Herbert555

Results 3 issues of Herbert555

测试spray的正则功能找未授权的api,已经匹配到到了结果“参数缺失:name"}” ![图片](https://github.com/user-attachments/assets/82fdeb85-2652-4890-b072-00ed483694aa) 但在输出的结果文件中3_res.txt中的extracts仍然为null ![图片](https://github.com/user-attachments/assets/ee4b2ac5-b67d-409f-8353-ca33cf8790d6) extractJson.yaml - name: 缺少参数 regexps: - (参数缺失.{1,10}) 另外同样的字典dirsearch能扫出来 ![图片](https://github.com/user-attachments/assets/ff842aad-5dad-4e11-b62a-562df3a22942) spray是直接过滤掉了 ![图片](https://github.com/user-attachments/assets/344b92cd-25a1-495f-be33-44c2bfee65c5) 看了下原因是[reason: fuzzy compare failed] ![图片](https://github.com/user-attachments/assets/ef41dfa8-1e06-46df-8dbd-9379b6f72a1b) admin-api/system/tenant/get-id-by-name这个接口内容和其他接口完全不一样 ![图片](https://github.com/user-attachments/assets/8eca0131-8ed4-4bd1-9a82-3b139ddaad70) ![图片](https://github.com/user-attachments/assets/11f142e6-ae40-4fe5-9984-08fbe5732189)

bug

扫描时报错 ![Image](https://github.com/user-attachments/assets/caefacb5-58a6-41cb-be4c-c30aaae4efb2) panic: runtime error: index out of range [0] with length 0 [recovered] panic: runtime error: index out of range [0] with length 0 goroutine 88 [running]: encoding/json.(*encodeState).marshal.func1() $GOROOT/src/encoding/json/encode.go:326...

问题一:请问如何在-X POST时指定post请求的参数? 问题二:--row存在bug 尝试使用--row代替发送post请求 ![Image](https://github.com/user-attachments/assets/2e99d623-77e6-4418-9c05-374858893866) 1.发现post参数被吞了 2.如果目标是https的站,--row只能发送http的请求 ![Image](https://github.com/user-attachments/assets/d602c786-f8d5-41bb-802e-36b9a6d2fbab)

bug