Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(scan): rework the alive endpoint and redirection operation #96

Merged
merged 3 commits into from
Jun 8, 2024

Conversation

psyray
Copy link
Contributor

@psyray psyray commented Jun 8, 2024

Fix #7 #14

With this PR reNgine-ng scans will work really better.
Check the issues for more details about the bug.

Now an endpoint is considered as alive if an HTTP status code exists and is > 0.
This prevent a lot of problems while running scan because in the current state if an endpoint returns 40x or 50x code, it will not be scanned.
This modification also correctly set the is_default state of the root endpoint of the subdomain that is the base of all the active scan (ffuf, nuclei ...)

There's also a problem with 301 and 302 status code.
In reNgine-ng, HTTPx was set to follow redirect by default, this creates bugs of scan not launched because the URL of the redirection is not the same as the scanned URL.
So I've switched the default value to False. To follow redirections, you must use the --follow-redirection parameter in your http_crawl section of your scanEngine configuration.

I've fixed also small bugs that I've found while testing all the scanEngine concerned by this PR:

  • Removed console.log dump that eat CPU in front because they are huge and contains recursive values
  • Fix unintended subdomain creation while Nuclei is running

Tested in all target and subdomain scan.

@psyray psyray added the bug Something isn't working label Jun 8, 2024
@psyray psyray requested a review from AnonymousWP June 8, 2024 02:23
@psyray psyray self-assigned this Jun 8, 2024
@AnonymousWP AnonymousWP linked an issue Jun 8, 2024 that may be closed by this pull request
1 task
@AnonymousWP AnonymousWP merged commit e3112c6 into master Jun 8, 2024
@AnonymousWP AnonymousWP deleted the fix-14-detect-alive-host branch June 8, 2024 08:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging this pull request may close these issues.

bug: Detection of alive hosts bug: Scan not starting when subdomain is_default is set to False
2 participants