chainreactors / spray

Next Generation HTTP Dir/File Fuzz Tool
https://chainreactors.github.io/wiki/spray/
GNU General Public License v3.0
381 stars 27 forks source link

bak参数使用问题 #39

Open SuperXiaoxiong opened 1 month ago

SuperXiaoxiong commented 1 month ago

bak 参数解析失败, host 是我自己打码的, 但 {@bak_ext} 未解析 [debug] [bak] https://host/i.{@bak_ext} [reason: compare failed] - 200 - 2018 - 104ms [html data] [debug] [word] https://host/crud [reason: compare failed] - 200 - 2018 - 104ms [html data] [debug] [common] https://host/status.cgi [reason: compare failed] - 200 - 2018 - 104ms [html data] [debug] [common] https://host/.gitignore [reason: compare failed] - 200 - 2018 - 171ms [html data] [debug] [common] https://host/ansible.cfg [reason: compare failed] - 200 - 2018 - 105ms [html data] [debug] [word] https://host/daily [reason: compare failed] - 200 - 2018 - 15ms [html data] [debug] [word] https://host/css [reason: compare failed] - 200 - 2018 - 15ms [html data] [debug] [common] https://host/MAKEFILE [reason: compare failed] - 200 - 2018 - 183ms [html data] [debug] [bak] https://host/ids..{@bak_ext} [reason: compare failed] - 200 - 2018 - 15ms [html data] [debug] [bak] https://host/ids.n.{@bak_ext} [reason: compare failed] - 200 - 2018 - 11ms [html data] [debug] [bak] https://host/ids.{@bak_ext} [reason: compare failed] - 200 - 2018 - 15ms [html data] [debug] [bak] https://host/ids.nu.{@bak_ext} [reason: compare failed] - 200 - 2018 - 11ms [html data] [debug] [bak] https://host/id.{@bak_ext} [reason: compare failed] - 200 - 2018 - 16ms [html data] [debug] [word] https://host/dashboard [reason: compare failed] - 200 - 2018 - 11ms [html data] [debug] [bak] https://host/ids.nuct.{@bak_ext} [reason: compare failed] - 200 - 2018 - 11ms [html data] [debug] [common] https://host/LICENSE [reason: compare failed] - 200 - 2018 - 188ms [html data] [debug] [word] https://host/data [reason: compare failed] - 200 - 2018 - 15ms [html data] [debug] [bak] https://host/ids.nuc.{@bak_ext} [reason: compare failed] - 200 - 2018 - 17ms [html data] [debug] [common] https://host/.gitmodules [reason: compare failed] - 200 - 2018 - 188ms [html data] [debug] [bak] https://host/ids.nuctec.{@bak_ext} [reason: compare failed] - 200 - 2018 - 10ms [html data]

SuperXiaoxiong commented 1 month ago

第二个是 备份文件 构造 aaa.bbb.ccc 通常情况下是否构造以下情况就够了,如上构造多种 aaa.{@bak_ext} aaa.bbb.{@bak_ext} aaa.bbb.ccc.{@bak_ext} bbb.ccc.{@bak_ext} ccc.{@bak_ext}

M09Ic commented 1 month ago

已确认问题, 是上个版本的words更新, spray没有及时更新导致的bug。 感谢你的反馈

M09Ic commented 1 month ago

自动构造的算法后续会优化