blacklanternsecurity / bbot

A recursive internet scanner for hackers.
https://www.blacklanternsecurity.com/bbot/
GNU General Public License v3.0
4.42k stars 393 forks source link

Emit Reflection True of Paramminer as Finding #1566

Open Sh4d0wHunt3rX opened 1 month ago

Sh4d0wHunt3rX commented 1 month ago

It seems for Reflection True of Paramminer module, no Finding is emitting:

{"type": "WEB_PARAMETER", "id": "WEB_PARAMETER:c71eeadf1f1f964e4357e8fa7010e224de414f50", "scope_description": "in-scope", "data": {"host": "qa-author-dam.delltechnologies.com", "url": "https://qa-author-dam.delltechnologies.com/", "type": "HEADER", "description": "[Paramminer] Header: [x-forwarded-port] Reasons: [code,header,body] Reflection: [True]", "name": "x-forwarded-port"}, "host": "qa-author-dam.delltechnologies.com", "resolved_hosts": ["143.166.68.105"], "dns_children": {"A": ["143.166.68.105"]}, "web_spider_distance": 0, "scope_distance": 0, "scan": "SCAN:ee17a4d00020dab4d624fcfdd5b075441bca750d", "timestamp": 1720623840.376556, "parent": "HTTP_RESPONSE:4a57f6eecb3481b1da7712459405917c23474816", "tags": ["http-reflection", "in-scope"], "module": "paramminer_headers", "module_sequence": "paramminer_headers", "discovery_context": "paramminer_headers scanned https://qa-author-dam.delltechnologies.com/ and identified WEB_PARAMETER: reflected header parameter: \"x-forwarded-port\"", "discovery_path": ["Scan 2024-07-10_18-41-56 seeded with DNS_NAME: delltechnologies.com", "hackertarget searched hackertarget API for \"delltechnologies.com\" and found DNS_NAME: qa-author-dam.delltechnologies.com", "portscan executed a TCP SYN scan against qa-author-dam.delltechnologies.com and found: OPEN_TCP_PORT: qa-author-dam.delltechnologies.com:443", "httpx visited qa-author-dam.delltechnologies.com:443 and got status code 302 at https://qa-author-dam.delltechnologies.com/", "HTTP_RESPONSE was 0B with unspecified content type", "paramminer_headers scanned https://qa-author-dam.delltechnologies.com/ and identified WEB_PARAMETER: reflected header parameter: \"x-forwarded-port\""]}

That would be great emit finding for reflection true. 🙏

liquidsec commented 1 month ago

Since web_parameters are hidden by default, I agree it might be useful to issue a FINDING for reflection. I will give it a try and make sure its not overwhelming spam