agentsclimarketplace
Sign in

Strix ffuf

Skill asdfgh1445/ctf-super-hub/strix-ffuf

Strix ffuf 模糊测试命令手册,覆盖匹配器、过滤器与自动化友好参数;触发名:strix-ffufFrom its SKILL.md

Install
npx -y skills add asdfgh1445/ctf-super-hub --skill strix-ffuf

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.

SKILL.md

3.0 KB, 869 tokens by cl100k_base, as published. Nobody here has run it

ffuf CLI Playbook

Official docs:

Canonical syntax: ffuf -w <wordlist> -u <url_with_FUZZ> [flags]

High-signal flags:

  • -u <url> target URL containing FUZZ
  • -w <wordlist> wordlist input (supports KEYWORD mapping via -w file:KEYWORD)
  • -mc <codes> match status codes
  • -fc <codes> filter status codes
  • -fs <size> filter by body size
  • -ac auto-calibration
  • -t <n> threads
  • -rate <n> request rate
  • -timeout <seconds> HTTP timeout
  • -x <proxy_url> upstream proxy (HTTP/SOCKS)
  • -ignore-body skip downloading response body
  • -noninteractive disable interactive console mode
  • -recursion and -recursion-depth <n> recursive discovery
  • -H <header> custom headers
  • -X <method> and -d <body> for non-GET fuzzing
  • -o <file> -of <json|ejson|md|html|csv|ecsv> structured output

Agent-safe baseline for automation: ffuf -w wordlist.txt -u https://target.tld/FUZZ -mc 200,204,301,302,307,401,403,405 -ac -t 20 -rate 50 -timeout 10 -noninteractive -of json -o ffuf.json

Common patterns:

  • Basic path fuzzing: ffuf -w /path/wordlist.txt -u https://target.tld/FUZZ -mc 200,204,301,302,307,401,403 -ac -t 40 -rate 200 -noninteractive
  • Vhost fuzzing: ffuf -w vhosts.txt -u https://target.tld -H 'Host: FUZZ.target.tld' -fs 0 -ac -noninteractive
  • Parameter value fuzzing: ffuf -w values.txt -u 'https://target.tld/search?q=FUZZ' -mc all -fs 0 -ac -t 30 -noninteractive
  • POST body fuzzing: ffuf -w payloads.txt -u https://target.tld/login -X POST -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=admin&password=FUZZ' -fc 401 -noninteractive
  • Recursive discovery: ffuf -w dirs.txt -u https://target.tld/FUZZ -recursion -recursion-depth 2 -ac -t 30 -noninteractive
  • Proxy-instrumented run: ffuf -w wordlist.txt -u https://target.tld/FUZZ -x http://127.0.0.1:48080 -mc 200,301,302,403 -ac -noninteractive

Critical correctness rules:

  • FUZZ must appear exactly at the mutation point in URL/header/body.
  • If using -w file:KEYWORD, that same KEYWORD must be present in URL/header/body.
  • Always include -noninteractive in agent/script execution to prevent ffuf console mode from swallowing subsequent shell commands.
  • Save structured output with -of json -o <file> for deterministic parsing.

Usage rules:

  • Prefer explicit matcher/filter strategy (-mc/-fc/-fs) over default-only output.
  • Start conservative (-rate, -t) and scale only if target tolerance is known.
  • Do not use -h/--help during normal execution unless absolutely necessary.

Failure recovery:

  • If ffuf drops into interactive mode, send C-c and rerun with -noninteractive.
  • If response noise is too high, tighten -mc/-fc/-fs instead of increasing load.
  • If runtime is too long, lower -rate/-t and tighten scope.

If uncertain, query web_search with: site:github.com/ffuf/ffuf <flag> README

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.