search

OWASP / joomscan

OWASP Joomla Vulnerability Scanner Project https://www.secologist.com/
https://www.secologist.com/open-source-projects
GNU General Public License v3.0
1.06k stars 242 forks source link

Https protocol module checks #16

Closed pes-soft closed 6 years ago

pes-soft commented 6 years ago

This PR fixes #15 If HTTPS protocol for LWP is missing and target uses HTTPS, error message is displayed and tool exits. The same occurs when update check is requested. GitHub uses HTTPS now, so update check uses HTTPS links now ( to avoid unnecessary redirects ). Verification of hostname has been not disabled ( update source should have matching hostname with HTTPS certificate ).

Ali-Razmjoo commented 6 years ago

Hello,

Thank you for your contribution, could you please check the target if it's https:// then use this condition. if (not can_https && target is https). it would be better if users do not have https library and want to scan http.

Best Regards.

@rezasp Please review.

pes-soft commented 6 years ago

Hi, Check of https has been done in original commits of this PR, but I've reviewed it a bit and now check for HTTPS module is done only when target starts with https:// as suggested. Thanks.

rezasp commented 6 years ago

Hello,

Thank you for your contribution, PR Merged.

Best Regards.