HackBlue

Tools · Attack surface inventory · 25 / 27

ffuf: the status code is not the length

A status and a size on one ffuf line are different columns. Write both, and do not copy the status into the size.

11 min read · practice only with authorization

The status is the code on that line

When ffuf prints a word, the status column is the HTTP code for the path it requested. 200 means that code. It does not mean the response was 200 bytes, and it does not describe a path that was not printed.

This page reads a saved line. It does not add words to a list or send a new request.

The size is the other number

The size column is the length the tool recorded for that same response. It can be 512 while the status is 200. Those are two facts. Swapping them makes the ticket claim a length the line did not have.

If the size column is missing, write that the size was not printed. Do not reuse the status as a stand-in.

What the ticket cites

File the base URL, the word, the status, and the size, with those labels. A sentence about how large the answer was has to use the size. A sentence about the code has to use the status.

Worked case: 200 copied into the size

A saved lab line shows word notes, status 200, and size 512 for https://staging.lab.example/. A draft says the notes path returned a body of length 200.

The note says status 200 and size 512. The length is 512. The code is 200. The draft length is corrected. No new request is sent from this reading.

Snippet
base: https://staging.lab.example/
word: notes
status: 200
size: 512
write: code and length as separate columns
not: length 200

Diagram

Read the two numbers in order

  1. Word

    The path that was printed.

    Input
    notes
  2. Status

    The HTTP code on that line.

    Code
    200
  3. Size

    The length recorded for that response.

    Length
    512
  4. The note

    Do not copy 200 into the size.

    Note
    length stays 512

Check yourself

1. A printed line shows status 200 and size 512. What is 200?

2. You need the length in the ticket. Which number do you use?

3. The size column is absent. What do you write for the length?