praetorian-inc / chariot-ui

Chariot Offensive Security Platform
https://preview.chariot.praetorian.com
MIT License
15 stars 6 forks source link

ipv4 asset class masks domain asset class #66

Open praetorian-matt-schneider opened 2 weeks ago

praetorian-matt-schneider commented 2 weeks ago

Bug Description when assets are classified, the ipv4 class takes precedence over the domain class. this causes many assets that are discovered by subdomain enumeration to have the ipv4 class and not the domain class.

Steps to Reproduce

  1. add a domain seed to an account
  2. observe the assets with dns names populated from that seed
  3. retrieve assets using the API/CLI and sort by asset class
  4. observe that the number of domain class assets is a fraction of the domains discovered beneath the added seed.

Expected Behavior we should be able to disaggregate domain assets and ip assets, even if they are overlapping.

Screenshots here we can see an account with >5k assets has only 28 domain class assets: image

relevant slack conversation history: image

privateducky commented 2 weeks ago

Ah; this is intended. Class is intended to bucket objects (assets, risks, etc) into single categories for two reasons:

we can look at alternative options though, likely tapping into asset attributes to provide more color on what you're trying to do.