Commit graph

88 commits

Author SHA1 Message Date
Joona Hoikkala
c7d0fb5cf5
Gracefully error in case stdin is used for search result (#634) 2023-02-04 13:36:00 +02:00
Joona Hoikkala
643f6b883f
Scraper functionality (#633)
* Scraper functionality

* Handle matched only - case for scraper

* Add scraper output to different formats

* Fix the ancient merge reminders

* Load scraper rules from directory

* Scraper fixes
2023-02-04 13:23:31 +02:00
DoI
7bff9e70da
Fix time-based matcher (#575)
* Fix time-based matcher

* add time filter/matcher double quotes in readme

---------

Co-authored-by: Joona Hoikkala <joohoi@users.noreply.github.com>
2023-02-02 16:08:57 +02:00
Joona Hoikkala
9bddff79b9
New functionality to map fired blind payloads back to the initial request (#632)
* Fix ioutil deprecation and use xdg paths instead (wip)

* Clean up deprecated ioutil references, add config directory structure creation and run entry creation

* Add wordlist position setting and FFUFHASH variable

* Save full wordlist paths and print out a raw request when searched

* Cast from string to 32bit integer, 2billion should be enough for a position

* Use correct format strings for float
2023-02-02 11:51:11 +02:00
Joona Hoikkala
21a19a1f3d Choose between 'and' and 'or' matching and filtering (#20) 2022-05-19 09:32:34 +03:00
Joona Hoikkala
9fa0a5d20a
Ac rewrite
* Full revamp of filtering, and autocalibration settings.

* Fix concurrency issue in calibration

* Fix linting
2022-05-19 09:31:54 +03:00
Justin Steven
4c1a75498b
Add -json option (#509)
* Add -json option

Prints newline-delimited JSON output to STDOUT

* sort

* Clear terminal line via STDERR foreach JSON result

For each JSON result being printed, prepend it with a TERMINAL_CLEAR_LINE via
STDERR. This clears the progress line (which is also being emitted via STDERR)
and leaves us with a clean stream of JSON lines in the terminal.
2022-03-06 16:39:33 +02:00
DoI
9aeae16a08
Add Sniper Mode (#469)
* Modify SimpleRunner to take a Request parameter, add base and copy functions for Requests

* Add Request structs to run queues

* Implemented sniper mode

* Added request and optionsparser tests for sniper mode

* Removed unneccesary print statements

* Updated readme.md and terminal output

* Enabled command inputs for sniper mode

* correctly initialize validmode in optionsparser

* Remove unnecessary print data in TestScrubTemplates

* Use InputProvider for sniper template characters

* Add a sniper-mode specific queue job execution log
2022-03-06 16:14:45 +02:00
Maxime Catrice
80a4aa7783
Fix -of all output and add HTTP/2 support (#451) (#462)
* Fix -of all output (#451)

* Add HTTP/2 support
2022-01-28 17:49:53 +02:00
Joona Hoikkala
2fdbd25655
Fix reading wordlists from cfg (#511)
* Fix issue with wordlists being defined in the ffufrc file

* Add changelog entry
2022-01-22 19:50:57 +02:00
DoI
965f282c0b
Response time logging and filtering (#433)
* Added response time reporting and filtering

* Update to use the http config context

* Added changelog and contributor info

* Round time output in stdout to nearest millisecond

* Change stdout duration rounding to use Milliseconds()

* Go back to Round() for timing output

* Changed stdout to display millisecond durations

Co-authored-by: Joona Hoikkala <joohoi@users.noreply.github.com>
2021-05-17 00:10:56 +03:00
Samuel Erb
5ad06815cd
Add TLS SNI Support (#441)
* add SNI support to ffuf

* remove change to keywordPresent

* Update CONTRIBUTORS.md

* Update CHANGELOG.md
2021-05-13 23:46:29 +03:00
Joona Hoikkala
ee0705e224
Fix an issue where output file was created regardless of -or (#444)
* Fix an issue where output file was created regardless of -or

* Add CHANGELOG entry
2021-05-13 19:07:00 +03:00
Joona Hoikkala
8ffe1bd64e
Add a cli flag to disable interactive mode (#436) 2021-04-26 23:04:12 +03:00
Joona Hoikkala
f97c2f7600
Interactive mode and recursion-strategy (#426)
* Add new feature: recursion-strategy

* Implementation of interactive mode (#8)

* Add interactive mode documentation (#9)

* Prepare for release 1.3.0 (#11)
2021-04-18 12:54:17 +03:00
Joona Hoikkala
fb1be906f0
Move version output to a function (#407)
* Version info as function (#3)

* Opportunistic coloring
2021-03-04 22:04:04 +02:00
Jesus Galvan
5b75e9018f
Allow input-shell option (#344)
* Allow input-shell option

* Markdown files

* Changelog
* Contributors
2021-01-24 18:55:23 +02:00
Bp0lr
bc5e61ecc3
Empty filter (#330)
* add support to filter empty result files.

