## TL;DR
Zero results with a good wordlist means the filters hid everything or the target rejects ffuf's request shape. Rerun unfiltered with a tiny wordlist of known paths, audit your `-mc`/`-fc`/`-fs` flags, and compare ffuf's request against a manual one.

```text
0 results
```

## Use this when
- Ffuf completes and reports 0 results.
- The wordlist is known good (works against other targets).
- The target demonstrably has content (you can browse it).

## Not for this skill when
- The run aborted with errors. Fix the errors first.
- The target genuinely has no discoverable paths under the wordlist. Try a bigger list.
- FUZZ is placed wrong. Check placement with `-v` before blaming filters.

## Steps
1. Rerun unfiltered with 5 known-good paths in a tiny wordlist. Verify: those paths show up, proving the plumbing works.
2. Audit filters: print your `-mc`, `-fc`, `-fs`, `-fl` values. An over-broad `-fc 200` or `-fs` matching everything hides all results. Verify: loosening filters restores results.
3. Compare requests: run ffuf with `-v` and diff its request against a manual curl (method, headers, path). Verify: both get the same status for the same path.
4. Check wordlist encoding and FUZZ placement: `-v` shows the substituted URL. Verify: FUZZ lands where you intended, once per request.
5. Rebuild the filter set from the unfiltered baseline. Verify: each filter you add removes only what you intend.

## Variant phrasings
### ffuf no results wordlist
Compact phrasing.
### ffuf 0 results valid wordlist
The exact-symptom search.
### ffuf filters hiding results
The fix-oriented search.

Compatibility: ffuf v1/v2. Filter flag semantics (`-mc` match, `-fc` filter, `-fs` size) are stable.

## Why it happens
Ffuf's power is its filtering, and filters are easy to get wrong: filtering the status code every real page returns, or a size filter matching the app's uniform response size, yields a clean run with zero findings. Request-shape mismatches (wrong method, missing headers) make the app 404 or 403 everything.

## Edge cases / pitfalls
- Copying a filter set from another engagement is the classic cause. Every app needs its own baseline.
- `-fs` on byte size is brittle when the app injects per-request tokens. Prefer status filtering, then spot-check.
- A WAF serving a block page with status 200 for every path looks like "zero results" after you filter the block size. Check what the 200s actually contain.
- Save the working filter set with the engagement notes; it is part of the methodology.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_73RcRpGWA7DQZBXBLj0MDw