What causes "-u flag or -request flag is required" in ffuf/ffuf?

Pass the target with -u, e.g. -u https://example.com/FUZZ

-u flag or -request flag is required

Error message

-u flag or -request flag is required

What it means

ffuf requires a target: ConfigFromOptions validates that either the -u URL flag or a raw HTTP request via -request was supplied. If parseOpts.HTTP.URL is empty AND parseOpts.Input.Request is empty, the error is added to a Multierror and returned, so the run never starts. It is a pure CLI/config validation guard with no network involvement.

Source

Thrown at pkg/ffuf/optionsparser.go:239

	out := make([]PreflightConfig, len(in))
	for i, pf := range in {
		out[i] = pf
		out[i].Vars = append([]VarExtract(nil), pf.Vars...)
	}
	return out
}

// ConfigFromOptions parses the values in ConfigOptions struct, ensures that the values are sane,
// and creates a Config struct out of them.
func ConfigFromOptions(parseOpts *ConfigOptions, ctx context.Context, cancel context.CancelFunc) (*Config, error) {
	//TODO: refactor in a proper flag library that can handle things like required flags
	errs := NewMultierror()
	conf := NewConfig(ctx, cancel)

	var err error
	var err2 error
	if len(parseOpts.HTTP.URL) == 0 && parseOpts.Input.Request == "" {
		errs.Add(fmt.Errorf("-u flag or -request flag is required"))
	}

	// prepare extensions
	if parseOpts.Input.Extensions != "" {
		extensions := strings.Split(parseOpts.Input.Extensions, ",")
		conf.Extensions = extensions
	}

	// Effective request headers: the -H values plus any -b/-cookie folded in. Built
	// as a fresh slice so ConfigFromOptions never mutates the caller's options (it
	// stays idempotent) and the retained snapshot below shares no backing with it.
	effectiveHeaders := append([]string(nil), parseOpts.HTTP.Headers...)
	if len(parseOpts.HTTP.Cookies) > 0 {
		effectiveHeaders = append(effectiveHeaders, "Cookie: "+strings.Join(parseOpts.HTTP.Cookies, "; "))
	}

	//Prepare inputproviders
	conf.InputMode = parseOpts.Input.InputMode

View on GitHub (pinned to 33c67d28c8)

Solutions

Pass the target with -u, e.g. -u https://example.com/FUZZ
Alternatively supply a raw HTTP request template with -request /path/to/request.txt
Check that any variable used in -u is actually set/non-empty in your shell
If using -config, add the url key to the JSON config file

Example fix

// before
ffuf -w words.txt -X GET
// after
ffuf -w words.txt -u https://example.com/FUZZ

Defensive patterns

Strategy: validation

Validate before calling

if opts.HTTP.URL == "" && opts.Input.Request == "" {
    return fmt.Errorf("ffuf needs -u <url> or -request <file> before running")
}

Type guard

func hasTarget(url string, request string) bool {
    return url != "" || request != ""
}

Prevention

Always pass -u explicitly in scripts; never rely on unset shell variables
Check `$TARGET` is non-empty before interpolating into -u (set -u in bash)
Validate generated CLI args before exec'ing ffuf
When using -config files, assert the url key exists

When it happens

Trigger: Calling ffuf (or ConfigFromOptions) with no -u value, an empty -u '' argument, a config file lacking the URL key, and simultaneously no -request file/string, so both target sources are empty.

Common situations: Forgetting the -u flag entirely; a shell variable holding the target expanding to empty (e.g. -u $TARGET with TARGET unset); scripting ffuf where the URL is built dynamically and ends up blank; loading a saved config file that omits the url field.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of ffuf/ffuf@33c67d28c8 (2026-09-04). Data as JSON: /api/errors/0002e250fe651677. Report an issue: GitHub.