ffuf/ffuf · error

sniper mode does not support command keywords

Error message

sniper mode does not support command keywords

What it means

In ffuf's ConfigFromOptions, an -input-cmd entry written as 'command:KEYWORD' is rejected when the input mode is 'sniper'. Sniper mode iterates each input position against a single target position one at a time, which is incompatible with command-based input providers, so the parser adds this error instead of creating the provider. This is a deliberate configuration validation, not a runtime failure.

Source

Thrown at pkg/ffuf/optionsparser.go:363

				Keyword:  "FUZZ",
				Template: template,
			}
			// Add encoders if set
			enc, ok := tmpEncoders["FUZZ"]
			if ok {
				newp.Encoders = enc
			}
			conf.InputProviders = append(conf.InputProviders, newp)
		}
		tmpWordlists = append(tmpWordlists, strings.Join(wl, ":"))
	}
	conf.Wordlists = tmpWordlists

	for _, v := range parseOpts.Input.Inputcommands {
		ic := strings.SplitN(v, ":", 2)
		if len(ic) == 2 {
			if conf.InputMode == "sniper" {
				errs.Add(fmt.Errorf("sniper mode does not support command keywords"))
			} else {
				newp := InputProviderConfig{
					Name:    "command",
					Value:   ic[0],
					Keyword: ic[1],
				}
				enc, ok := tmpEncoders[ic[1]]
				if ok {
					newp.Encoders = enc
				}
				conf.InputProviders = append(conf.InputProviders, newp)
				conf.CommandKeywords = append(conf.CommandKeywords, ic[0])
			}
		} else {
			newp := InputProviderConfig{
				Name:     "command",
				Value:    ic[0],
				Keyword:  "FUZZ",

View on GitHub (pinned to 33c67d28c8)

Solutions

1. Remove the custom ':KEYWORD' suffix from -input-cmd entries so they use the default FUZZ keyword... but note sniper also has keyword constraints, so prefer switching input mode
2. Change -X/-mode to clusterbomb or pitchfork, which support command keywords
3. Replace -input-cmd with a static -w wordlist generated ahead of time if sniper iteration is required

Example fix

// before
opts.Input.InputMode = "sniper"
opts.Input.Inputcommands = []string{"sqlmap --url=FUZZU:MYKW"}
// after
opts.Input.InputMode = "pitchfork" // or "clusterbomb"
opts.Input.Inputcommands = []string{"sqlmap --url=FUZZU:MYKW"}

func validateNoSniperCommandKeywords(mode string, inputcmds []string) error {
	if mode == "sniper" {
		for _, c := range inputcmds {
			if len(strings.SplitN(c, ":", 2)) == 2 {
				return fmt.Errorf("-input-cmd %q uses a custom keyword, unsupported in sniper mode", c)
			}
		}
	}
	return nil
}

func isSniperSafeInputcmd(mode string, inputcmd string) bool {
	return mode != "sniper" || len(strings.SplitN(inputcmd, ":", 2)) != 2
}

When it happens

Trigger: Calling ffuf.ConfigFromOptions with ConfigOptions whose Input.Inputcommands contains at least one entry with a ':'-separated custom keyword (len(ic)==2) while conf.InputMode == "sniper" (e.g. -X sniper -input-cmd 'cat words.txt:MYKW').

Common situations: Users switching a working pipeline from pitchfork/clusterbomb to sniper mode while keeping -input-cmd flags; shell scripts that set -X sniper globally; migrating old ffuf scripts after adding command keywords.

Related errors

• Either -w or --input-cmd flag is required
• Delay needs to be either a single float: "0.1" or a range of
• Header defined by -H needs to have a value. ":" should be us
• Word filter or matcher (-fw / -mw): invalid value: %s
• -u flag or -request flag is required

AI-assisted analysis of ffuf/ffuf@33c67d28c8 (2026-09-04). Data as JSON: /api/errors/17721a6aabdd2692. Report an issue: GitHub.