一键在 Manus 中运行任何 Skill

ffuf

星标6

分支2

更新时间2026年6月3日 05:58

[recon/exploit] Fast HTTP fuzzer — content/dir discovery, parameter & value fuzzing, and login/credential brute via the FUZZ keyword. Reach for it for forced browsing and (with the authz recipe) ID enumeration.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

tr4m0ryp

tr4m0ryp/shor

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

ffuf — HTTP fuzzer

ffuf (pure-Go). Anywhere a request has a fuzzable spot, mark it FUZZ and ffuf iterates a wordlist there. Used for content discovery, vhost/param/value fuzzing, HTTP login brute, and — driven by the authz recipe — object-ID enumeration for IDOR/BOLA.

When to reach for it

Directory/file discovery (forced browsing) on a live host.
Parameter-name and parameter-value fuzzing.
Credential brute over HTTP login forms (auth layer).
IDOR/BOLA ID sweeps (see the authz-recipe skill — capped, read-only).

Key flags

-u <url-with-FUZZ> target; -w <wordlist> (-w list:KEY for named/multiple).
-mc 200,301 match codes; -fc 404 filter; -fs <n> / -fw <n> filter by size/word count (kill boilerplate 200s).
-X POST -d 'user=admin&pass=FUZZ' body fuzz; -H 'Header: FUZZ'; -b 'cookie' auth.
-rate <n> requests/sec; -t <n> threads; -p <s> per-request delay.
-o out.json -of json structured output; -ac auto-calibrate filtering.
-recursion -recursion-depth <n> (use sparingly — multiplies traffic).

Safe invocation

# Content discovery, filter 404s, calibrated, rate-limited, JSON out
ffuf -u https://target.example.com/FUZZ -w wordlist.txt \
  -mc 200,204,301,302,401,403 -ac -rate 30 -t 20 -o ffuf.json -of json

Evidence to capture

Discovered paths/params with status + size (the response that proves the hit).
For ID enumeration: the request and the 200 that returns another identity's object.

Scope & rate caveats

Fuzz ONLY in-scope URLs. -rate is the no-DoS lever — keep it modest; recursion and big wordlists multiply load fast.
For credential brute / ID enumeration, respect the engagement caps (authz recipe: ≤3 sequential IDs to prove a pattern; ≤2 req/sec). Never bulk-dump real users.
Always set a -fs/-fw filter or -ac; an unfiltered run buries the real hits.

同仓库更多 Skills

同仓库

jwt-tool

tr4m0ryp/shor

[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.

2026-06-066

naabu

tr4m0ryp/shor

[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.

2026-06-066

trivy

tr4m0ryp/shor

[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.

2026-06-066

semgrep

tr4m0ryp/shor

[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.

2026-06-066

trufflehog

tr4m0ryp/shor

[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.

2026-06-066

gitleaks

tr4m0ryp/shor

[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.

2026-06-066

name	ffuf
description	[recon/exploit] Fast HTTP fuzzer — content/dir discovery, parameter & value fuzzing, and login/credential brute via the FUZZ keyword. Reach for it for forced browsing and (with the authz recipe) ID enumeration.

ffuf — HTTP fuzzer

When to reach for it

Directory/file discovery (forced browsing) on a live host.
Parameter-name and parameter-value fuzzing.
Credential brute over HTTP login forms (auth layer).
IDOR/BOLA ID sweeps (see the authz-recipe skill — capped, read-only).

Key flags

-u <url-with-FUZZ> target; -w <wordlist> (-w list:KEY for named/multiple).
-mc 200,301 match codes; -fc 404 filter; -fs <n> / -fw <n> filter by size/word count (kill boilerplate 200s).
-X POST -d 'user=admin&pass=FUZZ' body fuzz; -H 'Header: FUZZ'; -b 'cookie' auth.
-rate <n> requests/sec; -t <n> threads; -p <s> per-request delay.
-o out.json -of json structured output; -ac auto-calibrate filtering.
-recursion -recursion-depth <n> (use sparingly — multiplies traffic).

Safe invocation

# Content discovery, filter 404s, calibrated, rate-limited, JSON out
ffuf -u https://target.example.com/FUZZ -w wordlist.txt \
  -mc 200,204,301,302,401,403 -ac -rate 30 -t 20 -o ffuf.json -of json

Evidence to capture

Discovered paths/params with status + size (the response that proves the hit).
For ID enumeration: the request and the 200 that returns another identity's object.

Scope & rate caveats

Fuzz ONLY in-scope URLs. -rate is the no-DoS lever — keep it modest; recursion and big wordlists multiply load fast.
For credential brute / ID enumeration, respect the engagement caps (authz recipe: ≤3 sequential IDs to prove a pattern; ≤2 req/sec). Never bulk-dump real users.
Always set a -fs/-fw filter or -ac; an unfiltered run buries the real hits.