Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 33 additions & 27 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,11 @@
# `ffufai`

![GitHub top language](https://img.shields.io/github/languages/top/jthack/ffufai)
![GitHub last commit](https://img.shields.io/github/last-commit/jthack/ffufai)
[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](https://opensource.org/licenses/MIT)

<p class="align center">

ffufai is an AI-powered wrapper for the popular web fuzzer ffuf. It automatically suggests file extensions for fuzzing based on the target URL and its headers, using either OpenAI's GPT or Anthropic's Claude AI models.
ffufai is an AI-powered wrapper for the popular web fuzzer ffuf. It automatically suggests file extensions for fuzzing based on the target URL and its headers, using either OpenAI's GPT or Anthropic's Claude AI models and Free Hugging Face models on local.

</p>

Expand All @@ -21,67 +20,81 @@ ffufai is an AI-powered wrapper for the popular web fuzzer ffuf. It automaticall

- Seamlessly integrates with ffuf
- Automatically suggests relevant file extensions for fuzzing
- Supports both OpenAI and Anthropic AI models
- Supports both OpenAI, Anthropic AI models and Free Hugging Face AI models
- Passes through all ffuf parameters

## Prerequisites

- Python 3.6+
- ffuf (installed and accessible in your PATH)
- An OpenAI API key or Anthropic API key
- An OpenAI API key | Anthropic API key | Gemini API key | Free Hugging Face API key

## Installation

1. Clone this repository:
1. Clone this repository :
```
git clone https://github.com/jthack/ffufai
git clone https://github.com/ikajakam/ffufai.git
cd ffufai
```

2. Install the required Python packages:
2. Install the required Python packages :
```
pip install requests openai anthropic
```

3. Make the script executable:
```
chmod +x ffufai.py
```
3. To load and run `Qwen/Qwen2.5-1.5B-Instruct` model locally via Hugging Face :
```
pip install transformers torch accelerate
```
```
poetry add accelerate
```
- Models are cached in `~/.cache/huggingface`

4. (Optional) To use ffufai from anywhere, you can create a symbolic link in a directory that's in your PATH. For example:
4. To use ffufai globally from terminal, create a symbolic link in a directory that's in your PATH.
```
sudo ln -s /full/path/to/ffufai.py /usr/local/bin/ffufai
```
Replace "/full/path/to/ffufai.py" with the actual full path to where you cloned the repository.

5. Set up your API key as an environment variable:
For OpenAI:
6. Set up your API key as an environment variable :

OpenAI :
```
export OPENAI_API_KEY='your-api-key-here'
```
Or for Anthropic:
Anthropic :
```
export ANTHROPIC_API_KEY='your-api-key-here'
```

You can add these lines to your `~/.bashrc` or `~/.zshrc` file to make them permanent.
Gemini :
```
export GEMINI_API_KEY="your-api-key-here"
```
Hugging Face :
```
export HUGGINGFACE_API_KEY=your-api-key-here ## no ''
```

You can add these lines to your `~/.bashrc` or `~/.zshrc` file to make them permanent and reload your `~/.bashrc` or `~/.zshrc`

## Usage

Use ffufai just like you would use ffuf, but replace `ffuf` with `python3 ffufai.py` (or just `ffufai` if you've created the symbolic link):
Use ffufai just like you would use ffuf, but replace `ffuf` with `python3 ffufai.py` (or just `ffufai` if you've created the symbolic link) :

```
python3 ffufai.py -u https://example.com/FUZZ -w /path/to/wordlist.txt
```

Or if you've created the symbolic link:
Or if you've created the symbolic link :

```
ffufai -u https://example.com/FUZZ -w /path/to/wordlist.txt
```

ffufai will automatically suggest extensions based on the URL and add them to the ffuf command.


## Parameters

ffufai accepts all the parameters that ffuf does, plus a few additional ones:
Expand All @@ -104,16 +117,8 @@ All other ffuf parameters can be used as normal. For a full list of ffuf paramet

- ffufai requires the FUZZ keyword to be at the end of the URL path for accurate extension suggestion. It will warn you if this is not the case.
- All ffuf parameters are passed through to ffuf, so you can use any ffuf option with ffufai.
- If both OpenAI and Anthropic API keys are set, ffufai will prefer the OpenAI key.

HUGE Shoutout to zlz, aka Sam Curry, for the amazing idea to make this project. He suggested it and 2 hours later, here it is :)
<img width="744" alt="image" src="https://github.com/user-attachments/assets/9f914cc4-fe5f-4dbc-b7d9-548473ea2134">

## Troubleshooting

- If you encounter a "command not found" error, make sure you're using `python3 ffufai.py` or that you've correctly set up the symbolic link.
- If you get an API key error, ensure you've correctly set up your OPENAI_API_KEY or ANTHROPIC_API_KEY environment variable.
- If you see "import: command not found" errors, it means the script is being interpreted by the shell instead of Python. Make sure you're running it with `python3 ffufai.py` or that the shebang line at the top of the script is correct.

## Contributing

Expand All @@ -122,3 +127,4 @@ Contributions are welcome! Please feel free to submit a Pull Request.
## License

This project is licensed under the MIT License - see the LICENSE file for details.

Loading