re.error: bad escape \w at position 2

[thistehneisen]

➜  dotdotslash git:(master) ✗ python3 dotdotslash.py -u https://[truncated]/api/v1/DOTDOT --string DOTDOT -v
         _       _         _       _         _           _
      __| | ___ | |_    __| | ___ | |_   ___| | __ _ ___| |__
     / _` |/ _ \| __|  / _` |/ _ \| __| / __| |/ _` / __| '_ \
    | (_| | (_) | |_  | (_| | (_) | |_  \__ \ | (_| \__ \ | | |
     \__,_|\___/ \__|  \__,_|\___/ \__| |___/_|\__,_|___/_| |_|

    Automated Path Traversal Tester
    version 0.0.9
    Created by Julio Cesar Stefanutto (@jcesarstef)

    Starting run in: https://[truncated]/api/v1/DOTDOT

[+] Depth: 0
/usr/local/lib/python3.10/site-packages/urllib3/connectionpool.py:1045: InsecureRequestWarning: Unverified HTTPS request is being made to host '[truncated]'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings
  warnings.warn(
[500] https://[truncated]/api/v1/coot.ini
Traceback (most recent call last):
  File "/usr/local/Cellar/[email protected]/3.10.6_2/Frameworks/Python.framework/Versions/3.10/lib/python3.10/sre_parse.py", line 1051, in parse_template
    this = chr(ESCAPES[this][1])
KeyError: '\\w'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/nils.putnins/Code/Python/dotdotslash/dotdotslash.py", line 114, in <module>
    forloop()
  File "/Users/nils.putnins/Code/Python/dotdotslash/dotdotslash.py", line 61, in forloop
    fullrewrite = re.sub(arguments.string, rewrite, arguments.url)
  File "/usr/local/Cellar/[email protected]/3.10.6_2/Frameworks/Python.framework/Versions/3.10/lib/python3.10/re.py", line 209, in sub
    return _compile(pattern, flags).sub(repl, string, count)
  File "/usr/local/Cellar/[email protected]/3.10.6_2/Frameworks/Python.framework/Versions/3.10/lib/python3.10/re.py", line 326, in _subx
    template = _compile_repl(template, pattern)
  File "/usr/local/Cellar/[email protected]/3.10.6_2/Frameworks/Python.framework/Versions/3.10/lib/python3.10/re.py", line 317, in _compile_repl
    return sre_parse.parse_template(repl, pattern)
  File "/usr/local/Cellar/[email protected]/3.10.6_2/Frameworks/Python.framework/Versions/3.10/lib/python3.10/sre_parse.py", line 1054, in parse_template
    raise s.error('bad escape %s' % this, len(this))
re.error: bad escape \w at position 2

[n0kovo]

Getting the same error in python 3.7.13, 3.8.13, 3.9.13 and 3.10.5.

[Antonboom]

+1

[mon]

The dict keys in match.py are being interpreted as regex, the string: "c:\windows\system32\drivers\hosts" has the \w that is causing the error.

I fixed it by just replacing line 61 of dotdotslash.py from:
fullrewrite = re.sub(arguments.string, rewrite, arguments.url)
to:
fullrewrite = arguments.url.replace(arguments.string, rewrite)