search

mablanco / docker-osmedeus

Docker image for Osmedeus, a fully automated offensive security tool for reconnaissance and vulnerability scanning
GNU General Public License v3.0
100 stars 22 forks source link

Amass fails to run with defaults #13

Closed DefenceLogic closed 4 years ago

DefenceLogic commented 4 years ago

Running the default docker image with 

[*] Execute: /home/Osmedeus/plugins/go/amass enum -timeout 10 -active -max-dns-queries 10000 -include-unresolvable -dir /root/.osmedeus/workspaces/example.com/subdomain/amass-example.com -d example.com -o /root/.osmedeus/workspaces/example.com/subdomain/example.com-amass.txt
flag provided but not defined: -include-unresolvable
----------------------------------------------------------------------
Something went wrong with the command below:
/home/Osmedeus/plugins/go/amass enum -timeout 10 -active -max-dns-queries 10000 -include-unresolvable -dir /root/.osmedeus/workspaces/example.com/subdomain/amass-example.com -d example.com -o /root/.osmedeus/workspaces/example.com/subdomain/example.com-amass.txt

The default command pass an unsupported command line argument "include-unresolvable", if you run this manually with out the flag amass works.

Is there a way to pass tell osmedeus to run amass without the -include-unresolvable flag? I would like to be able to use amass with a configuration file similiar to https://github.com/OWASP/Amass/blob/master/examples/config.ini. Something like below

/home/Osmedeus/plugins/go/amass enum -timeout 10 -active -max-dns-queries 10000 -config <path to config file in docker image> -dir /root/.osmedeus/workspaces/example.com/subdomain/amass-example.com -d example.com -o /root/.osmedeus/workspaces/example.com/subdomain/example.com-amass.txt
mablanco commented 4 years ago

Hi. It seems that the version of Osmedeus included in the docker image is sending an unsupported command to amass. I think this is something that should be reported upstream to the main developer so it can be studied and solved, as it seems to come from the original code.

Anyway, I don't think there's an easy way to modify the behaviour of any tool in which Osmedeus relies without modifying the code itself and rebuilding the Docker image. Maye there's a runtime argument that I'm not aware of. Another possible option could be to launch a container, execute an interactive shell inside, modify the amass invocation and execute it, but it won't be persisted.

Let me have a look just in case I can do something at the image level.

DefenceLogic commented 4 years ago

I have reposted issue on the main site, please close.

DefenceLogic commented 4 years ago

The file that needs to be changed is in the lib/workflow/general.py at line 23. Just remove the "-include-unresolvable" from the command line. You will need to rebuild the python cache for the changes to take effect. Can you update the docker container please?

mablanco commented 4 years ago

Thanks for the fix, although it should go upstream. The Dockerfile has already been changed and the new image will be available in the next minutes. You'll be able to get it with docker pull mablanco/osmedeus:2.2-20201103.

BTW, as the image is built from scratch every time, it's already clean and therefore the python cache doesn't need to be rebuilt.

Regards.

DefenceLogic commented 4 years ago

Cheers, already posted upstream

DefenceLogic commented 4 years ago

Hi Looks like there is no manifest for it.

Error response from daemon: manifest for mablanco/osmedeus:2.2-20201103 not found: manifest unknown: manifest unknown

mablanco commented 4 years ago

Yes, it takes a lot to build and be pushed to Docker Hub. You can now try again.

mablanco commented 4 years ago

Cheers, already posted upstream

What do you mean? Maybe I don't understand you, but I've just checked the code upstream (https://github.com/j3ssie/Osmedeus/blob/master/lib/workflow/general.py#L10) and the "offending" flag is still there.

DefenceLogic commented 4 years ago

Forked repository and created PR to original