RedSiege / EyeWitness

EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.
https://www.christophertruncer.com/eyewitness-usage-guide/
GNU General Public License v3.0
4.93k stars 843 forks source link

basic vuln checking #146

Closed digininja closed 4 months ago

digininja commented 9 years ago

I've just ran Nessus across the range I scanned earlier and something Nessus does is to throw random filenames with html and aspx extensions at the site to see how it responds. From this I've just picked up a load of IIS error pages with path disclosure (the "IIS 7.5 Detailed Error 404.0" page")

This is going beyond your current remit of just taking screenshots but it would be good if you could add it as a disabled by default option.

Thinking really big, talk to the Nikto team and see if you could use their database to get full screenshots of errors rather than just their command line output.

freeload101 commented 8 years ago

I also think that would be out of scope for this app if anything it would be nice to have a 'dupelicate' checker. see diff dupe if 2 lines or less are different https://rmccurdy.com/scripts/WEBDUMP_BURP

also off topic you could use https://github.com/percx/Praeda to include some web checks too I found just running burp or curl on all ports/ips you can get shells on A/V systems and wonky IOT devices by searching for stuff liek "command not found" regex warn|\berr|fail|unabl|can|not|fault)

I really love Eyewitness because it allows me to QUICKLY with the help of my webdump_burp to remove dupes to go though thousands of webapps and get a picture of each landing page to find targets during pentest

https://github.com/percx/Praeda

Relkci commented 4 months ago

I'm inclined to close w/o development unless anyone else has anything to add?

Regarding duplicates, we could add a hash of the source, but I feel that bringing in data from the requests into Requests.csv might address this anyway because it will be possible to sort off the Title, etc. (#652).

digininja commented 4 months ago

Fair enough, it is outside the scope for the app.

On Mon, 3 Jun 2024, 07:32 Kent Ickler, @.***> wrote:

I'm inclined to close w/o development unless anyone else has anything to add?

Regarding duplicates, we could add a hash of the source, but I feel that bringing in data from the requests into Requests.csv might address this anyway because it will be possible to sort off the Title, etc. (#652 https://github.com/RedSiege/EyeWitness/pull/652).

— Reply to this email directly, view it on GitHub https://github.com/RedSiege/EyeWitness/issues/146#issuecomment-2144381233, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAA4SWNEE3MWSPOWP6ZXQ73ZFQEYRAVCNFSM4BINVB42U5DIOJSWCZC7NNSXTN2JONZXKZKDN5WW2ZLOOQ5TEMJUGQZTQMJSGMZQ . You are receiving this because you authored the thread.Message ID: @.***>