Previously ffuf read the (optional) static configuration file from $HOME/.ffufrc, but as pointed out by many the best practice would be using application directory $XDG_CONFIG_HOME which typically points to $HOME/.config. While ffuf keeps still falling back on the original config file location, it will initially try to read $XDG_CONFIG_HOME/ffuf/ffufrc (note that the actual file is not a dotfile anymore).

Various additional directories are also created under $XDG_CONFIG_HOME/ffuf for some of other ffuf features.

This is a standard specification to help users to control where their application data is stored. Defaults for the $XDG_CONFIG_HOME that ffuf uses are as follows for different operating systems:

Ffuf will save the ffuf command history under $XDG_CONFIG_HOME/ffuf/history/ to support ffufhash mapping functionality. There will be individual directories created under this directory for each tool invocation.

A directory $XDG_CONFIG_HOME/ffuf/scraper/ is created to store scraper rules and definitions.