[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EF0CNZ2VRMA9TYR55HW5MW":3,"skill-same:01M6EF0CNZ2VRMA9TYR55HW5MW":45},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":18,"linkOnly":19,"markdownContent":20,"markdownBody":20,"frontMatter":21,"refName":22,"commitSha":23,"skillDirectory":24,"forksCount":25,"repositoryHtmlUrl":26,"repositoryHomepageUrl":27,"ownerHtmlUrl":28,"ownerBlogUrl":6,"ownerDescription":29,"updatedAt":30,"install":31,"resources":44},"01M6EF0CNZ2VRMA9TYR55HW5MW","ffuf",null,"ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",67,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002FTerminalSkills\u002Fskills\u002Fffuf\u002FSKILL.md",[],[5],"2026-11-10 10:12:30",false,"# ffuf (Fuzz Faster U Fool)\n\n## Overview\n\nffuf is the fastest web fuzzer available — written in Go, it discovers hidden files, directories, subdomains, and API endpoints by sending thousands of requests with wordlist-based payloads. Unlike dirbuster or gobuster, ffuf supports multiple fuzzing positions (URL, headers, POST body, cookies), response filtering, and recursive scanning.\n\n## When to Use\n\n- Discovering hidden directories and files on web servers\n- Finding undocumented API endpoints\n- Subdomain and virtual host enumeration\n- Parameter discovery (GET\u002FPOST)\n- Bug bounty reconnaissance\n- Pre-pentest content discovery\n\n## Instructions\n\n### Setup\n\n```bash\n# Install\ngo install github.com\u002Fffuf\u002Fffuf\u002Fv2@latest\n\n# Or download binary\nwget https:\u002F\u002Fgithub.com\u002Fffuf\u002Fffuf\u002Freleases\u002Flatest\u002Fdownload\u002Fffuf_linux_amd64.tar.gz\ntar xzf ffuf_linux_amd64.tar.gz\n\n# Get wordlists (SecLists is the standard)\ngit clone --depth 1 https:\u002F\u002Fgithub.com\u002Fdanielmiessler\u002FSecLists.git\n```\n\n### Directory Discovery\n\n```bash\n# Basic directory fuzzing — FUZZ keyword marks the injection point\nffuf -u https:\u002F\u002Ftarget.com\u002FFUZZ -w SecLists\u002FDiscovery\u002FWeb-Content\u002Fcommon.txt\n\n# Filter by response code (ignore 404s)\nffuf -u https:\u002F\u002Ftarget.com\u002FFUZZ -w common.txt -fc 404\n\n# Filter by response size (remove default pages)\nffuf -u https:\u002F\u002Ftarget.com\u002FFUZZ -w common.txt -fs 4242\n\n# Match only specific codes\nffuf -u https:\u002F\u002Ftarget.com\u002FFUZZ -w common.txt -mc 200,301,302,403\n\n# Recursive scanning — follow discovered directories\nffuf -u https:\u002F\u002Ftarget.com\u002FFUZZ -w common.txt -recursion -recursion-depth 2\n\n# With extensions\nffuf -u https:\u002F\u002Ftarget.com\u002FFUZZ -w common.txt -e .php,.bak,.old,.txt,.json,.env\n```\n\n### Subdomain Discovery\n\n```bash\n# Subdomain fuzzing via DNS\nffuf -u https:\u002F\u002FFUZZ.target.com -w SecLists\u002FDiscovery\u002FDNS\u002Fsubdomains-top1million-5000.txt -fc 404\n\n# Virtual host discovery (different from DNS — checks Host header)\nffuf -u https:\u002F\u002Ftarget.com -w subdomains.txt -H \"Host: FUZZ.target.com\" -fs 1234\n```\n\n### API Endpoint Discovery\n\n```bash\n# REST API path fuzzing\nffuf -u https:\u002F\u002Fapi.target.com\u002Fv1\u002FFUZZ -w SecLists\u002FDiscovery\u002FWeb-Content\u002Fapi\u002Fapi-endpoints.txt -mc 200,401,403\n\n# API with authentication\nffuf -u https:\u002F\u002Fapi.target.com\u002Fv1\u002FFUZZ -w api-endpoints.txt \\\n  -H \"Authorization: Bearer eyJhbG...