search

mandiant / gocrack

GoCrack is a management frontend for password cracking tools written in Go
MIT License
1.12k stars 240 forks source link

A couple of issues #64

Closed Darkman2771 closed 3 years ago

Darkman2771 commented 4 years ago

Hello There,

I have gocrack up and running smoothly with a couple of issues, hopefully I could find answers here:

1) I can't seem to upload big dictionary files (15 GB) despite adjusting the file manager's task_max_upload_size to the correct size of the uploaded file (15 1024 1024 * 1024) - upload stops at 18% every-time.

2) There's an option in the server config allow_registration which I have set to false but despite that, the registration button and functionality in general is there and functional as if I have this option set to true.

3) I have a user that I want to delete but apparently there's no straight-forward way to do that, I attempted to modify the .db flat database file directly but it requested a password which I can't seem to find.

Thanks for taking the time to look into this.

tankbusta commented 3 years ago

Hey @Darkman2771,

Sorry for the delay - this project doesn't get a lot of my time now unfortunately but I'm looking to make some changes in the near future so that this still functions.

As to your questions,

  1. The API/UI was never meant to upload large files of that size. The server's filemanager has the ability to scan a directory on statup and import the file which was built for large dictionaries. This is configured inside the configuration file under filemanager with the key import_path
  2. The register button will still be there and but shouldn't function if you try and submit the form. Please also make sure your configuration looks like this
authentication:
  backend: "database"
  secret_key: helloworld
  backend_settings:
    bcrypt_cost: 10
    allow_registration: true
  1. You are correct - there is no easy way right now to disable/delete a user. The flatfile database is not encrypted nor does it have a password. While not recommended, it can be modified by using any BoltDB editor. I would not recommend deleting the user as it will most likely break things but you can add to the user's record (it'll be JSON encoded) "enabled": false. It was an oversight years ago because we use the LDAP backend