这是indexloc提供的服务,不要输入任何密码
Skip to content

ffuf cannot fuzzing https site that use old TLS/SSL #664

@alasalamont

Description

@alasalamont

I tested "ffuf" on "Beep" lab machine on HTB. The lab use old TLSv1. And when:

  1. I use ffuf with https, there is no results for both files and directories
  2. I use ffuf with http, it found files + tons of directories with 302 code
  3. I use ffuf with http, and filter status code 302. it found some files + directories but not enough
  4. I use "wfuzz", "dir", "dirbuster", and "feroxbuster" it can find all the files as well as directories
  5. When I check log file it says "tls: server selected unsupported protocol version 301"
    → Something wrong with ffuf when fuzzing https when server use old TLDs

How to fix these cases?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions