@latest
apt install ffuf
brew install ffuf
Quick Start
Basic directory fuzzing:
ffuf -u https://example.com/FUZZ -w /usr/share/wordlists/dirb/common.txt
ffuf -u https://example.com/FUZZ -w wordlist.txt -e .php,.html,.txt
ffuf -u https://example.com -H "Host: FUZZ.example.com" -w subdomains.txt
Core Workflows
Workflow 1: Directory and File Enumeration
For discovering hidden resources on web applications:
Start with common directory wordlist:
ffuf -u https://target.com/FUZZ \
-w /usr/share/seclists/Discovery/Web-Content/common.txt \
-mc 200,204,301,302,307,401,403 \
-o results.json
Review discovered directories (focus on 200, 403 status codes)
Enumerate files in discovered directories:
ffuf -u https://target.com/admin/FUZZ \
-w /usr/share/seclists/Discovery/Web-Content/raft-small-files.txt \
-e .php,.bak,.txt,.zip \
-mc all -fc 404
Use recursive mode for deep enumeration:
ffuf -u https://target.com/FUZZ \
-w wordlist.txt \
-recursion -recursion-depth 2 \
-e .php,.html \
-v
Document findings and test discovered endpoints
Workflow 2: Parameter Fuzzing (GET/POST)
Progress:
[ ] 1. Identify target endpoint for parameter testing
[ ] 2. Fuzz GET parameter names to discover hidden parameters
[ ] 3. Fuzz parameter values for injection vulnerabilities
[ ] 4. Test POST parameters with JSON/form data
[ ] 5. Apply appropriate filters to reduce false positives
[ ] 6. Analyze responses for anomalies and vulnerabilities
[ ] 7. Validate findings manually
[ ] 8. Document vulnerable parameters and payloads
Work through each step systematically. Check off completed items.
GET Parameter Name Fuzzing:
ffuf -u https://target.com/api?FUZZ=test \
-w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
-fs 0
GET Parameter Value Fuzzing:
ffuf -u https://target.com/api?id =FUZZ \
-w payloads.txt \
-mc all
ffuf -u https://target.com/login \
-X POST \
-d "username=admin&password=FUZZ" \
-w passwords.txt \
-H "Content-Type: application/x-www-form-urlencoded"
ffuf -u https://target.com/api/login \
-X POST \
-d '{"username":"admin","password":"FUZZ"}' \
-w passwords.txt \
-H "Content-Type: application/json"
Workflow 3: Virtual Host and Subdomain Discovery For identifying virtual hosts and subdomains:
Prepare subdomain wordlist (or use SecLists)
Run vhost fuzzing:
ffuf -u https://target.com \
-H "Host: FUZZ.target.com" \
-w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
-fs 0
Filter results by comparing response sizes/words
Verify discovered vhosts manually
Enumerate directories on each vhost
Document vhost configurations and exposed services
Workflow 4: Authentication Endpoint Fuzzing For testing login forms and authentication mechanisms:
Identify authentication endpoint
Fuzz usernames:
ffuf -u https://target.com/login \
-X POST \
-d "username=FUZZ&password=test123" \
-w usernames.txt \
-H "Content-Type: application/x-www-form-urlencoded" \
-mr "Invalid password|Incorrect password"
For identified users, fuzz passwords:
ffuf -u https://target.com/login \
-X POST \
-d "username=admin&password=FUZZ" \
-w /usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-1000.txt \
-H "Content-Type: application/x-www-form-urlencoded" \
-fc 401,403
Use clusterbomb mode for combined username/password fuzzing:
ffuf -u https://target.com/login \
-X POST \
-d "username=FUZZ1&password=FUZZ2" \
-w usernames.txt:FUZZ1 \
-w passwords.txt:FUZZ2 \
-mode clusterbomb
Workflow 5: Backup and Sensitive File Discovery For finding exposed backup files and sensitive data:
Create wordlist of common backup patterns
Fuzz for backup files:
ffuf -u https://target.com/FUZZ \
-w backup-files.txt \
-e .bak,.backup,.old,.zip,.tar.gz,.sql,.7z \
-mc 200 \
-o backup-files.json
Test common sensitive file locations:
ffuf -u https://target.com/FUZZ \
-w /usr/share/seclists/Discovery/Web-Content/sensitive-files.txt \
-mc 200,403
Download and analyze discovered files
Report findings with severity classification
Fuzzing Modes ffuf supports multiple fuzzing modes for different attack scenarios:
Clusterbomb Mode - Cartesian product of all wordlists (default):
ffuf -u https://target.com/FUZZ1/FUZZ2 \
-w dirs.txt:FUZZ1 \
-w files.txt:FUZZ2 \
-mode clusterbomb
Tests every combination: dir1/file1, dir1/file2, dir2/file1, dir2/file2
Pitchfork Mode - Parallel iteration of wordlists:
ffuf -u https://target.com/login \
-X POST \
-d "username=FUZZ1&password=FUZZ2" \
-w users.txt:FUZZ1 \
-w passwords.txt:FUZZ2 \
-mode pitchfork
Tests pairs: user1/pass1, user2/pass2 (stops at shortest wordlist)
Sniper Mode - One wordlist, multiple positions:
ffuf -u https://target.com/FUZZ \
-w wordlist.txt \
-mode sniper
Standard single-wordlist fuzzing.
