Tools · Attack surface inventory · 27 / 27
Gobuster: the size column is not the status
On a vhost line, status and size are different columns. Do not file the status number as the size.
Read the mode before the numbers
A vhost line can carry a name, a status, and a size. The status is the HTTP code for that Host header on that run. The size is the length recorded beside it. This lesson is about those two columns. It does not describe a DNS line, which has an address instead of a status.
If the saved file does not say the mode, write that the mode was not recorded, and do not invent a size.
The numbers do not trade places
Status 301 and size 128 can appear on one line. 301 is the code. 128 is the length. A draft that says the response was 301 bytes has moved the code into the size column.
A second name is a second line with its own pair. Do not reuse this size for that name.
Labels on the ticket
File the mode, the name, the status, and the size. If you mention length, use the size. If you mention the code, use the status. Leave a missing column missing.
Worked case: 301 filed as the length
A lab vhost line for billing.lab.example shows status 301 and size 128. A draft says the response length is 301 and does not mention 128.
The note says mode vhost, status 301, size 128. The length is 128. The code stays 301. The name is billing.lab.example, not a DNS address.
mode: vhost name: billing.lab.example status: 301 size: 128 write: code and length not: length 301
Diagram
Two numbers on a vhost line
The code and the length are different columns.
Status
301
The HTTP code for this name.
Size
128
The length recorded on the line.
The note
status 301, size 128
Both labels, unswapped.
Check yourself
1. A vhost line shows status 301 and size 128. What is 301?
2. Which number is the length?
3. The file does not say whether the run was vhost mode. What do you write?