Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Hello 猪猪侠,不知道这个工具还更新不,我反馈2个比较重要的bug。 #6

Open
coffeehb opened this issue Nov 23, 2016 · 2 comments

Comments

@coffeehb
Copy link

第一个:
common.py脚本里提取目标的链接资源时,没有考虑大小写问题,导致爬虫爬取数据不准确。 可以拿这个网站:http://www.shijihulian.com/ 测试。我看了源码,find_all似乎没有考虑大小写的,这算是一个坑吧。
第二个:
FuzzEnginer 分析引擎对备份文件的判断存在缺陷,我认为有2种情况下会被漏掉:1. 备份文件存,文件大小大于20K(代码:39行定义),2. 备份文件存在,文件大小于20k, 但文件内容包含了如:404,not Found等错误信息(代码:40-42行定义)
会被漏掉的2个假象场景:
1、目标网站存在全站的备份文件web.rar ,这个很容易就超过20K限制。
2、目标网站存在key.rar, 里面压缩了几个文件:404.html,config.php,password.txt ,几个很简单的文件。404.html很容易触发 “错误定义”文件识别导致被漏掉。

@ring04h
Copy link
Owner

ring04h commented Nov 23, 2016

恩,这个工具主要是给大家一个参考,已经用Golang重构了一个新版,不考虑更新这个版本了

@tosgit
Copy link

tosgit commented Jan 28, 2019

今天看了下代码 fuzz_tmp部分处理的有问题,原来不更新了啊....

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants