这是indexloc提供的服务，不要输入任何密码
Skip to content

[WIP] Adds request timings #316

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 1 commit into from
Closed

[WIP] Adds request timings #316

wants to merge 1 commit into from

Conversation

@zmackie
Copy link

@zmackie zmackie commented Sep 30, 2020

I was attempting to do a timing based attack on a target and realized ffuf does not have this information.
This is the first stages of PR that would add that data. I'm opening it in the spirit of discussions.

Here's what it looks like on the command line:

ffuf on  master [!] via 🐹 v1.13.8 
❯ ./ffuf -w ~/Desktop/passwords.txt -u https://example.org/FUZZ -mc all -fs 42 -c -v 

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v1.2.0-git
________________________________________________

 :: Method           : GET
 :: URL              : https://example.org/FUZZ
 :: Wordlist         : FUZZ: /home/zmackie/Desktop/passwords.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: all
 :: Filter           : Response size: 42
________________________________________________

[Status: 404, Size: 1256, Words: 298, Lines: 47, Duration: 207.566501ms] <------------------ NEW FIELD
| URL | https://example.org/1234
    * FUZZ: 1234

[Status: 404, Size: 1256, Words: 298, Lines: 47, Duration: 207.706648ms]
| URL | https://example.org/password
    * FUZZ: password

[Status: 404, Size: 1256, Words: 298, Lines: 47, Duration: 208.983548ms]
| URL | https://example.org/abc123
    * FUZZ: abc123

[Status: 404, Size: 1256, Words: 298, Lines: 47, Duration: 250.911374ms]
| URL | https://example.org/qazwsx
    * FUZZ: qazwsx

@zmackie
Copy link
Author

zmackie commented Sep 30, 2020

This PR would just be to add the durations to responses. It won't add anything like filtration or matching, but would unlock that capability.

@zmackie zmackie mentioned this pull request Sep 30, 2020
Closed
@joohoi
Copy link
Member

joohoi commented Oct 1, 2020

Thanks for opening the PR, I like the idea! It has actually been requested in the past too, but I have completely forgotten about it.

A few thoughts: I think it should be only displayed in the verbose mode (-v), as the space is really occupied within the single-line output method, especially if the input word is a longer one.

About the accuracy, I think we need to find something reasonable there, the current one is maybe a bit too ambitious (in terms of detecting anomalies) thoughts?

All in all, I don't think this needs a lot of modifications.

In addition the the things above, I'd love you to add yourself to CONTRIBUTORS.md (it's alphanumerically sorted) as well as a short description of the new functionality to CHANGELOG.md.

@joohoi
Copy link
Member

joohoi commented Oct 3, 2020

Oh and I'd like to see the timing information in the output files as well. Feel free to ask if you need directions.

@joohoi
Copy link
Member

joohoi commented Oct 21, 2020

Hi @zmackie , what do you think about the suggestions above?

@zmackie
Copy link
Author

zmackie commented Oct 22, 2020

@joohoi All that sounds great. Apologies I've not had time to follow-up; work and family have been a bit nuts lately.

@joohoi
Copy link
Member

joohoi commented May 17, 2021

Closing in favor of #433

@joohoi joohoi closed this May 17, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@zmackie @joohoi