Fix extensions with query vars

liamg · Jun 23, 2020 · 92ea7fc · 92ea7fc
1 parent cf7fdf2
commit 92ea7fc
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/pkg/scan/url_scanner.go b/pkg/scan/url_scanner.go
@@ -305,7 +305,12 @@ func (scanner *URLScanner) checkURL(job URLJob) *URLResult {
 
 				if !job.BasicOnly && !strings.Contains(job.URL, "/.htpasswd") && !strings.Contains(job.URL, "/.htaccess") {
 					for _, ext := range scanner.backupExtensions {
-						scanner.queue(URLJob{URL: job.URL + ext, BasicOnly: true})
+						bUrl := job.URL + ext
+						if strings.Contains(job.URL, "?") {
+							bits := strings.SplitN(job.URL, "?", 2)
+							bUrl = strings.Join(bits, ext+"?")
+						}
+						scanner.queue(URLJob{URL: bUrl, BasicOnly: true})
 					}
 				}