这是indexloc提供的服务,不要输入任何密码
Skip to content

Output format columns do not line up properly #660

@robertstrom

Description

@robertstrom

I have tried outputting all formats (and just csv) using a command like the one shown below:

ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -u http://www.holo.live/FUZZ -t 25 -fc 404 -e .php,.html,.htm,.txt,.bak,.zip,~ -o ffuf-www.holo.live-dirbust -of all

It does not seem to matter what format the output is in, the data in each column is incorrect. An example of the markdown output is shown below

| FUZZ | URL | Redirectlocation | Position | Status Code | Content Length | Content Words | Content Lines | Content Type | Duration | ResultFile | ScraperData
  | :- | :-- | :--------------- | :---- | :------- | :---------- | :------------- | :------------ | :--------- | :----------- | :------------ |
  | 4500679 | .htaccess | http://admin.holo.live/.htaccess |  | 121 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 170.385517ms |  |  |
  | 450067a | .htaccess.php | http://admin.holo.live/.htaccess.php |  | 122 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 170.991239ms |  |  |
  | 450067b | .htaccess.html | http://admin.holo.live/.htaccess.html |  | 123 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 170.689087ms |  |  |
  | 450067c | .htaccess.htm | http://admin.holo.live/.htaccess.htm |  | 124 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 171.412565ms |  |  |
  | 450067d | .htaccess.txt | http://admin.holo.live/.htaccess.txt |  | 125 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 171.058853ms |  |  |
  | 450067e | .htaccess.bak | http://admin.holo.live/.htaccess.bak |  | 126 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 170.998954ms |  |  |
  | 450067f | .htaccess.zip | http://admin.holo.live/.htaccess.zip |  | 127 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 169.575039ms |  |  |
  | 4500680 | .htaccess~ | http://admin.holo.live/.htaccess~ |  | 128 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 170.99362ms |  |  |
  | 4500681 | .htpasswd | http://admin.holo.live/.htpasswd |  | 129 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 170.331549ms |  |  |
  | 4500682 | .htpasswd.php | http://admin.holo.live/.htpasswd.php |  | 130 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 170.613646ms |  |  |
  | 4500684 | .htpasswd.htm | http://admin.holo.live/.htpasswd.htm |  | 132 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 172.298652ms |  |  |
  | 4500683 | .htpasswd.html | http://admin.holo.live/.htpasswd.html |  | 131 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 174.334828ms |  |  |
  | 4500685 | .htpasswd.txt | http://admin.holo.live/.htpasswd.txt |  | 133 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 170.22696ms |  |  |
  | 4500686 | .htpasswd.bak | http://admin.holo.live/.htpasswd.bak |  | 134 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 170.214649ms |  |  |
  | 4500687 | .htpasswd.zip | http://admin.holo.live/.htpasswd.zip |  | 135 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 170.850741ms |  |  |
  | 4500688 | .htpasswd~ | http://admin.holo.live/.htpasswd~ |  | 136 | 403 | 280 | 20 | 10 | text/html; charset=iso-8859-1 | 172.567656ms |  |  |
  | 4500654e1 | assets | http://admin.holo.live/assets | http://admin.holo.live/assets/ | 21729 | 301 | 319 | 20 | 10 | text/html; charset=iso-8859-1 | 333.517197ms |  |  |
  | 45006b2ca | dashboard.php | http://admin.holo.live/dashboard.php | index.php | 45770 | 302 | 0 | 1 | 1 | text/html; charset=UTF-8 | 266.388159ms |  |  |
  | 45006b4c2 | db_connect.php | http://admin.holo.live/db_connect.php |  | 46274 | 200 | 0 | 1 | 1 | text/html; charset=UTF-8 | 351.431156ms |  |  |
  | 45006c3b1 | docs | http://admin.holo.live/docs | http://admin.holo.live/docs/ | 50097 | 301 | 317 | 20 | 10 | text/html; charset=iso-8859-1 | 425.885651ms |  |  |

The FUZZ hash in in the column where the FUZZ should be and every other column is incorrect because of this. I have seen these same output results using both the 2.0.0-dev and the 2.0.0 versions. And the incorrectly formatted results seem to be the same regardless of the output format.

This seems to fix the markdown results

sed -E 's/( [a-f0-9]+ )//'  ffuf-admin.holo.live-dirbust.md | sed 's/  || /  | /'

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions