用 ffuf 和 dirsearch 扫自己的站点：一次完整实战

这篇文章对应第一次挖洞那篇的Tips，在用ai探测的便利下，我还是要去学习探测工具的使用#

所以决定使用 ffuf 和 dirsearch，扫一下自己的网站来做一次实战测试。

先看实战结论#

扫描跑了 9681 条字典（ffuf）/ 12296 条（dirsearch）
原始输出 230 条命中，其中只有 10 条是真实的站点路径
220 条 403 里，188 条是 nginx 的敏感文件拒绝规则，32 条是扫描压力下的假命中（冷却后变回 404）
没有发现任何备份文件、配置文件、密钥文件的泄露

换句话说：这次扫描的产出 90% 是噪音，而”识别噪音”才是这套工具真正的使用技能。

两个工具的分工#

ffuf：Go 写的单文件二进制，FUZZ 关键字替换任意位置（路径、参数名、header、甚至域名前缀），参数最细，速度最快。适合”我已经知道要控制什么”的精细扫描。
dirsearch：Python 写的，开箱即用，自带字典和递归，报告格式多。适合”先快速摸一遍底”。

实用顺序是：dirsearch 摸一遍 → 发现可疑目录 → ffuf 对那个目录精细扫。

两者都不是必须的。如果只有几条路径要试，curl 循环反而更直接。

使用过程#

先看 robots.txt 和 sitemap#

这一步 30 秒，能省掉后面半小时。

1
curl -sS https://lyh-blogs.top/robots.txt

本例输出：

1
User-agent: *
2
Disallow: /_astro/
3

4
Sitemap: https://lyh-blogs.top/sitemap-index.xml

含义：

/_astro/ 是构建产物的静态资源目录，站方自己标了”别爬”，说明它存在且可访问
sitemap 会列出所有文章 URL，这比任何字典都准

/sitemap-index.xml 实测 200，可以直接读出来拿到全部页面清单。

教训：字典爆破是”猜”，robots 和 sitemap 是”站点自己招供”。先看招供的，再猜。

摸清 404 行为#

这一步决定了后面所有参数，必须先做。

用两个随机路径试：

1
curl -sS -I -m 10 -o /dev/null -w "status=%{http_code} len=%{size_download}\n" \
2
  https://lyh-blogs.top/nope-abc123/

**Tips — 语法讲解

-sS -s 静默模式（不显示进度条），-S 出错时仍显示错误信息
-I只发送 HEAD 请求，只取响应头，不下载正文
-m 10 设置超时时间为 10 秒
-o /dev/null将响应内容丢弃，不保存到文件
-w "status=%{http_code} len=%{size_download}\n"自定义输出格式，打印 HTTP 状态码和下载大小

本例输出：

1
status=404

也就是真 404。这是最好的情况：状态码本身就能当判定依据。

其他两种常见情况，处理方式完全不同：

软 404：不存在的路径也返回 200，内容是一个固定页面。这时必须按响应长度过滤（ffuf 的 -fs），或者用 -ac 自动校准。
通配 200：SPA 把所有路径都路由到 index.html。这时按状态码、按长度都失效，只能看页面里有没有”未找到”的特征字符串（ffuf 的 -mr 正则匹配）。

判断方法：随机取两个不存在的路径，比较状态码和长度。两个都一样 → 软 404；一个 200 一个 404 → 正常。

本例还有第二个收获：404 页本身 350 KB（Content-Length: 350723）。这个数字后面会成为最大的坑。

算带宽预算（本例最大的坑）#

先算一笔账：

字典 9681 条
每条 404 都回 350 KB
合计约 3.4 GB 下行

按轻量服务器 6 Mbps 带宽算，光传输就要 75 分钟。这不是扫描慢的问题，是你会把自己的站打满带宽，同时访问博客的人全部卡死。

解法：用 HEAD 请求。HEAD 只回响应头，不回 body。

先验证服务器配合不配合：

1
curl -sS -I -m 10 -o /dev/null -w "status=%{http_code} body=%{size_download}\n" \
2
  https://lyh-blogs.top/nope-abc123/

输出：

1
status=404 body=0

body 是 0，说明 HEAD 生效，带宽从 3.4 GB 降到约 10 MB。

代价要清楚：ffuf 的 length 字段会全是 0，因为你没收到 body。所以用 HEAD 时，过滤只能靠状态码，不能靠长度。这个细节在第六步的结果里会看到。

ffuf 完整命令#

1
env -u HTTP_PROXY -u HTTPS_PROXY -u http_proxy -u https_proxy \
2
/Users/liyuhang/tools/bin/ffuf \
3
  -u https://lyh-blogs.top/FUZZ \
4
  -w ~/.local/share/uv/tools/dirsearch/lib/python3.14/site-packages/dirsearch/db/dicc.txt \
5
  -X HEAD \
6
  -mc 200,301,302,401,403 \
7
  -rate 60 -t 10 -timeout 15 \
8
  -s -of json -o ffuf-blog.json

逐参数拆：

env -u HTTP_PROXY ...：清掉代理环境变量。我的机器上设了本地代理，不清掉的话所有请求会绕一圈代理，既慢又会让扫描流量出现在代理日志里。这是最容易忽略的一条。
-u .../FUZZ：FUZZ 是占位符，ffuf 会把字典每一行填进去。它替代的不一定是路径末尾，也可以在中间、在参数值里。
-w：字典路径。
-X HEAD：用 HEAD 方法。省带宽的核心。
-mc 200,301,302,401,403：只保留这些状态码。一定要显式写，不要依赖默认值，默认值里包含 500，会把你自己的噪声混进来。
-rate 60：全局限速 60 请求/秒。
-t 10：并发线程 10。-rate 管总量，-t 管同时打开几个连接，两个都要设。
-timeout 15：单请求超时。
-s：静默模式，不刷进度条（重定向到文件时进度条会变成几千行垃圾）。
-of json -o ffuf-blog.json：结构化输出。一定要存 JSON，后面要写脚本统计，纯文本输出没法机读。

运行耗时 2 分 48 秒。

读结果——230 条怎么变成 10 条#

不要直接看 ffuf 的终端输出，先做统计。存了 JSON 就是为了这一步：

1
import json
2
from collections import Counter
3
rs = json.load(open("ffuf-blog.json"))["results"]
4
print("命中总数:", len(rs))
5
print("状态码分布:", Counter(r["status"] for r in rs).most_common())
6
print("长度分布:", Counter(r["length"] for r in rs).most_common(5))

本例输出：

1
命中总数: 230
2
状态码分布: [(403, 220), (200, 10)]
3
长度分布: [(0, 230)]

读法：

220 条 403，10 条 200。这个比例本身就是信号。静态博客不该有 220 个”存在但禁止访问”的路径。
长度全是 0，印证了用 HEAD 的代价——长度这个维度在这里完全没用。

再看 403 的具体内容：

1
/.aws/              /.env                /id_rsa
2
/.bzr/              /.git/               /etc/passwd
3
/web.config         /web.config.bak      /var/log/payment.log
4
/.DS_Store          /Thumbs.db           /config.php.swp

全是敏感文件名。这不像”文件真的存在但禁止访问”，更像一份黑名单在起作用。有两种可能，必须区分：

服务端配了敏感文件拒绝规则（好事，说明有加固）
扫描压力下触发了限速/防护，临时返回 403（坏事，说明这 220 条是废数据）

复测——本次最重要的一步#

判断方法只有一个：降速，单条再打一次。

如果 403 是真实规则，冷却后依然是 403；如果是限速，冷却后会变回 404。

我写了个 verify_hits.py 做这件事，读 ffuf 的 JSON，每条间隔 0.25 秒重打一遍：

输入：ffuf 的 -of json 输出（必须用 JSON，纯文本没法机器解析）。

1
{"commandline":"/Users/liyuhang/tools/bin/ffuf -u https://lyh-blogs.top/FUZZ -w /Users/liyuhang/.local/share/uv/tools/dirsearch/lib/python3.14/site-packages/dirsearch/db/dicc.txt -X HEAD -mc 200,301,302,401,403 -rate 60 -t 10 -timeout 15 -s -of json -o ffuf-blog.json","time":"2026-10-17T17:10:09+08:00","results":[{"input":{"FFUFHASH":"e2a0655","FUZZ":".aws/"},"position":85,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12463208,"resultfile":"","url":"https://lyh-blogs.top/.aws/","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0656","FUZZ":".aws/config"},"position":86,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":10989416,"resultfile":"","url":"https://lyh-blogs.top/.aws/config","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0657","FUZZ":".aws/credentials"},"position":87,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":16355208,"resultfile":"","url":"https://lyh-blogs.top/.aws/credentials","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a068a","FUZZ":".bzr/"},"position":138,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":14428500,"resultfile":"","url":"https://lyh-blogs.top/.bzr/","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a068b","FUZZ":".bzr/branch-format"},"position":139,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":16305291,"resultfile":"","url":"https://lyh-blogs.top/.bzr/branch-format","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a068c","FUZZ":".bzr/README"},"position":140,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13894375,"resultfile":"","url":"https://lyh-blogs.top/.bzr/README","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a068f","FUZZ":".c9/metadata/environment/.env"},"position":143,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":17676208,"resultfile":"","url":"https://lyh-blogs.top/.c9/metadata/environment/.env","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06d0","FUZZ":".config.inc.php.swp"},"position":208,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":10790375,"resultfile":"","url":"https://lyh-blogs.top/.config.inc.php.swp","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06d1","FUZZ":".config.php.swp"},"position":209,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":14435125,"resultfile":"","url":"https://lyh-blogs.top/.config.php.swp","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06e5","FUZZ":".configuration.php.swp"},"position":229,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":19861125,"resultfile":"","url":"https://lyh-blogs.top/.configuration.php.swp","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06122","FUZZ":".docker/.env"},"position":290,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":16351209,"resultfile":"","url":"https://lyh-blogs.top/.docker/.env","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06125","FUZZ":".docker/laravel/app/.env"},"position":293,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13760125,"resultfile":"","url":"https://lyh-blogs.top/.docker/laravel/app/.env","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06133","FUZZ":".DS_Store"},"position":307,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":20940542,"resultfile":"","url":"https://lyh-blogs.top/.DS_Store","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06134","FUZZ":".ds_store"},"position":308,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13129209,"resultfile":"","url":"https://lyh-blogs.top/.ds_store","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0614a","FUZZ":".env"},"position":330,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":15235042,"resultfile":"","url":"https://lyh-blogs.top/.env","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0614b","FUZZ":".env-example"},"position":331,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":16944042,"resultfile":"","url":"https://lyh-blogs.top/.env-example","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0614c","FUZZ":".env-sample"},"position":332,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":14993375,"resultfile":"","url":"https://lyh-blogs.top/.env-sample","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0614d","FUZZ":".env.backup"},"position":333,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":17742292,"resultfile":"","url":"https://lyh-blogs.top/.env.backup","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0614e","FUZZ":".env.dev"},"position":334,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":20013416,"resultfile":"","url":"https://lyh-blogs.top/.env.dev","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0614f","FUZZ":".env.dev.local"},"position":335,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":15702167,"resultfile":"","url":"https://lyh-blogs.top/.env.dev.local","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06150","FUZZ":".env.development.local"},"position":336,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":11530792,"resultfile":"","url":"https://lyh-blogs.top/.env.development.local","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06151","FUZZ":".env.development.sample"},"position":337,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":19357375,"resultfile":"","url":"https://lyh-blogs.top/.env.development.sample","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06152","FUZZ":".env.dist"},"position":338,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13676834,"resultfile":"","url":"https://lyh-blogs.top/.env.dist","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06153","FUZZ":".env.docker"},"position":339,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":17895334,"resultfile":"","url":"https://lyh-blogs.top/.env.docker","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06154","FUZZ":".env.docker.dev"},"position":340,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13912416,"resultfile":"","url":"https://lyh-blogs.top/.env.docker.dev","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06155","FUZZ":".env.example"},"position":341,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":17033041,"resultfile":"","url":"https://lyh-blogs.top/.env.example","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06156","FUZZ":".env.local"},"position":342,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":14568959,"resultfile":"","url":"https://lyh-blogs.top/.env.local","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06157","FUZZ":".env.php"},"position":343,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":15767000,"resultfile":"","url":"https://lyh-blogs.top/.env.php","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06158","FUZZ":".env.prod"},"position":344,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":14376459,"resultfile":"","url":"https://lyh-blogs.top/.env.prod","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06159","FUZZ":".env.prod.local"},"position":345,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":20238292,"resultfile":"","url":"https://lyh-blogs.top/.env.prod.local","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0615a","FUZZ":".env.production"},"position":346,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":11795417,"resultfile":"","url":"https://lyh-blogs.top/.env.production","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0615b","FUZZ":".env.production.local"},"position":347,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":20104291,"resultfile":"","url":"https://lyh-blogs.top/.env.production.local","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0615c","FUZZ":".env.sample"},"position":348,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":19220541,"resultfile":"","url":"https://lyh-blogs.top/.env.sample","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0615d","FUZZ":".env.sample.php"},"position":349,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":16537166,"resultfile":"","url":"https://lyh-blogs.top/.env.sample.php","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0615e","FUZZ":".env.save"},"position":350,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13072833,"resultfile":"","url":"https://lyh-blogs.top/.env.save","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0615f","FUZZ":".env.stage"},"position":351,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":17230167,"resultfile":"","url":"https://lyh-blogs.top/.env.stage","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06160","FUZZ":".env.test"},"position":352,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":17869375,"resultfile":"","url":"https://lyh-blogs.top/.env.test","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06161","FUZZ":".env.test.local"},"position":353,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":17702042,"resultfile":"","url":"https://lyh-blogs.top/.env.test.local","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06162","FUZZ":".env.test.sample"},"position":354,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":17892792,"resultfile":"","url":"https://lyh-blogs.top/.env.test.sample","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06163","FUZZ":".env.travis"},"position":355,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12963833,"resultfile":"","url":"https://lyh-blogs.top/.env.travis","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06167","FUZZ":".env~"},"position":359,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":16317708,"resultfile":"","url":"https://lyh-blogs.top/.env~","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061bb","FUZZ":".git"},"position":443,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":15350125,"resultfile":"","url":"https://lyh-blogs.top/.git","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061bc","FUZZ":".git-credentials"},"position":444,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12210875,"resultfile":"","url":"https://lyh-blogs.top/.git-credentials","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061bd","FUZZ":".git-rewrite/"},"position":445,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":15273250,"resultfile":"","url":"https://lyh-blogs.top/.git-rewrite/","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061be","FUZZ":".git.json"},"position":446,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13999542,"resultfile":"","url":"https://lyh-blogs.top/.git.json","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061bf","FUZZ":".git/"},"position":447,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":17782625,"resultfile":"","url":"https://lyh-blogs.top/.git/","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061c0","FUZZ":".git/branches/"},"position":448,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12479833,"resultfile":"","url":"https://lyh-blogs.top/.git/branches/","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061c1","FUZZ":".git/COMMIT_EDITMSG"},"position":449,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":15606042,"resultfile":"","url":"https://lyh-blogs.top/.git/COMMIT_EDITMSG","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061c2","FUZZ":".git/config"},"position":450,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":15061792,"resultfile":"","url":"https://lyh-blogs.top/.git/config","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061c3","FUZZ":".git/description"},"position":451,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":17100583,"resultfile":"","url":"https://lyh-blogs.top/.git/description","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061c4","FUZZ":".git/FETCH_HEAD"},"position":452,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12895708,"resultfile":"","url":"https://lyh-blogs.top/.git/FETCH_HEAD","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061c5","FUZZ":".git/HEAD"},"position":453,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":19208959,"resultfile":"","url":"https://lyh-blogs.top/.git/HEAD","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061c6","FUZZ":".git/head"},"position":454,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":9886666,"resultfile":"","url":"https://lyh-blogs.top/.git/head","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061c7","FUZZ":".git/hooks/"},"position":455,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13497042,"resultfile":"","url":"https://lyh-blogs.top/.git/hooks/","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061c8","FUZZ":".git/hooks/applypatch-msg"},"position":456,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":16141333,"resultfile":"","url":"https://lyh-blogs.top/.git/hooks/applypatch-msg","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061c9","FUZZ":".git/hooks/commit-msg"},"position":457,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":37472292,"resultfile":"","url":"https://lyh-blogs.top/.git/hooks/commit-msg","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061ca","FUZZ":".git/hooks/post-update"},"position":458,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":19891167,"resultfile":"","url":"https://lyh-blogs.top/.git/hooks/post-update","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061cb","FUZZ":".git/hooks/pre-applypatch"},"position":459,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12811250,"resultfile":"","url":"https://lyh-blogs.top/.git/hooks/pre-applypatch","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061cc","FUZZ":".git/hooks/pre-commit"},"position":460,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":14071041,"resultfile":"","url":"https://lyh-blogs.top/.git/hooks/pre-commit","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061cd","FUZZ":".git/hooks/pre-push"},"position":461,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":17684917,"resultfile":"","url":"https://lyh-blogs.top/.git/hooks/pre-push","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061ce","FUZZ":".git/hooks/pre-rebase"},"position":462,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":17084042,"resultfile":"","url":"https://lyh-blogs.top/.git/hooks/pre-rebase","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061cf","FUZZ":".git/hooks/pre-receive"},"position":463,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":17288250,"resultfile":"","url":"https://lyh-blogs.top/.git/hooks/pre-receive","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061d0","FUZZ":".git/hooks/prepare-commit-msg"},"position":464,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":25450166,"resultfile":"","url":"https://lyh-blogs.top/.git/hooks/prepare-commit-msg","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061d1","FUZZ":".git/hooks/update"},"position":465,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":19537625,"resultfile":"","url":"https://lyh-blogs.top/.git/hooks/update","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061d2","FUZZ":".git/index"},"position":466,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":14372459,"resultfile":"","url":"https://lyh-blogs.top/.git/index","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061d3","FUZZ":".git/info/"},"position":467,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":14785959,"resultfile":"","url":"https://lyh-blogs.top/.git/info/","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061d4","FUZZ":".git/info/attributes"},"position":468,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13364500,"resultfile":"","url":"https://lyh-blogs.top/.git/info/attributes","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061d5","FUZZ":".git/info/exclude"},"position":469,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":11038750,"resultfile":"","url":"https://lyh-blogs.top/.git/info/exclude","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061d6","FUZZ":".git/info/refs"},"position":470,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":16543791,"resultfile":"","url":"https://lyh-blogs.top/.git/info/refs","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061d7","FUZZ":".git/logs/"},"position":471,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":21317833,"resultfile":"","url":"https://lyh-blogs.top/.git/logs/","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061d8","FUZZ":".git/logs/HEAD"},"position":472,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13210125,"resultfile":"","url":"https://lyh-blogs.top/.git/logs/HEAD","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061d9","FUZZ":".git/logs/head"},"position":473,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":22654250,"resultfile":"","url":"https://lyh-blogs.top/.git/logs/head","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061da","FUZZ":".git/logs/refs"},"position":474,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":16072083,"resultfile":"","url":"https://lyh-blogs.top/.git/logs/refs","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061db","FUZZ":".git/logs/refs/heads"},"position":475,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":18769667,"resultfile":"","url":"https://lyh-blogs.top/.git/logs/refs/heads","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061dc","FUZZ":".git/logs/refs/heads/master"},"position":476,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":34053459,"resultfile":"","url":"https://lyh-blogs.top/.git/logs/refs/heads/master","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061dd","FUZZ":".git/logs/refs/remotes"},"position":477,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":17509541,"resultfile":"","url":"https://lyh-blogs.top/.git/logs/refs/remotes","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061de","FUZZ":".git/logs/refs/remotes/origin"},"position":478,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":17699625,"resultfile":"","url":"https://lyh-blogs.top/.git/logs/refs/remotes/origin","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061df","FUZZ":".git/logs/refs/remotes/origin/HEAD"},"position":479,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13930750,"resultfile":"","url":"https://lyh-blogs.top/.git/logs/refs/remotes/origin/HEAD","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061e0","FUZZ":".git/logs/refs/remotes/origin/master"},"position":480,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":16504875,"resultfile":"","url":"https://lyh-blogs.top/.git/logs/refs/remotes/origin/master","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061e1","FUZZ":".git/objects/"},"position":481,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":26268417,"resultfile":"","url":"https://lyh-blogs.top/.git/objects/","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061e2","FUZZ":".git/objects/info/packs"},"position":482,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12112583,"resultfile":"","url":"https://lyh-blogs.top/.git/objects/info/packs","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061e3","FUZZ":".git/packed-refs"},"position":483,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":16636958,"resultfile":"","url":"https://lyh-blogs.top/.git/packed-refs","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061e4","FUZZ":".git/refs/"},"position":484,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":27273417,"resultfile":"","url":"https://lyh-blogs.top/.git/refs/","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061e5","FUZZ":".git/refs/heads"},"position":485,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":14625167,"resultfile":"","url":"https://lyh-blogs.top/.git/refs/heads","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061e6","FUZZ":".git/refs/heads/master"},"position":486,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12716333,"resultfile":"","url":"https://lyh-blogs.top/.git/refs/heads/master","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061e7","FUZZ":".git/refs/remotes"},"position":487,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":30007083,"resultfile":"","url":"https://lyh-blogs.top/.git/refs/remotes","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061e8","FUZZ":".git/refs/remotes/origin"},"position":488,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12807625,"resultfile":"","url":"https://lyh-blogs.top/.git/refs/remotes/origin","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061e9","FUZZ":".git/refs/remotes/origin/HEAD"},"position":489,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":19474500,"resultfile":"","url":"https://lyh-blogs.top/.git/refs/remotes/origin/HEAD","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061ea","FUZZ":".git/refs/remotes/origin/master"},"position":490,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":20873125,"resultfile":"","url":"https://lyh-blogs.top/.git/refs/remotes/origin/master","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061eb","FUZZ":".git/refs/tags"},"position":491,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":16664791,"resultfile":"","url":"https://lyh-blogs.top/.git/refs/tags","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061ed","FUZZ":".git_release"},"position":493,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13486833,"resultfile":"","url":"https://lyh-blogs.top/.git_release","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061fe","FUZZ":".gitignore.swp"},"position":510,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13270667,"resultfile":"","url":"https://lyh-blogs.top/.gitignore.swp","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06207","FUZZ":".gitlab-ci/.env"},"position":519,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":15338625,"resultfile":"","url":"https://lyh-blogs.top/.gitlab-ci/.env","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06228","FUZZ":".hg"},"position":552,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":15403833,"resultfile":"","url":"https://lyh-blogs.top/.hg","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06229","FUZZ":".hg/"},"position":553,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":10905750,"resultfile":"","url":"https://lyh-blogs.top/.hg/","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0622a","FUZZ":".hg/branch"},"position":554,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":10003083,"resultfile":"","url":"https://lyh-blogs.top/.hg/branch","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0622b","FUZZ":".hg/dirstate"},"position":555,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":25049208,"resultfile":"","url":"https://lyh-blogs.top/.hg/dirstate","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0622c","FUZZ":".hg/hgrc"},"position":556,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13075333,"resultfile":"","url":"https://lyh-blogs.top/.hg/hgrc","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0622d","FUZZ":".hg/requires"},"position":557,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":16978750,"resultfile":"","url":"https://lyh-blogs.top/.hg/requires","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0622e","FUZZ":".hg/store/data/"},"position":558,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":15721625,"resultfile":"","url":"https://lyh-blogs.top/.hg/store/data/","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0622f","FUZZ":".hg/store/undo"},"position":559,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13187750,"resultfile":"","url":"https://lyh-blogs.top/.hg/store/undo","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06230","FUZZ":".hg/undo.dirstate"},"position":560,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":11991916,"resultfile":"","url":"https://lyh-blogs.top/.hg/undo.dirstate","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06242","FUZZ":".htaccess"},"position":578,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13771000,"resultfile":"","url":"https://lyh-blogs.top/.htaccess","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06243","FUZZ":".htaccess-dev"},"position":579,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":14553625,"resultfile":"","url":"https://lyh-blogs.top/.htaccess-dev","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06244","FUZZ":".htaccess-local"},"position":580,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":11663208,"resultfile":"","url":"https://lyh-blogs.top/.htaccess-local","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06245","FUZZ":".htaccess-marco"},"position":581,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12686792,"resultfile":"","url":"https://lyh-blogs.top/.htaccess-marco","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06246","FUZZ":".htaccess.BAK"},"position":582,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":11200584,"resultfile":"","url":"https://lyh-blogs.top/.htaccess.BAK","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06247","FUZZ":".htaccess.bak"},"position":583,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":14320417,"resultfile":"","url":"https://lyh-blogs.top/.htaccess.bak","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06248","FUZZ":".htaccess.bak1"},"position":584,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":14392334,"resultfile":"","url":"https://lyh-blogs.top/.htaccess.bak1","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06249","FUZZ":".htaccess.inc"},"position":585,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":16816000,"resultfile":"","url":"https://lyh-blogs.top/.htaccess.inc","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0624a","FUZZ":".htaccess.old"},"position":586,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":20897166,"resultfile":"","url":"https://lyh-blogs.top/.htaccess.old","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0624b","FUZZ":".htaccess.orig"},"position":587,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":15012416,"resultfile":"","url":"https://lyh-blogs.top/.htaccess.orig","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0624c","FUZZ":".htaccess.sample"},"position":588,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":15041500,"resultfile":"","url":"https://lyh-blogs.top/.htaccess.sample","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0624d","FUZZ":".htaccess.save"},"position":589,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":20052667,"resultfile":"","url":"https://lyh-blogs.top/.htaccess.save","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0624f","FUZZ":".htaccess/"},"position":591,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12841667,"resultfile":"","url":"https://lyh-blogs.top/.htaccess/","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06250","FUZZ":".htaccess_extra"},"position":592,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":10701458,"resultfile":"","url":"https://lyh-blogs.top/.htaccess_extra","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06251","FUZZ":".htaccess_orig"},"position":593,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":16243042,"resultfile":"","url":"https://lyh-blogs.top/.htaccess_orig","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06252","FUZZ":".htaccess_sc"},"position":594,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":14294416,"resultfile":"","url":"https://lyh-blogs.top/.htaccess_sc","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06256","FUZZ":".htaccess~"},"position":598,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":31855958,"resultfile":"","url":"https://lyh-blogs.top/.htaccess~","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0625b","FUZZ":".htpasswd"},"position":603,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13610375,"resultfile":"","url":"https://lyh-blogs.top/.htpasswd","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0625c","FUZZ":".htpasswd-old"},"position":604,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":15129916,"resultfile":"","url":"https://lyh-blogs.top/.htpasswd-old","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0625d","FUZZ":".htpasswd.bak"},"position":605,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":24698000,"resultfile":"","url":"https://lyh-blogs.top/.htpasswd.bak","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0625e","FUZZ":".htpasswd.inc"},"position":606,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":16575167,"resultfile":"","url":"https://lyh-blogs.top/.htpasswd.inc","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0625f","FUZZ":".htpasswd/"},"position":607,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":14493875,"resultfile":"","url":"https://lyh-blogs.top/.htpasswd/","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06260","FUZZ":".htpasswd_test"},"position":608,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12680709,"resultfile":"","url":"https://lyh-blogs.top/.htpasswd_test","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0629c","FUZZ":".index.php.swp"},"position":668,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":20138500,"resultfile":"","url":"https://lyh-blogs.top/.index.php.swp","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a062d2","FUZZ":".keys.yml.swp"},"position":722,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":16916958,"resultfile":"","url":"https://lyh-blogs.top/.keys.yml.swp","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a062fb","FUZZ":".localsettings.php.swp"},"position":763,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":20114916,"resultfile":"","url":"https://lyh-blogs.top/.localsettings.php.swp","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06356","FUZZ":".npmrc"},"position":854,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12781084,"resultfile":"","url":"https://lyh-blogs.top/.npmrc","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06435","FUZZ":".settings.php.swp"},"position":1077,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":39880916,"resultfile":"","url":"https://lyh-blogs.top/.settings.php.swp","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06460","FUZZ":".ssh/"},"position":1120,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":14214541,"resultfile":"","url":"https://lyh-blogs.top/.ssh/","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06461","FUZZ":".ssh/ansible_rsa"},"position":1121,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":20465875,"resultfile":"","url":"https://lyh-blogs.top/.ssh/ansible_rsa","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06462","FUZZ":".ssh/authorized_keys"},"position":1122,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13216875,"resultfile":"","url":"https://lyh-blogs.top/.ssh/authorized_keys","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06463","FUZZ":".ssh/config"},"position":1123,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":14460042,"resultfile":"","url":"https://lyh-blogs.top/.ssh/config","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06464","FUZZ":".ssh/google_compute_engine"},"position":1124,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":15027750,"resultfile":"","url":"https://lyh-blogs.top/.ssh/google_compute_engine","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06465","FUZZ":".ssh/google_compute_engine.pub"},"position":1125,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":11928125,"resultfile":"","url":"https://lyh-blogs.top/.ssh/google_compute_engine.pub","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06466","FUZZ":".ssh/id_dsa"},"position":1126,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13270416,"resultfile":"","url":"https://lyh-blogs.top/.ssh/id_dsa","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06467","FUZZ":".ssh/id_dsa.pub"},"position":1127,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":15346334,"resultfile":"","url":"https://lyh-blogs.top/.ssh/id_dsa.pub","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06468","FUZZ":".ssh/id_rsa"},"position":1128,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13542083,"resultfile":"","url":"https://lyh-blogs.top/.ssh/id_rsa","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06469","FUZZ":".ssh/id_rsa.key"},"position":1129,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":11876667,"resultfile":"","url":"https://lyh-blogs.top/.ssh/id_rsa.key","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0646a","FUZZ":".ssh/id_rsa.key~"},"position":1130,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":23307167,"resultfile":"","url":"https://lyh-blogs.top/.ssh/id_rsa.key~","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0646b","FUZZ":".ssh/id_rsa.priv"},"position":1131,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":19426250,"resultfile":"","url":"https://lyh-blogs.top/.ssh/id_rsa.priv","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0646c","FUZZ":".ssh/id_rsa.priv~"},"position":1132,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":67465833,"resultfile":"","url":"https://lyh-blogs.top/.ssh/id_rsa.priv~","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0646d","FUZZ":".ssh/id_rsa.pub"},"position":1133,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":25974959,"resultfile":"","url":"https://lyh-blogs.top/.ssh/id_rsa.pub","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0646e","FUZZ":".ssh/id_rsa.pub~"},"position":1134,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13912625,"resultfile":"","url":"https://lyh-blogs.top/.ssh/id_rsa.pub~","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0646f","FUZZ":".ssh/id_rsa~"},"position":1135,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":11780500,"resultfile":"","url":"https://lyh-blogs.top/.ssh/id_rsa~","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06471","FUZZ":".ssh/identity.pub"},"position":1137,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":17494250,"resultfile":"","url":"https://lyh-blogs.top/.ssh/identity.pub","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06470","FUZZ":".ssh/identity"},"position":1136,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":17535292,"resultfile":"","url":"https://lyh-blogs.top/.ssh/identity","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06472","FUZZ":".ssh/know_hosts"},"position":1138,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":16501125,"resultfile":"","url":"https://lyh-blogs.top/.ssh/know_hosts","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06473","FUZZ":".ssh/know_hosts~"},"position":1139,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":24267917,"resultfile":"","url":"https://lyh-blogs.top/.ssh/know_hosts~","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06474","FUZZ":".ssh/known_host"},"position":1140,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":16538541,"resultfile":"","url":"https://lyh-blogs.top/.ssh/known_host","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06475","FUZZ":".ssh/known_hosts"},"position":1141,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12108167,"resultfile":"","url":"https://lyh-blogs.top/.ssh/known_hosts","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0648b","FUZZ":".svn"},"position":1163,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":19621417,"resultfile":"","url":"https://lyh-blogs.top/.svn","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0648c","FUZZ":".svn/"},"position":1164,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":10903750,"resultfile":"","url":"https://lyh-blogs.top/.svn/","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0648d","FUZZ":".svn/all-wcprops"},"position":1165,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12110125,"resultfile":"","url":"https://lyh-blogs.top/.svn/all-wcprops","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0648e","FUZZ":".svn/entries"},"position":1166,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":14183916,"resultfile":"","url":"https://lyh-blogs.top/.svn/entries","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0648f","FUZZ":".svn/prop"},"position":1167,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13684750,"resultfile":"","url":"https://lyh-blogs.top/.svn/prop","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06490","FUZZ":".svn/text"},"position":1168,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":14323875,"resultfile":"","url":"https://lyh-blogs.top/.svn/text","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06491","FUZZ":".svn/text-base/"},"position":1169,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12706875,"resultfile":"","url":"https://lyh-blogs.top/.svn/text-base/","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06492","FUZZ":".svn/text-base/index.php.svn-base"},"position":1170,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":15967125,"resultfile":"","url":"https://lyh-blogs.top/.svn/text-base/index.php.svn-base","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06493","FUZZ":".svn/wc.db"},"position":1171,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":15848875,"resultfile":"","url":"https://lyh-blogs.top/.svn/wc.db","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0649a","FUZZ":".swo"},"position":1178,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12244125,"resultfile":"","url":"https://lyh-blogs.top/.swo","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0649b","FUZZ":".swp"},"position":1179,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":15835584,"resultfile":"","url":"https://lyh-blogs.top/.swp","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a064d4","FUZZ":".travis.yml.swp"},"position":1236,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":15307500,"resultfile":"","url":"https://lyh-blogs.top/.travis.yml.swp","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a064f2","FUZZ":".vscode/.env"},"position":1266,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12179250,"resultfile":"","url":"https://lyh-blogs.top/.vscode/.env","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0652c","FUZZ":".wp-config.php.swp"},"position":1324,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":11351834,"resultfile":"","url":"https://lyh-blogs.top/.wp-config.php.swp","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0652d","FUZZ":".wp-config.swp"},"position":1325,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13520708,"resultfile":"","url":"https://lyh-blogs.top/.wp-config.swp","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0658a","FUZZ":"2"},"position":1418,"status":200,"length":0,"words":1,"lines":1,"content-type":"text/html","redirectlocation":"","scraper":{},"duration":12283042,"resultfile":"","url":"https://lyh-blogs.top/2","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06656","FUZZ":"3"},"position":1622,"status":200,"length":0,"words":1,"lines":1,"content-type":"text/html","redirectlocation":"","scraper":{},"duration":12009208,"resultfile":"","url":"https://lyh-blogs.top/3","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a066bb","FUZZ":"\\..\\..\\..\\..\\..\\..\\..\\..\\..\\etc\\passwd"},"position":1723,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":20488625,"resultfile":"","url":"https://lyh-blogs.top/\\..\\..\\..\\..\\..\\..\\..\\..\\..\\etc\\passwd","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0677e","FUZZ":"about"},"position":1918,"status":200,"length":0,"words":1,"lines":1,"content-type":"text/html","redirectlocation":"","scraper":{},"duration":12567541,"resultfile":"","url":"https://lyh-blogs.top/about","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a068d7","FUZZ":"admin/.htaccess"},"position":2263,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":17023125,"resultfile":"","url":"https://lyh-blogs.top/admin/.htaccess","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06aea","FUZZ":"administrator/.htaccess"},"position":2794,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":15740208,"resultfile":"","url":"https://lyh-blogs.top/administrator/.htaccess","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06bc3","FUZZ":"analytics/saw.dll?getPreviewImage\u0026previewFilePath=/etc/passwd"},"position":3011,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":24256167,"resultfile":"","url":"https://lyh-blogs.top/analytics/saw.dll?getPreviewImage\u0026previewFilePath=/etc/passwd","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06c34","FUZZ":"app/.htaccess"},"position":3124,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":17726000,"resultfile":"","url":"https://lyh-blogs.top/app/.htaccess","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06c91","FUZZ":"archive"},"position":3217,"status":200,"length":0,"words":1,"lines":1,"content-type":"text/html","redirectlocation":"","scraper":{},"duration":22103417,"resultfile":"","url":"https://lyh-blogs.top/archive","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06dd5","FUZZ":"bitrix/web.config"},"position":3541,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":33335917,"resultfile":"","url":"https://lyh-blogs.top/bitrix/web.config","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06f51","FUZZ":"cms/Web.config"},"position":3921,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12374292,"resultfile":"","url":"https://lyh-blogs.top/cms/Web.config","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06f8c","FUZZ":"conf.php.swp"},"position":3980,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12170542,"resultfile":"","url":"https://lyh-blogs.top/conf.php.swp","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06f8d","FUZZ":"conf.swp"},"position":3981,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":15095375,"resultfile":"","url":"https://lyh-blogs.top/conf.swp","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06fc2","FUZZ":"config.php.swp"},"position":4034,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":11302417,"resultfile":"","url":"https://lyh-blogs.top/config.php.swp","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06fcc","FUZZ":"config.swp"},"position":4044,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":11760209,"resultfile":"","url":"https://lyh-blogs.top/config.swp","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06ffe","FUZZ":"configuration.php.swp"},"position":4094,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":25016375,"resultfile":"","url":"https://lyh-blogs.top/configuration.php.swp","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061002","FUZZ":"configuration.swp"},"position":4098,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":18537500,"resultfile":"","url":"https://lyh-blogs.top/configuration.swp","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061259","FUZZ":"ehthumbs.db"},"position":4697,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":17278750,"resultfile":"","url":"https://lyh-blogs.top/ehthumbs.db","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0612d1","FUZZ":"etc/hosts"},"position":4817,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":15153875,"resultfile":"","url":"https://lyh-blogs.top/etc/hosts","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0612d3","FUZZ":"etc/passwd"},"position":4819,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":20632250,"resultfile":"","url":"https://lyh-blogs.top/etc/passwd","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0612ea","FUZZ":"examples/jsp/%252e%252e/%252e%252e/manager/html/"},"position":4842,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":17593125,"resultfile":"","url":"https://lyh-blogs.top/examples/jsp/%252e%252e/%252e%252e/manager/html/","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0613ee","FUZZ":"gallery"},"position":5102,"status":200,"length":0,"words":1,"lines":1,"content-type":"text/html","redirectlocation":"","scraper":{},"duration":28963250,"resultfile":"","url":"https://lyh-blogs.top/gallery","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06146e","FUZZ":"guestbook"},"position":5230,"status":200,"length":0,"words":1,"lines":1,"content-type":"text/html","redirectlocation":"","scraper":{},"duration":15945167,"resultfile":"","url":"https://lyh-blogs.top/guestbook","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06151d","FUZZ":"id_dsa"},"position":5405,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":35812125,"resultfile":"","url":"https://lyh-blogs.top/id_dsa","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06151e","FUZZ":"id_dsa.ppk"},"position":5406,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":22463417,"resultfile":"","url":"https://lyh-blogs.top/id_dsa.ppk","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06151f","FUZZ":"id_rsa"},"position":5407,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":22390875,"resultfile":"","url":"https://lyh-blogs.top/id_rsa","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061520","FUZZ":"id_rsa.pub"},"position":5408,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":14772458,"resultfile":"","url":"https://lyh-blogs.top/id_rsa.pub","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061591","FUZZ":"index.html"},"position":5521,"status":200,"length":0,"words":1,"lines":1,"content-type":"text/html","redirectlocation":"","scraper":{},"duration":12271458,"resultfile":"","url":"https://lyh-blogs.top/index.html","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061645","FUZZ":"javax.faces.resource.../"},"position":5701,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13846042,"resultfile":"","url":"https://lyh-blogs.top/javax.faces.resource.../","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061646","FUZZ":"javax.faces.resource.../WEB-INF/web.xml.jsf"},"position":5702,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":16533833,"resultfile":"","url":"https://lyh-blogs.top/javax.faces.resource.../WEB-INF/web.xml.jsf","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0616d1","FUZZ":"lang/web.config"},"position":5841,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":18127750,"resultfile":"","url":"https://lyh-blogs.top/lang/web.config","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061760","FUZZ":"localsettings.php.swp"},"position":5984,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13221583,"resultfile":"","url":"https://lyh-blogs.top/localsettings.php.swp","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061815","FUZZ":"mailer/.env"},"position":6165,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":17118875,"resultfile":"","url":"https://lyh-blogs.top/mailer/.env","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061942","FUZZ":"modules/web.config"},"position":6466,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":22465792,"resultfile":"","url":"https://lyh-blogs.top/modules/web.config","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061c9a","FUZZ":"plugins/web.config"},"position":7322,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":14708250,"resultfile":"","url":"https://lyh-blogs.top/plugins/web.config","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061dd5","FUZZ":"remote/fgt_lang?lang=/../../../../////////////////////////bin/sslvpnd"},"position":7637,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":13403625,"resultfile":"","url":"https://lyh-blogs.top/remote/fgt_lang?lang=/../../../../////////////////////////bin/sslvpnd","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061dd6","FUZZ":"remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession"},"position":7638,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":10098875,"resultfile":"","url":"https://lyh-blogs.top/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061e22","FUZZ":"robots.txt"},"position":7714,"status":200,"length":0,"words":1,"lines":1,"content-type":"text/plain","redirectlocation":"","scraper":{},"duration":13412708,"resultfile":"","url":"https://lyh-blogs.top/robots.txt","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061e2e","FUZZ":"rss"},"position":7726,"status":200,"length":0,"words":1,"lines":1,"content-type":"text/html","redirectlocation":"","scraper":{},"duration":19703625,"resultfile":"","url":"https://lyh-blogs.top/rss","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061e7e","FUZZ":"search"},"position":7806,"status":200,"length":0,"words":1,"lines":1,"content-type":"text/html","redirectlocation":"","scraper":{},"duration":13907542,"resultfile":"","url":"https://lyh-blogs.top/search","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a061f0b","FUZZ":"settings.php.swp"},"position":7947,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":34290167,"resultfile":"","url":"https://lyh-blogs.top/settings.php.swp","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0621b9","FUZZ":"text-base/etc/passwd"},"position":8633,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12174250,"resultfile":"","url":"https://lyh-blogs.top/text-base/etc/passwd","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0621cc","FUZZ":"Thumbs.db"},"position":8652,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12044750,"resultfile":"","url":"https://lyh-blogs.top/Thumbs.db","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0621cd","FUZZ":"thumbs.db"},"position":8653,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":11646125,"resultfile":"","url":"https://lyh-blogs.top/thumbs.db","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06223b","FUZZ":"twitter/.env"},"position":8763,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":11661667,"resultfile":"","url":"https://lyh-blogs.top/twitter/.env","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a062326","FUZZ":"var/log/"},"position":8998,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12368916,"resultfile":"","url":"https://lyh-blogs.top/var/log/","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a062327","FUZZ":"var/log/authorizenet.log"},"position":8999,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":10688292,"resultfile":"","url":"https://lyh-blogs.top/var/log/authorizenet.log","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a062328","FUZZ":"var/log/exception.log"},"position":9000,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":10222791,"resultfile":"","url":"https://lyh-blogs.top/var/log/exception.log","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a062329","FUZZ":"var/log/librepag.log"},"position":9001,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":18306292,"resultfile":"","url":"https://lyh-blogs.top/var/log/librepag.log","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06232a","FUZZ":"var/log/old"},"position":9002,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":11019458,"resultfile":"","url":"https://lyh-blogs.top/var/log/old","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06232b","FUZZ":"var/log/payment.log"},"position":9003,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":20453041,"resultfile":"","url":"https://lyh-blogs.top/var/log/payment.log","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06232c","FUZZ":"var/log/payment_authorizenet.log"},"position":9004,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":12764959,"resultfile":"","url":"https://lyh-blogs.top/var/log/payment_authorizenet.log","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06232d","FUZZ":"var/log/payment_paypal_express.log"},"position":9005,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":11462875,"resultfile":"","url":"https://lyh-blogs.top/var/log/payment_paypal_express.log","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a062389","FUZZ":"wavemaker/studioService.download?method=getContent\u0026inUrl=file///etc/passwd"},"position":9097,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":10604792,"resultfile":"","url":"https://lyh-blogs.top/wavemaker/studioService.download?method=getContent\u0026inUrl=file///etc/passwd","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a062428","FUZZ":"web.config"},"position":9256,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":20509959,"resultfile":"","url":"https://lyh-blogs.top/web.config","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a062429","FUZZ":"web.config.bak"},"position":9257,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":24158959,"resultfile":"","url":"https://lyh-blogs.top/web.config.bak","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06242a","FUZZ":"web.config.bakup"},"position":9258,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":11838250,"resultfile":"","url":"https://lyh-blogs.top/web.config.bakup","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06242b","FUZZ":"web.config.old"},"position":9259,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":19266209,"resultfile":"","url":"https://lyh-blogs.top/web.config.old","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06242c","FUZZ":"web.config.temp"},"position":9260,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":11722458,"resultfile":"","url":"https://lyh-blogs.top/web.config.temp","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06242d","FUZZ":"web.config.tmp"},"position":9261,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":17289917,"resultfile":"","url":"https://lyh-blogs.top/web.config.tmp","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a06242f","FUZZ":"web.config::$DATA"},"position":9263,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":14322167,"resultfile":"","url":"https://lyh-blogs.top/web.config::$DATA","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0624d2","FUZZ":"wp-config.php.swo"},"position":9426,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":16589000,"resultfile":"","url":"https://lyh-blogs.top/wp-config.php.swo","host":"lyh-blogs.top"},{"input":{"FFUFHASH":"e2a0624d3","FUZZ":"wp-config.php.swp"},"position":9427,"status":403,"length":0,"words":1,"lines":1,"content-type":"text/html; charset=utf-8","redirectlocation":"","scraper":{},"duration":20755041,"resultfile":"","url":"https://lyh-blogs.top/wp-config.php.swp","host":"lyh-blogs.top"}],"config":{"auditlog":"","autocalibration":false,"autocalibration_keyword":"FUZZ","autocalibration_perhost":false,"autocalibration_strategies":["basic"],"autocalibration_strings":[],"colors":false,"cmdline":"/Users/liyuhang/tools/bin/ffuf -u https://lyh-blogs.top/FUZZ -w /Users/liyuhang/.local/share/uv/tools/dirsearch/lib/python3.14/site-packages/dirsearch/db/dicc.txt -X HEAD -mc 200,301,302,401,403 -rate 60 -t 10 -timeout 15 -s -of json -o ffuf-blog.json","configfile":"","postdata":"","debuglog":"","delay":{"value":"0.00"},"dirsearch_compatibility":false,"encoders":[],"extensions":[],"fmode":"or","follow_redirects":false,"headers":{},"ignorebody":false,"ignore_wordlist_comments":false,"inputmode":"clusterbomb","cmd_inputnum":100,"inputproviders":[{"name":"wordlist","keyword":"FUZZ","value":"/Users/liyuhang/.local/share/uv/tools/dirsearch/lib/python3.14/site-packages/dirsearch/db/dicc.txt","encoders":"","template":""}],"inputshell":"","json":false,"matchers":{"IsCalibrated":false,"Matchers":{"status":{"value":"200,301,302,401,403"}},"Filters":{},"PerDomainFilters":{}},"mmode":"or","maxtime":0,"maxtime_job":0,"method":"HEAD","noninteractive":false,"outputdirectory":"","outputfile":"ffuf-blog.json","outputformat":"json","OutputSkipEmptyFile":false,"proxyurl":"","quiet":true,"rate":60,"raw":false,"recursion":false,"recursion_depth":0,"recursion_strategy":"default","replayproxyurl":"","requestfile":"","requestproto":"https","scraperfile":"","scrapers":"all","sni":"","stop_403":false,"stop_all":false,"stop_errors":false,"threads":10,"timeout":15,"url":"https://lyh-blogs.top/FUZZ","verbose":false,"wordlists":["/Users/liyuhang/.local/share/uv/tools/dirsearch/lib/python3.14/site-packages/dirsearch/db/dicc.txt"],"http2":false,"client-cert":"","client-key":"","preflights":[],"postflights":[],"preflight_mode":"per-request","preflight_error":"abort"}}

