search

SamJoan / droopescan

A plugin-based scanner that aids security researchers in identifying issues with several CMSs, mainly Drupal & Silverstripe.
GNU Affero General Public License v3.0
1.27k stars 249 forks source link

An errors occurs while scanning a file not detecting #57

Closed XswoTman closed 2 years ago

XswoTman commented 2 years ago

I installed by using pip & manually cloning both have same type of error.

droopescan scan --help command works.

While using command not works ( droopescan scan drupal -u https://url/ )

It gives following error without executing :-

[+] Known drupal folders have returned 404 Not found. If a module does not have a LICENSE.txt file it will not be detected.

Can anyone explain why the error occurred?????

SamJoan commented 2 years ago

hi @masterwireshark

Thanks for filing an issue.

I can definitely explain why this warning message occurs. We generally identify known modules by making an HTTP request to a particular URL at which we presume a module may be present. For example /sites/all/modules/module_name/. Before sending thousands of requests in this manner however, droopescan checks whether the target server is configured to return 404 errors on known folders to avoid wasting time if we know it won't be successful.

In the case of your scan, this condition is true, the target server is configured to return 404 errors on known folders. The scanner then fallbacks to requesting LICENSE.txt, but this file may not be present for all plugins. The warning is issued so that you can be aware there may be potential false negatives in this plugin scan due to this.

Thanks, Sam