ワンクリックでManusで任意のスキルを実行

ffuf

スター6

フォーク2

更新日2026年6月3日 05:58

[recon/exploit] Fast HTTP fuzzer — content/dir discovery, parameter & value fuzzing, and login/credential brute via the FUZZ keyword. Reach for it for forced browsing and (with the authz recipe) ID enumeration.

インストール

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

Manusで実行

ソース

tr4m0ryp

tr4m0ryp/shor

GitHub リポジトリを開く Creator のリポジトリを見る

ダウンロード

Manusで実行

ffuf — HTTP fuzzer

ffuf (pure-Go). Anywhere a request has a fuzzable spot, mark it FUZZ and ffuf iterates a wordlist there. Used for content discovery, vhost/param/value fuzzing, HTTP login brute, and — driven by the authz recipe — object-ID enumeration for IDOR/BOLA.

When to reach for it

Directory/file discovery (forced browsing) on a live host.
Parameter-name and parameter-value fuzzing.
Credential brute over HTTP login forms (auth layer).
IDOR/BOLA ID sweeps (see the authz-recipe skill — capped, read-only).

Key flags

-u <url-with-FUZZ> target; -w <wordlist> (-w list:KEY for named/multiple).
-mc 200,301 match codes; -fc 404 filter; -fs <n> / -fw <n> filter by size/word count (kill boilerplate 200s).
-X POST -d 'user=admin&pass=FUZZ' body fuzz; -H 'Header: FUZZ'; -b 'cookie' auth.
-rate <n> requests/sec; -t <n> threads; -p <s> per-request delay.
-o out.json -of json structured output; -ac auto-calibrate filtering.
-recursion -recursion-depth <n> (use sparingly — multiplies traffic).

Safe invocation

# Content discovery, filter 404s, calibrated, rate-limited, JSON out
ffuf -u https://target.example.com/FUZZ -w wordlist.txt \
  -mc 200,204,301,302,401,403 -ac -rate 30 -t 20 -o ffuf.json -of json

Evidence to capture

Discovered paths/params with status + size (the response that proves the hit).
For ID enumeration: the request and the 200 that returns another identity's object.

Scope & rate caveats

Fuzz ONLY in-scope URLs. -rate is the no-DoS lever — keep it modest; recursion and big wordlists multiply load fast.
For credential brute / ID enumeration, respect the engagement caps (authz recipe: ≤3 sequential IDs to prove a pattern; ≤2 req/sec). Never bulk-dump real users.
Always set a -fs/-fw filter or -ac; an unfiltered run buries the real hits.

このリポジトリの他の Skills

同じリポジトリ

jwt-tool

tr4m0ryp/shor

[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.

2026-06-066

naabu

tr4m0ryp/shor

[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.

2026-06-066

trivy

tr4m0ryp/shor

[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.

2026-06-066

semgrep

tr4m0ryp/shor

[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.

2026-06-066

trufflehog

tr4m0ryp/shor

[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.

2026-06-066

gitleaks

tr4m0ryp/shor

[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.

2026-06-066

ffuf — HTTP fuzzer

When to reach for it

Directory/file discovery (forced browsing) on a live host.

Parameter-name and parameter-value fuzzing.

Credential brute over HTTP login forms (auth layer).

IDOR/BOLA ID sweeps (see the authz-recipe skill — capped, read-only).

Key flags

-u <url-with-FUZZ> target; -w <wordlist> (-w list:KEY for named/multiple).

-mc 200,301 match codes; -fc 404 filter; -fs <n> / -fw <n> filter by size/word count (kill boilerplate 200s).

-X POST -d 'user=admin&pass=FUZZ' body fuzz; -H 'Header: FUZZ'; -b 'cookie' auth.

-rate <n> requests/sec; -t <n> threads; -p <s> per-request delay.

-o out.json -of json structured output; -ac auto-calibrate filtering.

-recursion -recursion-depth <n> (use sparingly — multiplies traffic).

Safe invocation

# Content discovery, filter 404s, calibrated, rate-limited, JSON out ffuf -u https://target.example.com/FUZZ -w wordlist.txt \ -mc 200,204,301,302,401,403 -ac -rate 30 -t 20 -o ffuf.json -of json

Evidence to capture

Discovered paths/params with status + size (the response that proves the hit).

For ID enumeration: the request and the 200 that returns another identity's object.

Scope & rate caveats

Fuzz ONLY in-scope URLs. -rate is the no-DoS lever — keep it modest; recursion and big wordlists multiply load fast.

For credential brute / ID enumeration, respect the engagement caps (authz recipe: ≤3 sequential IDs to prove a pattern; ≤2 req/sec). Never bulk-dump real users.

Always set a -fs/-fw filter or -ac; an unfiltered run buries the real hits.

name	ffuf
description	[recon/exploit] Fast HTTP fuzzer — content/dir discovery, parameter & value fuzzing, and login/credential brute via the FUZZ keyword. Reach for it for forced browsing and (with the authz recipe) ID enumeration.