\" -mc 200\n\n# Parameter fuzzing (GET)\nffuf -u \"https:\u002F\u002Ftarget.com\u002Fapi\u002Fusers?FUZZ=value\" -w SecLists\u002FDiscovery\u002FWeb-Content\u002Fburp-parameter-names.txt -fs 0\n\n# POST body parameter fuzzing\nffuf -u https:\u002F\u002Ftarget.com\u002Fapi\u002Flogin -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"username\":\"admin\",\"FUZZ\":\"test\"}' \\\n  -w params.txt -fc 400\n```\n\n### Advanced Usage\n\n```bash\n# Multiple wordlists (two FUZZ positions: W1 and W2)\nffuf -u https:\u002F\u002Ftarget.com\u002FW1\u002FW2 -w endpoints.txt:W1 -w ids.txt:W2\n\n# Output to JSON for automation\nffuf -u https:\u002F\u002Ftarget.com\u002FFUZZ -w common.txt -o results.json -of json\n\n# Throttled scanning (polite)\nffuf -u https:\u002F\u002Ftarget.com\u002FFUZZ -w common.txt -rate 50 -t 10\n\n# Custom match on response body\nffuf -u https:\u002F\u002Ftarget.com\u002FFUZZ -w common.txt -mr \"admin|dashboard|config\"\n```\n\n## Examples\n\n### Example 1: Full recon on a new target\n\n**User prompt:** \"I have permission to pentest example.com. Start with content discovery.\"\n\nThe agent will run ffuf for directory discovery with common.txt, then check for backup files (.bak, .old, .sql), hidden API endpoints, and admin panels.\n\n### Example 2: Find hidden API endpoints\n\n**User prompt:** \"Our API has undocumented endpoints left by previous developers. Find them.\"\n\nThe agent will fuzz API paths with REST-specific wordlists, try common API versioning patterns (\u002Fv1\u002F, \u002Fv2\u002F), and check HTTP methods (GET, POST, PUT, DELETE) on discovered endpoints.\n\n## Guidelines\n\n- **ALWAYS have authorization** — fuzzing without permission is illegal\n- **Start with common.txt** — then escalate to bigger wordlists if needed\n- **Filter noise first** — use `-fc 404` or `-fs \u003Csize>` to remove false positives\n- **Rate limit** — `-rate 50` for production targets, unlimited for local\u002Fstaging\n- **FUZZ is the keyword** — place it wherever you want to inject wordlist entries\n- **Extensions matter** — `-e .php,.bak,.env` catches backup and config files\n- **JSON output for automation** — `-o results.json -of json` for pipeline integration\n- **Recursive with caution** — `-recursion-depth 2` max to avoid infinite loops\n- **SecLists is essential** — the standard wordlist collection for web fuzzing\n",{},"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002FTerminalSkills\u002Fskills\u002Fffuf",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":7,"skillName":5,"commands":32,"prompt":42,"zipAvailable":43},[33,36,39],{"tool":34,"command":35},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill ffuf",{"tool":37,"command":38},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill ffuf",{"tool":40,"command":41},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill ffuf","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002FTerminalSkills\u002Fskills\u002Fffuf\u002FSKILL.md",true,[],[46,60,70,79,85,92],{"skillNo":47,"name":48,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":49,"categories":50,"keywords":56,"publishedAt":18},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[51],{"categoryNo":52,"categoryName":53,"taxonomyType":54,"taxonomyTypeDesc":55},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[57,58,59],"model","model hierarchy","model hierarchy skill",{"skillNo":61,"name":62,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":63,"categories":64,"keywords":66,"publishedAt":18},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[65],{"categoryNo":52,"categoryName":53,"taxonomyType":54,"taxonomyTypeDesc":55},[67,68,69],"MCP","zoom","zoom mcp",{"skillNo":71,"name":72,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":73,"categories":74,"keywords":75,"publishedAt":18},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[76,77,78,68],"sdk","zoom apps sdk","apps",{"skillNo":80,"name":81,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":84,"publishedAt":18},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[81],{"skillNo":86,"name":87,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":91,"publishedAt":18},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[90],{"categoryNo":52,"categoryName":53,"taxonomyType":54,"taxonomyTypeDesc":55},[87],{"skillNo":93,"name":94,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":97,"publishedAt":18},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[94]]