edoardottt / scilla

Information Gathering tool - DNS / Subdomains / Ports / Directories enumeration
https://edoardottt.com/
GNU General Public License v3.0
946 stars 114 forks source link

Wonderful project! and here are some Optimized points #144

Open ghost opened 6 months ago

ghost commented 6 months ago

It's my frist time to ask any body to improve thier project,Because I really enjoy this project,and I also want some one to enjoy this project like me. I love scilla's subdomain module,some funcations are unique from others,but I don't master golang,so I can't modify it myself,I hope you don't mind me.Thank you for open source this and here are my sincere suggestions:

  1. Performance (1) When scilla run dns alive modules,It should allow user to set the Number of concurrencies and retry,Because Sometimes unstable network environment may cost the result not so complete,and we can't do that scan again. (2) Sometime firewall will ban your request,so if possiable,When response is as same as the one before or the title is same as the one before,It may mark them with the same color, and if too much response are all baned,it should be folded or stopped
  2. Functions (1) When scilla run dns alive modules,It may have an option to choose if redirect to some domains that is target or not,most time we don't have to ignore those domains that is not our targets,but some time we may need that for some reasons..
    (2) While http request those subdomains,you may want to know it's fingerprint,that will make you find out something juicy quickly.

Those are some great scanning tools may give you some reference

kscan: fingerprint identifiy tools https://github.com/shadow1ng/fscan fscan: LAN killer https://github.com/lcvvvv/kscan

edoardottt commented 6 months ago

Hi @LDZ-27 ! Thank you so much for your contribution. I love the words you spent for scilla, appreciated!

For point 1.1, I think this is easily achievable using ratelimit package by uber. I don't know if it's possible to do 1.2, it looks like really tough to implement. I'm not understading points 2.1 and 2.2 to be honest :/

In the meanwhile, points 1.1 and 1.2 could be created as separate issues. Then if someone want to start work on them could open a PR :)

ghost commented 6 months ago

Thank you for listenning my advice,here is my additional information about point 2.1,scilla dns alive module will check the status code of each subdomains,but some firewall or cdn will redirect the http request to different root domains and those response cause many unavailable subdomains return a status code that seems available,so if add a option to choose whether to redirect to some root domain that is not the one we input,we can make the scan result more exact; and for point 2.2,as we did catch the status code and show it to user,we can catch more infomation about the subdomains,if we only talk about the web server,we can use some fingerprint bank to filter key infomation from response such as the server is running tomcat,the application is wordpress,or the title,ico hash... while that will make us see those key infomcation simpler,and if some firewall ban our request,such as cloudflare,we can see that server is cloudflare and most of othose request length are similar and title are the same,if possible,mark all those subdomains which have similar response ,will make us more efficient and delightful. for the two point I recommend you kscan and fscan,they are very famous chinese hacker's infomation gather tool which are really efficient and powerful,and kscan's fingerprint scan are great.I really enjoy scilla and Thank you.

edoardottt commented 6 months ago

I've checked and tbh I understand that the alive dns check checks if a response is received, the response isn't checked. So As far as I can understand point 2.1 is useless. For point 2.2, this can be achieved piping scilla to other tools (like csprecon, favirecon etc.. )