ignore stuff starting with period

[joaociocca]

How can I make ferox not scan things starting with .? I thought a simple --dont-scan '^\..*' should do the trick, but it complains that it could not determine initial targets because the regex matches the URL, so the scan will never start.
I ask this to prevent ferox, on more thorough modes (but not exclusively --thorough) to try and scan for <url>/.htpasswds/<anything, actually> because it seem to dive in a rabbit hole from there.

An example, I was trying to show VulnHub's Jangow to a friend, and it spiralled down trying to search for things like...

[epi052]

Howdy! You probably could add the base url to the regex and be ok.

[joaociocca]

looks like the implementation of --dont-scan changes \. into /. instead of escaping the .

[epi052]

Ok, that was off the cuff. I'll take a look this evening

[epi052]

Actually, try the base url plus a period, no escape, no second period/asterisk

[joaociocca]

Nope.

I also tried using character class/set [.] and it also gets bypassed

[epi052]

👍 I'll need to actually look at the code it seems 😂

[joaociocca]

"it's regex, but not quite" =p times like this I wish I wasn't so blocked when trying to learn programming to give a hand. But I can help with test, if needed! I ended up on this scenario trying to see if I can find with ferox a link I've found manually on Jangow. I couldn't find it with other tools like dirb/dirbuster/gobuster.

[epi052]

Ok, this should behave the way you're wanting

--dont-scan '/\..*' 

--dont-scan does double duty. When it's an absolute/valid url that url::Url::parse can successfully ingest, then the comparison is done as a Url -> Url. On the other hand, if url::Url::parse fails, we parse what's given to dont-scan as a fullblown regex. So, when we were trying things with http... we weren't hitting the regex branch.

[joaociocca]

DING DING DING! Awesome, epi! Thank you! <3
it hit the right target I was aiming to, without polluting the output with all that .ht thrash! =D