输出：verify.json，每条一个对象，含 url、scan_status、now_status、content_length、changed。

1
[
2
  {
3
    "url": "https://lyh-blogs.top/.aws/",
4
    "input": ".aws/",
5
    "scan_status": 403,
6
    "now_status": 403,
7
    "content_length": "542",
8
    "changed": "same"
9
  },
10
  {
11
    "url": "https://lyh-blogs.top/.aws/config",
12
    "input": ".aws/config",
13
    "scan_status": 403,
14
    "now_status": 403,
15
    "content_length": "542",
16
    "changed": "same"
17
  },
18
  {
19
    "url": "https://lyh-blogs.top/.aws/credentials",
20
    "input": ".aws/credentials",
21
    "scan_status": 403,
22
    "now_status": 403,
23
    "content_length": "542",
24
    "changed": "same"
25
  },
26
  {
27
    "url": "https://lyh-blogs.top/.bzr/",
28
    "input": ".bzr/",
29
    "scan_status": 403,
30
    "now_status": 403,
31
    "content_length": "542",
32
    "changed": "same"
33
  },
34
  {
35
    "url": "https://lyh-blogs.top/.bzr/branch-format",
36
    "input": ".bzr/branch-format",
37
    "scan_status": 403,
38
    "now_status": 403,
39
    "content_length": "542",
40
    "changed": "same"
41
  },
42
  {
43
    "url": "https://lyh-blogs.top/.bzr/README",
44
    "input": ".bzr/README",
45
    "scan_status": 403,
46
    "now_status": 403,
47
    "content_length": "542",
48
    "changed": "same"
49
  },
50
  {
51
    "url": "https://lyh-blogs.top/.c9/metadata/environment/.env",
52
    "input": ".c9/metadata/environment/.env",
53
    "scan_status": 403,
54
    "now_status": 403,
55
    "content_length": "542",
56
    "changed": "same"
57
  },
58
  {
59
    "url": "https://lyh-blogs.top/.config.inc.php.swp",
60
    "input": ".config.inc.php.swp",
61
    "scan_status": 403,
62
    "now_status": 404,
63
    "content_length": "350723",
64
    "changed": "CHANGED"
65
  },
66
  {
67
    "url": "https://lyh-blogs.top/.config.php.swp",
68
    "input": ".config.php.swp",
69
    "scan_status": 403,
70
    "now_status": 404,
71
    "content_length": "350723",
72
    "changed": "CHANGED"
73
  },
74
  {
75
    "url": "https://lyh-blogs.top/.configuration.php.swp",
76
    "input": ".configuration.php.swp",
77
    "scan_status": 403,
78
    "now_status": 404,
79
    "content_length": "350723",
80
    "changed": "CHANGED"
81
  },
82
  {
83
    "url": "https://lyh-blogs.top/.docker/.env",
84
    "input": ".docker/.env",
85
    "scan_status": 403,
86
    "now_status": 403,
87
    "content_length": "542",
88
    "changed": "same"
89
  },
90
  {
91
    "url": "https://lyh-blogs.top/.docker/laravel/app/.env",
92
    "input": ".docker/laravel/app/.env",
93
    "scan_status": 403,
94
    "now_status": 403,
95
    "content_length": "542",
96
    "changed": "same"
97
  },
98
  {
99
    "url": "https://lyh-blogs.top/.DS_Store",
100
    "input": ".DS_Store",
101
    "scan_status": 403,
102
    "now_status": 404,
103
    "content_length": "350723",
104
    "changed": "CHANGED"
105
  },
106
  {
107
    "url": "https://lyh-blogs.top/.ds_store",
108
    "input": ".ds_store",
109
    "scan_status": 403,
110
    "now_status": 404,
111
    "content_length": "350723",
112
    "changed": "CHANGED"
113
  },
114
  {
115
    "url": "https://lyh-blogs.top/.env",
116
    "input": ".env",
117
    "scan_status": 403,
118
    "now_status": 403,
119
    "content_length": "542",
120
    "changed": "same"
121
  },
122
  {
123
    "url": "https://lyh-blogs.top/.env-example",
124
    "input": ".env-example",
125
    "scan_status": 403,
126
    "now_status": 403,
127
    "content_length": "542",
128
    "changed": "same"
129
  },
130
  {
131
    "url": "https://lyh-blogs.top/.env-sample",
132
    "input": ".env-sample",
133
    "scan_status": 403,
134
    "now_status": 403,
135
    "content_length": "542",
136
    "changed": "same"
137
  },
138
  {
139
    "url": "https://lyh-blogs.top/.env.backup",
140
    "input": ".env.backup",
141
    "scan_status": 403,
142
    "now_status": 403,
143
    "content_length": "542",
144
    "changed": "same"
145
  },
146
  {
147
    "url": "https://lyh-blogs.top/.env.dev",
148
    "input": ".env.dev",
149
    "scan_status": 403,
150
    "now_status": 403,
151
    "content_length": "542",
152
    "changed": "same"
153
  },
154
  {
155
    "url": "https://lyh-blogs.top/.env.dev.local",
156
    "input": ".env.dev.local",
157
    "scan_status": 403,
158
    "now_status": 403,
159
    "content_length": "542",
160
    "changed": "same"
161
  },
162
  {
163
    "url": "https://lyh-blogs.top/.env.development.local",
164
    "input": ".env.development.local",
165
    "scan_status": 403,
166
    "now_status": 403,
167
    "content_length": "542",
168
    "changed": "same"
169
  },
170
  {
171
    "url": "https://lyh-blogs.top/.env.development.sample",
172
    "input": ".env.development.sample",
173
    "scan_status": 403,
174
    "now_status": 403,
175
    "content_length": "542",
176
    "changed": "same"
177
  },
178
  {
179
    "url": "https://lyh-blogs.top/.env.dist",
180
    "input": ".env.dist",
181
    "scan_status": 403,
182
    "now_status": 403,
183
    "content_length": "542",
184
    "changed": "same"
185
  },
186
  {
187
    "url": "https://lyh-blogs.top/.env.docker",
188
    "input": ".env.docker",
189
    "scan_status": 403,
190
    "now_status": 403,
191
    "content_length": "542",
192
    "changed": "same"
193
  },
194
  {
195
    "url": "https://lyh-blogs.top/.env.docker.dev",
196
    "input": ".env.docker.dev",
197
    "scan_status": 403,
198
    "now_status": 403,
199
    "content_length": "542",
200
    "changed": "same"
201
  },
202
  {
203
    "url": "https://lyh-blogs.top/.env.example",
204
    "input": ".env.example",
205
    "scan_status": 403,
206
    "now_status": 403,
207
    "content_length": "542",
208
    "changed": "same"
209
  },
210
  {
211
    "url": "https://lyh-blogs.top/.env.local",
212
    "input": ".env.local",
213
    "scan_status": 403,
214
    "now_status": 403,
215
    "content_length": "542",
216
    "changed": "same"
217
  },
218
  {
219
    "url": "https://lyh-blogs.top/.env.php",
220
    "input": ".env.php",
221
    "scan_status": 403,
222
    "now_status": 403,
223
    "content_length": "542",
224
    "changed": "same"
225
  },
226
  {
227
    "url": "https://lyh-blogs.top/.env.prod",
228
    "input": ".env.prod",
229
    "scan_status": 403,
230
    "now_status": 403,
231
    "content_length": "542",
232
    "changed": "same"
233
  },
234
  {
235
    "url": "https://lyh-blogs.top/.env.prod.local",
236
    "input": ".env.prod.local",
237
    "scan_status": 403,
238
    "now_status": 403,
239
    "content_length": "542",
240
    "changed": "same"
241
  },
242
  {
243
    "url": "https://lyh-blogs.top/.env.production",
244
    "input": ".env.production",
245
    "scan_status": 403,
246
    "now_status": 403,
247
    "content_length": "542",
248
    "changed": "same"
249
  },
250
  {
251
    "url": "https://lyh-blogs.top/.env.production.local",
252
    "input": ".env.production.local",
253
    "scan_status": 403,
254
    "now_status": 403,
255
    "content_length": "542",
256
    "changed": "same"
257
  },
258
  {
259
    "url": "https://lyh-blogs.top/.env.sample",
260
    "input": ".env.sample",
261
    "scan_status": 403,
262
    "now_status": 403,
263
    "content_length": "542",
264
    "changed": "same"
265
  },
266
  {
267
    "url": "https://lyh-blogs.top/.env.sample.php",
268
    "input": ".env.sample.php",
269
    "scan_status": 403,
270
    "now_status": 403,
271
    "content_length": "542",
272
    "changed": "same"
273
  },
274
  {
275
    "url": "https://lyh-blogs.top/.env.save",
276
    "input": ".env.save",
277
    "scan_status": 403,
278
    "now_status": 403,
279
    "content_length": "542",
280
    "changed": "same"
281
  },
282
  {
283
    "url": "https://lyh-blogs.top/.env.stage",
284
    "input": ".env.stage",
285
    "scan_status": 403,
286
    "now_status": 403,
287
    "content_length": "542",
288
    "changed": "same"
289
  },
290
  {
291
    "url": "https://lyh-blogs.top/.env.test",
292
    "input": ".env.test",
293
    "scan_status": 403,
294
    "now_status": 403,
295
    "content_length": "542",
296
    "changed": "same"
297
  },
298
  {
299
    "url": "https://lyh-blogs.top/.env.test.local",
300
    "input": ".env.test.local",
301
    "scan_status": 403,
302
    "now_status": 403,
303
    "content_length": "542",
304
    "changed": "same"
305
  },
306
  {
307
    "url": "https://lyh-blogs.top/.env.test.sample",
308
    "input": ".env.test.sample",
309
    "scan_status": 403,
310
    "now_status": 403,
311
    "content_length": "542",
312
    "changed": "same"
313
  },
314
  {
315
    "url": "https://lyh-blogs.top/.env.travis",
316
    "input": ".env.travis",
317
    "scan_status": 403,
318
    "now_status": 403,
319
    "content_length": "542",
320
    "changed": "same"
321
  },
322
  {
323
    "url": "https://lyh-blogs.top/.env~",
324
    "input": ".env~",
325
    "scan_status": 403,
326
    "now_status": 403,
327
    "content_length": "542",
328
    "changed": "same"
329
  },
330
  {
331
    "url": "https://lyh-blogs.top/.git",
332
    "input": ".git",
333
    "scan_status": 403,
334
    "now_status": 403,
335
    "content_length": "542",
336
    "changed": "same"
337
  },
338
  {
339
    "url": "https://lyh-blogs.top/.git-credentials",
340
    "input": ".git-credentials",
341
    "scan_status": 403,
342
    "now_status": 403,
343
    "content_length": "542",
344
    "changed": "same"
345
  },
346
  {
347
    "url": "https://lyh-blogs.top/.git-rewrite/",
348
    "input": ".git-rewrite/",
349
    "scan_status": 403,
350
    "now_status": 403,
351
    "content_length": "542",
352
    "changed": "same"
353
  },
354
  {
355
    "url": "https://lyh-blogs.top/.git.json",
356
    "input": ".git.json",
357
    "scan_status": 403,
358
    "now_status": 403,
359
    "content_length": "542",
360
    "changed": "same"
361
  },
362
  {
363
    "url": "https://lyh-blogs.top/.git/",
364
    "input": ".git/",
365
    "scan_status": 403,
366
    "now_status": 403,
367
    "content_length": "542",
368
    "changed": "same"
369
  },
370
  {
371
    "url": "https://lyh-blogs.top/.git/branches/",
372
    "input": ".git/branches/",
373
    "scan_status": 403,
374
    "now_status": 403,
375
    "content_length": "542",
376
    "changed": "same"
377
  },
378
  {
379
    "url": "https://lyh-blogs.top/.git/COMMIT_EDITMSG",
380
    "input": ".git/COMMIT_EDITMSG",
381
    "scan_status": 403,
382
    "now_status": 403,
383
    "content_length": "542",
384
    "changed": "same"
385
  },
386
  {
387
    "url": "https://lyh-blogs.top/.git/config",
388
    "input": ".git/config",
389
    "scan_status": 403,
390
    "now_status": 403,
391
    "content_length": "542",
392
    "changed": "same"
393
  },
394
  {
395
    "url": "https://lyh-blogs.top/.git/description",
396
    "input": ".git/description",
397
    "scan_status": 403,
398
    "now_status": 403,
399
    "content_length": "542",
400
    "changed": "same"
401
  },
402
  {
403
    "url": "https://lyh-blogs.top/.git/FETCH_HEAD",
404
    "input": ".git/FETCH_HEAD",
405
    "scan_status": 403,
406
    "now_status": 403,
407
    "content_length": "542",
408
    "changed": "same"
409
  },
410
  {
411
    "url": "https://lyh-blogs.top/.git/HEAD",
412
    "input": ".git/HEAD",
413
    "scan_status": 403,
414
    "now_status": 403,
415
    "content_length": "542",
416
    "changed": "same"
417
  },
418
  {
419
    "url": "https://lyh-blogs.top/.git/head",
420
    "input": ".git/head",
421
    "scan_status": 403,
422
    "now_status": 403,
423
    "content_length": "542",
424
    "changed": "same"
425
  },
426
  {
427
    "url": "https://lyh-blogs.top/.git/hooks/",
428
    "input": ".git/hooks/",
429
    "scan_status": 403,
430
    "now_status": 403,
431
    "content_length": "542",
432
    "changed": "same"
433
  },
434
  {
435
    "url": "https://lyh-blogs.top/.git/hooks/applypatch-msg",
436
    "input": ".git/hooks/applypatch-msg",
437
    "scan_status": 403,
438
    "now_status": 403,
439
    "content_length": "542",
440
    "changed": "same"
441
  },
442
  {
443
    "url": "https://lyh-blogs.top/.git/hooks/commit-msg",
444
    "input": ".git/hooks/commit-msg",
445
    "scan_status": 403,
446
    "now_status": 403,
447
    "content_length": "542",
448
    "changed": "same"
449
  },
450
  {
451
    "url": "https://lyh-blogs.top/.git/hooks/post-update",
452
    "input": ".git/hooks/post-update",
453
    "scan_status": 403,
454
    "now_status": 403,
455
    "content_length": "542",
456
    "changed": "same"
457
  },
458
  {
459
    "url": "https://lyh-blogs.top/.git/hooks/pre-applypatch",
460
    "input": ".git/hooks/pre-applypatch",
461
    "scan_status": 403,
462
    "now_status": 403,
463
    "content_length": "542",
464
    "changed": "same"
465
  },
466
  {
467
    "url": "https://lyh-blogs.top/.git/hooks/pre-commit",
468
    "input": ".git/hooks/pre-commit",
469
    "scan_status": 403,
470
    "now_status": 403,
471
    "content_length": "542",
472
    "changed": "same"
473
  },
474
  {
475
    "url": "https://lyh-blogs.top/.git/hooks/pre-push",
476
    "input": ".git/hooks/pre-push",
477
    "scan_status": 403,
478
    "now_status": 403,
479
    "content_length": "542",
480
    "changed": "same"
481
  },
482
  {
483
    "url": "https://lyh-blogs.top/.git/hooks/pre-rebase",
484
    "input": ".git/hooks/pre-rebase",
485
    "scan_status": 403,
486
    "now_status": 403,
487
    "content_length": "542",
488
    "changed": "same"
489
  },
490
  {
491
    "url": "https://lyh-blogs.top/.git/hooks/pre-receive",
492
    "input": ".git/hooks/pre-receive",
493
    "scan_status": 403,
494
    "now_status": 403,
495
    "content_length": "542",
496
    "changed": "same"
497
  },
498
  {
499
    "url": "https://lyh-blogs.top/.git/hooks/prepare-commit-msg",
500
    "input": ".git/hooks/prepare-commit-msg",
501
    "scan_status": 403,
502
    "now_status": 403,
503
    "content_length": "542",
504
    "changed": "same"
505
  },
506
  {
507
    "url": "https://lyh-blogs.top/.git/hooks/update",
508
    "input": ".git/hooks/update",
509
    "scan_status": 403,
510
    "now_status": 403,
511
    "content_length": "542",
512
    "changed": "same"
513
  },
514
  {
515
    "url": "https://lyh-blogs.top/.git/index",
516
    "input": ".git/index",
517
    "scan_status": 403,
518
    "now_status": 403,
519
    "content_length": "542",
520
    "changed": "same"
521
  },
522
  {
523
    "url": "https://lyh-blogs.top/.git/info/",
524
    "input": ".git/info/",
525
    "scan_status": 403,
526
    "now_status": 403,
527
    "content_length": "542",
528
    "changed": "same"
529
  },
530
  {
531
    "url": "https://lyh-blogs.top/.git/info/attributes",
532
    "input": ".git/info/attributes",
533
    "scan_status": 403,
534
    "now_status": 403,
535
    "content_length": "542",
536
    "changed": "same"
537
  },
538
  {
539
    "url": "https://lyh-blogs.top/.git/info/exclude",
540
    "input": ".git/info/exclude",
541
    "scan_status": 403,
542
    "now_status": 403,
543
    "content_length": "542",
544
    "changed": "same"
545
  },
546
  {
547
    "url": "https://lyh-blogs.top/.git/info/refs",
548
    "input": ".git/info/refs",
549
    "scan_status": 403,
550
    "now_status": 403,
551
    "content_length": "542",
552
    "changed": "same"
553
  },
554
  {
555
    "url": "https://lyh-blogs.top/.git/logs/",
556
    "input": ".git/logs/",
557
    "scan_status": 403,
558
    "now_status": 403,
559
    "content_length": "542",
560
    "changed": "same"
561
  },
562
  {
563
    "url": "https://lyh-blogs.top/.git/logs/HEAD",
564
    "input": ".git/logs/HEAD",
565
    "scan_status": 403,
566
    "now_status": 403,
567
    "content_length": "542",
568
    "changed": "same"
569
  },
570
  {
571
    "url": "https://lyh-blogs.top/.git/logs/head",
572
    "input": ".git/logs/head",
573
    "scan_status": 403,
574
    "now_status": 403,
575
    "content_length": "542",
576
    "changed": "same"
577
  },
578
  {
579
    "url": "https://lyh-blogs.top/.git/logs/refs",
580
    "input": ".git/logs/refs",
581
    "scan_status": 403,
582
    "now_status": 403,
583
    "content_length": "542",
584
    "changed": "same"
585
  },
586
  {
587
    "url": "https://lyh-blogs.top/.git/logs/refs/heads",
588
    "input": ".git/logs/refs/heads",
589
    "scan_status": 403,
590
    "now_status": 403,
591
    "content_length": "542",
592
    "changed": "same"
593
  },
594
  {
595
    "url": "https://lyh-blogs.top/.git/logs/refs/heads/master",
596
    "input": ".git/logs/refs/heads/master",
597
    "scan_status": 403,
598
    "now_status": 403,
599
    "content_length": "542",
600
    "changed": "same"
601
  },
602
  {
603
    "url": "https://lyh-blogs.top/.git/logs/refs/remotes",
604
    "input": ".git/logs/refs/remotes",
605
    "scan_status": 403,
606
    "now_status": 403,
607
    "content_length": "542",
608
    "changed": "same"
609
  },
610
  {
611
    "url": "https://lyh-blogs.top/.git/logs/refs/remotes/origin",
612
    "input": ".git/logs/refs/remotes/origin",
613
    "scan_status": 403,
614
    "now_status": 403,
615
    "content_length": "542",
616
    "changed": "same"
617
  },
618
  {
619
    "url": "https://lyh-blogs.top/.git/logs/refs/remotes/origin/HEAD",
620
    "input": ".git/logs/refs/remotes/origin/HEAD",
621
    "scan_status": 403,
622
    "now_status": 403,
623
    "content_length": "542",
624
    "changed": "same"
625
  },
626
  {
627
    "url": "https://lyh-blogs.top/.git/logs/refs/remotes/origin/master",
628
    "input": ".git/logs/refs/remotes/origin/master",
629
    "scan_status": 403,
