Interactive console

ffuf runs an interactive console the whole time a scan is going. You don't have to kill the job and start over just because you want to tighten a filter or slow down the request rate: pause, adjust, resume.

It's on by default. Press ENTER during a run to pause and drop into the console. Press ENTER again (or type resume) to pick up where you left off.

# The console is on unless you turn it off
ffuf -w wordlist.txt -u 'https://ffuf.io.fi/FUZZ'

When you pause, ffuf prints:

entering interactive mode
type "help" for a list of commands, or ENTER to resume.

Type help (or ?) for the full list:

 afc  [value]        - append to status code filter
 fc   [value]        - (re)configure status code filter
 afl  [value]        - append to line count filter
 fl   [value]        - (re)configure line count filter
 afw  [value]        - append to word count filter
 fw   [value]        - (re)configure word count filter
 afs  [value]        - append to size filter
 fs   [value]        - (re)configure size filter
 aft  [value]        - append to time filter
 ft   [value]        - (re)configure time filter
 rate [value]        - adjust rate of requests per second
 queueshow           - show job queue
 queuedel [number]   - delete a job in the queue
 queueskip           - advance to the next queued job
 restart             - restart and resume the current ffuf job
 resume              - resume current ffuf job (or: ENTER)
 show                - show results for the current job
 savejson [filename] - save current matches to a file
 help                - you are looking at it

Opening the console pauses new requests, but requests already in flight keep coming back. Rather than let their results scroll the console off your screen, ffuf holds them: they're recorded, but not printed, while you're in the console. The prompt shows how many are waiting:

[3 new] >

When you resume, ffuf tells you how many turned up and carries on:

3 new match(es) found while paused. Type "show" to display them.

Held matches are real results: show prints them, savejson includes them, and they land in your output file. They're just kept out of the console so the banner and your commands stay put. If you tighten a filter while paused, any held match that no longer passes is dropped from that count too, so the number never contradicts what show prints.

This is the part you'll actually use. Say the scan is filling up with 302s you don't want. Pause and set a status filter without losing the run:

> fc 302

The fc / fl / fw / fs / ft commands replace the filter for that attribute, and the afc / afl / afw / afs / aft variants add to it. Pass none to clear one:

> fc none

When you change a filter, ffuf re-applies it to the results you've already collected, not just future requests, so the matches on your screen get cleaned up too. The help screen shows the current value next to each filter so you can see what's set.

Filtering only removes, it can't bring matches back. ffuf doesn't keep the responses it already filtered out, so relaxing or clearing a filter won't resurrect earlier matches it discarded. If you need them back, restart resets the state and re-runs the current job from the top.

rate changes requests per second on the fly:

> rate 50

Queue control is handy when recursion is piling up directory jobs. queueshow lists them (the active job is index 0), queuedel 3 drops job 3, and queueskip abandons the current job and moves to the next.

• restart resets and re-runs the current job from the top.
• show reprints the matches found so far.
• savejson results.json writes the current matches to a JSON file without waiting for the run to finish.

Running ffuf from a script, a pipe, or anywhere without a real terminal? Turn the console off with -noninteractive:

ffuf -w wordlist.txt -u 'https://ffuf.io.fi/FUZZ' -noninteractive

• Recursion - the feature that fills the job queue
• Performance and rate - the rate you adjust live
• CLI flag reference