agent ffuf fuzzing run failed: timed out with no checkpoint saved

TL;DR

ffuf has no native resume, so the agent must build one: shard the wordlist into chunks, run one ffuf invocation per chunk with its own JSON output file, and record completed chunks. A timeout then loses at most one chunk, and the retry covers only what is missing.

agent ffuf fuzzing run failed: timed out with no checkpoint saved

Use this when

• ffuf is killed by a timeout and the agent reports the fuzzing run as a total loss.
• The agent runs one huge wordlist in a single ffuf invocation.
• Retries replay the entire wordlist from the top.

Not for this skill when

• ffuf completes but returns zero results. That is a wordlist or filter problem.
• ffuf fails to start (bad flags, unreachable target). That is a setup problem.
• The wordlist is small enough to finish comfortably inside the step timeout. Chunking adds nothing.

Steps

1. Split the wordlist into chunks of a few thousand entries each, for example with split -l 5000 wordlist.txt chunk_. Verify: the chunk files exist and their line counts sum to the original.
2. Run one ffuf invocation per chunk with JSON output, for example ffuf -u TARGET_URL/FUZZ -w chunk_aa -o chunk_aa.json. Verify: each chunk command is independently runnable and writes its own file.
3. Wrap each chunk in its own timeout sized to the chunk, not the whole wordlist. Verify: a slow chunk exits with code 124 while completed chunk files stay valid.
4. Maintain a progress file listing finished chunks; after any kill, the agent runs only the chunks with no output file. Verify: the retry plan skips every completed chunk.
5. Merge the per-chunk JSON files into one findings list at the end, deduplicating by URL and status code. Verify: the merged count equals the sum of per-chunk matches.

Variant phrasings

ffuf timeout with no saved progress

Same sharding fix.

agent lost ffuf fuzzing results on kill

Process-kill variant.

resume ffuf run after agent timeout

Resume phrasing.

Compatibility: ffuf 2.x. JSON output per run and wordlist sharding are tool-agnostic patterns.

Why it happens

ffuf streams results to the terminal and only writes its final output file when the run completes, so a killed run leaves nothing the agent can use. Agents also default to one giant wordlist because it is one command. Sharding converts the single all-or-nothing run into independent units with durable per-unit output, which is the checkpoint ffuf itself does not provide.

Edge cases / pitfalls

• Chunk boundaries must not split multi-line entries. Use line-based wordlists or a splitter that understands the wordlist format.
• Recursion (-recursion) inside chunks multiplies work unpredictably. Keep recursion off during the chunked pass, then recurse only into confirmed directories.
• Rate-limit the chunks if the target is sensitive; sharding makes it easy to go faster, which is not always what the engagement allows.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstIwBw75OYUwg20gynS7LNQ