-
-
Notifications
You must be signed in to change notification settings - Fork 1.5k
Closed
Description
I have tried outputting all formats (and just csv) using a command like the one shown below:
ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -u http://www.holo.live/FUZZ -t 25 -fc 404 -e .php,.html,.htm,.txt,.bak,.zip,~ -o ffuf-www.holo.live-dirbust -of all
It does not seem to matter what format the output is in, the data in each column is incorrect. An example of the markdown output is shown below
| FUZZ | URL | Redirectlocation | Position | Status Code | Content Length | Content Words | Content Lines | Content Type | Duration | ResultFile | ScraperData
| :- | :-- | :--------------- | :---- | :------- | :---------- | :------------- | :------------ | :--------- | :----------- | :------------ |
| 4500679 | .htaccess | http://admin.holo.live/.htaccess | | 121 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 170.385517ms | | |
| 450067a | .htaccess.php | http://admin.holo.live/.htaccess.php | | 122 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 170.991239ms | | |
| 450067b | .htaccess.html | http://admin.holo.live/.htaccess.html | | 123 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 170.689087ms | | |
| 450067c | .htaccess.htm | http://admin.holo.live/.htaccess.htm | | 124 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 171.412565ms | | |
| 450067d | .htaccess.txt | http://admin.holo.live/.htaccess.txt | | 125 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 171.058853ms | | |
| 450067e | .htaccess.bak | http://admin.holo.live/.htaccess.bak | | 126 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 170.998954ms | | |
| 450067f | .htaccess.zip | http://admin.holo.live/.htaccess.zip | | 127 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 169.575039ms | | |
| 4500680 | .htaccess~ | http://admin.holo.live/.htaccess~ | | 128 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 170.99362ms | | |
| 4500681 | .htpasswd | http://admin.holo.live/.htpasswd | | 129 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 170.331549ms | | |
| 4500682 | .htpasswd.php | http://admin.holo.live/.htpasswd.php | | 130 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 170.613646ms | | |
| 4500684 | .htpasswd.htm | http://admin.holo.live/.htpasswd.htm | | 132 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 172.298652ms | | |
| 4500683 | .htpasswd.html | http://admin.holo.live/.htpasswd.html | | 131 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 174.334828ms | | |
| 4500685 | .htpasswd.txt | http://admin.holo.live/.htpasswd.txt | | 133 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 170.22696ms | | |
| 4500686 | .htpasswd.bak | http://admin.holo.live/.htpasswd.bak | | 134 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 170.214649ms | | |
| 4500687 | .htpasswd.zip | http://admin.holo.live/.htpasswd.zip | | 135 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 170.850741ms | | |
| 4500688 | .htpasswd~ | http://admin.holo.live/.htpasswd~ | | 136 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 172.567656ms | | |
| 4500654e1 | assets | http://admin.holo.live/assets | http://admin.holo.live/assets/ | 21729 | 301 | 319 | 20 | 10 | text/html; charset=iso-8859-1 | 333.517197ms | | |
| 45006b2ca | dashboard.php | http://admin.holo.live/dashboard.php | index.php | 45770 | 302 | 0 | 1 | 1 | text/html; charset=UTF-8 | 266.388159ms | | |
| 45006b4c2 | db_connect.php | http://admin.holo.live/db_connect.php | | 46274 | 200 | 0 | 1 | 1 | text/html; charset=UTF-8 | 351.431156ms | | |
| 45006c3b1 | docs | http://admin.holo.live/docs | http://admin.holo.live/docs/ | 50097 | 301 | 317 | 20 | 10 | text/html; charset=iso-8859-1 | 425.885651ms | | |
The FUZZ hash in in the column where the FUZZ should be and every other column is incorrect because of this. I have seen these same output results using both the 2.0.0-dev and the 2.0.0 versions. And the incorrectly formatted results seem to be the same regardless of the output format.
This seems to fix the markdown results
sed -E 's/( [a-f0-9]+ )//' ffuf-admin.holo.live-dirbust.md | sed 's/ || / | /'
Metadata
Metadata
Assignees
Labels
No labels