jSrSSKrSSKrSSKrSSKrSSKrSSKrSSKrSSKrSSK r SSK r SSK r SSK r SSK r SSKJrJr SSKJr SSKJr SSKJr SSKJr SSKrSSKrSrSS KJrJr Sr/S Qr 1S kr!S r"Sr#\RH"S\RJ\RL-5r'"SS\RP5r)S\*S\RV4Sjr,S\*4Sjr-Sr.S\/\*S\04Sjr1SFS\*S\*S\\*4Sjjr2SFS\*S\*S\/\*4Sjjr3S\*S\*4Sjr4SGS \*S!\*S"\*S#\RjS$\0S\/\*4 S%jjr6"S&S'5r7SHS(\/\*S \*S)\RVS*\8S+\S'S\04 S,jjr9S-\*S\/\*4S.jr:SIS \*S#\RjS)\RVS/\*S+\S'S\;4 S0jjrS4\/\=S\/\=4S5jr?S6\=S7\*4S8jr@S9\/\=S7\*4S:jrAS;rBS6\=S7\*4S<jrCS6\=S\*4S=jrDS>\\*S\\E4S?jrFS \*S@\\ES\04SAjrGS#\RjS)\RV4SBjrHS\R4SCjrJSDrK\LSE:Xa\K"5 gg!\a S rGNf=f!\a S rGNf=f)Ju ffuf_automation.py — Professional ffuf Web Directory Discovery Automation Tool Author: Areeb Mehdi / Devorions Purpose: Automate ffuf scanning across multiple authorized domains with structured reporting. ⚠️ LEGAL WARNING — READ BEFORE USE ⚠️ This tool is designed exclusively for: - Domains you own and control - Domains for which you have written/explicit authorization to test Unauthorized use against third-party systems is illegal under the Computer Fraud and Abuse Act (CFAA), the Computer Misuse Act (UK), and equivalent laws worldwide. The author assumes zero liability for misuse. Use responsibly and ethically. N)ThreadPoolExecutor as_completed)datetime)Path)Optional)urlparseTF) Environment BaseLoader)z/apiz/adminz/loginz /dashboardz/backupz/configz/corez/uploadsz/devz/testz/.envz/.gitz /wp-adminz /phpmyadminz/swaggerz/graphqlz /internalz/debugz/secret>-.z1.0.0zffuf-automationz!(\d+)\s+req/sec.*?Errors:\s*(\d+)c,^\rSrSrSrU4SjrSrU=r$)StatsAwareHandlerHz7Clears the live stats line before writing a log record.c>[RRS5 [RR5 [TU]U5 g)N )sysstdoutwriteflushsuperemit)selfrecord __class__s ffuf_automation.pyrStatsAwareHandler.emitJs1 %   V)__name__ __module__ __qualname____firstlineno____doc__r__static_attributes__ __classcell__)rs@rrrHsAr!r output_dirreturnc[RRUSS[R"5SS35n[R "[RR U5SS9 [R"[5nUR[R5 [R"SS5n[[R5nUR[R 5 UR#U5 [R$"U5nUR[R5 UR#U5 UR'U5 UR'U5 U$) z-Configure dual-output logger (stdout + file).logsscan_ %Y%m%d_%H%M%Sz.logTexist_okz)[%(asctime)s] [%(levelname)s] %(message)s%Y-%m-%d %H:%M:%S)ospathjoinrnowmakedirsdirnamelogging getLogger TOOL_NAMEsetLevelDEBUG FormatterrrrINFO setFormatter FileHandler addHandler)r*log_fileloggerfmtchfhs r setup_loggingrHSsww||J% }7UUY0Z[HKK)D9   y )F OOGMM"   GI\ ]C 3:: &BKK OOC   X &BKK OOC b b Mr!cV[R"SS/SSS9nURS:XapURR 5n[R"SS/SSS9nURR 5=(d UR R 5nX4$g![ a gf=f)z-Verify ffuf is installed and return its path.whichffufT)capture_outputtextrz-V)NN) subprocessrun returncoderstripstderrFileNotFoundError)resultr4ver version_strs rcheck_ffuf_installedrWos & 1$TR    !==&&(D..&$4PC****,B 0@0@0BK$ $ sBB B('B(c.S[S3n[U5 g)zPrint the tool banner.u  ╔══════════════════════════════════════════════════════════════════════╗ ║ ffuf-automation vuS — Web Discovery Toolkit ║ ║ Built by Areeb Mehdi / Devorions ║ ╚══════════════════════════════════════════════════════════════════════╝  ⚠️ AUTHORIZED USE ONLY — You must own or have written permission ⚠️ ⚠️ to test every domain in your input file. Unauthorized scanning ⚠️ ⚠️ is illegal. The author bears no responsibility for misuse. ⚠️ N)VERSIONprint)banners r print_bannerr\s# 'i( F &Mr!domainsc[S[U5S35 UHn[SU35 M [5 [S5R5R 5nUS:H$)z3Ask the user to explicitly confirm before scanning.z [SCOPE] The following z domain(s) will be scanned: → zdDo you confirm you own or have explicit permission to test ALL listed domains? [yes/no]: yes)rZleninputrQlower)r]danswers r confirm_scanrfsr .s7|n<^ _`  qcl G AGGIOOQF U?r!rawschemecUR5nU(aURS5(agURS5(aUSSnOURS5(aUSSnUSURS53$) z Normalize a raw domain string: - Strip whitespace / comments - Apply chosen scheme: http, https, or both - Remove trailing slashes #Nzhttp://zhttps://z:///)rQ startswithrstrip)rgrhs rnormalize_domainrpsq ))+C #..%% ~~i  !"g  # #!"gXSC) **r!filepathc[RRU5(d[SU35e/n[ 5n[ U5nUHnUS:XaHSH@n[ XV5nU(dMXs;dMURU5 URU5 MB MQ[ XQ5nU(dMeXs;dMlURU5 URU5 M SSS5 U$!,(df  U$=f)z?Read and normalize domains from a file, applying chosen scheme.zDomains file not found: both)httphttpsN) r3r4isfilerSsetopenrpappendadd)rqrhr]seenflinesdomains r load_domainsrs 77>>( # #":8* EFFG 5D h1D*A-d6Fv&"4v.( + *$76f0NN6*HHV$  N  Ns$ !C)/C)68C)2C)9&C)) C8urlc[U5nURUR-n[R"SSU5R S5$)z*Convert a URL into a filesystem-safe name.z[^\w\-.]_)rnetlocr4resubrQ)rparsednames r safe_filenamers; c]F ==6;; &D 66+sD ) / / 44r!rwordlist output_fileargsuse_ffuf_recursioncSSUS3SUS3SSSUS [UR5S [UR5S /nU(a+URS :aUS S[UR5/- nUR(aUSUR/- nUR (aUSUR /- nUR (aUSUR /- nUR(aUSUR/- nUR(aUSUR/- nUR(aUSUR/- nUR(aUS[UR5/- nUR(aUSS/- nU$)z/Construct the ffuf command from user arguments.rKz-wz:FUZZz-uz/FUZZz-ofjsonz-oz-tz-timeoutz-noninteractiverz -recursionz-recursion-depthz-ez-mcz-fcz-fwz-fsz-flz-ratez -maxtime-job0) strthreadstimeoutdepth extensions match_codes filter_codes filter_words filter_sizes filter_linesrate max_results)rrrrrcmds rbuild_ffuf_commandrss   %   v k c$,,C % Cdjj1n 0#djj/BB  doo&&  t''((  t(())  t(())  t(())  t(()) yy TYY((  $$ Jr!c \rSrSrSrSrS\R4SjrS\ RS\ 4Sjr S\ R4S jr S \ S \ 4S jr\S \ 4Sj5r\S \ 4Sj5r\S \ 4Sj5rSrSrSrSrSrS \ 4SjrSrg)PauseControlleriuz Manages pause / resume / stop across ALL running ffuf sub-processes. One instance is shared for the entire scan session. Keyboard controls (single listener for all parallel scans): p → pause all r → resume all q / Ctrl+C → stop all & save partial report Stats displayed: total req/sec + total errors summed across every concurrently running ffuf process. z[ Controls: [p] pause [r] resume [q] stop & saverDcXlSUl[R"5UlSUl[R "5Ul0Ul0Ul g)NF) rDpaused threadingEventdone_old_tcLock_lock_procs_stats)rrDs r__init__PauseController.__init__#s?  !)  !( 35 24 r!proc pty_masterc*UR XRUR'SURUR'SSS5 [R "UR URU4SS9nUR5 g!,(df  NK=f)z>Register a new ffuf process and start its stats reader thread.)rrNT)targetrdaemon)rrpidrrThread_read_stats_forstart)rrrts rregisterPauseController.register/sk ZZ$(KK !$*DKK !   ''txx.DT   Zs 2B BcUR URRURS5 URRURS5 SSS5 g!,(df  g=fN)rrpoprr)rrs r unregisterPauseController.unregister9s? ZZ KKOODHHd + KKOODHHd +ZZs A A## A1rfdcV[R"S5nSnURR5(Gd4[R"U///S5un nU(d1UR  XR ;a SSS5 gSSS5 Mw[R"US5nU(dgXG-SSnURSU5RSSS 9n[RU5n U (aWUR  [U RS 55[U RS 554URU'SSS5 OURR5(dGM3gg!,(df  N=f!,(df  NC=f![ a g["a gf=f) Ns\x1b\[[0-9;]*[a-zA-Z]|\rr!g?ii utf-8replaceerrors)rcompileris_setselectrrr3readrdecode _STATS_REsearchintgrouprOSError Exception) rrr_ansibufrrchunkrMms rrPauseController._read_stats_for?sK 78))""$$  --b"c:1akk1!$1$C({EF+yys+22792M$$T*,/ OS_+M C($))""$$ $$   sa1F+E.<FFF/AF>AE?F. E<8F? F  F F F( F('F(r+cUR [SURR555sSSS5 $!,(df  g=f)Nc3*# UH oSv M g7f)rNr".0r~s r 1PauseController._total_req_sec..\:%9t%9rsumrvaluesrs r_total_req_secPauseController._total_req_secY. ZZ:T[[%7%7%9::ZZ *A AcUR [SURR555sSSS5 $!,(df  g=f)Nc3*# UH oSv M g7f)rNr"rs rr0PauseController._total_errors..arrrrs r _total_errorsPauseController._total_errors^rrczUR [UR5sSSS5 $!,(df  g=fr)rrarrs r _active_countPauseController._active_countcs ZZt{{#ZZs, :c URnURnURnU(aSOSn[RR SUSUSSUSUS3 5 [RR 5 g) N3132u& ↳ scans: z req/sec: z<6u │ errors: z )rrrrrrr)rrpserrnerr_cols r _print_statsPauseController._print_statshs!!    $4 ../S1003Bx8118 3%@   r!cUR(agUR [URR 55nSSS5 WH#nUR [ R5 M% SUl[RRS5 [SSS9 g!,(df  Nh=f![a Mvf=f)NTrue  ┌──────────────────────────────────────┐ │ ⏸ ALL SCANS PAUSED │ │ [r] resume │ [q] stop & save report│ └──────────────────────────────────────┘r) rrlistrr send_signalsignalSIGSTOPrrrrrZrprocsps rpausePauseController.pausews ;;  ZZ++-.EA  fnn-   %   "  Z   s$B%B6% B36 CCcUR(dgUR [URR 55nSSS5 WH#nUR [ R5 M% SUl[RRS5 [SSS9 [URSS9 g!,(df  N|=f![a Mf=f)NFru2  ▶ RESUMED — scans continuing...Tr)rrrrrrrSIGCONTrrrrrZ _CONTROLSrs rresumePauseController.resumes{{  ZZ++-.EA  fnn-   % IQUV dnnD)Z   s$B9C 9 C CCcURR5 UR [URR 55nSSS5 WHSnUR (aUR[R5 UR[R5 MU g!,(df  Nh=f![a Mvf=fr) rrwrrrrrrrrSIGINTrrs rstopPauseController.stops  ZZ++-.EA ;;MM&..1 fmm, Z  s$B-AB>- B;> C  C c[(a#[RR5(dg[RR 5n[ R "U5Ul[R"U5 URR5(Gd[R"[R///S5un nUR(dUR5 U(dMv[RR!S5nUS;aUR#5 OfUS;aUR%5 OOUS;aIUR'5 [(R*"[(R,"5[.R05 O"URR5(dGMUR5U5 g![ Ra gf=f![2a N8f=f!UR5U5 f=f)Ng333333?r)rP)rR)qQ)HAS_TTYrstdinisattyfilenotermios tcgetattrrttysetrawerrorrrrrrrrrr r3killgetpidrr r_restore_terminal)rrrrkeys rlistenPauseController.listenscwcii..00  YY    ",,R0DL JJrN 'ii&&(( -- RTB1a{{%%'iinnQ'*$JJLJ&KKM..IIKGGBIIK7ii&&(($  " "2 &+}}   $     " "2 &sC1GDG!G1G!GG! G.+G1-G..G11HcURb9[R"U[RUR5 SUlgg![a Nf=fr)rr tcsetattr TCSADRAINr)rrs rr!PauseController._restore_terminalsO << # !!"g&7&7F DL $  s0A AA)rrrrrrDrN)r#r$r%r&r'rr9LoggerrrNPopenrrrrpropertyrrrrrrr r rr(r"r!rrrs  + 5w~~ 5Z--3,z//, 3C4;;;;s;;$s$$  * * '< C r!rrrD timeout_limitctrlc  ^ ^URSU35 URSSRU535 USLnSn[R"5upx[ R "UU[ RS9m [R"U5 U(aR[U5n[R"URSS9nUR5 [[R SS9 UR#T U5 /mU U4S jn [R"U SS9n U R5 T R%US 9 UR5T 5 U(a0UR(R+5 U(aURS S 9 [R"U5 [8R:R=S5 [8R:R?5 U RS S 9 SRT5RASSS9n T RBS:XaURSU35 gSU RE5;dT RBS:Xa6UR-ST RBSUSU RG5SS35 gUR3SUSU RG5SS35 g![&a U(a0UR(R+5 U(aURS S 9 UR-S U35 T R%S S 9 e![ R.a# T R15 T R%5 ef=f[ R.Ga U(a0UR(R+5 U(aURS S 9 T R15 T R%5 UR3SU35 UR5T 5 U(a0UR(R+5 U(aURS S 9 [R"U5 O![6a Of=f[8R:R=S5 [8R:R?5 gf=f![6a GNf=f!UR5T 5 U(a0UR(R+5 U(aURS S 9 [R"U5 O![6a Of=f[8R:R=S5 [8R:R?5 f=f![&a e[Ha!n UR3SUSU 35 Sn A gSn A ff=f) a Execute ffuf as a subprocess. Pass a shared PauseController via `ctrl` for parallel / session-wide control. When `ctrl` is None a standalone controller + keyboard listener are created. Returns True on success, False on failure, raises KeyboardInterrupt on stop. [SCAN] Starting: z[CMD]  N)rrRTrrrcN>TRHnTRU5 M gr)rRry)r}r stderr_bufs r _read_stderrrun_ffuf.._read_stderrs !!$'$r!rrz.[INTERRUPT] Waiting for ffuf to save results: z[TIMEOUT] Scan timed out for rFr!rrrrz[DONE] Completed: z no resultsrz[WARN] ffuf exited z for : rz[FAIL] ffuf error for i,z"[ERROR] Unexpected error scanning )%infodebugr5ptyopenptyrNr'PIPEr3closerrrr rrZrrwaitKeyboardInterruptrrwwarningTimeoutExpiredrrrrrrrrrrPrcrQr)rrrDr)r*own_ctrl key_threadr pty_slaver1 stderr_threadrRerr0s @@rrun_ffufrEs\ KK#F8,- LL6#((3-)* HJN #   ??   "6*D"))TJJ     /++4 8 dJ'"$  ("(( TJ "  IImI ,. OOD ! OOAO. $ JJ  [ ) JJ   1%*%,,WY,G ??a  KK,VH5 6v||~-A1E!4T__4EU6(RTU[UaUaUcdhehUiTjkl LL1&FLLN4CS??AUUU8U33U8 wordlist_pathc/n[U5nUHEnUR5nU(dMURS5(aM4URU5 MG SSS5 U$!,(df  U$=f![a U$f=f)zCRead words from a wordlist file, skipping blank lines and comments.rjN)rxrQrnryIOError)rFwordsr|r}ws rload_wordlist_wordsrK9s} E - AJJL1Q\\#..LLO! L!  