Filtering and Matching Effective filtering is crucial for reducing noise:
Match Filters (only show matching):
-mc 200,301 - Match HTTP status codes-ms 1234 - Match response size-mw 100 - Match word count-ml 50 - Match line count-mr "success|admin" - Match regex pattern in response Filter Options (exclude matching):
-fc 404,403 - Filter status codes-fs 0,1234 - Filter response sizes-fw 0 - Filter word count-fl 0 - Filter line count-fr "error|not found" - Filter regex pattern
ffuf -u https://target.com/FUZZ -w wordlist.txt -ac
Common Patterns
Pattern 1: API Endpoint Discovery Discover REST API endpoints:
ffuf -u https://api.target.com/v1/FUZZ \
-w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt \
-mc 200,201,401,403 \
-o api-endpoints.json
ffuf -u https://api.target.com/FUZZ/users \
-w <(seq 1 10 | sed 's/^/v/' ) \
-mc 200
Pattern 2: Extension Fuzzing Test multiple file extensions:
ffuf -u https://target.com/admin.FUZZ \
-w /usr/share/seclists/Discovery/Web-Content/web-extensions.txt \
-mc 200
ffuf -u https://target.com/FUZZ \
-w filenames.txt \
-e .php,.asp,.aspx,.jsp,.html,.bak,.txt
Pattern 3: Rate-Limited Fuzzing Respect rate limits and avoid detection:
ffuf -u https://target.com/FUZZ \
-w wordlist.txt \
-p 0.5-1.0
ffuf -u https://target.com/FUZZ \
-w wordlist.txt \
-t 5
Pattern 4: Custom Header Fuzzing Fuzz HTTP headers for security misconfigurations:
ffuf -u https://target.com/admin \
-w headers.txt:HEADER \
-H "HEADER: true" \
-mc all
ffuf -u https://target.com/admin \
-H "X-Forwarded-For: FUZZ" \
-w /usr/share/seclists/Fuzzing/IPs.txt \
-mc 200
Pattern 5: Cookie Fuzzing Test cookie-based authentication and session management:
ffuf -u https://target.com/dashboard \
-b "session=FUZZ" \
-w session-tokens.txt \
-mc 200
ffuf -u https://target.com/admin \
-b "FUZZ=admin" \
-w cookie-names.txt
Output Formats Save results in multiple formats:
ffuf -u https://target.com/FUZZ -w wordlist.txt -o results.json -of json
ffuf -u https://target.com/FUZZ -w wordlist.txt -o results.csv -of csv
ffuf -u https://target.com/FUZZ -w wordlist.txt -o results.html -of html
ffuf -u https://target.com/FUZZ -w wordlist.txt -o results -of all
Security Considerations
Sensitive Data Handling : Discovered files may contain credentials, API keys, or PII. Handle findings securely and report responsiblyAccess Control : Only fuzz applications with proper authorization. Obtain written permission before testing third-party systemsAudit Logging : Log all fuzzing activities including targets, wordlists used, and findings for compliance and audit trailsCompliance : Ensure fuzzing activities comply with bug bounty program rules, penetration testing agreements, and legal requirementsSafe Defaults : Use reasonable rate limits to avoid DoS conditions. Start with small wordlists before scaling up
Integration Points
Reconnaissance Workflow
Subdomain enumeration (amass, subfinder)
Port scanning (nmap)
Service identification
ffuf directory/file enumeration Content discovery and analysis
Vulnerability scanning
CI/CD Security Testing Integrate ffuf into automated security pipelines:
set -e
ffuf -u https://staging.example.com/FUZZ \
-w /wordlists/common.txt \
-mc 200,403 \
-o ffuf-results.json \
-of json
if grep -q "/.git/\|/backup/" ffuf-results.json; then
echo "ERROR: Sensitive files exposed!"
exit 1
fi
Integration with Burp Suite
Use Burp to identify target endpoints
Export interesting requests
Convert to ffuf commands for automated fuzzing
Import ffuf results back to Burp for manual testing
Troubleshooting
Issue: Too Many False Positives Solution : Use auto-calibration or manual filtering:
ffuf -u https://target.com/FUZZ -w wordlist.txt -ac
ffuf -u https://target.com/FUZZ -w wordlist.txt -fs 1234,5678
Issue: Rate Limiting or Blocking Solution : Reduce concurrency and add delays:
ffuf -u https://target.com/FUZZ \
-w wordlist.txt \
-t 1 \
-p 2.0 \
-H "User-Agent: Mozilla/5.0..."
Issue: Large Wordlist Takes Too Long Solution : Start with smaller, targeted wordlists:
head -1000 /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt > small.txt
ffuf -u https://target.com/FUZZ -w small.txt
Issue: Missing Discovered Content Solution : Test with multiple extensions and match codes:
ffuf -u https://target.com/FUZZ \
-w wordlist.txt \
-e .php,.html,.txt,.asp,.aspx,.jsp \
-mc all \
-fc 404
OWASP Testing Integration Map ffuf usage to OWASP Testing Guide categories:
WSTG-CONF-04 : Review Old Backup and Unreferenced FilesWSTG-CONF-05 : Enumerate Infrastructure and Application Admin InterfacesWSTG-CONF-06 : Test HTTP MethodsWSTG-IDENT-01 : Test Role Definitions (directory enumeration)WSTG-ATHZ-01 : Test Directory Traversal/File IncludeWSTG-INPVAL-01 : Test for Reflected Cross-site ScriptingWSTG-INPVAL-02 : Test for Stored Cross-site Scripting
References 