630
    "now_status": 403,
631
    "content_length": "542",
632
    "changed": "same"
633
  },
634
  {
635
    "url": "https://lyh-blogs.top/.git/objects/",
636
    "input": ".git/objects/",
637
    "scan_status": 403,
638
    "now_status": 403,
639
    "content_length": "542",
640
    "changed": "same"
641
  },
642
  {
643
    "url": "https://lyh-blogs.top/.git/objects/info/packs",
644
    "input": ".git/objects/info/packs",
645
    "scan_status": 403,
646
    "now_status": 403,
647
    "content_length": "542",
648
    "changed": "same"
649
  },
650
  {
651
    "url": "https://lyh-blogs.top/.git/packed-refs",
652
    "input": ".git/packed-refs",
653
    "scan_status": 403,
654
    "now_status": 403,
655
    "content_length": "542",
656
    "changed": "same"
657
  },
658
  {
659
    "url": "https://lyh-blogs.top/.git/refs/",
660
    "input": ".git/refs/",
661
    "scan_status": 403,
662
    "now_status": 403,
663
    "content_length": "542",
664
    "changed": "same"
665
  },
666
  {
667
    "url": "https://lyh-blogs.top/.git/refs/heads",
668
    "input": ".git/refs/heads",
669
    "scan_status": 403,
670
    "now_status": 403,
671
    "content_length": "542",
672
    "changed": "same"
673
  },
674
  {
675
    "url": "https://lyh-blogs.top/.git/refs/heads/master",
676
    "input": ".git/refs/heads/master",
677
    "scan_status": 403,
678
    "now_status": 403,
679
    "content_length": "542",
680
    "changed": "same"
681
  },
682
  {
683
    "url": "https://lyh-blogs.top/.git/refs/remotes",
684
    "input": ".git/refs/remotes",
685
    "scan_status": 403,
686
    "now_status": 403,
687
    "content_length": "542",
688
    "changed": "same"
689
  },
690
  {
691
    "url": "https://lyh-blogs.top/.git/refs/remotes/origin",
692
    "input": ".git/refs/remotes/origin",
693
    "scan_status": 403,
694
    "now_status": 403,
695
    "content_length": "542",
696
    "changed": "same"
697
  },
698
  {
699
    "url": "https://lyh-blogs.top/.git/refs/remotes/origin/HEAD",
700
    "input": ".git/refs/remotes/origin/HEAD",
701
    "scan_status": 403,
702
    "now_status": 403,
703
    "content_length": "542",
704
    "changed": "same"
705
  },
706
  {
707
    "url": "https://lyh-blogs.top/.git/refs/remotes/origin/master",
708
    "input": ".git/refs/remotes/origin/master",
709
    "scan_status": 403,
710
    "now_status": 403,
711
    "content_length": "542",
712
    "changed": "same"
713
  },
714
  {
715
    "url": "https://lyh-blogs.top/.git/refs/tags",
716
    "input": ".git/refs/tags",
717
    "scan_status": 403,
718
    "now_status": 403,
719
    "content_length": "542",
720
    "changed": "same"
721
  },
722
  {
723
    "url": "https://lyh-blogs.top/.git_release",
724
    "input": ".git_release",
725
    "scan_status": 403,
726
    "now_status": 403,
727
    "content_length": "542",
728
    "changed": "same"
729
  },
730
  {
731
    "url": "https://lyh-blogs.top/.gitignore.swp",
732
    "input": ".gitignore.swp",
733
    "scan_status": 403,
734
    "now_status": 404,
735
    "content_length": "350723",
736
    "changed": "CHANGED"
737
  },
738
  {
739
    "url": "https://lyh-blogs.top/.gitlab-ci/.env",
740
    "input": ".gitlab-ci/.env",
741
    "scan_status": 403,
742
    "now_status": 403,
743
    "content_length": "542",
744
    "changed": "same"
745
  },
746
  {
747
    "url": "https://lyh-blogs.top/.hg",
748
    "input": ".hg",
749
    "scan_status": 403,
750
    "now_status": 403,
751
    "content_length": "542",
752
    "changed": "same"
753
  },
754
  {
755
    "url": "https://lyh-blogs.top/.hg/",
756
    "input": ".hg/",
757
    "scan_status": 403,
758
    "now_status": 403,
759
    "content_length": "542",
760
    "changed": "same"
761
  },
762
  {
763
    "url": "https://lyh-blogs.top/.hg/branch",
764
    "input": ".hg/branch",
765
    "scan_status": 403,
766
    "now_status": 403,
767
    "content_length": "542",
768
    "changed": "same"
769
  },
770
  {
771
    "url": "https://lyh-blogs.top/.hg/dirstate",
772
    "input": ".hg/dirstate",
773
    "scan_status": 403,
774
    "now_status": 403,
775
    "content_length": "542",
776
    "changed": "same"
777
  },
778
  {
779
    "url": "https://lyh-blogs.top/.hg/hgrc",
780
    "input": ".hg/hgrc",
781
    "scan_status": 403,
782
    "now_status": 403,
783
    "content_length": "542",
784
    "changed": "same"
785
  },
786
  {
787
    "url": "https://lyh-blogs.top/.hg/requires",
788
    "input": ".hg/requires",
789
    "scan_status": 403,
790
    "now_status": 403,
791
    "content_length": "542",
792
    "changed": "same"
793
  },
794
  {
795
    "url": "https://lyh-blogs.top/.hg/store/data/",
796
    "input": ".hg/store/data/",
797
    "scan_status": 403,
798
    "now_status": 403,
799
    "content_length": "542",
800
    "changed": "same"
801
  },
802
  {
803
    "url": "https://lyh-blogs.top/.hg/store/undo",
804
    "input": ".hg/store/undo",
805
    "scan_status": 403,
806
    "now_status": 403,
807
    "content_length": "542",
808
    "changed": "same"
809
  },
810
  {
811
    "url": "https://lyh-blogs.top/.hg/undo.dirstate",
812
    "input": ".hg/undo.dirstate",
813
    "scan_status": 403,
814
    "now_status": 403,
815
    "content_length": "542",
816
    "changed": "same"
817
  },
818
  {
819
    "url": "https://lyh-blogs.top/.htaccess",
820
    "input": ".htaccess",
821
    "scan_status": 403,
822
    "now_status": 403,
823
    "content_length": "542",
824
    "changed": "same"
825
  },
826
  {
827
    "url": "https://lyh-blogs.top/.htaccess-dev",
828
    "input": ".htaccess-dev",
829
    "scan_status": 403,
830
    "now_status": 403,
831
    "content_length": "542",
832
    "changed": "same"
833
  },
834
  {
835
    "url": "https://lyh-blogs.top/.htaccess-local",
836
    "input": ".htaccess-local",
837
    "scan_status": 403,
838
    "now_status": 403,
839
    "content_length": "542",
840
    "changed": "same"
841
  },
842
  {
843
    "url": "https://lyh-blogs.top/.htaccess-marco",
844
    "input": ".htaccess-marco",
845
    "scan_status": 403,
846
    "now_status": 403,
847
    "content_length": "542",
848
    "changed": "same"
849
  },
850
  {
851
    "url": "https://lyh-blogs.top/.htaccess.BAK",
852
    "input": ".htaccess.BAK",
853
    "scan_status": 403,
854
    "now_status": 403,
855
    "content_length": "542",
856
    "changed": "same"
857
  },
858
  {
859
    "url": "https://lyh-blogs.top/.htaccess.bak",
860
    "input": ".htaccess.bak",
861
    "scan_status": 403,
862
    "now_status": 403,
863
    "content_length": "542",
864
    "changed": "same"
865
  },
866
  {
867
    "url": "https://lyh-blogs.top/.htaccess.bak1",
868
    "input": ".htaccess.bak1",
869
    "scan_status": 403,
870
    "now_status": 403,
871
    "content_length": "542",
872
    "changed": "same"
873
  },
874
  {
875
    "url": "https://lyh-blogs.top/.htaccess.inc",
876
    "input": ".htaccess.inc",
877
    "scan_status": 403,
878
    "now_status": 403,
879
    "content_length": "542",
880
    "changed": "same"
881
  },
882
  {
883
    "url": "https://lyh-blogs.top/.htaccess.old",
884
    "input": ".htaccess.old",
885
    "scan_status": 403,
886
    "now_status": 403,
887
    "content_length": "542",
888
    "changed": "same"
889
  },
890
  {
891
    "url": "https://lyh-blogs.top/.htaccess.orig",
892
    "input": ".htaccess.orig",
893
    "scan_status": 403,
894
    "now_status": 403,
895
    "content_length": "542",
896
    "changed": "same"
897
  },
898
  {
899
    "url": "https://lyh-blogs.top/.htaccess.sample",
900
    "input": ".htaccess.sample",
901
    "scan_status": 403,
902
    "now_status": 403,
903
    "content_length": "542",
904
    "changed": "same"
905
  },
906
  {
907
    "url": "https://lyh-blogs.top/.htaccess.save",
908
    "input": ".htaccess.save",
909
    "scan_status": 403,
910
    "now_status": 403,
911
    "content_length": "542",
912
    "changed": "same"
913
  },
914
  {
915
    "url": "https://lyh-blogs.top/.htaccess/",
916
    "input": ".htaccess/",
917
    "scan_status": 403,
918
    "now_status": 403,
919
    "content_length": "542",
920
    "changed": "same"
921
  },
922
  {
923
    "url": "https://lyh-blogs.top/.htaccess_extra",
924
    "input": ".htaccess_extra",
925
    "scan_status": 403,
926
    "now_status": 403,
927
    "content_length": "542",
928
    "changed": "same"
929
  },
930
  {
931
    "url": "https://lyh-blogs.top/.htaccess_orig",
932
    "input": ".htaccess_orig",
933
    "scan_status": 403,
934
    "now_status": 403,
935
    "content_length": "542",
936
    "changed": "same"
937
  },
938
  {
939
    "url": "https://lyh-blogs.top/.htaccess_sc",
940
    "input": ".htaccess_sc",
941
    "scan_status": 403,
942
    "now_status": 403,
943
    "content_length": "542",
944
    "changed": "same"
945
  },
946
  {
947
    "url": "https://lyh-blogs.top/.htaccess~",
948
    "input": ".htaccess~",
949
    "scan_status": 403,
950
    "now_status": 403,
951
    "content_length": "542",
952
    "changed": "same"
953
  },
954
  {
955
    "url": "https://lyh-blogs.top/.htpasswd",
956
    "input": ".htpasswd",
957
    "scan_status": 403,
958
    "now_status": 403,
959
    "content_length": "542",
960
    "changed": "same"
961
  },
962
  {
963
    "url": "https://lyh-blogs.top/.htpasswd-old",
964
    "input": ".htpasswd-old",
965
    "scan_status": 403,
966
    "now_status": 403,
967
    "content_length": "542",
968
    "changed": "same"
969
  },
970
  {
971
    "url": "https://lyh-blogs.top/.htpasswd.bak",
972
    "input": ".htpasswd.bak",
973
    "scan_status": 403,
974
    "now_status": 403,
975
    "content_length": "542",
976
    "changed": "same"
977
  },
978
  {
979
    "url": "https://lyh-blogs.top/.htpasswd.inc",
980
    "input": ".htpasswd.inc",
981
    "scan_status": 403,
982
    "now_status": 403,
983
    "content_length": "542",
984
    "changed": "same"
985
  },
986
  {
987
    "url": "https://lyh-blogs.top/.htpasswd/",
988
    "input": ".htpasswd/",
989
    "scan_status": 403,
990
    "now_status": 403,
991
    "content_length": "542",
992
    "changed": "same"
993
  },
994
  {
995
    "url": "https://lyh-blogs.top/.htpasswd_test",
996
    "input": ".htpasswd_test",
997
    "scan_status": 403,
998
    "now_status": 403,
999
    "content_length": "542",
1000
    "changed": "same"
1001
  },
1002
  {
1003
    "url": "https://lyh-blogs.top/.index.php.swp",
1004
    "input": ".index.php.swp",
1005
    "scan_status": 403,
1006
    "now_status": 404,
1007
    "content_length": "350723",
1008
    "changed": "CHANGED"
1009
  },
1010
  {
1011
    "url": "https://lyh-blogs.top/.keys.yml.swp",
1012
    "input": ".keys.yml.swp",
1013
    "scan_status": 403,
1014
    "now_status": 404,
1015
    "content_length": "350723",
1016
    "changed": "CHANGED"
1017
  },
1018
  {
1019
    "url": "https://lyh-blogs.top/.localsettings.php.swp",
1020
    "input": ".localsettings.php.swp",
1021
    "scan_status": 403,
1022
    "now_status": 404,
1023
    "content_length": "350723",
1024
    "changed": "CHANGED"
1025
  },
1026
  {
1027
    "url": "https://lyh-blogs.top/.npmrc",
1028
    "input": ".npmrc",
1029
    "scan_status": 403,
1030
    "now_status": 403,
1031
    "content_length": "542",
1032
    "changed": "same"
1033
  },
1034
  {
1035
    "url": "https://lyh-blogs.top/.settings.php.swp",
1036
    "input": ".settings.php.swp",
1037
    "scan_status": 403,
1038
    "now_status": 404,
1039
    "content_length": "350723",
1040
    "changed": "CHANGED"
1041
  },
1042
  {
1043
    "url": "https://lyh-blogs.top/.ssh/",
1044
    "input": ".ssh/",
1045
    "scan_status": 403,
1046
    "now_status": 403,
1047
    "content_length": "542",
1048
    "changed": "same"
1049
  },
1050
  {
1051
    "url": "https://lyh-blogs.top/.ssh/ansible_rsa",
1052
    "input": ".ssh/ansible_rsa",
1053
    "scan_status": 403,
1054
    "now_status": 403,
1055
    "content_length": "542",
1056
    "changed": "same"
1057
  },
1058
  {
1059
    "url": "https://lyh-blogs.top/.ssh/authorized_keys",
1060
    "input": ".ssh/authorized_keys",
1061
    "scan_status": 403,
1062
    "now_status": 403,
1063
    "content_length": "542",
1064
    "changed": "same"
1065
  },
1066
  {
1067
    "url": "https://lyh-blogs.top/.ssh/config",
1068
    "input": ".ssh/config",
1069
    "scan_status": 403,
1070
    "now_status": 403,
1071
    "content_length": "542",
1072
    "changed": "same"
1073
  },
1074
  {
1075
    "url": "https://lyh-blogs.top/.ssh/google_compute_engine",
1076
    "input": ".ssh/google_compute_engine",
1077
    "scan_status": 403,
1078
    "now_status": 403,
1079
    "content_length": "542",
1080
    "changed": "same"
1081
  },
1082
  {
1083
    "url": "https://lyh-blogs.top/.ssh/google_compute_engine.pub",
1084
    "input": ".ssh/google_compute_engine.pub",
1085
    "scan_status": 403,
1086
    "now_status": 403,
1087
    "content_length": "542",
1088
    "changed": "same"
1089
  },
1090
  {
1091
    "url": "https://lyh-blogs.top/.ssh/id_dsa",
1092
    "input": ".ssh/id_dsa",
1093
    "scan_status": 403,
1094
    "now_status": 403,
1095
    "content_length": "542",
1096
    "changed": "same"
1097
  },
1098
  {
1099
    "url": "https://lyh-blogs.top/.ssh/id_dsa.pub",
1100
    "input": ".ssh/id_dsa.pub",
1101
    "scan_status": 403,
1102
    "now_status": 403,
1103
    "content_length": "542",
1104
    "changed": "same"
1105
  },
1106
  {
1107
    "url": "https://lyh-blogs.top/.ssh/id_rsa",
1108
    "input": ".ssh/id_rsa",
1109
    "scan_status": 403,
1110
    "now_status": 403,
1111
    "content_length": "542",
1112
    "changed": "same"
1113
  },
1114
  {
1115
    "url": "https://lyh-blogs.top/.ssh/id_rsa.key",
1116
    "input": ".ssh/id_rsa.key",
1117
    "scan_status": 403,
1118
    "now_status": 403,
1119
    "content_length": "542",
1120
    "changed": "same"
1121
  },
1122
  {
1123
    "url": "https://lyh-blogs.top/.ssh/id_rsa.key~",
1124
    "input": ".ssh/id_rsa.key~",
1125
    "scan_status": 403,
1126
    "now_status": 403,
1127
    "content_length": "542",
1128
    "changed": "same"
1129
  },
1130
  {
1131
    "url": "https://lyh-blogs.top/.ssh/id_rsa.priv",
1132
    "input": ".ssh/id_rsa.priv",
1133
    "scan_status": 403,
1134
    "now_status": 403,
1135
    "content_length": "542",
1136
    "changed": "same"
1137
  },
1138
  {
1139
    "url": "https://lyh-blogs.top/.ssh/id_rsa.priv~",
1140
    "input": ".ssh/id_rsa.priv~",
1141
    "scan_status": 403,
1142
    "now_status": 403,
1143
    "content_length": "542",
1144
    "changed": "same"
1145
  },
1146
  {
1147
    "url": "https://lyh-blogs.top/.ssh/id_rsa.pub",
1148
    "input": ".ssh/id_rsa.pub",
1149
    "scan_status": 403,
1150
    "now_status": 403,
1151
    "content_length": "542",
1152
    "changed": "same"
1153
  },
1154
  {
1155
    "url": "https://lyh-blogs.top/.ssh/id_rsa.pub~",
1156
    "input": ".ssh/id_rsa.pub~",
1157
    "scan_status": 403,
1158
    "now_status": 403,
1159
    "content_length": "542",
1160
    "changed": "same"
1161
  },
1162
  {
1163
    "url": "https://lyh-blogs.top/.ssh/id_rsa~",
1164
    "input": ".ssh/id_rsa~",
1165
    "scan_status": 403,
1166
    "now_status": 403,
1167
    "content_length": "542",
1168
    "changed": "same"
1169
  },
1170
  {
1171
    "url": "https://lyh-blogs.top/.ssh/identity.pub",
1172
    "input": ".ssh/identity.pub",
1173
    "scan_status": 403,
1174
    "now_status": 403,
1175
    "content_length": "542",
1176
    "changed": "same"
1177
  },
1178
  {
1179
    "url": "https://lyh-blogs.top/.ssh/identity",
1180
    "input": ".ssh/identity",
1181
    "scan_status": 403,
1182
    "now_status": 403,
1183
    "content_length": "542",
1184
    "changed": "same"
1185
  },
1186
  {
1187
    "url": "https://lyh-blogs.top/.ssh/know_hosts",
1188
    "input": ".ssh/know_hosts",
1189
    "scan_status": 403,
1190
    "now_status": 403,
1191
    "content_length": "542",
1192
    "changed": "same"
1193
  },
1194
  {
1195
    "url": "https://lyh-blogs.top/.ssh/know_hosts~",
1196
    "input": ".ssh/know_hosts~",
1197
    "scan_status": 403,
1198
    "now_status": 403,
1199
    "content_length": "542",
1200
    "changed": "same"
1201
  },
1202
  {
1203
    "url": "https://lyh-blogs.top/.ssh/known_host",
1204
    "input": ".ssh/known_host",
1205
    "scan_status": 403,
1206
    "now_status": 403,
1207
    "content_length": "542",
1208
    "changed": "same"
1209
  },
1210
  {
1211
    "url": "https://lyh-blogs.top/.ssh/known_hosts",
1212
    "input": ".ssh/known_hosts",
1213
    "scan_status": 403,
1214
    "now_status": 403,
1215
    "content_length": "542",
1216
    "changed": "same"
1217
  },
1218
  {
1219
    "url": "https://lyh-blogs.top/.svn",
1220
    "input": ".svn",
1221
    "scan_status": 403,
1222
    "now_status": 403,
1223
    "content_length": "542",
1224
    "changed": "same"
1225
  },
1226
  {
1227
    "url": "https://lyh-blogs.top/.svn/",
1228
    "input": ".svn/",
1229
    "scan_status": 403,
1230
    "now_status": 403,
1231
    "content_length": "542",
1232
    "changed": "same"
1233
  },
1234
  {
1235
    "url": "https://lyh-blogs.top/.svn/all-wcprops",
1236
    "input": ".svn/all-wcprops",
1237
    "scan_status": 403,
1238
    "now_status": 403,
1239
    "content_length": "542",
1240
    "changed": "same"
1241
  },
1242
  {
1243
    "url": "https://lyh-blogs.top/.svn/entries",
1244
    "input": ".svn/entries",
1245
    "scan_status": 403,
1246
    "now_status": 403,
1247
    "content_length": "542",
1248
    "changed": "same"
1249
  },
1250
  {
1251
    "url": "https://lyh-blogs.top/.svn/prop",
1252
    "input": ".svn/prop",
1253
