gobuster
gobuster copied to clipboard
Unable to exclude status code
Hii! For some reason, I can't exclude (or better say include) the status code that makes up issue with wildcards.
See below for example:
# => includes only HTTP 200 OK
$ gobuster dir -u https://www.example.com/ -w ~/util/SecLists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -s 200
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: https://www.example.com/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: ~/util/SecLists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.1.0
[+] Timeout: 10s
[+] // Missing "Status Code"
===============================================================
2021/02/05 15:35:27 Starting gobuster in directory enumeration mode
===============================================================
Error: the server returns a status code that matches the provided options for non existing urls. https://www.example.com/da8306e5-10c0-416a-9c63-4f125bc96878 => 302 (Length: 26). To continue please exclude the status code, the length or use the --wildcard switch
Why does it even check for 302 if I only included 200 OK? Why is there no information about status code(s) I included in the stdout tty banner?
I've submitted a pull request (Update dir.go #286) to fix this issue. You can make the changes yourself to 2 lines of code to fix this behavior.
This works as expected. Everything except 404 is handled a "good hit". The Pre check tries some random urls that do not exist and every one of those result in a 302 so there is no real way to detect this. So you need to update the -b switch with 404,302 or exclude the length to continue
Will this ever be fixed? Still an issue in 3.1.0
Error: the server returns a status code that matches the provided options for non existing urls. https://acf51fdf1ef3226bc0c107b5001d0039.web-security-academy.net/5a5ad98b-471c-4dee-a868-dbf7b56088d5 => 302 (Length: 0). To continue please exclude the status code, the length or use the --wildcard switch
If it's only 2 lines of code to fix, wondering why in 8 months there hasn't been a release w/ a fix... Is this tool no longer supported or under maintenance?
What version was this bug introduced in so I can downgrade?
Will this ever be fixed? Still an issue in 3.1.0
Error: the server returns a status code that matches the provided options for non existing urls. https://acf51fdf1ef3226bc0c107b5001d0039.web-security-academy.net/5a5ad98b-471c-4dee-a868-dbf7b56088d5 => 302 (Length: 0). To continue please exclude the status code, the length or use the --wildcard switch
If it's only 2 lines of code to fix, wondering why in 8 months there hasn't been a release w/ a fix... Is this tool no longer supported or under maintenance?
What version was this bug introduced in so I can downgrade?
You can simply use the -b switch to define bad codes. -b 302 does the trick.
Will this ever be fixed? Still an issue in 3.1.0 Error: the server returns a status code that matches the provided options for non existing urls. https://acf51fdf1ef3226bc0c107b5001d0039.web-security-academy.net/5a5ad98b-471c-4dee-a868-dbf7b56088d5 => 302 (Length: 0). To continue please exclude the status code, the length or use the --wildcard switch If it's only 2 lines of code to fix, wondering why in 8 months there hasn't been a release w/ a fix... Is this tool no longer supported or under maintenance? What version was this bug introduced in so I can downgrade?
You can simply use the -b switch to define bad codes. -b 302 does the trick.
Looks like -b doesnt exist in 3.1.0 either.
gobuster vhost -u $dns -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t 200 -r -b 302 Error: unknown shorthand flag: 'b' in -b
Just use the latest version:
go install github.com/OJ/gobuster/v3@latest
The exclusion thing is working now, this issue needs to be closed @Admonstrator @FireFart
thank you work perfectly fine
Will this ever be fixed? Still an issue in 3.1.0 Error: the server returns a status code that matches the provided options for non existing urls. https://acf51fdf1ef3226bc0c107b5001d0039.web-security-academy.net/5a5ad98b-471c-4dee-a868-dbf7b56088d5 => 302 (Length: 0). To continue please exclude the status code, the length or use the --wildcard switch If it's only 2 lines of code to fix, wondering why in 8 months there hasn't been a release w/ a fix... Is this tool no longer supported or under maintenance? What version was this bug introduced in so I can downgrade?
You can simply use the -b switch to define bad codes. -b 302 does the trick.
Looks like -b doesnt exist in 3.1.0 either.
gobuster vhost -u $dns -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t 200 -r -b 302 Error: unknown shorthand flag: 'b' in -b
Is the flag back? 3.6 doesn't have -b neither.
As commented on the other thread, vhost mode does not have a b
flag. Please don't spam old issues.