search

PortSwigger / param-miner

https://portswigger.net/blog/practical-web-cache-poisoning
Other
1.23k stars 166 forks source link

Doesn't work on Windows? #49

Closed mikedesu closed 3 years ago

mikedesu commented 3 years ago

The default wordlist points to a Linux path: /usr/share/dict/words I've tried changing this thinking that it was a path issue but the following formats fail:

C:/my/path/file.txt C:\my\path\file.txt C:\my\path\file.txt

I'd love to be able to use this tool, it seems really useful but I am having difficulty even getting it to run once at all

albinowax commented 3 years ago

This works for me with C:\path\to\file

Could you share a screenshot of your config?

mikedesu commented 3 years ago

The full path is to the effect of: C:\Users\user\OneDrive\Documents\SecLists\Discovery\Web-Content\burp-parameter-names.txt paramminer3

Attempting to launch any of the param miner attacks on a page or domain seems to fail with no visible output indicating anything is running at all. I do this by right-clicking a subdomain or page in "Target" and then clicking one of the attacks under the "Param Miner" context menu.

This has been the case in both Burp Pro and Burp Community.

albinowax commented 3 years ago

You need to check the 'use custom wordlist' box to use your custom wordlist

mikedesu commented 3 years ago

LOL ok well now I feel dumb having not seen that, but from a UI/UX-perspective, can I be faulted for eyeballing right past it? Could you move that checkbox so that it is right below or above the custom wordlist path? Thanks again albinowax, I will give this a shot now.

albinowax commented 3 years ago

Yeah it did used to be next to the path but clearly moved itself at some point