    "scan_status": 403,
1254
    "now_status": 403,
1255
    "content_length": "542",
1256
    "changed": "same"
1257
  },
1258
  {
1259
    "url": "https://lyh-blogs.top/.svn/text",
1260
    "input": ".svn/text",
1261
    "scan_status": 403,
1262
    "now_status": 403,
1263
    "content_length": "542",
1264
    "changed": "same"
1265
  },
1266
  {
1267
    "url": "https://lyh-blogs.top/.svn/text-base/",
1268
    "input": ".svn/text-base/",
1269
    "scan_status": 403,
1270
    "now_status": 403,
1271
    "content_length": "542",
1272
    "changed": "same"
1273
  },
1274
  {
1275
    "url": "https://lyh-blogs.top/.svn/text-base/index.php.svn-base",
1276
    "input": ".svn/text-base/index.php.svn-base",
1277
    "scan_status": 403,
1278
    "now_status": 403,
1279
    "content_length": "542",
1280
    "changed": "same"
1281
  },
1282
  {
1283
    "url": "https://lyh-blogs.top/.svn/wc.db",
1284
    "input": ".svn/wc.db",
1285
    "scan_status": 403,
1286
    "now_status": 403,
1287
    "content_length": "542",
1288
    "changed": "same"
1289
  },
1290
  {
1291
    "url": "https://lyh-blogs.top/.swo",
1292
    "input": ".swo",
1293
    "scan_status": 403,
1294
    "now_status": 404,
1295
    "content_length": "350723",
1296
    "changed": "CHANGED"
1297
  },
1298
  {
1299
    "url": "https://lyh-blogs.top/.swp",
1300
    "input": ".swp",
1301
    "scan_status": 403,
1302
    "now_status": 404,
1303
    "content_length": "350723",
1304
    "changed": "CHANGED"
1305
  },
1306
  {
1307
    "url": "https://lyh-blogs.top/.travis.yml.swp",
1308
    "input": ".travis.yml.swp",
1309
    "scan_status": 403,
1310
    "now_status": 404,
1311
    "content_length": "350723",
1312
    "changed": "CHANGED"
1313
  },
1314
  {
1315
    "url": "https://lyh-blogs.top/.vscode/.env",
1316
    "input": ".vscode/.env",
1317
    "scan_status": 403,
1318
    "now_status": 403,
1319
    "content_length": "542",
1320
    "changed": "same"
1321
  },
1322
  {
1323
    "url": "https://lyh-blogs.top/.wp-config.php.swp",
1324
    "input": ".wp-config.php.swp",
1325
    "scan_status": 403,
1326
    "now_status": 404,
1327
    "content_length": "350723",
1328
    "changed": "CHANGED"
1329
  },
1330
  {
1331
    "url": "https://lyh-blogs.top/.wp-config.swp",
1332
    "input": ".wp-config.swp",
1333
    "scan_status": 403,
1334
    "now_status": 404,
1335
    "content_length": "350723",
1336
    "changed": "CHANGED"
1337
  },
1338
  {
1339
    "url": "https://lyh-blogs.top/2",
1340
    "input": "2",
1341
    "scan_status": 200,
1342
    "now_status": 200,
1343
    "content_length": "403459",
1344
    "changed": "same"
1345
  },
1346
  {
1347
    "url": "https://lyh-blogs.top/3",
1348
    "input": "3",
1349
    "scan_status": 200,
1350
    "now_status": 200,
1351
    "content_length": "396189",
1352
    "changed": "same"
1353
  },
1354
  {
1355
    "url": "https://lyh-blogs.top/\\..\\..\\..\\..\\..\\..\\..\\..\\..\\etc\\passwd",
1356
    "input": "\\..\\..\\..\\..\\..\\..\\..\\..\\..\\etc\\passwd",
1357
    "scan_status": 403,
1358
    "now_status": 403,
1359
    "content_length": "542",
1360
    "changed": "same"
1361
  },
1362
  {
1363
    "url": "https://lyh-blogs.top/about",
1364
    "input": "about",
1365
    "scan_status": 200,
1366
    "now_status": 200,
1367
    "content_length": "353500",
1368
    "changed": "same"
1369
  },
1370
  {
1371
    "url": "https://lyh-blogs.top/admin/.htaccess",
1372
    "input": "admin/.htaccess",
1373
    "scan_status": 403,
1374
    "now_status": 403,
1375
    "content_length": "542",
1376
    "changed": "same"
1377
  },
1378
  {
1379
    "url": "https://lyh-blogs.top/administrator/.htaccess",
1380
    "input": "administrator/.htaccess",
1381
    "scan_status": 403,
1382
    "now_status": 403,
1383
    "content_length": "542",
1384
    "changed": "same"
1385
  },
1386
  {
1387
    "url": "https://lyh-blogs.top/analytics/saw.dll?getPreviewImage&previewFilePath=/etc/passwd",
1388
    "input": "analytics/saw.dll?getPreviewImage&previewFilePath=/etc/passwd",
1389
    "scan_status": 403,
1390
    "now_status": 403,
1391
    "content_length": "542",
1392
    "changed": "same"
1393
  },
1394
  {
1395
    "url": "https://lyh-blogs.top/app/.htaccess",
1396
    "input": "app/.htaccess",
1397
    "scan_status": 403,
1398
    "now_status": 403,
1399
    "content_length": "542",
1400
    "changed": "same"
1401
  },
1402
  {
1403
    "url": "https://lyh-blogs.top/archive",
1404
    "input": "archive",
1405
    "scan_status": 200,
1406
    "now_status": 200,
1407
    "content_length": "374264",
1408
    "changed": "same"
1409
  },
1410
  {
1411
    "url": "https://lyh-blogs.top/bitrix/web.config",
1412
    "input": "bitrix/web.config",
1413
    "scan_status": 403,
1414
    "now_status": 403,
1415
    "content_length": "542",
1416
    "changed": "same"
1417
  },
1418
  {
1419
    "url": "https://lyh-blogs.top/cms/Web.config",
1420
    "input": "cms/Web.config",
1421
    "scan_status": 403,
1422
    "now_status": 403,
1423
    "content_length": "542",
1424
    "changed": "same"
1425
  },
1426
  {
1427
    "url": "https://lyh-blogs.top/conf.php.swp",
1428
    "input": "conf.php.swp",
1429
    "scan_status": 403,
1430
    "now_status": 404,
1431
    "content_length": "350723",
1432
    "changed": "CHANGED"
1433
  },
1434
  {
1435
    "url": "https://lyh-blogs.top/conf.swp",
1436
    "input": "conf.swp",
1437
    "scan_status": 403,
1438
    "now_status": 404,
1439
    "content_length": "350723",
1440
    "changed": "CHANGED"
1441
  },
1442
  {
1443
    "url": "https://lyh-blogs.top/config.php.swp",
1444
    "input": "config.php.swp",
1445
    "scan_status": 403,
1446
    "now_status": 404,
1447
    "content_length": "350723",
1448
    "changed": "CHANGED"
1449
  },
1450
  {
1451
    "url": "https://lyh-blogs.top/config.swp",
1452
    "input": "config.swp",
1453
    "scan_status": 403,
1454
    "now_status": 404,
1455
    "content_length": "350723",
1456
    "changed": "CHANGED"
1457
  },
1458
  {
1459
    "url": "https://lyh-blogs.top/configuration.php.swp",
1460
    "input": "configuration.php.swp",
1461
    "scan_status": 403,
1462
    "now_status": 404,
1463
    "content_length": "350723",
1464
    "changed": "CHANGED"
1465
  },
1466
  {
1467
    "url": "https://lyh-blogs.top/configuration.swp",
1468
    "input": "configuration.swp",
1469
    "scan_status": 403,
1470
    "now_status": 404,
1471
    "content_length": "350723",
1472
    "changed": "CHANGED"
1473
  },
1474
  {
1475
    "url": "https://lyh-blogs.top/ehthumbs.db",
1476
    "input": "ehthumbs.db",
1477
    "scan_status": 403,
1478
    "now_status": 404,
1479
    "content_length": "350723",
1480
    "changed": "CHANGED"
1481
  },
1482
  {
1483
    "url": "https://lyh-blogs.top/etc/hosts",
1484
    "input": "etc/hosts",
1485
    "scan_status": 403,
1486
    "now_status": 403,
1487
    "content_length": "542",
1488
    "changed": "same"
1489
  },
1490
  {
1491
    "url": "https://lyh-blogs.top/etc/passwd",
1492
    "input": "etc/passwd",
1493
    "scan_status": 403,
1494
    "now_status": 403,
1495
    "content_length": "542",
1496
    "changed": "same"
1497
  },
1498
  {
1499
    "url": "https://lyh-blogs.top/examples/jsp/%252e%252e/%252e%252e/manager/html/",
1500
    "input": "examples/jsp/%252e%252e/%252e%252e/manager/html/",
1501
    "scan_status": 403,
1502
    "now_status": 403,
1503
    "content_length": "542",
1504
    "changed": "same"
1505
  },
1506
  {
1507
    "url": "https://lyh-blogs.top/gallery",
1508
    "input": "gallery",
1509
    "scan_status": 200,
1510
    "now_status": 200,
1511
    "content_length": "289",
1512
    "changed": "same"
1513
  },
1514
  {
1515
    "url": "https://lyh-blogs.top/guestbook",
1516
    "input": "guestbook",
1517
    "scan_status": 200,
1518
    "now_status": 200,
1519
    "content_length": "291",
1520
    "changed": "same"
1521
  },
1522
  {
1523
    "url": "https://lyh-blogs.top/id_dsa",
1524
    "input": "id_dsa",
1525
    "scan_status": 403,
1526
    "now_status": 403,
1527
    "content_length": "542",
1528
    "changed": "same"
1529
  },
1530
  {
1531
    "url": "https://lyh-blogs.top/id_dsa.ppk",
1532
    "input": "id_dsa.ppk",
1533
    "scan_status": 403,
1534
    "now_status": 403,
1535
    "content_length": "542",
1536
    "changed": "same"
1537
  },
1538
  {
1539
    "url": "https://lyh-blogs.top/id_rsa",
1540
    "input": "id_rsa",
1541
    "scan_status": 403,
1542
    "now_status": 403,
1543
    "content_length": "542",
1544
    "changed": "same"
1545
  },
1546
  {
1547
    "url": "https://lyh-blogs.top/id_rsa.pub",
1548
    "input": "id_rsa.pub",
1549
    "scan_status": 403,
1550
    "now_status": 403,
1551
    "content_length": "542",
1552
    "changed": "same"
1553
  },
1554
  {
1555
    "url": "https://lyh-blogs.top/index.html",
1556
    "input": "index.html",
1557
    "scan_status": 200,
1558
    "now_status": 200,
1559
    "content_length": "406367",
1560
    "changed": "same"
1561
  },
1562
  {
1563
    "url": "https://lyh-blogs.top/javax.faces.resource.../",
1564
    "input": "javax.faces.resource.../",
1565
    "scan_status": 403,
1566
    "now_status": 404,
1567
    "content_length": "350723",
1568
    "changed": "CHANGED"
1569
  },
1570
  {
1571
    "url": "https://lyh-blogs.top/javax.faces.resource.../WEB-INF/web.xml.jsf",
1572
    "input": "javax.faces.resource.../WEB-INF/web.xml.jsf",
1573
    "scan_status": 403,
1574
    "now_status": 404,
1575
    "content_length": "350723",
1576
    "changed": "CHANGED"
1577
  },
1578
  {
1579
    "url": "https://lyh-blogs.top/lang/web.config",
1580
    "input": "lang/web.config",
1581
    "scan_status": 403,
1582
    "now_status": 403,
1583
    "content_length": "542",
1584
    "changed": "same"
1585
  },
1586
  {
1587
    "url": "https://lyh-blogs.top/localsettings.php.swp",
1588
    "input": "localsettings.php.swp",
1589
    "scan_status": 403,
1590
    "now_status": 404,
1591
    "content_length": "350723",
1592
    "changed": "CHANGED"
1593
  },
1594
  {
1595
    "url": "https://lyh-blogs.top/mailer/.env",
1596
    "input": "mailer/.env",
1597
    "scan_status": 403,
1598
    "now_status": 403,
1599
    "content_length": "542",
1600
    "changed": "same"
1601
  },
1602
  {
1603
    "url": "https://lyh-blogs.top/modules/web.config",
1604
    "input": "modules/web.config",
1605
    "scan_status": 403,
1606
    "now_status": 403,
1607
    "content_length": "542",
1608
    "changed": "same"
1609
  },
1610
  {
1611
    "url": "https://lyh-blogs.top/plugins/web.config",
1612
    "input": "plugins/web.config",
1613
    "scan_status": 403,
1614
    "now_status": 403,
1615
    "content_length": "542",
1616
    "changed": "same"
1617
  },
1618
  {
1619
    "url": "https://lyh-blogs.top/remote/fgt_lang?lang=/../../../../////////////////////////bin/sslvpnd",
1620
    "input": "remote/fgt_lang?lang=/../../../../////////////////////////bin/sslvpnd",
1621
    "scan_status": 403,
1622
    "now_status": 404,
1623
    "content_length": "350723",
1624
    "changed": "CHANGED"
1625
  },
1626
  {
1627
    "url": "https://lyh-blogs.top/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession",
1628
    "input": "remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession",
1629
    "scan_status": 403,
1630
    "now_status": 404,
1631
    "content_length": "350723",
1632
    "changed": "CHANGED"
1633
  },
1634
  {
1635
    "url": "https://lyh-blogs.top/robots.txt",
1636
    "input": "robots.txt",
1637
    "scan_status": 200,
1638
    "now_status": 200,
1639
    "content_length": "82",
1640
    "changed": "same"
1641
  },
1642
  {
1643
    "url": "https://lyh-blogs.top/rss",
1644
    "input": "rss",
1645
    "scan_status": 200,
1646
    "now_status": 200,
1647
    "content_length": "355519",
1648
    "changed": "same"
1649
  },
1650
  {
1651
    "url": "https://lyh-blogs.top/search",
1652
    "input": "search",
1653
    "scan_status": 200,
1654
    "now_status": 200,
1655
    "content_length": "350560",
1656
    "changed": "same"
1657
  },
1658
  {
1659
    "url": "https://lyh-blogs.top/settings.php.swp",
1660
    "input": "settings.php.swp",
1661
    "scan_status": 403,
1662
    "now_status": 404,
1663
    "content_length": "350723",
1664
    "changed": "CHANGED"
1665
  },
1666
  {
1667
    "url": "https://lyh-blogs.top/text-base/etc/passwd",
1668
    "input": "text-base/etc/passwd",
1669
    "scan_status": 403,
1670
    "now_status": 403,
1671
    "content_length": "542",
1672
    "changed": "same"
1673
  },
1674
  {
1675
    "url": "https://lyh-blogs.top/Thumbs.db",
1676
    "input": "Thumbs.db",
1677
    "scan_status": 403,
1678
    "now_status": 404,
1679
    "content_length": "350723",
1680
    "changed": "CHANGED"
1681
  },
1682
  {
1683
    "url": "https://lyh-blogs.top/thumbs.db",
1684
    "input": "thumbs.db",
1685
    "scan_status": 403,
1686
    "now_status": 404,
1687
    "content_length": "350723",
1688
    "changed": "CHANGED"
1689
  },
1690
  {
1691
    "url": "https://lyh-blogs.top/twitter/.env",
1692
    "input": "twitter/.env",
1693
    "scan_status": 403,
1694
    "now_status": 403,
1695
    "content_length": "542",
1696
    "changed": "same"
1697
  },
1698
  {
1699
    "url": "https://lyh-blogs.top/var/log/",
1700
    "input": "var/log/",
1701
    "scan_status": 403,
1702
    "now_status": 403,
1703
    "content_length": "542",
1704
    "changed": "same"
1705
  },
1706
  {
1707
    "url": "https://lyh-blogs.top/var/log/authorizenet.log",
1708
    "input": "var/log/authorizenet.log",
1709
    "scan_status": 403,
1710
    "now_status": 403,
1711
    "content_length": "542",
1712
    "changed": "same"
1713
  },
1714
  {
1715
    "url": "https://lyh-blogs.top/var/log/exception.log",
1716
    "input": "var/log/exception.log",
1717
    "scan_status": 403,
1718
    "now_status": 403,
1719
    "content_length": "542",
1720
    "changed": "same"
1721
  },
1722
  {
1723
    "url": "https://lyh-blogs.top/var/log/librepag.log",
1724
    "input": "var/log/librepag.log",
1725
    "scan_status": 403,
1726
    "now_status": 403,
1727
    "content_length": "542",
1728
    "changed": "same"
1729
  },
1730
  {
1731
    "url": "https://lyh-blogs.top/var/log/old",
1732
    "input": "var/log/old",
1733
    "scan_status": 403,
1734
    "now_status": 403,
1735
    "content_length": "542",
1736
    "changed": "same"
1737
  },
1738
  {
1739
    "url": "https://lyh-blogs.top/var/log/payment.log",
1740
    "input": "var/log/payment.log",
1741
    "scan_status": 403,
1742
    "now_status": 403,
1743
    "content_length": "542",
1744
    "changed": "same"
1745
  },
1746
  {
1747
    "url": "https://lyh-blogs.top/var/log/payment_authorizenet.log",
1748
    "input": "var/log/payment_authorizenet.log",
1749
    "scan_status": 403,
1750
    "now_status": 403,
1751
    "content_length": "542",
1752
    "changed": "same"
1753
  },
1754
  {
1755
    "url": "https://lyh-blogs.top/var/log/payment_paypal_express.log",
1756
    "input": "var/log/payment_paypal_express.log",
1757
    "scan_status": 403,
1758
    "now_status": 403,
1759
    "content_length": "542",
1760
    "changed": "same"
1761
  },
1762
  {
1763
    "url": "https://lyh-blogs.top/wavemaker/studioService.download?method=getContent&inUrl=file///etc/passwd",
1764
    "input": "wavemaker/studioService.download?method=getContent&inUrl=file///etc/passwd",
1765
    "scan_status": 403,
1766
    "now_status": 403,
1767
    "content_length": "542",
1768
    "changed": "same"
1769
  },
1770
  {
1771
    "url": "https://lyh-blogs.top/web.config",
1772
    "input": "web.config",
1773
    "scan_status": 403,
1774
    "now_status": 403,
1775
    "content_length": "542",
1776
    "changed": "same"
1777
  },
1778
  {
1779
    "url": "https://lyh-blogs.top/web.config.bak",
1780
    "input": "web.config.bak",
1781
    "scan_status": 403,
1782
    "now_status": 403,
1783
    "content_length": "542",
1784
    "changed": "same"
1785
  },
1786
  {
1787
    "url": "https://lyh-blogs.top/web.config.bakup",
1788
    "input": "web.config.bakup",
1789
    "scan_status": 403,
1790
    "now_status": 403,
1791
    "content_length": "542",
1792
    "changed": "same"
1793
  },
1794
  {
1795
    "url": "https://lyh-blogs.top/web.config.old",
1796
    "input": "web.config.old",
1797
    "scan_status": 403,
1798
    "now_status": 403,
1799
    "content_length": "542",
1800
    "changed": "same"
1801
  },
1802
  {
1803
    "url": "https://lyh-blogs.top/web.config.temp",
1804
    "input": "web.config.temp",
1805
    "scan_status": 403,
1806
    "now_status": 403,
1807
    "content_length": "542",
1808
    "changed": "same"
1809
  },
1810
  {
1811
    "url": "https://lyh-blogs.top/web.config.tmp",
1812
    "input": "web.config.tmp",
1813
    "scan_status": 403,
1814
    "now_status": 403,
1815
    "content_length": "542",
1816
    "changed": "same"
1817
  },
1818
  {
1819
    "url": "https://lyh-blogs.top/web.config::$DATA",
1820
    "input": "web.config::$DATA",
1821
    "scan_status": 403,
1822
    "now_status": 403,
1823
    "content_length": "542",
1824
    "changed": "same"
1825
  },
1826
  {
1827
    "url": "https://lyh-blogs.top/wp-config.php.swo",
1828
    "input": "wp-config.php.swo",
1829
    "scan_status": 403,
1830
    "now_status": 404,
1831
    "content_length": "350723",
1832
    "changed": "CHANGED"
1833
  },
1834
  {
1835
    "url": "https://lyh-blogs.top/wp-config.php.swp",
1836
    "input": "wp-config.php.swp",
1837
    "scan_status": 403,
1838
    "now_status": 404,
1839
    "content_length": "350723",
1840
    "changed": "CHANGED"
1841
  }
1842
]

