search

davtur19 / DotGit

An extension for checking if .git is exposed in visited websites
GNU General Public License v3.0
368 stars 32 forks source link

Issue with security.txt #16

Closed rayabee closed 4 weeks ago

rayabee commented 1 month ago

Hi,

Love this project as a whitehat hacker.

I uploaded a security.txt (blank file) on one of my domains to check if I get an alert, but it did not alert me. I then added some text to the file, so it's not 0kb, but also no alert.

Am I doing something wrong with testing or might this be a bug?

Keep up the good work.

p.s. I read it's possible to get an audio alert, how do i set this up?

Ray

davtur19 commented 1 month ago

I don't think you understand what the extension is for.

The extension is for finding .git/.hg/.svn, not for finding security.txt.

Also, if you have an empty file or one with random data, the check will fail, as it must be a valid file to avoid false positives.

So in summary, you need a valid repository and a valid security.txt file to appear in the extension.

I don't think a whitehat hacker would have any problem reading a few lines of code in JavaScript and modifying it to their liking.

As for notifications, all you need to do is set the notification sound in your browser or OS settings.

rayabee commented 1 month ago

"Check if the site has security.txt" so it doesn't check that. Too bad.

davtur19 commented 1 month ago

It only does this if the site has a vulnerability, otherwise why would it do it?