Is --resume-from broken or am I doing something wrong?

[joaociocca]

When I try to resume from a .state file, all I'm getting is ERROR: Could not connect to any target provided. But I notice that the "splash" info won't show any target. I attempted to curl the target and it's accessible.

So I thought, "ok, since there's no target there, maybe I need to supply it again" (although I understand it should be in the .state file, it makes no sense to try to resume it on a different target), and as expected, I got the message error: The argument '--resume-from <STATE_FILE>' cannot be used with '--url <URL>'

[epi052]

hard to say. are you able to upload your state file?

if the target needs to be sanitized, the file could be hand-edited (it's just json)

[joaociocca]

{
  "scans": [
    {
      "id": "fd151dd875fb4766b588c59787c1608c",
      "url": "https://target/",
      "normalized_url": "https://target/",
      "scan_type": "Directory",
      "status": "Complete",
      "num_requests": 245367
    },
    {
      "id": "f8e204e58fc949bd9a0ebfd5412fcf4c",
      "url": "https://target/text/",
      "normalized_url": "https://target/text/",
      "scan_type": "File",
      "status": "NotStarted",
      "num_requests": 245367
    },
    {
      "id": "adf0e6238ed5427a8632c1d7f611ecfa",
      "url": "https://target/text/css",
      "normalized_url": "https://target/text/css/",
      "scan_type": "File",
      "status": "NotStarted",
      "num_requests": 245367
    },
    {
      "id": "18f4fcd7e5e644dc80ae69f5bd7dc025",
      "url": "https://target/arquivos",
      "normalized_url": "https://target/arquivos/",
      "scan_type": "File",
      "status": "NotStarted",
      "num_requests": 245367
    }
  ],
  "config": {
    "type": "configuration",
    "wordlist": "/home/kali/repo/br-sem-acentos_lower.txt",
    "config": "/etc/feroxbuster/ferox-config.toml",
    "proxy": "",
    "replay_proxy": "",
    "target_url": "https://target/",
    "status_codes": [
      200,
      204,
      301,
      302,
      307,
      308,
      401,
      403,
      405,
      500
    ],
    "replay_codes": [
      200,
      204,
      301,
      302,
      307,
      308,
      401,
      403,
      405,
      500
    ],
    "filter_status": [],
    "threads": 50,
    "timeout": 7,
    "verbosity": 0,
    "silent": false,
    "quiet": false,
    "auto_bail": false,
    "auto_tune": true,
    "json": true,
    "output": "target_",
    "debug_log": "",
    "user_agent": "feroxbuster/2.7.3",
    "random_agent": true,
    "redirects": false,
    "insecure": true,
    "extensions": [],
    "methods": [
      "GET"
    ],
    "data": [],
    "headers": {},
    "queries": [],
    "no_recursion": false,
    "extract_links": true,
    "add_slash": false,
    "stdin": false,
    "depth": 4,
    "scan_limit": 0,
    "parallel": 0,
    "rate_limit": 0,
    "filter_size": [],
    "filter_line_count": [],
    "filter_word_count": [],
    "filter_regex": [],
    "dont_filter": false,
    "resumed": false,
    "resume_from": "",
    "save_state": true,
    "time_limit": "",
    "filter_similar": [],
    "url_denylist": [],
    "regex_denylist": [],
    "collect_extensions": true,
    "dont_collect": [
      "tif",
      "tiff",
      "ico",
      "cur",
      "bmp",
      "webp",
      "svg",
      "png",
      "jpg",
      "jpeg",
      "jfif",
      "gif",
      "avif",
      "apng",
      "pjpeg",
      "pjp",
      "mov",
      "wav",
      "mpg",
      "mpeg",
      "mp3",
      "mp4",
      "m4a",
      "m4p",
      "m4v",
      "ogg",
      "webm",
      "ogv",
      "oga",
      "flac",
      "aac",
      "3gp",
      "css",
      "zip",
      "xls",
      "xml",
      "gz",
      "tgz"
    ],
    "collect_backups": true,
    "collect_words": true,
    "force_recursion": false
  },
  "responses": [
    {
      "type": "response",
      "url": "https://target/",
      "original_url": "https://target/",
      "path": "/",
      "wildcard": false,
      "status": 301,
      "method": "GET",
      "content_length": 178,
      "line_count": 7,
      "word_count": 12,
      "headers": {
        "content-type": "text/html",
        "server": "nginx",
        "date": "Wed, 18 Jan 2023 14:09:16 GMT",
        "connection": "keep-alive",
        "location": "https://target/autosc/",
        "content-length": "178"
      },
      "extension": ""
    }
  ],
  "statistics": {
    "type": "statistics",
    "timeouts": 363,
    "requests": 245442,
    "expected_per_scan": 245367,
    "total_expected": 245441,
    "errors": 363,
    "successes": 1,
    "redirects": 5,
    "client_errors": 245073,
    "server_errors": 0,
    "total_scans": 1,
    "initial_targets": 0,
    "links_extracted": 3,
    "extensions_collected": 0,
    "status_200s": 1,
    "status_301s": 5,
    "status_302s": 0,
    "status_401s": 0,
    "status_403s": 0,
    "status_429s": 0,
    "status_500s": 0,
    "status_503s": 0,
    "status_504s": 0,
    "status_508s": 0,
    "wildcards_filtered": 0,
    "responses_filtered": 0,
    "resources_discovered": 2,
    "url_format_errors": 0,
    "redirection_errors": 0,
    "connection_errors": 0,
    "request_errors": 0,
    "directory_scan_times": [
      2603.047281043
    ],
    "total_runtime": [
      0
    ]
  },
  "collected_extensions": [],
  "filters": []
}

[epi052]

the error you're seeing is from the initial heuristics tests. it's returned when ferox can't connect to any given target.

• did you use burp on the initial scan? if so, is burp still running?
• is the target alive?

[joaociocca]

no burp, target is alive. I'll sanitize the json and put it here

[epi052]

thanks for posting the state file, i'll be able to check this out over the weekend

[joaociocca]

no problem, appreciate the help, epi! have a nice weekend!

[epi052]

Ok, a question or two based on your state file:

• what did you expect to happen on resume?
• which scan(s) weren't complete?

i ask because the only scan i see that has a scan type of Directory also has a status of Complete. This indicates that there was only one directory scan and it ran to completion. The reason you're getting the 'no targets' error is because it doesn't see any incomplete scan to resume

I'm not trying to be snarky, just trying to figure out if there's a bug in how scans are stored or something along those lines.

[epi052]

what did you expect to happen on resume?

meaning, were /text, /text/css, or /arquivos being scanned as though they were a directory?

[joaociocca]

huh, I didn't knew the scan had been completed, actually. And I also thought, in that case when all scans were completed, no .state file was left behind.

I'll take a look again when I get back to it Monday!