* update readme

* add contributors.

* add changelog

* Update ffufrc.example
2020-11-23 20:39:06 +02:00
Joona Hoikkala
bde943cc5d
Add support for configuration files for ffuf (#308)
* Refactor config and job creation

* ConfigOptions defaults

* Structure ConfigOptions for config file parser

* Sort options

* Finalize the configuration file reading and add examples and documentation

* Fix issues with opts -> config translation
2020-09-27 19:24:06 +03:00
Joona Hoikkala
dc24ad2639
Make SIGINT more responsive, and handle zombied TCP connections properly (#302) 2020-09-24 12:04:31 +03:00
Joona Hoikkala
f3bcb50e3a
Fixed comma parsing bugs in non-wordlist cli arguments (#298) 2020-09-16 11:08:09 +03:00
Stephen Haywood
a71f1c0105
Comma separated -w flags (#294)
* Comma separated -w flags.

* Remove printf

* Updated changelog and contributors

* Alphabetical order
2020-09-14 23:13:21 +03:00
Joona Hoikkala
a4b3154484
Better pre-flight errors (#288) 2020-08-30 15:22:06 +03:00
Joona Hoikkala
0ce941326b
Throttle rate of requests per second (#287)
* Add the functionality to perform req/sec limiting (for humans)

* Add documentation
2020-08-30 13:51:41 +03:00
C_Sto
27fcbee730
fix file get thing (#226)
* fix file get thing

* update doco
2020-07-23 12:15:36 +03:00
Joona Hoikkala
0633fb6b0a
Fixed behavior of wordlist:keyword separator in Windows (#240) 2020-05-16 15:49:57 +03:00
Dave Walker
88720dfdc9
Support outputting all file formats concurrently (#218)
* Support outputting all file formats concurrently

Previously ffuf would allow outputting to a single
file-format, ie Markdown (md), json or HTML.  It was not
possible to output in multiple formats in the same
execution.

This change allows specifying an output (-of) of "all",
which means that the output filename (-o) is used, but the
appropriate suffix is added.

As an example,
... -of all -o output/report

Will output:
 - output/report.json
 - output/report.html
 - output/report.csv
 - ... etc

Fixes ffuf/ffuf#215

Signed-off-by: Dave Walker (Daviey) <email@daviey.com>

* Updated Changelog and added myself to CONTRIBUTORS

Signed-off-by: Dave Walker (Daviey) <email@daviey.com>

* Fix file extension for 'ecsv' when 'all' is used

.. And fix CONTRIBUTORS.md to be alphabetical

Signed-off-by: Dave Walker (Daviey) <email@daviey.com>
2020-04-19 12:11:15 +03:00
bjhulst
ef1aac3a1e
Feature178 (#186)
* feature 178

* sync

* sync

* sync

* sync

Co-authored-by: bjhulst <bjhulst>
2020-03-20 12:42:54 +02:00
Damian Schwyrz
7ffd74d87e
Fix for issue #179 (#180)
* Fix for issue #179

* additional changes after review | #179

* Further info -> README.md regarding #179 & CONTRIBUTORS.md

* Further info -> README.md regarding #179 & CONTRIBUTORS.md

* Further info -> README.md regarding #179

* Fix for removed "Changes"

* Fix for removed "Changes"
2020-02-27 15:19:07 +02:00
bjhulst
5f0d0faeb7
Make defining User-agent header case insensitive #171 (#173)
* Takes the User-Agent header from a list.

* typo

* base

* Make defining User-agent header case insensitive #171

* -whitespaces

* Make canonical http headers and set default User-Agent only once.

* clean-up

* formatting, canonical customer headers, docs updated

* cleanup

* fmt

* Checking userdefined headers for excluding in canonicalization.

* resolving one conflict

* moved logic back and less resolve conflicts

Co-authored-by: Joona Hoikkala <joohoi@users.noreply.github.com>
2020-02-21 22:43:19 +02:00
Joona Hoikkala
b58c30625e
Detect -u properly after last change (#174) 2020-02-19 09:04:21 +02:00
Joona Hoikkala
1e57e6d0a9
Fix issue when -request is used in conjunction with -u (#172) 2020-02-18 19:20:30 +02:00
Joona Hoikkala
afece7bf2b
Better usage information and -help. Ignore -mc default value if any matcher is manually set (#143) 2020-01-30 00:23:58 +02:00
Joona Hoikkala
b0a632e6cd
Replay matches using a chosen proxy (#140)
* Replay matches using a custom proxy

