chainreactors / spray

Next Generation HTTP Dir/File Fuzz Artifact
https://chainreactors.github.io/wiki/spray/
GNU General Public License v3.0
504 stars 40 forks source link

--filter 与 --match 不生效 (interface conversion: interface {} is pkg.BS, not string (1:18)) #77

Open Luoooio opened 1 week ago

Luoooio commented 1 week ago

./spray_linux_amd64 -u http://127.0.0.1:8080 -d dict.txt --filter 'current.Body not contains "c"' --debug [=] Black Status: [400 410], WhiteStatus: [200], WAFStatus: [493 418 1020 406] , 2024-10-20 07:54.35 [=] Fuzzy Status: [500 501 502 503 301 302], Unique Status: [403 200 404] , 2024-10-20 07:54.35 ──────────────────────────────────────────────────────────── 🌐 URL: [http://127.0.0.1:8080] 🔢 PortRange: 📚 Dictionaries: [dict.txt] 💡 Word: {?0} 📜 Rules: [] 🔍 FilterRule: 🔧 AppendRule: [] 🧩 AppendWords: 0 📊 Match: ⚙ Filter: current.Body not contains "c" 🔎 Extracts: [] 🔌 Plugins: 🛑 BlackStatus: [400 410] ✅ WhiteStatus: [200] 🔄 FuzzyStatus: [500 501 502 503 301 302] 🔒 UniqueStatus: [403 200 404] 🔑 Unique: false ⏱ Timeout: 5 📈 PoolSize: 5 🧵 Threads: 20 🌍 Proxy: ──────────────────────────────────────────────────────────── [=] Loaded 1 word from dict.txt , 2024-10-20 07:54.35 [=] Parsed 1 words by {?0} , 2024-10-20 07:54.35 [*] [pool] task: http://127.0.0.1:8080, total 1 words, 20 threads, proxy: , 2024-10-20 07:54.35 [debug] pythonSimpleHTTP finger hit, header: simplehttp/ [debug] pythonSimpleHTTP finger hit, header: simplehttp/ [=] [baseline.index] http://127.0.0.1:8080/ [200] [870] [0ms] [Directory listing for /] [directory] [pythonsimplehttp] , 2024-10-20 07:54.35 [=] [baseline.random] http://127.0.0.1:8080/JKalnibgxBLoKKUq [404] [469] [0ms] [Error response] [pythonsimplehttp] , 2024-10-20 07:54.35 [index] 200 870 0ms http://127.0.0.1:8080/ [Directory listing for /] [directory] [pythonsimplehttp] [warn] interface conversion: interface {} is pkg.BS, not string (1:18) | current.Body not contains "c" | .................^ [word] 200 2 0ms http://127.0.0.1:8080/web [bin data] [*] [stat] http://127.0.0.1:8080 took 0 s, request total: 3, finish: 1/1(0 skipped), found: 1, check: 0, failed: 0 , 2024-10-20 07:54.35 [=] [stat] http://127.0.0.1:8080 200: 1, , 2024-10-20 07:54.35 [=] [stat] http://127.0.0.1:8080 word: 1, , 2024-10-20 07:54.35 total progressive: done! 0s

M09Ic commented 17 hours ago

有个临时的解决办法是 --filter 'string(current.Body) not contains "c"'

因为在Baseline结构体中, Body, Header都是 []byte, 而expr 的contains只能对string使用