L   L s9 A7A%A%A%A7% A4/A74A77 BBraw_dirc D [UR5n[USS5n[USS5nU(aW[U5Vs/sHoRS5PM n nUR S[ U 5SUS[ U5S 35 O Sn UR S [ U5S 35 /n [ 5n S n U/n S n[URS-5GHInU(d&U(a$URR5(aSn GO/nU Htn[U5n[RRUUS35n[UURUUS S9nU (dSRU5n UR!UUU45 Mv /nUHunnn[RR#U5(a[RR%U5S:afUR SUSU35 ['UUR(5H3nUSU ;dMU R+US5 U R!U5 M5 MUR!UUU45 M U(dGOEUS::aUHunnnU(a$URR5(aSn GO [-UUX$S9nU(d.UU:XaUS:Xa XSS 4s s $UR1SUSU35 Ms['UUR(5H3nUSU ;dMU R+US5 U R!U5 M5 M GOwS n[3US9n0nUHRunnnU(a#URR5(aSn O%UR5[,UUUSU5nUU4UU'MT U(d[7U5HnUUunnUR95n['UUR(5H3nUSU ;dMU R+US5 U R!U5 M5 U(d)UU:Xa#US:XaSnUHnUR?5 M OIU(dMURR5(dMSnUHnUR?5 M O URASS9 U(aXSS 4s $U(a OuXR:dGMU b US:XaU nOUn/nU H"nUHn UR!USU 35 M M$ Un UR S US-S[ U 5S!35 GML XS U4$s snf![.as ['UUR(5H3nUSU ;dMU R+US5 U R!U5 M5 UR S[ U 5S35 Sn GMf=f![:a$nUR=SUSU35 S nSnAGNSnAff=f![.a SnUHnUR?5 M GN~f=f!URASS9 f=f)"a" Python-level recursion regardless of HTTP response codes (even 404). When --force-recursion-paths is given: depth 0 : domain/FUZZ (full wordlist at root) depth 1 : domain/forcepath/FUZZ (full wordlist inside each forced path) depth 2+: domain/forcepath/word/FUZZ ... (full wordlist at every level) When no --force-recursion-paths: every depth uses all wordlist words as sub-path candidates. Sub-scans at each depth level run in parallel (--parallel-scans threads). Returns (all_results, base_cmd_str, failed, interrupted). parallel_scansrforce_recursion_pathsNrmz[FORCE-RECURSION] z forced entry path(s) from z, then full wordlist (z words) at each deeper levelz[FORCE-RECURSION] Using all z wordlist word(s) at every depthFT.json)rr- z[SKIP] Already scanned (depth=z): rr*r_z" partial path(s) saved (cancelled)rz[WARN] Sub-scan failed (depth= max_workersz$[ERROR] Parallel scan exception for r5r<z[FORCE-RECURSION] Depth z sub-path(s) queued)!rKrgetattrlstripr6rarwrangerrrrr3r4r5rryrvgetsizeparse_ffuf_resultsrrzrEr=r>rsubmitrrTrrcancelshutdown)!rrrDrLr*wordlist_wordsrNrecursion_paths_filerJ forced_paths all_results seen_urls base_cmd_str current_bases interrupted depth_level scan_tasksbasefnamejson_outr tasks_to_runrsuccess root_failedexecutorfuturesr|futureexc expansion next_baseswords! rrun_force_recursive_scanrwGs,*$--8Nd$4a8N"4)@$G/BCW/XY/X! /X Y (\):(;;VWkVlm++.~+>*??[] ^  23~3F2GGghiKIL MKTZZ!^, 4DII$4$4$6$6K #% !D#D)Eww||Gwe_=H(t}}hafgC"xx}   tS(3 4 "%' #- D#xww~~h''BGGOOH,E,J <[MTFST+Hd6F6FGAxy0! ah/#**1-H ##T3$9:$.  q '3#c8DII,,.."&K &sD&DGv~+*:*$EENN%CK=PSTXSY#Z[+Hd6F6FGAxy0! ah/#**1-H'(44 K,HHG& -+7'D#x 0 0 2 2&*  #tVT4PA"&!1GAJ ,8#".w"7)0h,&,mmoG "4Hd>N>N!OA xy8 ) ah 7 + 2 21 5"P '46>kQ>N*.K%, ! &-!4DII$4$4$6$6*.K%, ! &-!/#8:!!t!,"$==    #'K1,<( * $&J%%D%%av&67&&'M KK2;?2C2c-FXEYYlm no-r e[ 88MZf)/$:J:JKU894%MM!E(3'..q1LKK&[)9(::\ ]^"&KJ ),"LL+OPTvUWX[W\)]^&+G,(% "  AHHJ!  !!t!,sT, T1A5W"6V1 W"*AW"XW" W"-W" X W"1*V.A V.-V.1 W;WW"WW""%X X X  XX json_filerc[RRU5(d/$[U5n[R "U5nSSS5 WRS/5nU(aUSUn/n[5nUGHnURSS5nX;aMURU5 Sn URS05=(d 0n [U [5(a)U RS5=(d U RS5n URU[U5RURSS 5URS S 5URS S 5URS S 5U =(d SURS 05RSS5S.5 GM" U$!,(df  GNa=f![R [4a /s$f=f)zf Parse ffuf JSON output into a list of result dicts. Returns empty list if file missing or malformed. NresultsrrPheaderslocationLocationstatusrlengthrIlinesrbFUZZ)rr4r~rrIrredirectrb)r3r4rvrxrloadJSONDecodeErrorrHgetrwrz isinstancedictryr) rxrr|data results_rawrrdrrrr{s rr\r\s 77>>) $ $  )_99Q A9 % A>9A>> B u. ffuf-automation Report — {{ scan_date }}

