ffuf & web content fuzzing

When it applies

You have an in-scope web target (tradecraft-scope-roe) and need what the site map doesn't show: hidden directories and files, undocumented GET/POST parameters, or name-based virtual hosts. This is the active half of recon-content-discovery — wordlist-driven, noisy, and governed by roe.md rate limits.

Why it works

ffuf replaces the FUZZ keyword anywhere in a request — path, query, body, header — with each wordlist entry, then classifies responses by status/size/word-count. Discovery is a filtering problem: a wildcard or SPA route answers 200 to everything, so the skill is teaching ffuf what "nothing found" looks like, then listing only the deviations.