#892·ffuf

unexpected behaviors when fuzzing multiple urls

Author: pwn0xfffCreated Apr 24, 2026Updated Apr 24, 2026

OS: Linux ubuntu 24 LTS ffuf release: 2.1.0-dev

command used ffuf -u "FUZZURL/FUZZWORDS" -mc all -fc 404 -sa -ac -w /opt/SecLists/Discovery/Web-Content/big.txt:FUZZWORDS,./webs.txt:FUZZURL

  • There are two unusual behaviors here, the first one is that ffuf errors out on the first request [ERR] Encountered an error while executing autocalibration request: Get "adminPfRXnLNIBvZMeTToURL/adminPfRXnLNIBvZMeTToWORDS": unsupported protocol scheme "" somehow ffuf is taking both FUZZURL FUZZWORDS from the big.txt wordlist instead of reading each wordlist separately ( this happens at the first 4-5 requests but then it finds its way to the correct values ).

  • The second unexpected behavior is that ffuf will ignore the ac, sa, se, sf flags midway while fuzzing ( If I am not wrong in the first few requests the ac and sa are applied but after a while their logic is dropped ).

  • Also something to note is that all filtering flags must be used before the -w flag which is kind of weird since I always use them at the end when fuzzing a single url.