A Status code 200 is wrong

[jedai47]

Here if you try with this https://reptox.cnesst.gouv.qc.ca/bin/admin_backup/catall.aspx we got a line with:
200,101017 --> https://reptox.cnesst.gouv.qc.ca -H X-rewrite-url: /bin/admin_backup/catall.aspx

in fact when i go over it in burp I actually got a 302 redirect. Any idea how or why ?

[jedai47]

You should remove the L from the -iL so it doesnt follow the redirect

[iamj0ker]

Hi @jedai47,
the reason for adding follow redirection is because, when we try most bypasses. There is a chance of redirecting back to same page. In such conditions all responses will be 302 with almost same length. So we would need to manually reverify that. If it follow redirection automatically, it is easy for the user to distinguish the responses.