🔍 ffuf-automation — Web Discovery Report

Generated: {{ scan_date }}  |  Total domains: {{ domains|length }}  |  Total paths found: {{ total_paths }}  |  Interesting findings: {{ total_interesting }}
⚠️ AUTHORIZED USE ONLY — This report was generated by ffuf-automation. Scanning must only be performed against domains you own or have explicit written authorization to test.

📊 Scan Summary

{{ domains|length }}
Domains Scanned
{{ total_paths }}
Paths Discovered
{{ total_interesting }}
Interesting Paths
{{ failed_domains|length }}
Failed Domains
{{ scan_config.depth }}
Recursion Depth
{{ scan_config.threads }}
Threads

⚙️ Scan Configuration

{{ scan_config.wordlist }}
{{ scan_config.extensions or "None" }}
{{ scan_config.match_codes or "Default" }}
{{ scan_config.filter_codes or "None" }}
{{ scan_config.filter_words or "None" }}
{{ scan_config.filter_sizes or "None" }}
{{ scan_config.threads }}
{{ scan_config.timeout }}s
{{ scan_config.depth }}

📋 Domains Index

    {% for d in domains %}
  • {{ d.domain }}   {% if d.pending %}NOT SCANNED {% else %}{{ d.results|length }} paths {% if d.interesting %}{{ d.interesting|length }} interesting{% endif %} {% if d.failed %}FAILED{% endif %} {% endif %}
    • {% endfor %}
{% for d in domains %} {% set anchor = d.domain | replace('https://', '') | replace('http://', '') | replace('/', '_') %}

🌐 {{ d.domain }}

{% if d.pending %}NOT SCANNED {% else %} {{ d.results|length }} paths {% if d.interesting %}{{ d.interesting|length }} interesting{% endif %} {% if d.failed %}SCAN FAILED{% endif %} {% endif %}
{% if d.pending %}
⏸ Scan was cancelled before this domain was reached.
{% elif d.command %}
$ {{ d.command }}
{% endif %} {% if d.results and not d.pending %} {% for r in d.results %} {% set is_interesting = r.url in (d.interesting | map(attribute='url') | list) %} {% endfor %}
URL Status Size Words Lines Redirect
{{ r.url }} {% if is_interesting %}⚠ interesting{% endif %} {% set sc = r.status | string %} {{ r.status }} {{ r.length }} {{ r.words }} {{ r.lines }} {{ r.redirect or "—" }}
{% elif d.failed and not d.pending %}
❌ Scan failed for this domain. Check logs for details.
{% elif not d.pending and not d.results %}
No results found for this domain.
{% endif %} {% if d.interesting %}
⚠ Interesting Findings ({{ d.interesting|length }}) {% for i in d.interesting %} {% endfor %}
URLMatch ReasonStatus
{{ i.url }} {{ i.match_reason }} {{ i.status }}
{% endif %}
{% endfor %} {% if failed_domains %}

