Strix•ffuf 用法 Agent Skill
Strix ffuf 模糊测试命令手册,覆盖匹配器、过滤器与自动化友好参数;触发名:strix-ffuf
Install
one command, takes just this skill from the repositorynpx skills add https://github.com/asdfgh1445/ctf-super-hub --skill Strix•ffuf 用法The instruction itself
1 sections, as written by the authorffuf CLI Playbook
Official docs:
- https://github.com/ffuf/ffuf
Canonical syntax:
ffuf -w <wordlist> -u <url_with_FUZZ> [flags]
High-signal flags:
-u <url>target URL containingFUZZ-w <wordlist>wordlist input (supportsKEYWORDmapping via-w file:KEYWORD)-mc <codes>match status codes-fc <codes>filter status codes-fs <size>filter by body size-acauto-calibration-t <n>threads-rate <n>request rate-timeout <seconds>HTTP timeout-x <proxy_url>upstream proxy (HTTP/SOCKS)-ignore-bodyskip downloading response body-noninteractivedisable interactive console mode-recursionand-recursion-depth <n>recursive discovery-H <header>custom headers-X <method>and-d <body>for non-GET fuzzing-o <file> -of <json|ejson|md|html|csv|ecsv>structured output
Agent-safe baseline for automation:
ffuf -w wordlist.txt -u https://target.tld/FUZZ -mc 200,204,301,302,307,401,403,405 -ac -t 20 -rate 50 -timeout 10 -noninteractive -of json -o ffuf.json
Common patterns:
- Basic path fuzzing:
ffuf -w /path/wordlist.txt -u https://target.tld/FUZZ -mc 200,204,301,302,307,401,403 -ac -t 40 -rate 200 -noninteractive
- Vhost fuzzing:
ffuf -w vhosts.txt -u https://target.tld -H 'Host: FUZZ.target.tld' -fs 0 -ac -noninteractive
- Parameter value fuzzing:
ffuf -w values.txt -u 'https://target.tld/search?q=FUZZ' -mc all -fs 0 -ac -t 30 -noninteractive
- POST body fuzzing:
ffuf -w payloads.txt -u https://target.tld/login -X POST -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=admin&password=FUZZ' -fc 401 -noninteractive
- Recursive discovery:
ffuf -w dirs.txt -u https://target.tld/FUZZ -recursion -recursion-depth 2 -ac -t 30 -noninteractive
- Proxy-instrumented run:
ffuf -w wordlist.txt -u https://target.tld/FUZZ -x http://127.0.0.1:48080 -mc 200,301,302,403 -ac -noninteractive
Critical correctness rules:
FUZZmust appear exactly at the mutation point in URL/header/body.- If using
-w file:KEYWORD, that sameKEYWORDmust be present in URL/header/body. - Always include
-noninteractivein agent/script execution to prevent ffuf console mode from swallowing subsequent shell commands. - Save structured output with
-of json -o <file>for deterministic parsing.
Usage rules:
- Prefer explicit matcher/filter strategy (
-mc/-fc/-fs) over default-only output. - Start conservative (
-rate,-t) and scale only if target tolerance is known. - Do not use
-h/--helpduring normal execution unless absolutely necessary.
Failure recovery:
- If ffuf drops into interactive mode, send
C-cand rerun with-noninteractive. - If response noise is too high, tighten
-mc/-fc/-fsinstead of increasing load. - If runtime is too long, lower
-rate/-tand tighten scope.
If uncertain, query web_search with:
site:github.com/ffuf/ffuf <flag> README
Other skills for the same job
different authors, same section of the catalogue
Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.
Use when implementation is complete, all tests pass, and you need to decide how to integrate the work - guides completion of development work by presenting structured options for merge, PR, or cleanup
Use when implementing any feature or bugfix, before writing implementation code
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes
Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always
Expert guidance for systematic backtesting of trading strategies. Use when developing, testing, stress-testing, or validating quantitative trading strategies. Covers "beating ideas to death" methodology, parameter robustness testing, slippage modeling, bias prevention, and interpreting backtest results. Applicable when user asks about backtesting, strategy validation, robustness testing, avoiding overfitting, or systematic trading development.
Cloud laboratory platform for automated protein testing and validation. Use when designing proteins and needing experimental validation including binding assays, expression testing, thermostability measurements, enzyme activity assays, or protein sequence optimization. Also use for submitting experiments via API, tracking experiment status, downloading results, optimizing protein sequences for better expression using computational tools (NetSolP, SoluProt, SolubleMPNN, ESM), or managing protein design workflows with wet-lab validation.
This skill should be used for time series machine learning tasks including classification, regression, clustering, forecasting, anomaly detection, segmentation, and similarity search. Use when working with temporal data, sequential patterns, or time-indexed observations requiring specialized algorithms beyond standard ML approaches. Particularly suited for univariate and multivariate time series analysis with scikit-learn compatible APIs.
How to use it
Take asdfgh1445/strix•ffuf 用法 from the repository into ~/.claude/skills for personal
use, or into .claude/skills inside a project.
The agent identifies a skill by the name field in its header. Two skills with the
same name cannot sit side by side — one of them will be ignored.