RedSiege / EyeWitness

EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.
https://www.christophertruncer.com/eyewitness-usage-guide/
GNU General Public License v3.0
5.01k stars 848 forks source link

Stalled on some web servers -url #667

Closed Relkci closed 5 months ago

Relkci commented 5 months ago

OS Used - ALL Information (architecture, linux flavor, etc.)

ubuntu

Pastebin link to error you are encountering

No error - When urllib is called to capture the request, a webserver may indefinitely hang the python process because urllib doesn't have a fallback timeout.

Expected behavior (vs. what you encountered)

if a http server accepts the connection but doesn't close, force urllib to close on a timeout error by specifying a timeout when it is called

Any additional information

Someday we'll add verbose logging to make this easier.

Anyway. urllib.request.urlopen in selenium_module.py needs the EyeWitness timeout parameter added. The indefinite hang I received was overcome by specifying a ten second timeout-- but this should be replaced with the actual parameter from cmdline or default. This causes urllib to report a connection reset or badstatus.

Code:

image

Running changes above -

Note the exit on verbose "here9e3" which indicates urllib closed with either badstatus or connection reset (likely because we forced the timeout disconnect) image

here9e3

image

The issue where webservers don't respond, or never send data and indefinitely hold the connection, might be overcome by a modification of headers, or something else. Forcing the timeout allows EyeWitness to at least complete however. An example of the indefinite (or near indefinite) connection can be seen on http://hotels.com via curl. image