mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-10-20 07:11:28 +02:00
Yogesh OjhaandClaude Opus 5
7588fdc090
EndpointSource.FUZZ had a label, a rank and a SourceKind and no producer. stages/content_discovery/ is it: ffuf against every live site with a ranked wordlist, level 5 beside url_discovery, a capability a person chooses, and enabled=False by default so an existing engine does not silently gain a run that sends 25,000 requests. tools/data/content.txt ships with the image (6,000 words, SecLists raft small, directories interleaved before files at each rank, regenerated by scripts/fetch_content_wordlist.py and committed like the port registry so an offline box still has one). The order is the budget, exactly as the subdomain list's is. One ffuf process per site, never several sites through a second wordlist keyword. The clusterbomb form looks like the efficient shape and silently defeats the only filter that matters: measured on one soft-404 host, `-w hosts:HOSTW -w words:FUZZ -u HOSTW/FUZZ -ac -ach` returned 278 of 300 guessed paths, while the same host asked in its own process returned 0. ffuf cannot calibrate against a host it does not know until the payload is substituted. Sites run over a small thread pool and only the stage thread writes, the url_discovery rule. A second belt sits behind calibration because no calibration is perfect: a site answering to 25% or more of a ranked list is answering to anything, so its whole run is dropped and the sites are named in a warning rather than quietly filtered. -maxtime is the per-site budget, -sf gives up on a host returning 403 to everything, and a run that hit its budget, a site that was dropped and a site that could not be reached are each counted and reported. Rows store is_probed=True with the status ffuf observed — it made the request, so the status is an observation, not an inference. `input.FUZZ` is base64 in -json mode (plain in -of json, which is why vhost() is fine), so the word is read off `url`. Verified live: 3 sites x 300 words in 11.7s, 295 raw hits became 17 real ones — /admin, /login, /media, /modules and /index.php among them. 29 tests, each proven to fail against 10 mutations. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013dKUV96WkQQETZBMoAG98C