mcpField
F
fuzz

fuzz

github.com/ariadossSecurity1259 installsUpdated 1d ago
Repository

About fuzz

fuzz is a lightweight web application fuzzing skill that uses ffuf. It helps security testers discover paths, API endpoints, parameters, and subdomains, with response filters and JSON output options.

Key features

  1. 01Directory and file discovery
  2. 02API endpoint discovery
  3. 03GET and POST parameter fuzzing
  4. 04Subdomain enumeration
  5. 05Filter responses by status and content
  6. 06Export results as JSON

Use cases

  1. 01Find hidden web paths and files
  2. 02Probe API routes with wordlists
  3. 03Test web parameters and login inputs
  4. 04Enumerate subdomains and save scan results

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/ariadoss/superskills --skill fuzz

After installing, type/fuzzin Claude Code to confirm it loaded.

Details

From the project README

Fuzz — Web Fuzzing with ffuf

Lightweight web application fuzzing using ffuf.

Prerequisites

command -v ffuf && ffuf -V

If not installed:

brew install ffuf    # macOS
# or
go install github.com/ffuf/ffuf/v2@latest

Common Wordlists

/usr/share/wordlists/                          # Kali default
/opt/homebrew/share/wordlists/                 # Homebrew
~/.local/share/wordlists/                      # User-local

# SecLists (install: brew install seclists)
/opt/homebrew/share/seclists/Discovery/Web-Content/common.txt
/opt/homebrew/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
/opt/homebrew/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
/opt/homebrew/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt

If no wordlists found: brew install seclists

Usage Patterns

Directory / File Discovery
ffuf -u https://TARGET/FUZZ -w wordlist.txt -mc 200,301,302,403
API Endpoint Discovery
ffuf -u https://TARGET/api/FUZZ -w wordlist.txt -mc 200,401,403,405
Parameter Fuzzing (GET)
ffuf -u "https://TARGET/page?FUZZ=value" -w params.txt -mc 200 -fs 4242
POST Data Fuzzing
ffuf -u https://TARGET/login -X POST \
  -d "username=admin&password=FUZZ" \
  -w passwords.txt -mc 200 -fc 401
Subdomain Enumeration
ffuf -u https://FUZZ.TARGET.com -w subdomains.txt -mc 200,301,302
Authenticated Fuzzing
ffuf -u https://TARGET/api/FUZZ -w wordlist.txt \
  -H "Authorization: Bearer <token>" \
  -H "Cookie: session=<value>" \
  -mc 200,201,403

Filtering Options

  • -mc 200,301 — match HTTP status codes
  • -fc 404,500 — filter (exclude) status codes
  • -fs 4242 — filter by response size (removes noise)
  • -fw 12 — filter by word count
  • -fr "not found" — filter by regex in response

Output

ffuf -u https://TARGET/FUZZ -w wordlist.txt -o results.json -of json

Tips

  • Start with small wordlists, expand if needed
  • Use -rate 100 to limit requests per second (avoid DoS)
  • Use -t 40 to control thread count (default: 40)
  • Run once without filters, note the common response size, then add -fs
  • Combine with -recursion -recursion-depth 2 for recursive discovery

Comments

Markdown supported