search

OJ / gobuster

Directory/File, DNS and VHost busting tool written in Go
Apache License 2.0
9.6k stars 1.17k forks source link

Feature Request: Ability to add query string to each request #227

Open Paradoxis opened 4 years ago

Paradoxis commented 4 years ago

The issue

During a penetration test I was faced with an application which uses authentication inside the URL as a query parameter, I was using gobuster in dir mode to try to enumerate the endpoints however all of them seemed to return 401 if the parameter was not set.

Feature Request

Could it be possible to add a feature that lets users specify a query string to be added to the end of each request? This could be done with a -Q or --query parameter when calling gobuster

Example

$ gobuster dir -u http://example.com/api/v1/ -w wordlist.txt -Q 'secret=blargh'
$ gobuster dir -u http://example.com/api/v1/ -w wordlist.txt --query 'secret=blargh'

PS

Thanks for your work on the tool, it's one of my all time favorites

OJ commented 4 years ago

Hello @Paradoxis. Thanks very much for the suggestion. I think it's a good idea and one what we should consider adding for sure.

Leave it with me and I'll have a think about what it might look like. I think what you've suggested for parameterisation is good.

Watch this space!

ghost commented 3 years ago

hi there @OJ , if you dont mind or have no problem, i would like to work on this issue please