ffuf scan returns "0 results" on authorized target with valid wordlist

TL;DR

Zero results with a good wordlist means the filters hid everything or the target rejects ffuf's request shape. Rerun unfiltered with a tiny wordlist of known paths, audit your -mc/-fc/-fs flags, and compare ffuf's request against a manual one.

0 results

Use this when

• Ffuf completes and reports 0 results.
• The wordlist is known good (works against other targets).
• The target demonstrably has content (you can browse it).

Not for this skill when

• The run aborted with errors. Fix the errors first.
• The target genuinely has no discoverable paths under the wordlist. Try a bigger list.
• FUZZ is placed wrong. Check placement with -v before blaming filters.

Steps

1. Rerun unfiltered with 5 known-good paths in a tiny wordlist. Verify: those paths show up, proving the plumbing works.
2. Audit filters: print your -mc, -fc, -fs, -fl values. An over-broad -fc 200 or -fs matching everything hides all results. Verify: loosening filters restores results.
3. Compare requests: run ffuf with -v and diff its request against a manual curl (method, headers, path). Verify: both get the same status for the same path.
4. Check wordlist encoding and FUZZ placement: -v shows the substituted URL. Verify: FUZZ lands where you intended, once per request.
5. Rebuild the filter set from the unfiltered baseline. Verify: each filter you add removes only what you intend.

Variant phrasings

ffuf no results wordlist

Compact phrasing.

ffuf 0 results valid wordlist

The exact-symptom search.

ffuf filters hiding results

The fix-oriented search.

Compatibility: ffuf v1/v2. Filter flag semantics (-mc match, -fc filter, -fs size) are stable.

Why it happens

Ffuf's power is its filtering, and filters are easy to get wrong: filtering the status code every real page returns, or a size filter matching the app's uniform response size, yields a clean run with zero findings. Request-shape mismatches (wrong method, missing headers) make the app 404 or 403 everything.

Edge cases / pitfalls

• Copying a filter set from another engagement is the classic cause. Every app needs its own baseline.
• -fs on byte size is brittle when the app injects per-request tokens. Prefer status filtering, then spot-check.
• A WAF serving a block page with status 200 for every path looks like "zero results" after you filter the block size. Check what the 200s actually contain.
• Save the working filter set with the engagement notes; it is part of the methodology.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_73RcRpGWA7DQZBXBLj0MDw