Skip to content

Conversation

shelld3v
Copy link
Collaborator

Description

Currently -f does not only append extensions to paths but "/" as well. This unnecessarily generates a huge number of entries, and users can't get rid of this behavior no matter what. So, I decided to remove it, considering that users still can append slash if they want with --suffixes.

@maurosoria
Copy link
Owner

Hello! I added this because in the past some users missed endpoints (because webapp routing systems are sensitive to a slash at the end). This wasn't the case many years ago, but now the slash we'll probably find different endpoints.

It is true that not every web framework have this behaviour and I open to discussion, but I don't think this a solution.

@shelld3v
Copy link
Collaborator Author

@maurosoria Maybe create something like --slash? Cause I would like this behavior to be "optional"

@maurosoria
Copy link
Owner

If there is an option to change manually force this behaviour it would be much better. Anyway, I think keeping the current behaviour by default and then what we can do is provide more curated and largest wordlists.

@shelld3v
Copy link
Collaborator Author

shelld3v commented Oct 21, 2024

"Providing more curated and larger wordlists" isn't the solution because our default wordlist doesn't even need -f, users use this on their own crafted wordlists, something that we can't control. And the problem here isn't much related to the wordlist anyway, the problem is that some web servers treat /path and /path/ equally, so generating tens of thousands more entries for absolutely nothing is a massive waste

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants