Repository navigation
Relaxing final negative match #29
Description
In rare cases (particularly involving Jakarta), CFM files can be loaded on IIS using their short (8.3) filenames. This behavior causes issues for shortscan.
It would be helpful to have an option to relax the final negative match. With this adjustment, the following debug message would no longer appear, and the final match would instead be included in the results:
DEBUG Possible hit, but status is the same as a negative match filename="USERAC~1.CFM/" status=200 statusNeg=20
Activity
[-]Relaxing Final Negative Match[/-][+]Relaxing final negative match[/+]irsdl commentedon Oct 21, 2025
I was thinking that when such flag has been implemented, it can still perform the check but raise those pages as tentative/potential rather than fully confirmed.
irsdl commentedon Oct 22, 2025
I have added this features as well as other PR improvements in https://github.com/irsdl/shortscan/ using AI if you need an example how this can be done.