[Fix] Fixed multiline output when using only one fuzz variable (issue #645) #656
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
joohoi
requested changes
Apr 21, 2023
joohoi
approved these changes
Apr 21, 2023
Closed
|
using the latest git build silent/quit |
|
Seems like this issue is back, using |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Fixed multi-line output when using only one fuzz variable (issue #645)
Fixes: #645
Bug source
In version 2.0 of fuff,
FFUFHASHwas added.ffuf/CHANGELOG.md
Line 8 in b2c1f94
This variable is set in the
Inputmap of the result structure:ffuf/main.go
Line 397 in b2c1f94
This triggers two bugs
Bug 1
Because of this, the size of
res.Inputis now at least 2. Therefore all output modes will be multi-lines since the conditionlen(res.Input) > 1is never met in the functionPrintResult()inpkg/output/stdout.go.https://github.com/p0dalirius/ffuf/blob/b2c1f9471f5bc275912c9c8194e88593d2636597/pkg/output/stdout.go#L375-L377
Changing the condition
len(res.Input) > 1tolen(s.fuzzkeywords) > 1fixes this bug.Bug 2
Another bug then occurs when only one fuzz variable is passed and results are printed. When
prepareInputsOneLine()inpkg/output/stdout.gogets called, the function iterates on res.Input, therefore printingFFUFHASHtoo.https://github.com/p0dalirius/ffuf/blob/master/pkg/output/stdout.go#L386
https://github.com/p0dalirius/ffuf/blob/master/pkg/output/stdout.go#L395
Changing the iteration on
res.Inputto an iteration ons.fuzzkeywordsfixes this bug.New behavior
When fuzzing only one variable:
When fuzzing two and more variables:
Best regards,