Open ghost opened 6 months ago
Hi @LDZ-27 ! Thank you so much for your contribution. I love the words you spent for scilla, appreciated!
For point 1.1, I think this is easily achievable using ratelimit package by uber. I don't know if it's possible to do 1.2, it looks like really tough to implement. I'm not understading points 2.1 and 2.2 to be honest :/
In the meanwhile, points 1.1 and 1.2 could be created as separate issues. Then if someone want to start work on them could open a PR :)
Thank you for listenning my advice,here is my additional information about point 2.1,scilla dns alive module will check the status code of each subdomains,but some firewall or cdn will redirect the http request to different root domains and those response cause many unavailable subdomains return a status code that seems available,so if add a option to choose whether to redirect to some root domain that is not the one we input,we can make the scan result more exact; and for point 2.2,as we did catch the status code and show it to user,we can catch more infomation about the subdomains,if we only talk about the web server,we can use some fingerprint bank to filter key infomation from response such as the server is running tomcat,the application is wordpress,or the title,ico hash... while that will make us see those key infomcation simpler,and if some firewall ban our request,such as cloudflare,we can see that server is cloudflare and most of othose request length are similar and title are the same,if possible,mark all those subdomains which have similar response ,will make us more efficient and delightful. for the two point I recommend you kscan and fscan,they are very famous chinese hacker's infomation gather tool which are really efficient and powerful,and kscan's fingerprint scan are great.I really enjoy scilla and Thank you.
I've checked and tbh I understand that the alive dns check checks if a response is received, the response isn't checked. So As far as I can understand point 2.1 is useless. For point 2.2, this can be achieved piping scilla to other tools (like csprecon, favirecon etc.. )
It's my frist time to ask any body to improve thier project,Because I really enjoy this project,and I also want some one to enjoy this project like me. I love scilla's subdomain module,some funcations are unique from others,but I don't master golang,so I can't modify it myself,I hope you don't mind me.Thank you for open source this and here are my sincere suggestions:
(2) While http request those subdomains,you may want to know it's fingerprint,that will make you find out something juicy quickly.
Those are some great scanning tools may give you some reference
kscan: fingerprint identifiy tools https://github.com/shadow1ng/fscan fscan: LAN killer https://github.com/lcvvvv/kscan