proabiral / inception

A highly configurable Framework for easy automated web scanning
357 stars 66 forks source link

Feature request - url file #18

Closed unl1k3ly closed 4 years ago

unl1k3ly commented 5 years ago

Hi mate, this tool is awesome! Thanks for coming up with some like that!

Would be good to use this tool to parse a url.txt.

I was thinking in something like, -url urls.txt.

By doing so, we don't have to worry with protocol scheme (http/s) since urls.txt file would contain an url as http://www.example.com:8080

Cheers

proabiral commented 5 years ago

Thanks. :) I will take a look into it

unl1k3ly commented 5 years ago

Thanks mate

BBerastegui commented 4 years ago

Yup, thumbs up for this.

This could save a lot of time so we can directly pass http/https if we got that information already.

https://target1.com:8443
http://target2.com
http://target2.com:8080
proabiral commented 4 years ago

Hi @unl1k3ly @BBerastegui ,

Scheme can now be passed from domains list. Since the code has not yet been pushed to master branch please check beta branch.

Let me know if there are any issues.

Regards,

BBerastegui commented 4 years ago

Hi @proabiral, I don't want to open another issue just for this, but I haven't been able to make the beta branch work.

I'm solving one problem but running into another all the time. Could you provide some basic instructions in the beta branch on how to make it work so I can start testing it and maybe help a little bit with the coding? :D

Thanks!

proabiral commented 4 years ago

1) Git clone https://github.com/proabiral/inception.git 2) cd inception 3) git checkout beta 4) go run main.go -d domains.txt -provider provider.json

BBerastegui commented 4 years ago

Thanks both. But none of those work, that's why I came to ask, I promise I've tried before :/

With @proabiral's steps, first I was missing the packages aurora and gorequest, but when pulling them, I get this error for gorequest:

package github.com/moul/http2curl: code in directory /go/src/github.com/moul/http2curl expects import "moul.io/http2curl"

With @geeknik's, I'm missing the gorequest library, and if I pull it, I get the same error again:

package github.com/moul/http2curl: code in directory /go/src/github.com/moul/http2curl expects import "moul.io/http2curl"

It's clearly that package problem, but I was surprised that you didn't run into exactly the same problem xD

proabiral commented 4 years ago

@BBerastegui , This should be fixed now. Let me know if the issue still occurs.

BBerastegui commented 4 years ago
git clone https://github.com/proabiral/inception.git
cd inception
go get ./...
go run main.go -provider provider.json -d EXAMPLE.services

This now works, but unfortunately, inception seems to be doing "nothing" now. It just exists saying "Completed" without sending a single request.

I'll have to look at it further to see what is happening.

proabiral commented 4 years ago

Hi @BBerastegui, Are you using provider.json that comes with the tool ?

BBerastegui commented 4 years ago

Yup, the same one.

proabiral commented 4 years ago

How many domains are you testing against and how many threads are you using ? Can you make sure the tool is not being killed by OS due to lack of resource ?

BBerastegui commented 4 years ago

A list of 10 domains, 1 thread.

go run main.go -provider provider.json -d EXAMPLE.subdomains -v -t 1

It's true that I see the CPU spiking to 100% and then the tool finishes. It's a really low end machine, but with only one thread seems weird to be crashing because of this :/

proabiral commented 4 years ago

Hi, do you see any error in the console like "killed" ? Are you checking the webserver log to make sure the tool is not making any request ?

BBerastegui commented 4 years ago

Nope, any message that may make me think that it's being killed.

And yes, I've checked with: sudo tcpdump -A -s 0 'tcp port 80 or tcp port 443' and not a single request is made.

Now, I'm sure it's because it's running out of resources, I just run it in my laptop (much more CPU than the VPS where I was testing it) and now I get no errors.

Just in case you want to look further at this or if someone comes asking about the same thing :D

proabiral commented 4 years ago

Thanks. I will be looking at ways to optimize resource usage in future.

BBerastegui commented 4 years ago

No need to thank. Thank you for your work! Have a great new year!

BBerastegui commented 4 years ago

Okay, found the issue.

It's because I was using a provider.json file that was missing either the method or had the old payload field. :D

I think it works now!