Closed terrabitz closed 2 years ago
Thanks for the PR! I was behind on the PR stack for this project, and having since caught up a bit this PR now has merge conflicts. Apologies for that! Would you mind rebasing?
@leonjza I just rebased, accounting for the PR that switches to a singleton Wappalyzer client.
Thanks!
The Issue
In the master branch of gowitness, the wappalyzer module is used to detect technologies used by a scanned website. However, I found that not all the technologies on the website were being discovered correctly.
After some investigation, it appeared that the
wappalyzer.Fingerprint
command was always getting a zero-length byte array as thebody
argument. This was due to thehttp.Response.Body
already being read previously duringGetHTMLTitle
. When ahttp.Response.Body
is read once, it's no longer usable and should be closed; any further reads result in an empty byte array.The Fix
Instead of passing the response body around and allowing subfunctions to read it, it's read once as part of
chrome.Preflight
. That byte array is then passed to the relevant subfunctions.Test Methodology
Perform a scan using the code from the latest master branch, and another using the modified version. Validate that more technologies are identified in the latter.
Screenshots
Before the fix:![2022-02-17-15-51-45](https://user-images.githubusercontent.com/11320431/154570382-b4986942-1485-432c-936a-146d5a76f249.png)
After the fix:![2022-02-17-15-52-55](https://user-images.githubusercontent.com/11320431/154570401-b7555f7f-fb26-4a87-baf0-cb7a3b23672c.png)