v1.5.1
epi052/feroxbusterv1.5.1Nov 7, 2020by epi052
AI Summary
A safety check was added to prevent URL injection into the wordlist, which could overwrite the base URL.
Key Highlights
- Added warning if a URL is found in the wordlist
- Stops processing that specific word to prevent injection
- Thanks to @Greenwolf for bringing this to attention
New Features
- URL validation logic to prevent injection
Full Release Notes
Normally, a word from the given wordlist is joined using [reqwest::Url::join](https://docs.rs/reqwest/0.10.8/reqwest/struct.Url.html#method.join). When that function is called using a fully formed url as the 'word', it actually overwrites the base url.
Example:
```
Url("http://localhost").join("http:yunyunyun.net")
=> Url("http:yunyunyun.net")
```
Added logic that issues a warning if a url is found in the wordlist, and then stops processing that word before anything actually happens.
Special thanks to @Greenwolf for bringing the issue to my attention!