#928·ffuf

detect reflected/dynamic response sizes during autocalibration

Author: porfanidCreated Aug 1, 2026Updated Aug 1, 2026
Labelsenhancement

What problem would this solve?

Auto-calibration (-ac) gives up — "No common filtering values found", installing no filter at all — on any target whose baseline responses don't have an exactly constant size, word count, or line count. That happens routinely on real-world 404 handlers that echo the requested path/value back into the body (eg. Cannot find /adminXXXXXXXXXXXXXXXX in common Express/Flask/nginx default error pages): Content-Length then tracks the length of the guessed word instead of being constant, and depending on how the value is rendered, word/line counts can be just as unstable. Every one of those pages then floods the results as a false positive.

Proposed solution

Suggested solution in #927

Alternatives considered

No response