Closed ErikOwen closed 12 months ago
Opened PR #588 for this. Hope this helps!
Thank for looking into this issue and pushing up a solution, @WigzyDev! I very much appreciate you taking the time to look into this 🙏.
Using katana v1.0.4
I am seeing that the -dr
flag does properly report the redirect (301
status code) 🎉. But if I set a larger max crawl depth (-d
flag) katana still follows the redirects:
> echo "http://projectdiscovery.io" | katana -silent -d 3 -dr
http://projectdiscovery.io
https://projectdiscovery.io/
https://projectdiscovery.io/cdn-cgi/l/email-protection
https://projectdiscovery.io/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
https://chaos.projectdiscovery.io/
https://blog.projectdiscovery.io/announcing-nuclei-cloud/
https://blog.projectdiscovery.io/
https://blog.projectdiscovery.io/stop-pentesting-start-programming/
https://blog.projectdiscovery.io/the-best-defense-is-a-good-offensive-security-program/
https://blog.projectdiscovery.io/hunting-c2-servers/
https://projectdiscovery.io/requestdemo
https://projectdiscovery.io/nuclei
https://projectdiscovery.io/community
https://projectdiscovery.io/terms
https://projectdiscovery.io/privacy
https://projectdiscovery.io/cloudplatform
https://projectdiscovery.io/aboutus
I would expect katana to not crawl any HTTPS pages when the -dr
flag is set, and the target is HTTP (http://projectdiscovery.io
).
I'll open up another issue to track this bug.
Please describe your feature request:
When crawling a target, do not follow HTTP redirects. Specifically, if a
301
or302
redirect response code is returned from the server, do not submit an additional request to the value of theLocation
header.Describe the use case of this feature:
I want to be able to use katana to crawl an HTTP target that redirects to HTTPS, and be able to see a
301
response and the corresponding headers in the JSON output. I cannot currently do that, because it appears as though katana automatically follows redirects. Here is an example:Example of a target that has an HTTP -> HTTPS redirect
Example of katana following the redirect: