search

projectdiscovery / interactsh

An OOB interaction gathering server and client library
https://app.interactsh.com
MIT License
3.3k stars 352 forks source link

Add ability to specify root-path favicon file via commandline parameter in interactsh-server #797

Open mikedesu opened 6 months ago

mikedesu commented 6 months ago

Please describe your feature request:

My idea is straight-forward:

I want to pass a cmdline flag like -favicon to interactsh-server in order to specify a local file to serve at the root path for any interactsh-client instances I spin up.

Describe the use case of this feature:

I think it would be interesting to serve a giant local file (1gb+) to a target that makes HTTP requests.

interactsh-server -domain mydomain.site -favicon giantfile

So when I run a local client, asfahfefkhqfreq.mydomain.site/favicon.ico would return the giantfile.

This kind of attack could render some headless browsers vulnerable to DDOS or resource exhaustion.

ehsandeep commented 6 months ago

@mikedesu there is already support for it - https://github.com/projectdiscovery/interactsh?tab=readme-ov-file#static-file-hosting

mikedesu commented 4 months ago

Serving from /s/ isn't good enough. I want to serve and track the favicon that sites load from the root path

Mzack9999 commented 3 days ago

@mikedesu the file can already be served in the /s/ subpath or via dynamic response. Unfortunately without a strong use we prefer to keep the / serve the courtesy page. Apart from DDOS detection, could you provide more context on the kind of use cases you have in mind?