epi052 / feroxbuster

A fast, simple, recursive content discovery tool written in Rust.
https://epi052.github.io/feroxbuster/
MIT License
5.61k stars 472 forks source link

[BUG] Links are not recursed #1076

Closed wilco375 closed 5 months ago

wilco375 commented 5 months ago

Describe the bug When Feroxbuster discovers a directory from a HTML link, that directory is not brute-forced using the provided wordlists.

To Reproduce

  1. Save this simple example server as index.py:
    
    from flask import Flask, render_template, request

app = Flask(name)

@app.route('/', methods=['GET']) def index(): return 'Test', 200

@app.route('/a', methods=['GET']) def a(): return 'Hello world', 200

@app.route('/test', methods=['GET']) def test(): return 'Hello world', 200

@app.route('/test/a', methods=['GET']) def testA(): return 'Hello world', 200

2. Run `python3 index.py`
3. Run `echo -e "a\nb\n" | feroxbuster -u http://localhost:5000 -w /dev/stdin --force-recursion`

**Expected behavior**
The following directories are discovered:
`/a` - Using wordlist
`/test` - Using HTML link parsing
`/test/a` - Using HTML link parsing and then wordlist

**Traceback / Error Output**
Only `/a` and `/test` are discovered

| | |) |) | / ` / \ _/ | | \ | | | | \ | \ | \, _/ / \ | |_/ | by Ben "epi" Risher πŸ€“ ver: 2.10.1 ───────────────────────────┬────────────────────── 🎯 Target Url β”‚ http://localhost:5000 πŸš€ Threads β”‚ 50 πŸ“– Wordlist β”‚ /dev/stdin πŸ‘Œ Status Codes β”‚ All Status Codes! πŸ’₯ Timeout (secs) β”‚ 7 🦑 User-Agent β”‚ feroxbuster/2.10.1 πŸ”Ž Extract Links β”‚ true 🏁 HTTP methods β”‚ [GET] πŸ”ƒ Recursion Depth β”‚ 4 🀘 Force Recursion β”‚ true ───────────────────────────┴────────────────────── 🏁 Press [ENTER] to use the Scan Management Menuβ„’ ────────────────────────────────────────────────── 404 GET 4l 34w 232c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 200 GET 1l 2w 11c http://localhost:5000/a 200 GET 1l 2w 11c http://localhost:5000/test 200 GET 1l 2w 50c http://localhost:5000/ [####################] - 1s 7/7 0s found:3 errors:0



**Environment (please complete the following information):**
 - feroxbuster version: 2.10.1
 - OS: Ubuntu 22.04.1
wilco375 commented 5 months ago

Closed, does work if test route is defined as /test, see #1077