pathfinder

Fuzz a list of URLs for potential path traversal/normalization issues.

Multiple comparisons are performed to establish a confidence level for findings that should be manually investigated.

Install

▶ go install github.com/dptsec/pathfinder@latest

Build locally

$ cd pathfinder
$ go build

Usage

pathfinder accepts input from stdin with 1 URL per line.

The tool automatically normalizes each URL (adds a scheme if missing, strips query parameters, and trims paths to the closest directory), de-duplicates normalized entries, and threads payload metadata all the way to the findings so you can pipe raw crawler output without running awk/sed cleanup first.

Any lines that have no scheme will have https:// prepended:

$ cat samples/input.txt
http://nmap.scanme.org/search.php?q=ping
https://nmap.scanme.org/images/logo.png
$ cat samples/input.txt | pathfinder
[*] Configuration:
- Confidence cut-off:   3
- Request method:       GET
- Proxy URL:
- Rate-limiting:        50 requests/sec
- Request timeout:      10 seconds
- Total threads:        5
- HTTP User-Agent:      Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
- Stop on errors:       false

[*] Running 6 total queued jobs
[*] StatusCode mismatch:
        200 != 404
[*] Levenshtein distance:
        6734
[*] Word count:
        24 != 495
[*] Header mismatch: Content-Type
        text/html != text/html; charset=iso-8859-1

[*] Potential hit (Generic path traversal): http://nmap.scanme.org/%2e%2e%2f

An initial baseline request is sent per host (and scheme) and reused for subsequent payloads so you can scan mixed host lists in a single run, and every execution ends with a summary showing total attempts, errors, and confirmed hits.

Options

The following options can be specified on the command line:

• -C: Specify cookie data in the form of "COOKIENAME=VALUE;"
• -T: HTTP request timeout in seconds
• -c: Confidence cut-off level for positive findings
• -e: Stop fuzzing when >=75% of requests have returned errors (>=400 or transport failures)
• -m: HTTP method to use
• -o: Write all positive findings (with comparison details) to the specified file
• -p: HTTP or SOCKS proxy for requests
• -r: Rate-limit requests per second
• -t: Number of concurrent threads
• -u: User-Agent string
• -k: Skip TLS certificate verification (disabled by default)
• -v: Verbose mode - Show results of all confidence level checks
• -H: Custom header in Key: Value format (repeat flag to send multiple headers)
• -body: HTTP request body (prefix with @ to load from file)

TODO

• Better detection for traversals that aren't a result of path normalization
• nginx alias traversal support with wordlist
• Parameter fuzzing

References

***Breaking Parser Logic - Orange Tsai, 2018