search

erwanlr / Fingerprinter

CMS/LMS/Library etc Versions Fingerprinter
Other
256 stars 47 forks source link

Add flag to accept insecure certificates #44

Closed martinbydefault closed 5 years ago

martinbydefault commented 5 years ago

Sometimes a website have expired/miss-configured/self-signed certificates and when trying to fingerprint a site, this error is shown: SSL peer certificate or SSH remote key was not OK

It would be useful to have an option to allow invalid certificates, similar to the -k flag that curl has. This pr adds this new option, let me know if: (1) Do you agree to add this feature (2) you are ok with the way I did the changes (3) or you want to do it in a different way or make some changes to the PR.

(By the way, curl itself does almost the same way I did: https://github.com/curl/curl/blob/8c1cc369d0c7163c6dcc91fd38edfea1f509ae75/src/tool_operate.c#L1153)

Thank you again for accepting issues so fast! Also I like this tool a lot.

erwanlr commented 5 years ago

Actually, the tool should not care about certificates, seems like I mixed up the ssl_verifyhost value (as the ssl_verifypeer is false).

So you can remove the option and just set https://github.com/erwanlr/Fingerprinter/blob/master/lib/fingerprinter.rb#L76 to 0 :)

Other than that, it was the perfect way to implement the option

martinbydefault commented 5 years ago

I preserved the commit with previous changes just in case (and to avoid losing track of the referenced solution in the comments). Hope that's ok.

erwanlr commented 5 years ago

Great, thx, merged!