Security-Tools-Alliance / rengine-ng

reNgine-ng is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface.
GNU General Public License v3.0
70 stars 12 forks source link

refactor: update wordlists and configuration defaults #221

Closed psyray closed 3 weeks ago

psyray commented 3 weeks ago

As reported on the Discord, dir fuzzing is very long to run and generates heavy traffic on the targeted server when using default Full scan engine. So I've changed the default dir dicc by fuzz-Bo0oM, more quick to run and which show a lot of quick findings, reduced the recursivity level to 0 and removed all the extensions.

Tested and working

Details here :

Summary by Sourcery

Update the default wordlist for directory scanning from dicc.txt to fuzz-Bo0oM.txt, reduce the recursive level to 0, and remove file extensions from the configuration. Refactor configuration files to use default wordlist names and paths for Amass and FFUF, enhancing maintainability and centralizing configuration.

Enhancements:

sourcery-ai[bot] commented 3 weeks ago

Reviewer's Guide by Sourcery

This PR optimizes directory fuzzing performance by switching to a faster wordlist and reducing scan depth. The changes include updating the default wordlist from 'dicc.txt' to 'fuzz-Bo0oM.txt', setting recursive level to 0, and removing file extensions from the configuration to reduce server load and scan duration while maintaining effective discovery capabilities.

Class diagram for updated configuration defaults

classDiagram
    class Configuration {
        +String AMASS_DEFAULT_WORDLIST_NAME = "deepmagic.com-prefixes-top50000"
        +String AMASS_DEFAULT_WORDLIST_PATH = "Path(RENGINE_WORDLISTS)"
        +String FFUF_DEFAULT_WORDLIST_NAME = "fuzz-Bo0oM"
        +String FFUF_DEFAULT_WORDLIST_PATH = "Path(RENGINE_WORDLISTS)"
        +List FFUF_DEFAULT_MATCH_HTTP_STATUS = [200, 204]
        +int FFUF_DEFAULT_RECURSIVE_LEVEL = 0
        +boolean FFUF_DEFAULT_FOLLOW_REDIRECT = false
    }

File-Level Changes

Change Details Files
Updated directory fuzzing configuration to improve performance
  • Changed default wordlist from 'dicc.txt' to 'fuzz-Bo0oM.txt'
  • Set recursive level from 2 to 0 to reduce scan depth
  • Removed all file extensions from the configuration
  • Updated command line parameters in directory scan fixtures
web/startScan/fixtures/startScan.json
web/fixtures/default_scan_engines.yaml
web/config/default_yaml_config.yaml
web/scanEngine/fixtures/scanEngine.json
Refactored wordlist configuration management
  • Added default wordlist name constants
  • Centralized wordlist path configuration
  • Updated path construction for wordlist files
web/reNgine/definitions.py
web/reNgine/tasks.py

Tips and commands #### Interacting with Sourcery - **Trigger a new review:** Comment `@sourcery-ai review` on the pull request. - **Continue discussions:** Reply directly to Sourcery's review comments. - **Generate a GitHub issue from a review comment:** Ask Sourcery to create an issue from a review comment by replying to it. - **Generate a pull request title:** Write `@sourcery-ai` anywhere in the pull request title to generate a title at any time. - **Generate a pull request summary:** Write `@sourcery-ai summary` anywhere in the pull request body to generate a PR summary at any time. You can also use this command to specify where the summary should be inserted. #### Customizing Your Experience Access your [dashboard](https://app.sourcery.ai) to: - Enable or disable review features such as the Sourcery-generated pull request summary, the reviewer's guide, and others. - Change the review language. - Add, remove or edit custom review instructions. - Adjust other review settings. #### Getting Help - [Contact our support team](mailto:support@sourcery.ai) for questions or feedback. - Visit our [documentation](https://docs.sourcery.ai) for detailed guides and information. - Keep in touch with the Sourcery team by following us on [X/Twitter](https://x.com/SourceryAI), [LinkedIn](https://www.linkedin.com/company/sourcery-ai/) or [GitHub](https://github.com/sourcery-ai).