search

hannob / snallygaster

Tool to scan for secret files on HTTP servers
BSD Zero Clause License
2.07k stars 228 forks source link

Not finding server-status #22

Closed Themercee closed 6 years ago

Themercee commented 6 years ago

I have done some test and the Apache Server-Status page need to end with a " / " at the end. If it is not present, the page doesn't show up.

hannob commented 6 years ago

I can assure this test works, I have found countless instances of server-status with it. The sample config shipped with apache and the docs shipped with apache itself also indicate an URL without a slash at the end.

Please explain more specifically why you believe this to be different or in what setup you're experiencing this.

Themercee commented 6 years ago

I run the tool in debug mode on a domain like www.example.com and I know there is a server-status on https://www.example.com/server-status . But snallygaster doesn't mention anything about it. I try to run only the apache_server_status test and nothing. If I figure anything out that may fail the test I will send more info.

hannob commented 6 years ago

Please name me or run a public test server that exposes this behavior, otherwise I can't check this.