RedSiege / EyeWitness

EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.
https://www.christophertruncer.com/eyewitness-usage-guide/
GNU General Public License v3.0
5.01k stars 849 forks source link

white/blank screenshot during render race condition #630

Closed Relkci closed 10 months ago

Relkci commented 1 year ago

OS Used - ALL Information (architecture, linux flavor, etc.)

Kali

Expected behavior (vs. what you encountered)

Expected: URL in browser renders webapp interface Actual: Screenshot is solid white/blank

EyeWitness (Selenium) appears to capture the image prior to the browser fully rendering the image. My belief is that this will happen on any webapp that uses js/css to pause the initial paint, even if all sub-requests are technically already fulfilled. 

Fix:

I prepped a fix for this already, effectively checking the mean of the pixels. If =255 (only white pixels), python is instructed to wait a couple seconds for selenium to finish the render and then re-capture the page.

I found this resolves alot of the "blank" screenshots seen, especially from ESXi -- or anything else that has a programmatic wait on render via CSS, etc.

https://github.com/Relkci/EyeWitness/blob/ImageRaceCondition/Python/modules/selenium_module.py

The fix relies on opencv and numpy -- which would add to the dependencies -- there may be another way around this. If you want me to PR, let me know, the setup.sh would need updated as well. (prints included to explain, should be removed)

selenium_module.py ~ top

import cv2
import numpy as np
import time

selenium_module.py ~ line 195

# Save our screenshot to the specified directory
    try:
        driver.save_screenshot(http_object.screenshot_path)
        if np.mean(cv2.imread(http_object.screenshot_path)) == 255:
            print ('----->Image is empty.  Waiting and trying again')
            time.sleep(3)
            driver.save_screenshot(http_object.screenshot_path)
        else:
            print ('image was not empty')

Issue: image

Fixed: image

0x6d6f7468 commented 10 months ago

I've talked about this with Kent offline, I think this is a cool solution but I'm a bit wary of adding Numpy to the dependencies/projects as it's a pretty hefty import. This might be a non-issue if we just specifically import mean from numpy, I'd have to look.

Alternatively, I was looking at Selenium options and I think there might be a built-in way to accomplish this. Needs research and testing. Stay tuned.

digininja commented 10 months ago

I've had this issue but just increase the wait time with the command line parameter, that usually fixes it for me.

On Wed, 10 Jan 2024, 20:22 moth, @.***> wrote:

I've talked about this with Kent offline, I think this is a cool solution but I'm a bit wary of adding Numpy to the dependencies/projects as it's a pretty hefty import. This might be a non-issue if we just specifically import mean from numpy, I'd have to look.

Alternatively, I was looking at Selenium options and I think there might be a built-in way to accomplish this. Needs research and testing. Stay tuned.

— Reply to this email directly, view it on GitHub https://github.com/RedSiege/EyeWitness/issues/630#issuecomment-1885659611, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAA4SWNPCZ2GIMHUL7OIUM3YN32B3AVCNFSM6AAAAAA74WOJ22VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQOBVGY2TSNRRGE . You are receiving this because you are subscribed to this thread.Message ID: @.***>

Relkci commented 10 months ago

That fix actually works. Its not conditional based on the render but is already prepared and doesn't require additional dependencies. balancing those two out and I'd rather not worry about more dependencies

0x6d6f7468 commented 10 months ago

Yeah I was thinking we could maybe add something to the retry logic that adds a small delay and retries screenshots, but that introduces a whole bunch of issues and it might be best that we make the user to season their commands to taste.

Happy to revisit this if there's any objections. Closing.