ffuf: a redirect line is not the page it points at

The hit is the response you got

Each ffuf result is one response: a status, a size, and the URL that was requested. A 301 or 302 means that response was a redirect. The body of the page the server pointed at was not part of this result, unless the run followed redirects and the line you are reading is the followed one. The status tells you which.

Size on a redirect is the size of that redirect response. It is not the size of the destination page. Many redirects share a size because they share a short redirect body.

Location is a header on this response

If the result recorded a Location header, quote it as that header. It is where the server told the client to go. It is not a second hit, and it is not proof the destination returned 200. A Location pointing at a login path means the redirect said so. The login page’s contents are a different request.

If Location was not recorded, write “Location not in this result.” Do not reconstruct it from the URL you requested.

What to file

File the requested URL, the status, the size, and the Location header if present. Say whether redirects were followed. Do not file a sentence about the destination page’s title or contents from the redirect line alone.

Worked case: a 302 described as a login form

A lab result for https://staging.hackblue-lab.org/reports shows status 302, size 0, and a Location of /login. A draft says the reports page shows a login form with input fields. Nothing in the result is the login page’s body.

The note quotes the requested URL, status 302, size 0, and Location /login. It says the login form was not fetched. The finding is a redirect. A description of the form waits on a request whose status is the form’s response.

requested: https://staging.hackblue-lab.org/reports
status: 302  size: 0
Location: /login
redirects followed: no
login page body: not in this result
write: a redirect, not a form