owasp-amass / amass

In-depth attack surface mapping and asset discovery
https://owasp.org/www-project-amass/
Other
11.94k stars 1.88k forks source link

config.ini not taken into account #201

Closed Techbrunch closed 5 years ago

Techbrunch commented 5 years ago

I'm running amass with this command:

amass enum -config /Users/xxx/amass/config.ini -src -d target.com

This is the content of my config.ini:

# Copyright 2017 Jeff Foley. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

# Should only passive data sources be used without DNS resolution?
#mode = passive
# Would you like to use more active techniques, such as pulling
# certificates from discovered IP addresses?
mode = active

# Ports used when pulling certificates
#port = 8080
port = 443

# The directory that stores the Cayley graph database and other output files
# The default is $HOME/amass
output_directory = ./

# The maximum number of concurrent DNS queries that can be performed during the enumeration.
# Increase this value over 100000 as long as your network and resolvers can handle the traffic
#maximum_dns_queries = 1000

# Would you like unresolved names to be included in the output?
include_unresolvable = true

# Root domain names used in the enumeration
#[domains]
#domain = owasp.org
#domain = appsecusa.org
#domain = appsec.eu
#domain = appsec-labs.com

# DNS resolvers used globally by the amass package
[resolvers]
resolver = 1.1.1.1 ; Cloudflare
resolver = 8.8.8.8 ; Google
resolver = 64.6.64.6 ; Verisign
resolver = 74.82.42.42 ; Hurricane Electric
resolver = 1.0.0.1 ; Cloudflare Secondary
resolver = 8.8.4.4 ; Google Secondary
resolver = 9.9.9.10 ; Quad9 Secondary
resolver = 64.6.65.6 ; Verisign Secondary
resolver = 77.88.8.1 ; Yandex.DNS Secondary

# Are there any subdomains that are out of scope?
#[blacklisted]
#subdomain = education.appsec-labs.com
#subdomain = 2012.appsecusa.org

# Are there any data sources that should not be utilized?
#[disabled_data_sources]
#data_source = Ask
#data_source = Exalead
#data_source = IPv4Info

# Configure Amass to use a Gremlin Server instead of the in-memory graph
#[gremlin]
#url = ws://localhost:8182
#username =
#password =

# Settings related to brute forcing
[bruteforce]
enabled = true
recursive = true
# Number of discoveries made in a subdomain before performing recursive brute forcing
# Default is 0
minimum_for_recursive = 0
wordlist_file = /Users/REDACTED/Documents/github/SecLists/Discovery/DNS/subdomains-top1mil-5000.txt
#wordlist_file = /usr/share/wordlists/all.txt # multiple lists can be used

# Would you like to permute resolved names?
[alterations]
enabled = true
# minimum_for_word_flip specifies the number of times a word must be seen before
# using it for future word flips and word additions
minimum_for_word_flip = 2
# edit_distance specifies the number of times a primitive edit operation will be
# performed on a name sample during fuzzy label searching
edit_distance = 1
flip_words = true   # test-dev.owasp.org -> test-prod.owasp.org
flip_numbers = true # test1.owasp.org -> test2.owasp.org
add_words = true    # test.owasp.org -> test-dev.owasp.org
add_numbers = true  # test.owasp.org -> test1.owasp.org
#wordlist_file = /usr/share/wordlists/all.txt
#wordlist_file = /usr/share/wordlists/all.txt # multiple lists can be used

# Provide API key information for a data source
#[AlienVault]
#apikey =

#[BinaryEdge]
#apikey =

[Censys]
apikey = REDACTED
secret = REDACTED

[CertDB]
username = REDACTED
password = REDACTED

#[CIRCL]
#username =
#password =

#[DNSDB]
#apikey =

#[PassiveTotal]
#username =
#apikey =

[SecurityTrails]
apikey = REDACTED

[Shodan]
apikey = REDACTED

# Provide your Twitter App Consumer API key and Consumer API secrety key
#[Twitter]
#apikey =
#secret =

# The apikey must be an API access token created through the Investigate management UI
#[Umbrella]
#apikey =

# URLScan can be used without an API key, but the key allows new submissions to be made
#[URLScan]
#apikey =

[VirusTotal]
apikey = REDACTED

I'm pretty sure that no recursive bruteforce is done since when I run the same command but with a subdomain, amass will find new subdomains using brute forcing:

amass enum -config /Users/xxx/amass/config.ini -src -d staging.target.com
0xrb13 commented 5 years ago

how to fix, when installed via brew

caffix commented 5 years ago

This issue already exists in #192