search

owasp-amass / amass

In-depth attack surface mapping and asset discovery
https://owasp.org/www-project-amass/
Other
11.96k stars 1.88k forks source link

[Feature Request] separate config file for just API keys. #602

Open gprime31 opened 3 years ago

gprime31 commented 3 years ago

api_key.ini so I can put all the api keys there and use the command line args I already use, and not mess with the big config file.

caffix commented 3 years ago

The "big config file" can be setup so it simply specifies API keys for data sources. We are considering a JSON version of the configuration file format though

mzpqnxow commented 3 years ago

@caffix I'll throw in a vote for a new format, though my personal preference for this sort of thing is YaML, just because it's easier to edit and can support comments. Maybe there's a reason JSON is preferred for this case- I'm just throwing in my $.02 after being out of the loop for so long :)

chrisdlangton commented 3 years ago

I read keys from a secrets vault at runtime and write to a config each time i need to adjust other parts of the config like domain, everytime. It would be convenient to support a yaml approach because yaml are seem less to concatenate so there's no limits of how many configurations you can use.

If yaml is chosen, a location of configs might be passed so Amass just reads 1 or more yaml in that location concatenate them all together and just read them all as 1 big config like you do now

sesam commented 3 years ago

At this time, I've heard the format will not be changed. I had missed that the current format actually supports comments, which is a big issue with .json files that are much easier to mess up.

If you're seeing issues with validating your config files, maybe make a feature request for a command that reads and checks a specified ini file? On the other hand, maybe it's more typical that you need to validate the keys you have, so that would be another kind of pre-flight check up, and yet another separate feature request :)