Wordlist usage / definition error behavior

## Issue

I understand that when a keyword is used but not defined an error occurs:

```
ffuf -u 'http://ffuf.me/cd/param/CUSTOM'
...
Encountered error(s): 1 errors occured.                                                                                                                                                                                                     
        * Either -w or --input-cmd flag is required                                                                                                                                                                                         
```

I don't see how it could be useful to trigger an error when a keyword is defined but not used. A warning could be triggered instead so warn the user he may be missing something he is expecting.

```
ffuf -u 'http://ffuf.me/cd/param/CUSTOM' -w /usr/share/seclists/Discovery/Web-Content/common.txt:CUSTOM -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt:PARAM
...
Encountered error(s): 1 errors occured.                                                                                                                                                                                                     
* Keyword PARAM defined, but not found in headers, method, URL or POST data.
```

This last behavior becomes especially annoying when you want specify tons of named wordlists as shortcuts in the `.ffufrc` config file.

```toml
[input]
    wordlists = [
        "/usr/share/seclists/Discovery/Web-Content/common.txt:COMMON",
        "/usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt:PARAM",
        "/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt:SUBDOMAINS",
        "/usr/share/seclists/Discovery/Web-Content/quickhits.txt:QUICKHITS",
        "/usr/share/seclists/Discovery/Web-Content/raft-medium-files-lowercase.txt:MEDIUMFILES",
        "/usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt:MEDIUMDIR",
        "/usr/share/seclists/Discovery/Web-Content/raft-medium-words-lowercase.txt:MEDIUMWORDS"
    ]
```

```
ffuf -u 'http://ffuf.me/cd/param/COMMON?PARAM=1' -config ~/test.ffurc.toml
...
Encountered error(s): 5 errors occured.
        * Keyword SUBDOMAINS defined, but not found in headers, method, URL or POST data.
        * Keyword QUICKHITS defined, but not found in headers, method, URL or POST data.
        * Keyword MEDIUMFILES defined, but not found in headers, method, URL or POST data.
        * Keyword MEDIUMDIR defined, but not found in headers, method, URL or POST data.
        * Keyword MEDIUMWORDS defined, but not found in headers, method, URL or POST data.
```

I would expect that unused wordlists defined in the config file are ignored, this would allow to have aliases / shortcuts for wordlists.

Currently you have to comment unused wordlists to avoid errors:

```toml
[input]
    wordlists = [
        "/usr/share/seclists/Discovery/Web-Content/common.txt:COMMON",
        "/usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt:PARAM",
        #"/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt:SUBDOMAINS",
        #"/usr/share/seclists/Discovery/Web-Content/quickhits.txt:QUICKHITS",
        #"/usr/share/seclists/Discovery/Web-Content/raft-medium-files-lowercase.txt:MEDIUMFILES",
        #"/usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt:MEDIUMDIR",
        #"/usr/share/seclists/Discovery/Web-Content/raft-medium-words-lowercase.txt:MEDIUMWORDS"
    ]
```

## Related code

https://github.com/ffuf/ffuf/blob/5c489aea78b9a76472ca3f0b09774078932c9d59/pkg/ffuf/optionsparser.go#L505-L519

	conf.CommandLine = strings.Join(os.Args, " ")

	for _, provider := range conf.InputProviders {
	if provider.Template != "" {
	if !templatePresent(provider.Template, &conf) {
	errmsg := fmt.Sprintf("Template %s defined, but not found in pairs in headers, method, URL or POST data.", provider.Template)
	errs.Add(fmt.Errorf(errmsg))
	}
	} else {
	if !keywordPresent(provider.Keyword, &conf) {
	errmsg := fmt.Sprintf("Keyword %s defined, but not found in headers, method, URL or POST data.", provider.Keyword)
	errs.Add(fmt.Errorf(errmsg))
	}
	}
	}

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Wordlist usage / definition error behavior #572

Issue

Related code

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Uh oh!

Wordlist usage / definition error behavior #572

Description

Issue

Related code

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions