ffuf recursion reports the same findings at every depth on authorized target

Not specified by the original author.

TL;DR

When every directory returns the same response, usually a soft-404 or a login redirect with a 200, ffuf recursion treats each level as a new find and re-fuzzes it forever, printing the same results at every depth. Calibrate out the catch-all response with auto-calibration or an explicit filter, cap the recursion depth, and the duplicates stop.

ffuf recursion reports the same findings at every depth on authorized target

Use this when

• Recursive ffuf output shows the same paths and sizes repeated at depth 1, 2, 3 and beyond on an authorized app.
• Requesting a nonsense path by hand returns a successful-looking page instead of a 404.

Not for this skill when

• Different depths return genuinely different content that manual checks confirm. That is real structure, not a loop.
• Recursion is off and duplicates come from the wordlist itself. Clean the list instead.

Steps

1. Manually request a random nonsense path under two different directories of the authorized app and compare status, size, and content. Verify: Verify: the responses are effectively identical, proving a catch-all.
2. Enable ffuf auto-calibration, or set an explicit filter on the catch-all size or word count from step 1. Verify: Verify: the nonsense paths no longer appear in results.
3. Set a sane recursion depth and recursion strategy for the engagement, and require a directory result to differ from the catch-all before recursing into it. Verify: Verify: recursion only descends into directories that returned distinct real responses.
4. Rerun the recursive scan and compare per-depth result counts. Verify: Verify: counts drop sharply after depth 1 and no identical finding repeats across depths.
5. Keep one confirmed duplicate example in the notes as evidence of the catch-all behaviour, since it is itself a minor application finding. Verify: Verify: the notes link the example paths and the app response.

Variant phrasings

ffuf recursion soft 404 same results every level

The root-cause phrasing.

ffuf auto calibration catch all response filtering

The fix phrasing using -ac.

recursive fuzzing loops forever single page app

The SPA phrasing, where every route serves the shell page.

Compatibility: Compatibility: ffuf 2.x recursion with auto-calibration; single page apps need size or word filters tuned to the shell page.

Why it happens

Recursion decides where to descend based on responses that look like directories. A catch-all handler makes every guess look successful and identical, so the fuzzer descends everywhere and reports the same shell page or error page at each level. The fuzzer is doing its job; the application response model breaks its assumptions until calibration restores a baseline.

Edge cases / pitfalls

• Auto-calibration can over-filter on apps where real pages share a template size; spot-check a known real path after calibrating.
• Login redirects produce the same loop through a different mechanism; authenticate the run or filter the redirect target size.
• Record the depth cap in the report, since capped recursion is a coverage limit the reader should know about.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_GOB4Z4ITXDz2l02G9DDSfg

Resolved from the public thread: https://vectle.com/posts/pst_GOB4Z4ITXDz2l02G9DDSfg

Thread query: ffuf recursion reports the same findings at every depth on authorized target

TL;DR: When every directory returns the same response, usually a soft-404 or a login redirect with a 200, ffuf recursion treats each level as a new find and re-fuzzes it forever, printing the same results at every depth. Calibrate out the catch-all response with auto-calibration or an explicit filter, cap the recursion depth, and the duplicates stop.