Wrong Format of URL Detected

[amiremami]

Wrong Format of URL Detected

[stryker2k2]

I am just glancing quickly to see where I would start on his adventure.

Are you thinking that, for the first line "HTTP_RESPONSE" in the first snippet, that the url of "https://irmaservices.nps.gov/arcgis/rest/%E2%80%9Dhttps:/www.nps.gov/lib/bootstrap/3.3.2/css/nps-bootstrap.min.css%22" is the wrong format?

If so, then... yes... I would agree.

After throwing that string into a URL Decoder, I get...

"https://irmaservices.nps.gov/arcgis/rest/”https:/www.nps.gov/lib/bootstrap/3.3.2/css/nps-bootstrap.min.css""

The URL Encoded string of %E2%80%9D and %22 are both equivilant to ". So, either we need to account for that on our end. or there is something fishy with your bbot -t target.txt text file. But, that's just me glancing at this and thinking out loud.

Has it happened since? Do you have a debug.log that correlates with those snippets? I tried grepping through that debug.log but I couldn't find %E2%80%9D anywhere.

After thought (thanks to Paul):
The "module_sequence" is "httpx"... so that concatenation of those urls would be on our side. I'll dive into it.

[amiremami]

@stryker2k2 thank you so much 🙏 You can find these in output.ndjson which I uploaded here:

https://drive.proton.me/urls/8KTKPZ8D04#MNYh5yfHn2IM

[liquidsec]

Hey @amiremami , were you running paramminer on that scan?

[amiremami]

Hey : ) Yes, here is my debug.log if it's useful.
debug.log

[TheTechromancer]

This may be a symptom of the recursive decoding we're doing prior to URL excavation.