Alot More to add!

[TotallyNotAHaxxer]

hello there, my name is ArkAngeL43, Angel is prefered, im a cyber weapons developer currently studying 20+ programming languages, as of now focusing on ruby, i recreated this tool in ruby while not being as affective i think there could be alot more to do to it

in my script i added the following WHOIS Port Server Server OS Scheme request code a port scanner

i originally came across your tool and i thought why not remake it in ruby, so i did im not going to say its better because there is a shit ton of bugs in it however there are somethings you can add, since this is just a http analyzer its not worth it going into port scanners, however i think it would be great to add

scheme, connection code, request sent and request given back, methods, server name, and since your doing python maybe consider a vulnerability tester for the current server. python is a great language for speed, ability, portability, and so much more. i think this tool really could be great if you add some more things like the suggestions above

if you want to know more about my thoughts please do message me here and if you want which would be easier you can direct message me on instagram

sec_re43p3r_scare

i hope my suggestions help you in the further future, and i hope i can help. thank you for taking your time to read this!

date ==> Tue 14 Sep 2021 10:56:17 PM name ==> Angel, RE43P3R, Reaper, or arkangel

have a great night/day

[rfc-st]

Hi, Angel

Indeed!!, 'humble' could be improved with more detailed analysis, showing more information of the server's response, etc.

For now I want to focus only on HTTP response header analysis/detection, fix a couple of bugs, improve the requests to avoid blocked responses (referer, user agent), perhaps more export options, etc.

I will take into account, for the future, your suggestions.

Thanks for your time!.

[TotallyNotAHaxxer]

On Fri, Sep 17, 2021 at 11:08 rfc-st @.***> wrote:

Hi, Angel

Yes indeed, 'humble' could be improved with more detailed analysis, showing more information of the server's response, etc.

For now I want to focus only on HTTP response header analysis/detection, fix a couple of bugs, improve the requests to avoid blocked responses (referer, user agent), perhaps more export options, etc.

I will take into account, for the future, your suggestions.

Thanks for your time!.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/rfc-st/humble/issues/1#issuecomment-921872989, or unsubscribe https://github.com/notifications/unsubscribe-auth/AUZJ64JUIFC4GXCCVWTIRKTUCNKYHANCNFSM5EBXKEMA .

Ofc! I well appreciate the feedback. Have a nice one! If you need my help with any suggestions or even a project maybe we can collab just let me know.

[rfc-st]

Hi, @ArkAngeL43

Since September last year, this humble program has been evolving, little by little. Taking into account your previous comments, I would like to know your opinion about the features that you think may be interesting to include, mainly focused on the review and analysis of security HTTP headers.

Thanks!!

[TotallyNotAHaxxer]

Sorry for such a late response i myself have been very very busy this week, i took a look and i like the changes to it

my favorite part of tools is usually if they have it when they export the code to HTML templates, JSON, XML, YAML or file reports such as PDF and DOC reports of what it went. I really do like those current features, trust me that really makes a great tool. However stilla few notes on the code, while the features improved, code can always be improved

Do note that this is NOT a dig at you or your skill its constructive criticism

Despite me not programming in python i have touched many many languages, c++, fortran, go, ruby, c, c#, F#, JS, Java, and much more along that list and one thing that always stuck with me during programming was finding ways to make a program do the same thing with shorter lines of code and more robust code. I do alot of write ups on fortran, perl, go, and even C++ now. One thing i have always urged people to do is to not only clean up code but always find ways to update code and make it robust, the point in making it robust is to see where your skill is so here is the areas as a programmer i would improve.

SECTION 1: LINE - 507 to 836 | TOPIC - IF statements | File - humble.py

Using if statements in your code can make code slow, especially when you use them like so.

if 'X-Robots-Tag' in headers:
    if 'all' in headers['X-Robots-Tag']:
        print_header("X-Robots-Tag (Unsafe Value)")
        if not args.brief:
            print_detail("[ixrob]", "m")
        i_cnt += 1

if 'X-Runtime' in headers:
    print_header("X-Runtime (Unsafe Value)")
    if not args.brief:
        print_detail("[ixrun]", "d")
        i_cnt += 1

if 'X-Webkit-CSP' in headers:
    print_header("X-Webkit-CSP (Deprecated Header)")
    if not args.brief:
        print_detail("[ixcsp]", "d")
    i_cnt += 1

if 'X-XSS-Protection' in headers:
    if '0' not in headers["X-XSS-Protection"]:
        print_header("X-XSS-Protection (Unsafe Value)")
        if not args.brief:

if statements are SUPER CPU and memory heavy especially when running programs like this that are parsing through hundreds of lines of code. The way i as a programmer would do this is by using function interface maps. A function interface map is something i learned within my time of the Go programming language, Go uses this thing called an interface. In other words a interface data type in short is a custom type that is used to specify a set of one or more method signatures. Which means with an interface you can use things such as integers, unsigned integers. short and long integers, strings, chars, runes, bytes so on and so on. In python since you really do not deal with data types given it does that for you, you can impliment something like and interface within a map.

the control flow method you would use in python is actually using a dictionary to do so like the following say your code looks like this

x = 2

if x == 1:
    do_one(x)
elif x == 2:
    do_two(x)
elif x == 3:
    do_three(x)
else:
    do_def(x)

