Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →asdfgh1445/Strix•ffuf 用法
Strix ffuf 模糊测试命令手册,覆盖匹配器、过滤器与自动化友好参数;触发名:strix-ffuf
Passed 20 of 21 test cases with the skill, and 14 of 21 without it.
and 2 more in the full report
6 fixed15 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
I need an ffuf command to brute-force a login endpoint at `https://portal.company.com/login` using POST request data where `username=admin` and the password field is fuzzed with `passwords.txt`. Make sure the output command is suitable for automated execution.
| Checked | Without skill | With skill |
|---|---|---|
| Includes -X POST | Missed | Passed |
| Includes -d parameter containing username=admin&password=FUZZ | Missed | Passed |
| Includes the -noninteractive flag | Missed | Passed |
The instructions your model reads when the skill loads.
Official docs:
Canonical syntax:
ffuf -w <wordlist> -u <url_with_FUZZ> [flags]
High-signal flags:
-u <url> target URL containing FUZZ-w <wordlist> wordlist input (supports KEYWORD mapping via -w file:KEYWORD)-mc <codes> match status codes-fc <codes> filter status codes-fs <size> filter by body size-ac auto-calibration-t <n> threads-rate <n> request rate-timeout <seconds> HTTP timeout-x <proxy_url> upstream proxy (HTTP/SOCKS)-ignore-body skip downloading response body-noninteractive disable interactive console mode-recursion and -recursion-depth <n> recursive discovery-H <header> custom headers-X <method> and -d <body> for non-GET fuzzing-o <file> -of <json|ejson|md|html|csv|ecsv> structured outputAgent-safe baseline for automation:
ffuf -w wordlist.txt -u https://target.tld/FUZZ -mc 200,204,301,302,307,401,403,405 -ac -t 20 -rate 50 -timeout 10 -noninteractive -of json -o ffuf.json
Common patterns:
ffuf -w /path/wordlist.txt -u https://target.tld/FUZZ -mc 200,204,301,302,307,401,403 -ac -t 40 -rate 200 -noninteractiveffuf -w vhosts.txt -u https://target.tld -H 'Host: FUZZ.target.tld' -fs 0 -ac -noninteractiveffuf -w values.txt -u 'https://target.tld/search?q=FUZZ' -mc all -fs 0 -ac -t 30 -noninteractiveffuf -w payloads.txt -u https://target.tld/login -X POST -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=admin&password=FUZZ' -fc 401 -noninteractiveffuf -w dirs.txt -u https://target.tld/FUZZ -recursion -recursion-depth 2 -ac -t 30 -noninteractivetest cases passed, vs 14 / 21 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.