ゆっくりgobuster

Error: the server returns a status code that matches the provided options for non existing urls.

$ gobuster dir -k -u http://192.168.1.1 -w b.txt
===============================================================
Gobuster v3.5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.1.1
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                b.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.5
[+] Timeout:                 10s
===============================================================
2023/03/04 09:58:08 Starting gobuster in directory enumeration mode
===============================================================

Error: the server returns a status code that matches the provided options for non existing urls. http://192.168.1.1/68f21a18-de7f-4f09-a7f0-9267e7c0938f => 200 (Length: 1987). To continue please exclude the status code or the length

エラーメッセージの以下の箇所に注目。

Error: the server returns a status code that matches the provided options for non existing urls. http://192.168.1.1/68f21a18-de7f-4f09-a7f0-9267e7c0938f => 200 (Length: 1987).

• gobusterは実際にブルートフォースをする前に、preテストで、ありえないURLにリクエストを投げる。
• ありえないURLのレスポンスでステータスコード「200」が返ってきた場合、何を試しても200が返りテスト継続に意味がないと判断する。そしてエラーを出して終了する。
• そのURLのContent-lengthを表示してくれているので、Content-lengthのサイズを除外する指定をすると、ブルートフォースが正常に実行できる。

$ gobuster dir -k -u http://192.168.1.1 -w b.txt --exclude-length 1987

===============================================================
Gobuster v3.5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.1.1
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                ./b.txt
[+] Negative Status codes:   404
[+] Exclude Length:          1987
[+] User Agent:              gobuster/3.5
[+] Timeout:                 10s
===============================================================
2023/03/04 10:00:27 Starting gobuster in directory enumeration mode
===============================================================
/profile              (Status: 500) [Size: 1243]
/assets               (Status: 301) [Size: 179] [--> /assets/]
/video                (Status: 200) [Size: 10075518]
/redirect             (Status: 500) [Size: 3119]
/ftp                  (Status: 200) [Size: 11082]
/api                  (Status: 500) [Size: 3016]
/Video                (Status: 200) [Size: 10075518]