ffuf/ffuf · error

bad FFUFHASH value

Error message

bad FFUFHASH value

What it means

SearchHash validates an FFUFHASH string (the 5-char history hash prefix plus a hex-encoded position) and rejects it when it is shorter than 6 characters, so it cannot possibly contain both the hash and positional parts. This is pure input-shape validation performed before any history directory is scanned; the offending input is the hash argument passed on the command line.

Source

Thrown at pkg/engine/history.go:104

				o.Matcher.Status = f.Repr()
			case "time":
				o.Matcher.Time = f.Repr()
			case "words":
				o.Matcher.Words = f.Repr()
			}
		}
	}
	return o
}

func calculateHistoryHash(options []byte) string {
	return fmt.Sprintf("%x", sha256.Sum256(options))
}

func SearchHash(hash string) ([]ConfigOptionsHistory, int, error) {
	coptions := make([]ConfigOptionsHistory, 0)
	if len(hash) < 6 {
		return coptions, 0, errors.New("bad FFUFHASH value")
	}
	historypart := hash[0:5]
	position, err := strconv.ParseInt(hash[5:], 16, 32)
	if err != nil {
		return coptions, 0, errors.New("bad positional value in FFUFHASH")
	}
	all_dirs, err := os.ReadDir(ffuf.HISTORYDIR)
	if err != nil {
		return coptions, 0, err
	}
	matched_dirs := make([]string, 0)
	for _, filename := range all_dirs {
		if filename.IsDir() {
			if strings.HasPrefix(strings.ToLower(filename.Name()), strings.ToLower(historypart)) {
				matched_dirs = append(matched_dirs, filename.Name())
			}
		}
	}

View on GitHub (pinned to 33c67d28c8)

Solutions

1. Check that the value passed to -searchhash/FFUFHASH lookup is a full hash copied from a previous run's output, not a truncated or typo'd string
2. Trim surrounding whitespace or quotes accidentally included when copying the hash
3. If scripting the lookup, verify len(hash) >= 6 (and that chars 6+ are valid hex) before calling SearchHash

When it happens

Trigger: Thrown at pkg/engine/history.go:104 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ffuf/ffuf@33c67d28c8 (2026-09-04). Data as JSON: /api/errors/b12de2cd176cf3d1. Report an issue: GitHub.