search

epi052 / feroxbuster

A fast, simple, recursive content discovery tool written in Rust.
https://epi052.github.io/feroxbuster/
MIT License
5.9k stars 498 forks source link

[FEATURE REQUEST] feroxbuster should respect wordlist order #233

Closed Kiblyn11 closed 3 years ago

Kiblyn11 commented 3 years ago

Describe the bug Feroxbuster process wordlist randomly which is very inconvenient when sorted by best matches. I haven't found this behavior documented anywhere.

To Reproduce

# Instant findings
ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -u http://challenge01.root-me.org/realiste/ch7/FUZZ -t 1

# Randomly pop a finding, very long
feroxbuster --url http://challenge01.root-me.org/realiste/ch7/ -t 2

Expected behavior Tool should keep wordlist ordering or be able to provide an option to do so. I'm not really sure to know why it's processing randomly.

Traceback / Error Output If applicable, add error output to help explain your problem.

Environment (please complete the following information): feroxbuster 2.2.1 (freshly pulled)

Additional context Add any other context about the problem here.

epi052 commented 3 years ago

You're the second person in about a week or so to ask about this (https://github.com/epi052/feroxbuster/issues/226). I suppose I'll have to change the behavior. Right now the file read uses tokio's implementation, which is asynchronous, leading to unordered results.

epi052 commented 3 years ago

Thank you for taking the time to create the issue by the way!

Kiblyn11 commented 3 years ago

Ah I didn't think to look in past issues. Well, if there is no particular reason for treating the list unorderly it would be nice to follow the order :) And thanks for the work on this tool !

epi052 commented 3 years ago

@secure-77 @Kiblyn11

version 2.2.2 maintains wordlist order.

additionally, i misspoke when i blamed tokio. I chose a hashset for storing the wordlist in order to remove duplicate entries, however hashsets are by definition unordered data structures. Changing it to a vector fixed the issue. Thank you both for the input!

secure-77 commented 3 years ago

thank you for adding this feature!

Kiblyn11 commented 3 years ago

@epi052 That was fast ! Confirm it works. Thanks.