search

evilsocket / xray

XRay is a tool for recon, mapping and OSINT gathering from public networks.
GNU General Public License v3.0
2.21k stars 299 forks source link

Bugfix and minor improvements #17

Closed stefanoj3 closed 7 years ago

stefanoj3 commented 7 years ago

I simplified a bit some code in http grabber and fixed something that seems to be a bug.

Also I smell that there is chance of race conditions since you access directly from multiple threads variables of the Target struct, check usage of mutex if you haven't discovered them yet: mutex

evilsocket commented 7 years ago

Could you please be a little bit more descriptive? What bug did u fix exactly?

Also, yeah I know the code is not perfect ( that's why 1.0.0b ), and thanks, I know about mutexes and how they work if you take a look at the rest of the code.

stefanoj3 commented 7 years ago

Regarding the bug, if you check http_grabber.go:166 you see you are letting the 8080 pass the validation, but then later on you decide, based on the port, which protocol to use http/https, but the 8080 is ignored at this point, meaning that if you enter the method with 8080 you will produce an invalid url and of course the call will fail (check the first commit in the PR)

I see you are using mutexes around the codebase, but for example the variable Banners is not protected against concurrent write/read, you are writing on constant keys, so it should not happen to write concurrently on the same, but I would not rely to much on it IMHO at least would be good to have methods exposed from the target struct to write/read on it, so later on you can easily introduce mutex if it's needed, and make unexported the properties, so all the grabbers have to pass through methods for reading and writing data