search

codingo / Reconnoitre

A security tool for multithreaded information gathering and service enumeration whilst building directory structures to store results, along with writing out recommendations for further testing.
GNU General Public License v3.0
2.11k stars 456 forks source link

Fix python 3.6 compat issue with subprocess.Popen keyword arguments && creating helper function 'run_scan' to create a subprocess, moving subprocess logic to helper. #112

Closed tonydelanuez closed 5 years ago

tonydelanuez commented 5 years ago

This allows us to change the configuration/arguments supplied to scans in one place, rather than for every single scan.

This PR also fixes the issue with the "text" keyword argument to subprocess.check_output by using the backwards-compatible universal_newlines keyword argument.

@tlavoie Would you mind reviewing this as well?

codingo commented 5 years ago

I'm going to merge this, largely because this is a beginners project intended to cover mass usage, and not having this functionality being more universal does push against that.

For more perspective - this is an older project of mine. After the success of Reconnoitre there's been a crazy number of similar projects to do the same thing. When considering where Reconnoitre should lead and how I should improve it to stay on the "cutting edge" I ultimately decided - this is a bad approach once you're a pentester.

When I'm pentesting I need flexibility, and I need a workflow that alters for the job. No product doing what Reconnoitre is doing can offer that, and for that reason I teamed up with @prodigysml and we authored https://github.com/codingo/Interlace.

My intention isn't to rewrite the threading here, but to instead make an Interlace command file showing how it replaces Reconnoitre and adds enough flexibility to make it more professional grade for testing outside of just the OSCP.

Interlaces _blocker and _block_ handle the sub tasks problem very elegantly, and I encourage reading through the full readme if automating your workflow is key. I'll continue maintaining Reconnoitre in the meantime, but I don't believe this kind of an approach (including the variants of similar automation that spawned off this) should be hard coded, and the highly variable nature of a customisable command file is what is more needed, and where the majority of my time will go into improving upon.

codingo commented 5 years ago

Also please don't get me wrong, I greatly appreciate the pull request and value the work you both put into this.