ffuf output json missing results array after crash during authorized scan

TL;DR

ffuf only writes the final results array when it exits cleanly, so a crash leaves a truncated JSON file with headers but no results. Check the file tail to confirm truncation, salvage the intact config block for the exact re-run flags, then re-run the scan in smaller chunks with separate output files.

(output file missing "results" array after ffuf crash)

Use this when

• ffuf -o out.json was killed or crashed and the file ends abruptly without a results key.
• You need the partial findings back without re-running the full wordlist blindly.
• The target is in your authorized scope and the re-run budget is limited.

Not for this skill when

• ffuf finished cleanly but found nothing. Empty results are a legitimate outcome, not this bug.
• You streamed output with a line-based format. Truncation behaves differently there.

Steps

1. Inspect the tail of the output: tail -c 400 out.json. Verify: the file ends mid-structure instead of closing cleanly, which confirms truncation rather than a parser bug on your side.
2. Salvage the intact parts: the commandline and config blocks at the top of the file survive most crashes. Verify: you can recover the exact flags and wordlist path from the file head for the re-run.
3. Re-run in chunks by splitting the wordlist: split -l 5000 wordlist.txt chunk_ and give each chunk its own -o chunk_N.json. Verify: each chunk run gets a separate output file so one crash cannot wipe everything.
4. Add -rate throttling if the crash correlated with target-side resets, which is common right before a crash. Verify: chunk runs complete without the connection-error storm that preceded the crash.
5. Merge the chunk JSONs with a small script that concatenates the results arrays. Verify: the merged file parses and the match count equals the sum of the chunk counts.

Variant phrasings

ffuf json output incomplete after crash

Shorter symptom phrasing.

ffuf -o file corrupt interrupted scan

The interrupt-flavored search.

Compatibility: ffuf 1.x/2.x JSON output. Results serialize at the end of the run in all recent versions.

Why it happens

ffuf accumulates matches in memory and writes the JSON document once at exit. A SIGKILL, an out-of-memory kill, or a panic skips the serialization step entirely, leaving headers plus a partial body. Nothing is wrong with the findings that were matched; they were simply never flushed to disk.

Edge cases / pitfalls

• Do not trust the truncated file even if a results key exists but is empty: on some crashes ffuf writes an empty array early. Re-run to be sure.
• If crashes repeat at the same wordlist offset, the target may be rate-limiting or dropping your tester box. Back off the request rate before assuming a tool bug.
• Huge single-file JSON outputs also strain downstream agent parsers. Chunked outputs are friendlier to both humans and pipelines.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_JZm8yowFYwo6e11PYtBgvA