1
python3 verify_hits.py ffuf-blog.json --delay 0.25 --out verify.json

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
"""
4
复测脚本：把扫描器报出来的每一条命中，用低速率单独再打一次，区分
5
「真命中」和「扫描压力下的假命中」。
6

7
用法:
8
    python3 verify_hits.py ffuf-blog.json --delay 0.2 --out verify.json
9

10
为什么需要它：
11
    扫描器在 40~60 req/s 的压力下，目标站点的限速/防护模块可能临时返回
12
    403/429/302。这些响应会被当成"命中"写进结果，冷却后就消失了。
13
    批量复测（单条、带间隔）是区分二者的唯一可靠办法。
14
"""
15
import argparse
16
import json
17
import ssl
18
import sys
19
import time
20
import urllib.request
21
from collections import Counter
22

23
ctx = ssl.create_default_context()
24
ctx.check_hostname = False
25
ctx.verify_mode = ssl.CERT_NONE
26

27
# 显式禁用环境变量里的代理，避免请求走到本地代理上
28
opener = urllib.request.build_opener(
29
    urllib.request.ProxyHandler({}),
30
    urllib.request.HTTPSHandler(context=ctx),
31
)
32

33

34
def probe(url, method="HEAD", timeout=10):
35
    """发一次请求，返回 (状态码, Content-Length)。异常返回 (None, 错误信息)。"""
36
    req = urllib.request.Request(url, method=method)
37
    req.add_header("User-Agent", "Mozilla/5.0 (verify_hits)")
38
    try:
39
        with opener.open(req, timeout=timeout) as r:
40
            return r.status, r.headers.get("Content-Length")
41
    except urllib.error.HTTPError as e:
42
        return e.code, e.headers.get("Content-Length")
43
    except Exception as e:
44
        return None, type(e).__name__
45

46

47
def main():
48
    ap = argparse.ArgumentParser()
49
    ap.add_argument("result_json", help="ffuf 的 -of json 输出文件")
50
    ap.add_argument("--delay", type=float, default=0.2, help="每次请求间隔秒数（默认 0.2）")
51
    ap.add_argument("--out", default="verify.json", help="复测结果输出文件")
52
    ap.add_argument("--field", default="FUZZ", help="ffuf 结果里取哪个 input 字段")
53
    args = ap.parse_args()
54

55
    data = json.load(open(args.result_json, encoding="utf-8"))
56
    hits = data.get("results", [])
57

58
    rows = []
59
    print(f"复测 {len(hits)} 条，间隔 {args.delay}s —— 约需 {len(hits) * args.delay / 60:.1f} 分钟\n")
60
    for i, r in enumerate(hits, 1):
61
        url = r["url"]
62
        scan_status = r["status"]
63
        now_status, clen = probe(url)
64
        changed = "CHANGED" if now_status != scan_status else "same"
65
        rows.append({
66
            "url": url,
67
            "input": r.get("input", {}).get(args.field, ""),
68
            "scan_status": scan_status,
69
            "now_status": now_status,
70
            "content_length": clen,
71
            "changed": changed,
72
        })
73
        if changed != "same":
74
            print(f"[{i:>3}/{len(hits)}] {scan_status} -> {now_status}  {url}")
75
        time.sleep(args.delay)
76

77
    json.dump(rows, open(args.out, "w", encoding="utf-8"), ensure_ascii=False, indent=2)
78

79
    print("\n=== 汇总 ===")
80
    print("扫描时的状态码分布:", Counter(r["scan_status"] for r in rows).most_common())
81
    print("复测时的状态码分布:", Counter(r["now_status"] for r in rows).most_common())
82
    flaky = [r for r in rows if r["changed"] != "same"]
83
    print(f"状态发生变化的条目: {len(flaky)} 条（这些就是扫描压力下的假命中）")
84
    real = [r for r in rows if r["now_status"] == 200]
85
    print(f"复测仍为 200 的真实路径: {len(real)} 条")
86
    for r in sorted(real, key=lambda x: x["url"]):
87
        print("   200", r["url"], f"(Content-Length={r['content_length']})")
88
    print(f"\n明细已写入 {args.out}")
89

90

91
if __name__ == "__main__":
92
    sys.exit(main())

对脚本进行讲解#

开头三块：docstring、导入、SSL 与代理#

1
ctx = ssl.create_default_context()
2
ctx.check_hostname = False
3
ctx.verify_mode = ssl.CERT_NONE
4

5
opener = urllib.request.build_opener(
6
    urllib.request.ProxyHandler({}),
7
    urllib.request.HTTPSHandler(context=ctx),
8
)

SSL 部分：默认上下文会校验证书链和主机名，遇到自签证书、过期证书、或者域名和证书不匹配的目标，直接抛异常。把 check_hostname 关掉、verify_mode 设成 CERT_NONE，就跳过所有校验。

代价要说清楚：这时候连接没有中间人防护，只适合自己测试用。

代理部分（重点）：

urllib 默认会读环境变量 HTTP_PROXY / HTTPS_PROXY / http_proxy / https_proxy，有就走代理。你机器上设了本地代理的话，复测请求会全部绕一圈代理出去。

绕代理的后果不是”慢一点”这么简单：

代理可能自己对请求做限速或改写，你测的就不是目标的行为
代理日志里全是你的扫描流量
某些代理会改写响应头，Content-Length 就对不上了

ProxyHandler({}) 的机制：ProxyHandler 接收一个”协议 → 代理地址”的映射表，构造时它会遍历这个表，为每个协议注册一个处理器。传空字典，等于”没有任何协议需要代理”，于是所有请求直连。