❌ Failed Domains

{{ failed_domains|length }}
{% for fd in failed_domains %} {% endfor %}
DomainReason
{{ fd.domain }}{{ fd.reason }}
{% endif %}
ffuf-automation v1.0.0 — Devorions  |  Report generated {{ scan_date }}  |  Authorized use only
c[(a9[[5S9nUR[5nUR "S0UD6nO [ U5n[US5nURU5 SSS5 g!,(df  g=f)zERender the HTML report using either Jinja2 or a simple string format.)loaderrJNr") HAS_JINJA2r r from_string HTML_TEMPLATErender_render_html_fallbackrxr)rrenvtmplhtmlr|s rwrite_html_reportr)saz.}-{{'Y'%Y/ k3 1    s A77 Bc SnURS/5H@nUSUSS3- nURS/5HnUSUSS US S US S 3- nM MB S URSS5SUS3$)z.Very basic HTML fallback if Jinja2 is missing.rPr]z

rz

rzz

ru — r~rzB

uffuf Report

ffuf-automation Report — scan_datezK

Install Jinja2 for the full styled report: pip install jinja2

z )r)rrowsrdrs rrr7s D ]]9b ) $q{m5))y"%A c!E(58 U1X;-uM MD&* ) k" =>?  r! scope_filec6U(dg[RRU5(d[SU35e[ 5n[ U5nUH(n[ U5nU(dMURU5 M* SSS5 U$!,(df  U$=f)z2Load a scope whitelist file (one domain per line).NzScope file not found: )r3r4rvrSrwrxrprz)rscoper|r}rds r load_scoperIs  77>>* % %"8 EFF EE j QD &Aq !   L   LsB *B  BrcUcgX;$)z=Return True if domain is in scope (or scope is unrestricted).Tr")rrs rin_scoperXs } ?r!c^^^)^*[TRTRS9nU(d'TRS5 [R "S5 [ [TSS55nUVs/sHn[XC5(dMUPM nnUVs/sHn[XC5(aMUPM nnU(aTRS[U5S35 UnU(d'TRS5 [R "S5 [U5(d'TRS 5 [R "S 5 [RRTRS 5m*[RRTRS 5n[R "T*S S9 [R "US S9 [R "[RRTRS5S S9 ["R$"5R'S5n/n /n /n S n S n TR(TR*TR,TR.TR0TR2[TSS5TR4TR6TR8TR[TSS5S. n[;T5m)[<R>"T)R@S S9nURC5 [E[:RFS S9 [TSS5nSnS[H4UU)UU*4Sjjn[KUS9nUVs0sHnURMUU5U_M nnTROS[U5SUS35 [QU5GH[nUUnURS5unnnnnnUS:Xa,U RWUS!S".5 U RWUS //US#.5 OUS$:XaU RWUSS //S S%.5 OU [U5- n U [U5- n UH@nUS&UVs1sHnUS&iM sn;nU RW0UEUU(aS'OS S(.E5 MB U RWUSUUUS#.5 TROS)[U5S*[U5S+US,35 U(d"T)RXR[5(dGMAS nUHn U R]5 M O URaS S-9 T)RXRc5 URS.S/9 U(aeTRS05 U Vs1sHoDSiM snU Vs1sHoDSiM sn-n!UH#nUU!;dM U RWUSS //S S%.5 M% U (d'TRS15 [R "S 5 US2[d3UU U U U S3.n"["R$"5R'S45n#U(aS5OS n$[RRUS6U#U$S735n%[RRUS6U#U$S835n&[RRUS6U#U$S935n'[gU"U%5 TROS:U%35 [iU U&5 TROS;U&35 [kU"U'5 TROSn([ES?S@SAU(SBS@SC[U 5SDU SEU SF[U 5SGUS?S@SH35 gs snfs snfs snf![Ta/nTRSUSU35 S//S S4unnnnnSnAGNSnAff=fs snf![^a S nUHn U R]5 M GNf=f!URaS S-9 T)RXRc5 URS.S/9 f=fs snfs snf)IuAMain orchestration loop — scan each domain and collect results.)rhz%No valid domains found in input file.rrNz[SCOPE] Skipping z domain(s) not in scope file.z&All domains are out of scope. Exiting.zScan cancelled by user.rrgreportsTr0r-r2rrN) rrrrrrrrrrrhrNr.rFrcT>T RR5(aUS//SS4$T RSU35 [T SS5(a0[ UT T T T S9upp4U(aUS//US4$[ U5nUSXX$4$[ U5n[RRT US 35n[UT RUT 5nS RU5n[RRU5(a8[RRU5S :aT RS U35 O7[XT T S9n [UT R 5nU (dU(dUS//US4$[UT R 5n[ U5nT RR5nUSXX$4$) u  Worker: run a complete scan for one domain. Runs in a thread-pool worker — no KeyboardInterrupt is raised here. Stopping is signalled via ctrl.done. Returns (domain, status, results, interesting, cmd_str, was_interrupted). status is one of: 'success' | 'failed' pendingrPFr,force_recursionrSfailedrnrQr-rRz*[SKIP] Already scanned (raw file exists): )rrr6rXrwrrr3r4r5rrrvr[rEr\r)rrzcmd_str scan_failedwas_interruptedrrkrlrrnrr*rDrLs r_scan_domain_task#run_scan.._scan_domain_tasks 99    9b"b%7 7 'x01 4*E 2 2=UfgD> :GkxR%??