Unable to exclude status code

[duraki]

trafficstars

Hii! For some reason, I can't exclude (or better say include) the status code that makes up issue with wildcards.

See below for example:

# => includes only HTTP 200 OK
$ gobuster dir -u https://www.example.com/ -w ~/util/SecLists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -s 200
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     https://www.example.com/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                ~/util/SecLists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.1.0
[+] Timeout:                 10s
[+] // Missing "Status Code"
===============================================================
2021/02/05 15:35:27 Starting gobuster in directory enumeration mode
===============================================================
Error: the server returns a status code that matches the provided options for non existing urls. https://www.example.com/da8306e5-10c0-416a-9c63-4f125bc96878 => 302 (Length: 26). To continue please exclude the status code, the length or use the --wildcard switch

Why does it even check for 302 if I only included 200 OK? Why is there no information about status code(s) I included in the stdout tty banner?

[sloftis2016]

I've submitted a pull request (Update dir.go #286) to fix this issue. You can make the changes yourself to 2 lines of code to fix this behavior.

[firefart]

This works as expected. Everything except 404 is handled a "good hit". The Pre check tries some random urls that do not exist and every one of those result in a 302 so there is no real way to detect this. So you need to update the -b switch with 404,302 or exclude the length to continue

[ZackInMA]

Will this ever be fixed? Still an issue in 3.1.0

Error: the server returns a status code that matches the provided options for non existing urls. https://acf51fdf1ef3226bc0c107b5001d0039.web-security-academy.net/5a5ad98b-471c-4dee-a868-dbf7b56088d5 => 302 (Length: 0). To continue please exclude the status code, the length or use the --wildcard switch

If it's only 2 lines of code to fix, wondering why in 8 months there hasn't been a release w/ a fix... Is this tool no longer supported or under maintenance?

What version was this bug introduced in so I can downgrade?

[Admonstrator]

Will this ever be fixed? Still an issue in 3.1.0

Error: the server returns a status code that matches the provided options for non existing urls. https://acf51fdf1ef3226bc0c107b5001d0039.web-security-academy.net/5a5ad98b-471c-4dee-a868-dbf7b56088d5 => 302 (Length: 0). To continue please exclude the status code, the length or use the --wildcard switch

If it's only 2 lines of code to fix, wondering why in 8 months there hasn't been a release w/ a fix... Is this tool no longer supported or under maintenance?

What version was this bug introduced in so I can downgrade?

You can simply use the -b switch to define bad codes. -b 302 does the trick.

[AirHeadsbuirse]

Will this ever be fixed? Still an issue in 3.1.0 Error: the server returns a status code that matches the provided options for non existing urls. https://acf51fdf1ef3226bc0c107b5001d0039.web-security-academy.net/5a5ad98b-471c-4dee-a868-dbf7b56088d5 => 302 (Length: 0). To continue please exclude the status code, the length or use the --wildcard switch If it's only 2 lines of code to fix, wondering why in 8 months there hasn't been a release w/ a fix... Is this tool no longer supported or under maintenance? What version was this bug introduced in so I can downgrade?

You can simply use the -b switch to define bad codes. -b 302 does the trick.

Looks like -b doesnt exist in 3.1.0 either.

gobuster vhost -u $dns -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t 200 -r -b 302 Error: unknown shorthand flag: 'b' in -b

[firefart]

Just use the latest version:

go install github.com/OJ/gobuster/v3@latest

[Rushour0]

The exclusion thing is working now, this issue needs to be closed @Admonstrator @FireFart

[Cryptic-error]

thank you work perfectly fine

[HuliKos]

Will this ever be fixed? Still an issue in 3.1.0 Error: the server returns a status code that matches the provided options for non existing urls. https://acf51fdf1ef3226bc0c107b5001d0039.web-security-academy.net/5a5ad98b-471c-4dee-a868-dbf7b56088d5 => 302 (Length: 0). To continue please exclude the status code, the length or use the --wildcard switch If it's only 2 lines of code to fix, wondering why in 8 months there hasn't been a release w/ a fix... Is this tool no longer supported or under maintenance? What version was this bug introduced in so I can downgrade?

You can simply use the -b switch to define bad codes. -b 302 does the trick.

Looks like -b doesnt exist in 3.1.0 either.

gobuster vhost -u $dns -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t 200 -r -b 302 Error: unknown shorthand flag: 'b' in -b

Is the flag back? 3.6 doesn't have -b neither.

[firefart]

As commented on the other thread, vhost mode does not have a b flag. Please don't spam old issues.