fix(scan): rework the alive endpoint and redirection operation #96
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fix #7 #14
With this PR reNgine-ng scans will work really better.
Check the issues for more details about the bug.
Now an endpoint is considered as alive if an HTTP status code exists and is > 0.
This prevent a lot of problems while running scan because in the current state if an endpoint returns 40x or 50x code, it will not be scanned.
This modification also correctly set the
is_default
state of the root endpoint of the subdomain that is the base of all the active scan (ffuf, nuclei ...)There's also a problem with 301 and 302 status code.
In reNgine-ng, HTTPx was set to follow redirect by default, this creates bugs of scan not launched because the URL of the redirection is not the same as the scanned URL.
So I've switched the default value to False. To follow redirections, you must use the
--follow-redirection
parameter in your http_crawl section of your scanEngine configuration.I've fixed also small bugs that I've found while testing all the scanEngine concerned by this PR:
Tested in all target and subdomain scan.