注意必须是 {} 而不是 None。ProxyHandler() 或 ProxyHandler(None) 会走默认逻辑，也就是读环境变量——反而没禁用。

build_opener(...) 把多个处理器组合成一个 opener。之后所有请求都走 opener.open()，不再用 urllib.request.urlopen()——后者用的是全局默认 opener，管不到自定义的处理器。

`probe()`：urllib 最大的坑#

1
def probe(url, method="HEAD", timeout=10):
2
    req = urllib.request.Request(url, method=method)
3
    req.add_header("User-Agent", "Mozilla/5.0 (verify_hits)")
4
    try:
5
        with opener.open(req, timeout=timeout) as r:
6
            return r.status, r.headers.get("Content-Length")
7
    except urllib.error.HTTPError as e:
8
        return e.code, e.headers.get("Content-Length")
9
    except Exception as e:
10
        return None, type(e).__name__

这里有一个和直觉完全相反的设计：

在 requests 里，requests.get() 遇到 404 也是正常返回，r.status_code 就是 404。但在 urllib 里，4xx 和 5xx 会抛 urllib.error.HTTPError 异常。

也就是说，不写 except HTTPError，脚本碰到的第一条 404 就会崩溃退出。这个差异坑过无数人。

HTTPError 虽然是异常，但它同时也是一个响应对象，所以有 .code 和 .headers，能拿到状态码和长度。这一点很多人不知道，以为异常里没有信息。

三个分支的分工：

正常返回（2xx/3xx）→ 从 r 上取状态码和长度
HTTPError（4xx/5xx）→ 从异常对象上取，这是”有意义的失败”
其他异常（超时、连接重置、DNS 失败、SSL 错误）→ 返回 (None, 异常类名)，用 None 表示”根本没拿到 HTTP 响应”，和真实的 404 区分开

type(e).__name__ 只取异常类名（比如 TimeoutError），不取完整消息，避免终端被长错误串刷屏。

with ... as r: 用上下文管理器，退出时自动关闭连接。批量请求不关连接会耗尽文件描述符。

`main()` 的四个参数#

1
ap = argparse.ArgumentParser()
2
ap.add_argument("result_json", help="ffuf 的 -of json 输出文件")
3
ap.add_argument("--delay", type=float, default=0.2, ...)
4
ap.add_argument("--out", default="verify.json", ...)
5
ap.add_argument("--field", default="FUZZ", ...)
6
args = ap.parse_args()

不带 -- 的是位置参数，必填，按顺序对应。
带 -- 的是可选参数，有默认值。
type=float 会自动把字符串 "0.25" 转成浮点数。不写 type，args.delay 就是字符串，time.sleep("0.25") 会报类型错误。
--field 是为了适配不同的 ffuf 用法：默认取 input.FUZZ，如果你用的占位符不叫 FUZZ（比如 FUZZ2），改这个参数就行。

argparse 还自动带 -h/--help，把 help= 的文字整理成帮助信息。这是比手写 sys.argv 解析更值得养成的习惯。

主循环#

1
for i, r in enumerate(hits, 1):
2
    url = r["url"]
3
    scan_status = r["status"]
4
    now_status, clen = probe(url)
5
    changed = "CHANGED" if now_status != scan_status else "same"
6
    rows.append({
7
        "url": url,
8
        "input": r.get("input", {}).get(args.field, ""),
9
        ...
10
    })
11
    if changed != "same":
12
        print(f"[{i:>3}/{len(hits)}] {scan_status} -> {now_status}  {url}")
13
    time.sleep(args.delay)

几个点：

enumerate(hits, 1) —— 同时拿到序号和元素，1 表示序号从 1 开始（默认从 0）。用于打印 [ 12/230] 这样的进度。

r["status"] 和 r.get("input", {}) 的差别 —— status 是 ffuf 每条结果必有的字段，用 [] 直接取；input 在某些情况下可能不存在，所以用 .get("input", {}) 先拿到字典（不存在就给空字典），再 .get(args.field, "") 取具体键。连续两次 .get 是”安全取嵌套字段”的标准写法，直接 r["input"]["FUZZ"] 在字段缺失时会抛 KeyError。

f"{i:>3}" —— 格式化占位：> 右对齐，3 是最小宽度。作用是让 [ 1/230] 和 [230/230] 竖直对齐，进度好看。

只打印 CHANGED —— 230 条里 198 条没变，全打出来会把重点淹没。这条”只在异常时输出”的原则，在批量脚本里很关键。

time.sleep 放在循环末尾 —— 放在开头会让第一次请求前也等一次；放末尾则是”每次请求之后歇一下”，语义更准。0.25 秒 ≈ 4 req/s，远低于扫描时的 60 req/s，这样才能复现真实状态。

落盘与汇总#

1
json.dump(rows, open(args.out, "w", encoding="utf-8"), ensure_ascii=False, indent=2)
2

3
print("扫描时的状态码分布:", Counter(r["scan_status"] for r in rows).most_common())
4
flaky = [r for r in rows if r["changed"] != "same"]
5
real = [r for r in rows if r["now_status"] == 200]
6
for r in sorted(real, key=lambda x: x["url"]):

ensure_ascii=False：默认 True 会把中文写成 \u4e2d\u6587，人能读但没法看。关掉之后中文原样写出。
indent=2：缩进两格，方便人工翻。
Counter(生成器).most_common()：先统计每个状态码出现次数，再按次数降序返回列表。读扫描结果的第一步永远是看状态码分布，比例异常的那个码就是线索。
[r for r in rows if ...]：列表推导，按条件筛。
sorted(real, key=lambda x: x["url"])：按 URL 字符串排序，key 指定”用哪个值排序”。lambda 是一个匿名函数，这里等价于”取字典的 url 字段”。

真实输出怎么读#

1
[ 92/230] 403 -> 404  https://lyh-blogs.top/.gitignore.swp
2
[126/230] 403 -> 404  https://lyh-blogs.top/.index.php.swp
3
...
4
=== 汇总 ===
5
扫描时的状态码分布: [(403, 220), (200, 10)]
6
复测时的状态码分布: [(403, 188), (404, 32), (200, 10)]
7
状态发生变化的条目: 32 条（这些就是扫描压力下的假命中）
8
复测仍为 200 的真实路径: 10 条

读法：

403 -> 404：扫描时以为”存在但被拒”，实际不存在。这是假命中。
汇总里 220 → 188 + 32：220 条 403 分成”真的 188”和”假的 32”。
复测仍为 200 才是真正需要人工看的条目。
注意”403 保持 403”不能证明文件存在，只能证明有规则在拒绝这个路径。要判断是”文件存在”还是”黑名单匹配”，得换关键词试（比如把 .env 换成 .envv，如果还是 403 就是黑名单）。

三个常见改造#

改成 GET：把 method="HEAD" 改成 "GET"。代价是要收完整 body，目标 404 页很大的话会很慢（博客那次 350KB/条）。

加自定义 header：在 probe() 里 req.add_header("Cookie", "...")。适合复测需要登录态的路径。

加速：用 concurrent.futures.ThreadPoolExecutor 并发。但要注意，并发本身就会引入限速，反而可能制造新的假命中——这就是为什么原版故意做成串行。

容易卡住的三个点#

不加 except HTTPError，第一条 404 就崩（这是 urllib 和直觉最大的冲突）。
--delay 设成 0，复测和扫描一样快，假命中照样出现，等于没测。
目标如果在复测期间把你 IP 封了，所有条目都会返回 403 或超时，看起来”全都变了”。所以复测前先手动 curl 一条确认站点正常。

230 条，1 分 11 秒跑完。输出：

1
扫描时的状态码分布: [(403, 220), (200, 10)]
2
复测时的状态码分布: [(403, 188), (404, 32), (200, 10)]
3
状态发生变化的条目: 32 条（这些就是扫描压力下的假命中）
4
复测仍为 200 的真实路径: 10 条

结论：

32 条是假的，冷却后变回 404。/Thumbs.db、/config.php.swp、/.DS_Store 全在这一批里。
188 条是真的，稳定返回 403。

那 188 条按特征归类：

152 条是点开头的隐藏文件（.env、.git、.aws、.svn、.htaccess）
12 条是 web.config 系列（含 .bak/.old/.tmp/::$DATA 变体）
8 条是 var/log/ 下的日志路径
5 条是 etc/passwd / etc/hosts 探测
4 条是 id_rsa / id_dsa 私钥探测
3 条是 .htaccess

规律很清楚：命中的都是”敏感文件名黑名单”，不是真实存在的文件。nginx 对这个名单一律回 403，而不是 404，其实是暴露了”我配了这份名单”——但代价可以忽略，加固本身是对的。

这一步的方法论：扫描器给的每一条命中都要单独复测。批量扫描的结果属于”线索”，不属于”证据”。

dirsearch 对照#

同样的字典，换 dirsearch 跑一遍对照：

1
dirsearch -u https://lyh-blogs.top/ \
2
  -w ~/.local/share/uv/tools/dirsearch/lib/python3.14/site-packages/dirsearch/db/dicc.txt \
3
  -m HEAD \
4
  -i 200,301,302,401 \
5
  -t 10 --max-rate 40 --timeout 15 --random-agent \
6
  -o dirsearch-blog.txt -O plain

输出dirsearch-blog.txt

1
# Dirsearch started at 2026-10-17 17:10:31 as: /Users/liyuhang/.local/bin/dirsearch -u https://lyh-blogs.top/ -w /Users/liyuhang/.local/share/uv/tools/dirsearch/lib/python3.14/site-packages/dirsearch/db/dicc.txt -m HEAD -i 200,301,302,401 -t 10 --max-rate 40 --timeout 15 --random-agent -o dirsearch-blog.txt -O plain
2
200  394KB https://lyh-blogs.top/2  (24ms)
3
200  387KB https://lyh-blogs.top/3  (76ms)
4
200  343KB https://lyh-blogs.top/404.html  (17ms)
5
200  345KB https://lyh-blogs.top/about  (21ms)
6
200  365KB https://lyh-blogs.top/archive  (20ms)
7
200   289B https://lyh-blogs.top/gallery  (20ms)
8
200   291B https://lyh-blogs.top/guestbook  (20ms)
9
200  397KB https://lyh-blogs.top/index.html  (22ms)
10
200    82B https://lyh-blogs.top/robots.txt  (71ms)
11
200  347KB https://lyh-blogs.top/rss  (31ms)
12
200  342KB https://lyh-blogs.top/search  (37ms)

参数说明：

-m HEAD：指定方法，默认是 GET。
-i 200,301,302,401：状态码白名单。这里故意不包含 403，因为已经知道那 188 条是规则噪音。
-x：黑名单，-i 是白名单，二选一。
-O plain：输出格式。老版本叫 --format=plain，新版是 -O。
--max-rate 40：限速。

另外两个坑：

dirsearch 会自动加后缀。字典 9681 行，它加载成 12296 条，因为它默认给每个词都试一遍 php/asp/aspx/jsp/html/htm。不想要就显式指定 -e。
同样是 HEAD，长度字段含义不同。dirsearch 显示的是 Content-Length（从响应头读），ffuf 显示的是实际收到的 body 长度。所以 ffuf 全是 0，dirsearch 能显示 394KB。

结果：

1
200  394KB https://lyh-blogs.top/2
2
200  387KB https://lyh-blogs.top/3
3
200  343KB https://lyh-blogs.top/404.html
4
200  345KB https://lyh-blogs.top/about
5
200  365KB https://lyh-blogs.top/archive
6
200   289B https://lyh-blogs.top/gallery
7
200   291B https://lyh-blogs.top/guestbook
8
200  397KB https://lyh-blogs.top/index.html
9
200    82B https://lyh-blogs.top/robots.txt
10
200  347KB https://lyh-blogs.top/rss
11
200  342KB https://lyh-blogs.top/search

11 条，和 ffuf 的 10 条基本一致，多了个 /404.html（Astro 的 404 页面被构建成了静态文件）。两个工具互相印证，说明这次扫描没有漏报。

结论#

10 条真实路径，逐条看：

/ 和 /index.html：首页，同一份文件两种访问方式
/2、/3：分页，说明文章列表有分页
/about、/archive、/gallery、/guestbook、/search、/rss：正常的页面导航
robots.txt：82 字节，就是上面看的那份

注意到 /gallery 只有 289 字节、/guestbook 只有 291 字节——不是完整页面，是占位或空壳页。这类”200 但没内容”的响应，在扫描结果里要单独拎出来看，不能算作”发现了功能”。

安全角度的结论：

没有 *.bak、*.zip、.git/、config.php 之类的东西泄露
敏感文件名统一 403，规则生效
404 返回真 404，没有暴露目录结构
唯一可优化点：403 而不是 404，会让扫描者知道”你配了黑名单”。想更隐蔽可以改成 return 404

参数速查#

ffuf 常用：

-u 目标 URL，FUZZ 是占位符
-w 字典，-X 方法
-mc 保留状态码，-fc 排除状态码
-fs 按响应长度过滤（软 404 时用）
-mr 按响应内容正则匹配
-ac 自动校准（自动探测软 404 特征）
-rate 全局限速，-t 并发，-timeout 超时
-H 加 header，-b 加 cookie
-of json -o 结构化输出，-s 静默

dirsearch 常用：

-u 目标，-w 字典，-e 后缀列表
-m HTTP 方法
-i 状态码白名单，-x 黑名单
-t 线程，--max-rate 限速
-r 递归，--recursion-status 允许递归的状态码
-o 输出文件，-O 输出格式
--random-agent 随机 UA

一些必须知道的坑#

不摸 404 行为就开扫。软 404 的站点会让你得到几千条假 200。
不算带宽就开扫。本例 9681 条 × 350KB ≈ 3.4 GB，会把自己的站打死。先用 HEAD。
把 403 当成”文件存在”。本例 220 条 403 里 32 条是限速噪音，188 条是黑名单，没有一条是真实文件。
不清代理环境变量。请求会走本地代理，速度慢、日志脏、还可能被上游限速。
不存结构化输出。只有终端输出就没法统计、没法复测、没法对比两次扫描。

下次怎么用（清单）#

扫自己站点的固定流程：

看 robots.txt 和 sitemap，先拿”招供”的路径
随机两条不存在路径，确认 404 行为（真 404 / 软 404 / 通配 200）
量一下 404 页大小，决定要不要用 HEAD
清代理变量，-rate 设 30~60，-t 设 10
跑 ffuf，-of json 存档
用脚本统计状态码分布，先看比例异常的那个码
对每一条命中单独复测（verify_hits.py），剔掉不可复现的
用 dirsearch 换一套字典和参数交叉验证
最后人工打开那几条 200，判断是”真页面”还是”空壳”

一句话总结：扫描器只负责产生线索，可信度要靠复测、交叉验证和人工判断来建立。

音乐

音乐

这篇文章对应第一次挖洞那篇的Tips，在用ai探测的便利下，我还是要去学习探测工具的使用#

先看实战结论#

两个工具的分工#

使用过程#

先看 robots.txt 和 sitemap#

摸清 404 行为#

算带宽预算（本例最大的坑）#

ffuf 完整命令#

读结果——230 条怎么变成 10 条#

复测——本次最重要的一步#

对脚本进行讲解#

开头三块：docstring、导入、SSL 与代理#

`probe()`：urllib 最大的坑#

`main()` 的四个参数#

主循环#

落盘与汇总#

真实输出怎么读#

三个常见改造#

容易卡住的三个点#

dirsearch 对照#

结论#

参数速查#

一些必须知道的坑#

下次怎么用（清单）#

文章分享

音乐

文章目录

音乐

音乐

用 ffuf 和 dirsearch 扫自己的站点：一次完整实战

这篇文章对应第一次挖洞那篇的Tips，在用ai探测的便利下，我还是要去学习探测工具的使用#

先看实战结论#

两个工具的分工#

使用过程#

先看 robots.txt 和 sitemap#

摸清 404 行为#

算带宽预算（本例最大的坑）#

ffuf 完整命令#

读结果——230 条怎么变成 10 条#

复测——本次最重要的一步#

对脚本进行讲解#

开头三块：docstring、导入、SSL 与代理#

probe()：urllib 最大的坑#

main() 的四个参数#

主循环#

落盘与汇总#

真实输出怎么读#

三个常见改造#

容易卡住的三个点#

dirsearch 对照#

结论#

参数速查#

一些必须知道的坑#

下次怎么用（清单）#

文章分享

音乐

文章目录

`probe()`：urllib 最大的坑#

`main()` 的四个参数#