honoki / bbrf-client

The Bug Bounty Reconnaissance Framework (BBRF) can help you coordinate your reconnaissance workflows across multiple devices
MIT License
613 stars 90 forks source link

TLD's cannot be added in the outscope #73

Closed Retr02332 closed 2 years ago

Retr02332 commented 3 years ago

Hi @honoki

I was using your application and I noticed that I could not add TLD's in the programs outscope.

For example, when I try to run this command:

bbrf outscope add *.gov www.federalreserve.gov -p FederalReserve

and then I do a:

bbrf show FederalReserve

The program returns me the following:

{"outscope":["www.federalreserve.gov"]}

It does not take into account the *.gov in the outscope, and I consider this a major bug for the application logic.

The particular bug is in the add_outscope function. As you can see its condition is made in such a way that it does not support the TLDs.

This is the condition I am referring to:

 if REGEX_DOMAIN.match(e) or e.startswith('*.') and REGEX_DOMAIN.match(e[2:]):
     changed = True
     outscope.append(e)

I took the audacity to do a local test of your implementation, and it confirms the problem that exists in the application:

>>> REGEX_DOMAIN = re.compile('^(?:[a-z0-9_](?:[a-z0-9-_]{0,61}[a-z0-9])?\\.)+[a-z0-9][a-z0-9-]{0,61}[a-z0-9]$')
>>> domain = "*.gov"
>>> print(REGEX_DOMAIN.match(domain[2:]))
None
>>> print(REGEX_DOMAIN.match(domain))
None
>>> print(REGEX_DOMAIN.match("hello.com"))
<re.Match object; span=(0, 8), match='hello.com'>
>>> print(REGEX_DOMAIN.match("*.hello.com"))
None
>>> print(REGEX_DOMAIN.match(".gov"))
None
>>> print(REGEX_DOMAIN.match("gov"))
None
>>> print(REGEX_DOMAIN.match("www.federalreserve.gov"))
<re.Match object; span=(0, 22), match='www.federalreserve.gov'>

As I said at the beginning, when I enter *.gov and www.federalreserve.gov in the outscope, only www.federalreserve.gov is added as you could see in the local experiment I did:

# So this one is added
>>> print(REGEX_DOMAIN.match("www.federalreserve.gov"))
<re.Match object; span=(0, 22), match='www.federalreserve.gov'>

# So this one is NOT added
>>> domain = "*.gov"
>>> print(REGEX_DOMAIN.match(domain[2:]))
None

I look forward to your reply, best regards.

honoki commented 2 years ago

Hi @Retr02332 - thanks for logging this issue (and please excuse my delayed response). It is true that BBRF at this point does a rudimentary check to validate if the defined scope is a domain, but does not accept whole TLDs.

I consider this to be a fair assumption for most use cases of reconnaissance programs, but I understand that this may not always suit your needs. As a workaround, note that you can always manually edit your program scope via the CouchDB server interface on https://<bbrf-server>/_utils/#database/bbrf/<program-name>. This should allow you to continue using BBRF even for a wide scope as in your example.