* Add changelog entry
2020-01-17 09:49:25 +02:00
Ice3man
3d8e233097 Added ignore comment option (#138)
* Added ignore comment option

* Ignore blank lines & added changelog entry
2020-01-15 11:19:18 +02:00
Ice3man
01e516988d Added raw request parsing option (#137)
* Added request body option

* Update CHANGELOG.md

* Update CONTRIBUTORS.md

* Removed typo

* Fixed the URL in path issue

* Misc changes to align to codebase
2020-01-15 11:08:24 +02:00
Joona Hoikkala
ac2b447dfd
Write configuration to output JSON (#135)
* Config to json output, filters and matchers

* optRange marshaling

* Add CHANGELOG entry
2020-01-07 18:27:43 +02:00
Shaked Klein Orbach
1b45085191 remove -k flag support, convert to dummy flag (#134)
* remove -k flag support, convert to dummy flag

* update changelog and contributors
2020-01-07 18:25:42 +02:00
Joona Hoikkala
b4adeae872
Recursive jobs support (#129) 2019-12-31 14:19:27 +02:00
Tapio Vuorinen
7032f0eb47 -maxtime cli flag to limit running time of ffuf. resolves #85 (#127) 2019-12-30 12:49:34 +02:00
Joona Hoikkala
15524003b8
Write requests and responses to filesystem if requested (#126) 2019-12-28 17:46:44 +02:00
Tapio Vuorinen
918d5dcc8f count also 429 response codes if -sa (stop on all error cases) is used (#113)
* count also 429 response codes if -sa (stop on all error cases) is used. resolves #83

* Update README.md

Co-Authored-By: Joona Hoikkala <joohoi@users.noreply.github.com>

* Update main.go

Co-Authored-By: Joona Hoikkala <joohoi@users.noreply.github.com>

* lowered the 429 threshold to 20%

Co-authored-by: Joona Hoikkala <joohoi@users.noreply.github.com>
2019-12-20 20:23:54 +02:00
Joona Hoikkala
c33a431716
Limit the use of -e to a single keyword (#106)
* Limit the use of extension to a single wordlist

* Update README
2019-11-16 22:22:14 +02:00
Joona Hoikkala
3949e49b3b
Implement -v (verbose) flag (#100) 2019-11-16 16:32:11 +02:00
Joona Hoikkala
7aad9c6051
Fix JSON output regression and Stdout race condition issues (#94)
* Fix json output regression and improve stdout printing

* Add changelog entry
2019-11-16 01:48:00 +02:00
Joona Hoikkala
ac141e5e34
Fix the multi wordlist bug and add a new mode of operation (#93)
* Fix the multi wordlist bug and add a new mode

* Add a README entry
2019-11-16 00:40:04 +02:00
Joona Hoikkala
5456a37f72
Multiple wordlist support (#79)
* Multiple wordlist support

* Display error correctly if wordlist file could not be opened

* Add back the redirect location

* Support multiple keywords in HTML output and fix wordlist positioning

* Support multiple wordlists for md output

* Support multiple keywords in CSV output

* Improve output for multi keyword runs

* Add changelog entry

* Switch the wordlist filename <-> keyword around to allow tab completion

* Fix the usage example in README
2019-11-10 23:30:54 +02:00
SakiiR
e200bd11f7 Added lines count to filter/matcher and stdout + csv + json (#71)
* Added HTML and Markdown output support

* Add HTML color code in HTML template

* Added lines count

* Added content lines to json + csv

* Added changelog entry

* Fixed copy paste mistake

* Changed the html report to be grepable :)

* Grepable output fixed

* Fixed lines count
2019-11-09 22:09:12 +02:00
SakiiR
826ebbc21c Added HTML and Markdown output support (#63)
* Added HTML and Markdown output support

* Add HTML color code in HTML template

* Added changelog entry

* Fixed copy paste mistake

* Changed the html report to be grepable :)

* Grepable output fixed
2019-11-08 16:18:27 +02:00
Cory
492253b67b Add option for -debug-log. (#74)
* Add options for -disable-logging and -logfile.

Both of these options have to do with the logging surrounding issues
such as #39. Where in that issue the server was returning data after
the connection was closed. Therefore, I added two options one for
completely disabling all of the internal logging functionality aka
sending it to /dev/null. Another for writing the logging information
to a file so it can be retrieved later if need be.

* Changed to automatically disable internal logging.

Per the changes requested by @joohoi, changed to a single
flag `-debug-log` which will place all of the internal logging
into the specified file. If the file fails to be opened or is
not specified it will disable the logging.

* Update readme with the changes for -debug-log.
2019-10-20 18:38:11 +03:00