xray icon indicating copy to clipboard operation
xray copied to clipboard

dirscan admin 扫描重复结果

Open zerokeeper opened this issue 2 years ago • 3 comments

dirscan/admin/default 扫描会出现不同后缀的结果 好像也是1.9.x新版本的问题,之前1.8.x的版本没发现这个问题

https://example.com/admin.html
https://example.com/admin.jsp
https://example.com/admin.do
https://example.com/admin.asp
https://example.com/admin
https://example.com/admin/

zerokeeper avatar Dec 17 '22 06:12 zerokeeper

https://example.com/.bashrc	dirscan/system/config	
https://example.com/.zshrc	dirscan/system/config	
https://example.com/.bash_profile	dirscan/system/config	
https://example.com/.bash_logout	dirscan/system/config	
https://example.com/code.tar.gz	dirscan/backup/code	
https://example.com/src.tar.gz	dirscan/backup/code	
https://example.com/htdocs.tar.gz	dirscan/backup/code	
https://example.com/webserver.tar.gz	dirscan/backup/code	
https://example.com/tools.tar.gz	dirscan/backup/code	
........                            dirscan/backup/code	

再补充一个就是dirscan扫描会出现大量误报结果,源站实际是访问任意路径都会下载一个文件,但是文件大小都是相同的。 可否先请求一个不存在的文件验证一下文件大小,然后排除这些误报的结果。

zerokeeper avatar Dec 18 '22 04:12 zerokeeper

可以判断响应头,响应头里有响应类型,把常见的文件类型响应捋一捋,能减少误判。

shmilylty avatar Dec 21 '22 05:12 shmilylty

收到建议,我们后续回优化一下dirscan这个插件

Jarcis-cy avatar Dec 22 '22 09:12 Jarcis-cy