honoki / bbrf-client

The Bug Bounty Reconnaissance Framework (BBRF) can help you coordinate your reconnaissance workflows across multiple devices
MIT License
613 stars 90 forks source link

Odd behaviour: auto adding inscope rules while adding domains #116

Open pdelteil opened 7 months ago

pdelteil commented 7 months ago

Hello!

I have this issue on my programs: Some will have a long list of inscope rules that wasn't added to the program.

I think is due to these lines of code (here):

   # not entirely sure this will ever occur, but hey (update: it does occur, as a result of crt.sh)
            # it makes sense to do this here, because it will still check whether it is in scope
            # before extending the existing scope.
            if domain.startswith('*.'):
                domain = domain[2:]
                # if it matches the existing scope definition,
                # add this wildcard to the scope too
                if REGEX_DOMAIN.match(domain) and not self.matches_scope(domain, outscope) and self.matches_scope(domain, inscope):
                    add_inscope.append('*.'+domain)

I think that it is triggered when crt.sh gives out domains that include a *.

I would not want my inscope rules to be modified, so I will just comment this section of the code.

Thanks!