Closed Retr02332 closed 2 years ago
Hi @Retr02332 - thanks for logging this issue (and please excuse my delayed response). It is true that BBRF at this point does a rudimentary check to validate if the defined scope is a domain, but does not accept whole TLDs.
I consider this to be a fair assumption for most use cases of reconnaissance programs, but I understand that this may not always suit your needs. As a workaround, note that you can always manually edit your program scope via the CouchDB server interface on https://<bbrf-server>/_utils/#database/bbrf/<program-name>
. This should allow you to continue using BBRF even for a wide scope as in your example.
Hi @honoki
I was using your application and I noticed that I could not add TLD's in the programs outscope.
For example, when I try to run this command:
and then I do a:
The program returns me the following:
It does not take into account the
*.gov
in the outscope, and I consider this a major bug for the application logic.The particular bug is in the add_outscope function. As you can see its condition is made in such a way that it does not support the TLDs.
This is the condition I am referring to:
I took the audacity to do a local test of your implementation, and it confirms the problem that exists in the application:
As I said at the beginning, when I enter
*.gov
andwww.federalreserve.gov
in the outscope, onlywww.federalreserve.gov
is added as you could see in the local experiment I did:I look forward to your reply, best regards.