I have an application under test. The application response with a simple HTML with a response code 200 to every requests. The HTML contains link tags and script tags which contains necessary js files and css files to render the HTML content later.

So, if I run a gobuster or dirb against the app, it responds with the same message to every request such that the tools cannot understand whether there exist actually a page or not.

What is the solution to this? Couldn't find anything in the documentation of these tools. Any workaround?

  • Looks like gobuster can't do that. I know it sucks, but I could not find any option in gobuster that actually looks at the content of the response and not just the header.
    – MechMK1
    Feb 11 '20 at 10:22
  • use burp intruder along with the grep option in it.
    – yeah_well
    Feb 11 '20 at 11:10
  • @VipulNair I don't think that makes much difference since there is literally no difference between the response data of an existing page and non existing page. The redirection is initiated by the JS file which is loaded in the script inside the HTML. Feb 11 '20 at 13:29
  • There is a follow redirection option too i guess
    – yeah_well
    Feb 11 '20 at 14:01
  • 1
    you need to run the web page, not just load its bits. look into puppeteer.
    – dandavis
    Feb 11 '20 at 17:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.