search

minvws / nl-kat-coordination

OpenKAT scans networks, finds vulnerabilities and creates accessible reports. It integrates the most widely used network tools and scanning software into a modular framework, accesses external databases such as shodan, and combines the information from all these sources into clear reports. It also includes lots of cat hair.
https://openkat.nl
European Union Public License 1.2
126 stars 58 forks source link

Redirections within a DNS zone do not have expected clearance #2407

Open originalsouth opened 9 months ago

originalsouth commented 9 months ago

Describe the bug Suppose we would like to scan some URL like https://kennisnet.nl with the Wappalyzer boefje. Hence, we enable the Wappalyzer boefje, add the URL OOI, and clear it on level 2. Upon scanning, we discover nothing but a new https://www.kennisnet.nl as https://kennisnet.nl redirects to https://www.kennisnet.nl.

For reasons explained in #1662, and addressed in #1962, redirects by the Wappalyzer are yielded without any clearance as this could cause KAT to start scanning URLs that are not cleared by the user.

In this particular case, however, one can argue that a redirection within the same DNS zone can be cleared, as any user would intend and expect such behavior. Hence this bug.

To Reproduce

  1. Enable Wappalyzer
  2. Add URL https://kennisnet.nl and set clearance to level 2
  3. Yield URL https://www.kennisnet.nl without any clearance

Expected behavior Yield software instances identified by Wappalyzer on https://www.kennisnet.nl

Screenshots image

OpenKAT version main (84fcfbac3efb1b461754a696dac37539a6756814)

noamblitz commented 9 months ago

Instead of KAT deciding (with very complex rules) whether new objects should be cleared, we are going to build a screen where all new objects are shown in a list much like a to-list, which user can clear. Ticket can be handed over to the design team for refinement.

underdarknl commented 2 months ago

This could be great first use case for a dashboard query.

Basically: Select (using a Path query) all URL/HOSTNAME OOI's on the OOI-list that do not have a clearance level, and are within a zone that has a clearance level.

The user can then decide to add a clearance level to these, or set them to 0.