web-fuzzing

ljchg12-hue's avatarfrom ljchg12-hue

Web application security testing using fuzzing techniques to discover vulnerabilities, injection points, and edge cases

⭐0stars🔀0forks📁View on GitHub🕐Updated Jan 6, 2026
[Security Operations]

When & Why to Use This Skill

This Claude skill automates web application security testing through advanced fuzzing techniques. It empowers developers and security teams to proactively discover critical vulnerabilities such as SQL injection, Cross-Site Scripting (XSS), and path traversal by systematically probing input fields, API endpoints, and file upload systems to ensure robust application defense.

Use Cases

  • Vulnerability Discovery: Automatically scanning web applications for common security flaws like SQL injection, XSS, and command injection during the development lifecycle.
  • API Security Auditing: Testing REST or GraphQL endpoints for improper input handling, edge cases, and potential authentication bypass vulnerabilities.
  • Automated Penetration Testing: Integrating high-performance tools like ffuf and sqlmap to identify hidden directories, sensitive files, and exploitable injection points.
  • Input Validation Testing: Systematically verifying how an application processes malicious or unexpected data to prevent unauthorized access and data breaches.
nameweb-fuzzing
descriptionWeb application security testing using fuzzing techniques to discover vulnerabilities, injection points, and edge cases

Web Fuzzing Skill

Automated security testing using fuzzing to discover web application vulnerabilities.

When to Use

  • Security testing
  • Vulnerability discovery
  • Input validation testing
  • API endpoint testing

Core Capabilities

  • Parameter fuzzing
  • Path traversal testing
  • SQL injection detection
  • XSS vulnerability scanning
  • Command injection testing
  • File upload vulnerabilities
  • Authentication bypass attempts

Tools

# ffuf (Fast web fuzzer)
ffuf -u https://target.com/FUZZ -w wordlist.txt

# wfuzz
wfuzz -c -z file,wordlist.txt https://target.com/FUZZ

# Burp Suite Intruder
# SQLmap for SQL injection
sqlmap -u "https://target.com/page?id=1" --batch

# XSStrike
python xsstrike.py -u "https://target.com/search?q=test"

Fuzzing Patterns

  • Path traversal: ../../../etc/passwd
  • SQL injection: ' OR '1'='1
  • Command injection: ; ls -la
  • XSS: <script>alert(1)</script>

Best Practices

  • Get authorization before testing
  • Use rate limiting
  • Test in staging environment
  • Document findings
  • Follow responsible disclosure

Resources