*73K9gGT T%V,Eww||Gwe_=H)&$--4PCxx}Gww~~h''BGGOOH,E,J HQR"3TB,Xt7G7GHw!8RWeCC,Xt7G7GHG*73K"ii..0O9gGT Tr!rTz [PARALLEL] z domain(s) queued across z parallel worker(s)z![ERROR] Unexpected exception for r5rrPzffuf exited with error)rreason)rrrzrcommandr)rrrrzrrrYES)rrr_z path(s) found, z interesting []rWr3u> [INTERRUPTED] Scan cancelled — generating partial report...u7[SKIPPED] No domains completed — no report generated.zffuf-automation v)rtool scan_configr]failed_domains total_pathstotal_interestingr/_partialreport_rQz.csvz.htmlu[REPORT] JSON → u[REPORT] CSV → u[REPORT] HTML → zPARTIAL REPORT (cancelled)z SCAN COMPLETEz u────────────────────────────────────────────────────────────z  z Domains scanned : z Paths found : z Interesting : z Failed : z Reports :  )6rr]rhrrexitrrXrr>rarfr3r4r5outputr7rr6strftimerrrrrrrrrrrrr rrZrrrr]r6rrTrryrrr^r=r_rwrYrrr)+rrDr]rrddomains_in_scope out_of_scope reports_dirrall_domain_dataall_flat_resultsrrrrrArN cancelledrdomain_executorrdomain_futuresrrr~rzrrrrsrxis_intr|scannedrtssuffix json_report csv_report html_report status_labelr*rLs+`` @@rrun_scanrbsm4<<     01  ggll4;;.G'',,t{{I6KKK$'KK d+KK T[[&1DA ''(;<<<<::;;"4)91= K !(D!!TBJ / # #40T#3Q7NI(U#(U(UV*nEOF 0&96A KK c'l^#<^2F#F+F eQWQ^Q^Q`Ng !%%C[&\]&&$!"( 9$&&$$!"( S\1 !S%55! AuXK)HKq!E(K)HHF$++,kq,kF\bSXhj,kl! &&$&{w( fS\N2B3{CSBTTbcibjjklm$))"2"2"4"4 'AHHJ(M3Z   d + "XY(781X;8Q_;`Q_AhKQ_;``FW$&&#)#(#'#%#%#% ( PQ  &/y9'+*'.I   1B$Z"F'',,{gbT&,GHK'',,{gbT&,FGJ'',,{gbT&,GHKi- KK$[M23%z2 KK$ZL12i- KK$[M234=//L  *  ()*=!%&''()=! *  ]BAB e @3%PQIQSUWY[]_dIdFg e**I  A HHJ    d + "9;`s+\\\'\,\ -]\A:]] "B]9]]>]]>-^;_ ] $]?]]  ]%];7]>:];;]>>:^8c[R"SS[RSS9nURSSSS9 URS SS S9 URS S S S9 URS[SSS9 URSSSSSS9 URSSSSS9 URSSSS9 URS S!SS"S9 URS#S$S%S&S9 URS'S(S)S*S9 URS+S,SS-S9 URS.S/SS0S9 URS1S2SS3S9 URS4[S5S6S9 URS7[S8S9S9 URS:[S;SS9 URS?S@[S;SASB9 URSCSSDS9 URSESFSSGS9 URSHSI/SJQSKSL9 URSMSN[SOSPSB9 URSQSRSS[ 3ST9 U$)UNzffuf_automation.pyuPProfessional ffuf web directory discovery automation — AUTHORIZED DOMAINS ONLYa Examples: python3 ffuf_automation.py --domains domains.txt --wordlist wordlist.txt --output results python3 ffuf_automation.py --domains domains.txt --wordlist /path/to/wl.txt \ --depth 2 --extensions .php,.txt,.bak \ --match-codes 200,204,301,302,403 --filter-codes 404 \ --threads 50 --timeout 10 --output results LEGAL: Only scan domains you own or have explicit written authorization to test. )prog descriptionformatter_classepilogz --domainsTz*Path to domains file (one domain per line))requiredhelpz --wordlistzPath to wordlist for ffufz--outputrzz#Output directory (default: results))rrz--depthrz(Recursion depth (default: 1, 0=disabled))typerrz--force-recursionr store_trueFzXCustom Python-level recursion: recurse into paths regardless of HTTP response (even 404))destactionrrz--force-recursion-pathsrOrPzcFile with specific paths to force-recurse into (one per line). If omitted, uses all wordlist words.)rrrz --extensionsz(Extensions to append e.g. .php,.txt,.bakz--extensions-fileextensions_filezBFile with extensions to append, one per line (e.g. extensions.txt)z --match-codesrz200,204,301,302,403,401zMatch HTTP status codesz--filter-codesr404zFilter out HTTP status codesz--filter-wordsrzFilter by word