Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Using comma delimited wordlists, and multiple parameters isn't working as intended #290

codingo opened this issue Sep 5, 2020 · 2 comments · Fixed by #294
enhancement New feature or request good first issue Good for newcomers


Copy link

codingo commented Sep 5, 2020

For the sake of the tests below domains.txt contains only "codingo" and wordlist.txt contains only "admin".

When specifying a wordlist, you can specify a variable to fuzz with using:

-w ./wordlist.txt:W1

Where W1 is our insertion point. In addition, FFUF allows you to specify multiple wordlists in a comma delimited fashion. If we put the two together, we have something like:

ffuf -u -w ./wordlist.txt:W1, ./domains.txt:W2

Unfortunately, this isn't accepted, throwing the error:

Encountered error(s): 1 errors occurred.
* Keyword W1, defined, but not found in headers, method, URL or POST data.

However if we remove the comma delimited w flag, and use it a second time, this works as intended:

ffuf -u -w ./wordlist.txt:W1 -w ./domains.txt:W2

This appears to be a bug in the input sanitisation of parameters, and likely an easy first issue for somebody to tackle.

Copy link

joohoi commented Sep 11, 2020

I don't think comma separation of multiple wordlists has been a feature (at least not intentionally), but I do agree that it would make sense to have it. Definitely something that would be rather easy to tackle. I'll add a good-first-issue label to this, so if anyone wants to get started with contributing it would serve as an easy introduction to the codebase.

@joohoi joohoi added enhancement New feature or request good first issue Good for newcomers labels Sep 11, 2020
Copy link

codingo commented Sep 12, 2020

Awesome, offering a bounty for this one here

If nobody claims it I'll try to get the time next week to solve this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
enhancement New feature or request good first issue Good for newcomers
None yet

Successfully merging a pull request may close this issue.

2 participants