generalize -recursion to a FUZZ keyword in the body (-d) or headers, not just the URL

What problem would this solve?

Summary

Today -recursion only works when FUZZ is at the end of the URL path (-u must end in FUZZ), and the descent is hardwired to append /FUZZ to the matched URL. I'd like to float the idea of generalizing recursion so the FUZZ keyword can live anywhere in the request — URL, -d body, or a header — and recursion descends on it generically.

Motivation

Recursion is naturally useful beyond directory discovery. The concrete case that prompted this was blind LDAP injection, extracting a value one character at a time via the POST body:

-d 'username=admin)(description=FUZZ*&password=*' -fr 'Login failed'

Each matching character should extend the known prefix and continue fuzzing (H → HT → HTB → HTB{ …). That's conceptually the same "recurse on a match" loop recursion already implements — just not anchored to the URL path. The same idea applies to header-based fuzzing.

Proposed solution

Proposed solution

• Allow FUZZ to be anywhere in the request; recursion descends on it wherever it is.
• On a match, rebuild the next-depth template by replacing FUZZ with matched + separator + FUZZ across method/URL/body/headers.
• -recursion-strategy still governs a URL FUZZ only:
  • default → redirect/directory-based (unchanged),
  • greedy → recurse on every match.
• A body/header FUZZ has no directory concept, so it always recurses on matches (no strategy needed).
• Separator between the matched value and the new FUZZ: / for a URL FUZZ (preserving classic directory recursion byte-for-byte) and "" (literal concatenation) for body/header.

Backward compatibility: URL recursion is unchanged; the only validation change is that it becomes more permissive (it no longer requires the URL to end in FUZZ).

Reference implementation (rough PoC - fully claude code vibecoded - please treat as a sketch, not a PR)

I put together a working proof of concept to make the proposal concrete. Full disclosure: this branch was developed with Claude (Claude Code) and is deliberately "dirty" — it's meant to illustrate the idea and start a discussion, not to be merged as-is.

• Branch: https://github.com/Ne0re0/ffuf/tree/global-recursion
• Commit: https://github.com/Ne0re0/ffuf/commit/cdcd74d

It compiles, and the existing + added tests pass (unit tests for the generic descent, an end-to-end body-recursion integration test).

Alternatives considered

No response