count e.g. 10,20z--filter-sizesrz&Filter by response size e.g. 1234,5678z--filter-linesrzFilter by line count e.g. 0,1z --threads(z$Number of ffuf threads (default: 40)z --timeoutrRz,Per-request timeout in seconds (default: 10)z--raterz%Max requests per second (0=unlimited)z--delayz-Delay in seconds between domains (default: 0)z --max-resultsrz$Max results per domain (0=unlimited))rrrrz--scopezOptional scope whitelist filez--interesting-fileinteresting_filez1File with interesting path patterns, one per linez--schemeru)rtrursz6Protocol to use: http, https, or both (default: https))rchoicesrz--parallel-scansrNrzVNumber of parallel sub-scans per depth level when --force-recursion is on (default: 3)z --versionversionzffuf-automation )rr)argparseArgumentParserRawDescriptionHelpFormatter add_argumentrfloatrY)parsers r build_parserrKs  $ $ !f <<  F   D@lm  D@[\  9Chi  QEop +2CLbgwy 18OY[CD 2@jk +2CRac  HaiBC (Trs (Qrs (Qyz (Qpq  RFlm  RFtu QFmn  qGvw  CQRYA  2?^_ ,3ErPR  WF_UW *1AUVuw  9HXY`XaFbc Mr!c  [5 [5nUR5nUR(dSUlUR(dSUlUR (dSUlUR (dSUlURS:XaSUl[5up#U(d7[S5 [S5 [S5 [R"S5 [SUSUS35 UR(Ga[[RRUR5(d/[S URS 35 [R"S5 [!UR5nUVs/sHPnUR#5(dMUR#5R%S 5(aM@UR#5PMR nnSSS5 WVs/sHowR%S 5(aUOS U3PM! nnUVs/sHow[&;dMUPM nn[&R)U5 [S [+U5SURS35 UR,(Ga[RRUR,5(d/[SUR,S 35 [R"S5 [!UR,5nUVs/sHPnUR#5(dMUR#5R%S 5(aM@UR#5PMR n nSSS5 W V s/sHoR%S5(aU OSU 3PM! n n UR.(a4UR.R1S5V s/sH o(dM U PM sn O/n XV s/sH oU ;dM U PM sn -n SR3U 5Ul[S [+U 5SUR,SUR.S35 UR4(a^[RRUR45(d/[SUR4S 35 [R"S5 OSUl[RRUR65(d/[SUR6S 35 [R"S5 [9UR:5n [=X5 gs snf!,(df  GNM=fs snfs snfs snf!,(df  GN=fs sn fs sn fs sn f![>a* U RAS5 [R"S5 g[Ba3n U RESU 3SS9 [R"S5 Sn A gSn A ff=f)Nrz8[ERROR] ffuf is not installed or not in PATH.z5Install it: go install github.com/ffuf/ffuf/v2@latestz"Or: apt install ffuf (Kali Linux)rz[OK] ffuf found: z rz1[ERROR] Interesting paths file not found: zrjrmz[OK] Loaded z" interesting path pattern(s) from z*[ERROR] Extensions file not found: .,z extension(s) from r5z5[ERROR] Force-recursion paths file not found: z#[ERROR] Wordlist not found: z( [INTERRUPTED] Scan interrupted by user.z[FATAL] Unexpected error: T)exc_info)#r\r parse_argsrrrrrrWrZrrrr3r4rvrxrQrnrextendrarrsplitr5rOrrHrrr=r>rr)rr ffuf_pathffuf_verr|r}customradded file_extsrDexistingmergedrDs rmainr sN ^F    D ::             1/0I  NO EF 23   ' {"XJi HI ww~~d3344 HI^I^H__fg h HHQK $'' (A)*)*::<(, (?(?(D  ) @FFv!||C((!!g5vF"AFq/@&@FA  ' &s6{m3UVZVkVkUlluvw ww~~d2233 A$BVBVAWW^_ ` HHQK $&& '1)*)*::<(, (?(?(D  ( CLL)Q,,s++Q1QC8) LCG??t44S9?9!QA9?XZ G 1h5FQ GG((6* &s9~&66I$J^J^I__abfbqbqarr{|} !!ww~~d8899 LTMgMgLhhop q HHQK%)" 77>>$-- ( ( 6t}}oWMN  4;; 'F[) ( GA( ' M?G. BC   1!5 E  s<T T"TTT &&T2 T7#T7)U.T< "T<1T<U&U) U7U UU U"T  T/<U U"1W W)W  W__main__)ru)T)rVNr)Mr'rrrr9r3r8rrrrNrrtimeconcurrent.futuresrrrpathlibrtypingr urllib.parserrrr ImportErrorjinja2r r rrHIGHLIGHT_CODESrYr;r IGNORECASEDOTALLr StreamHandlerrrr&rHrWr\rboolrfrprr NamespacerrrrErKtuplerwrr\rrrrrrrwrrrrrr r#r"r!rrs     ?!G.J1    JJ;R]]RYY=V W --cgnn8 c   $s)+#+s+#+$3$s).5s5s5 $ 7 777    7  7  #Y 7@} } N(, a ca a NNa a $ % a  aN s tCy &)- a9 a9   a9 NNa9 a9 $ % a9  a9N,#,HSM,TRVZ,^ d4j T$Z "77C7 E$t*E3Eh V  C  T c $ 8C= Xc] S#4c8%%cw~~cR/h--/jTn zFa-GJs$ H9# I9IIII