This can become an issue, when under a for loop or while loop or even outside of one constantly using if else or match case statements can RUIN performance and kill runtime. Alot of people throw hate on optimizing code simply due to the fact that they are lazy, a vast majority of programmers are lazy now which is what causes performance issues and runtime issues, so how exactly do we modify this? use a dictionary

x = 2

actions = {
     1: do_one,
     2: do_two,
     3: do_three
}
action = actions.get(x, do_def)

why is this better? well during my programming road i have learned that the constant use of IF ELSE is not bad just for hardware and runtime it is also bad for security, production, and so on. People talk all shit about how dictionaries are bad but dont understand the standard differences between linear searching with languages like python and the issues that can come along using switch case or if else. for example look at my golang code when i wrote a project about 6 months ago

this project is a console based security tool like MSF that has over 250 standard utiltiies and tools that are written purely

for reference the project file is here https://github.com/ArkAngeL43/Red-Rabbit/blob/main/modg/switch/case.go

    case "sniff tcp":
        if flags_rr6.Sniffc == "" {
            Parse_options_for_netcap("tcp", true, "")
        } else {
            Parse_options_for_netcap("tcp", false, flags_rr6.Sniffc)
        }
    case "sniff icmp":
        if flags_rr6.Sniffc == "" {
            Parse_options_for_netcap("icmp", true, "")
        } else {
            Parse_options_for_netcap("icmp", false, flags_rr6.Sniffc)
        }
    case "sniff ip":
        if flags_rr6.Sniffc == "" {
            Parse_options_for_netcap("ip", true, "")
        } else {
            Parse_options_for_netcap("ip", false, flags_rr6.Sniffc)
        }
    case "sniff dhcp":
        if flags_rr6.Sniffc == "" {
            Parse_options_for_netcap("dhcmp", true, "")
        } else {
            Parse_options_for_netcap("dhcmp", false, flags_rr6.Sniffc)
        }
    case "sniff ethernet":
        if flags_rr6.Sniffc == "" {
            Parse_options_for_netcap("eth", true, "")
        } else {
            Parse_options_for_netcap("eth", false, flags_rr6.Sniffc)
        }
    case "sniff ftp_cred":
        if flags_rr6.Sniffc == "" {
            a := sio("Enter a interface to use> ", v.RET_RED)
            IEEE_Sniff.Ftp_starter_credential_Applayer(1024, "tcp port 110 or tcp port 25 or tcp port 143", a)
        } else {
            IEEE_Sniff.Ftp_starter_credential_Applayer(1024, "tcp port 110 or tcp port 25 or tcp port 143", flags_rr6.Sniffc)
        }
    case "sniff smtp_cred":
        if flags_rr6.Sniffc == "" {
            a := sio("Enter a interface to use> ", v.RET_RED)
            IEEE_Sniff.Smtp_Starter_crednetial_listener(1024, "tcp port 110 or tcp port 25 or tcp port 143", a)
        } else {
            IEEE_Sniff.Smtp_Starter_crednetial_listener(1024, "tcp port 110 or tcp port 25 or tcp port 143", flags_rr6.Sniffc)
        }

there are over 2,000 lines of just pure switch case if else statements in there, when you run the tool most utilities work but some are thrown on threads and the threads cause your program to crash and sometimes even your PC, switch case statements are good in all but like IF ELSE they are NOT good or SECURE to use in a program say something like mine which needs user based input to be define. A way im currently working with this and working around it is using a dictionary well in golang a dictionary is a map, and comparing the map to the length of the input the user compares within each session throughout the console, and logging it in a binary format to not only save on storage but to also prevent memory from crashing. Alot of people say the way i have it is fine enough but again a complete lie. When i released this tool alot of people enjoyed it, starred it and forked it but recently i had a few good programmers on my development team that i am apart of ( for another project ) come to me and say this was horribly written. Every bit of code within the project was fine but it was the file case.go which was an issue, everytime they ran the code they could create memory errors, segment violations, and i believe the binary is easy to exploit, and you can exploit it through binary exploitation. This is SUPER bad for my code if i ever want to release a pro version or paid version of the program. In order to work around that i will need to use advanced sets like in this write up on advanced and secure cyber weapons development seen here

package Console_main

import "fmt"

type Message struct {
    Name string
}

var Access Message

var Func_Map = map[string]interface{}{
    "hello": Access.Hello_there,
}

func (QT *Message) Hello_there(filler string) {
    fmt.Printf("\n:> Hello there user! i see you set your name as %s\n\n", QT.Name)
}

by using the Func_Map i am able to completely erase the if else statements and just compare it based on the user input like so.

dt := Func_Map[some_user_Input]

if a value like some_user_input is within the given map, it will match and run the function. For example if the user says hello the program will convert all the letters to a lowercase and compare them to the commands within the map and run the function

func (QT *Message) Hello_there(filler string) {
    fmt.Printf("\n:> Hello there user! i see you set your name as %s\n\n", QT.Name)
}

which will output

:> Hello there user! i see you set your name as (whatever name the user set)

by doing this you not only save your runtime but you also save potential memory issues, despite python not being a very low end language like C, Rust, or Fortran and other languages alike you can still cause memory issues. I know i used a code example using golang but that is the best i can give you for other sections, there are a few things i note such as code dependability but that is something that NEEDS to be fixed IMMEDIATELY when you get the time or chance.

[rfc-st]

Hi, @ArkAngeL43

I highly appreciate your response; I will carefully review your notes, examples and advices.

Thank you!!!

[TotallyNotAHaxxer]

Fantastic! glad i could help let me know when you read them and your honest opinion about it

[rfc-st]

@ArkAngeL43, I am currently optimizing the code, trying to make it run more efficiently and faster (my goal is to allow dozens, or hundreds, of URLs to be analyzed sequentially, and for that I need to modularize the code and review the part of the exceptions)

As I said, I will take your suggestions into account.

Thanks for your time!!.