search

hannob / snallygaster

Tool to scan for secret files on HTTP servers
BSD Zero Clause License
2.07k stars 228 forks source link

add check for RCS files (/RCS/*,v) #37

Closed roycewilliams closed 5 years ago

roycewilliams commented 5 years ago

This adds a simple check for ,v files in the RCS directory. If the RCS directory is not exposed, or if no ,v files are shown, the test should pass.

hannob commented 5 years ago

Is RCS still a thing? Do you have scan results giving a rough estimate if this is practically happening?

I find scanning for CVS borderline questionable already.

roycewilliams commented 5 years ago

It would indeed be relatively rare these days. I haven't done an Alexa scan or anything like that. [Edit: that being said, I have found it in the wild on more than one occasion]

And I see that that has been the goal in the discussion around other pull requests, so your philosophy may be different. I would argue that snallygaster could be useful to scan for both common and uncommon issues, but the use cases are different. It seems to me that a flag for including uncommon tests would be a great add, so that bulk testers could skip uncommon tests, but so that people doing individual tests could do a deep test.

[Edit: would you be interested in a PR that added such a flag? Or is that out of scope?]

roycewilliams commented 5 years ago

Assuming that there's no interest in this; closing.