This PR introduces functionality for configuring a "target" within the software package (hereon referred to as CORS Hunter for ease of reference). More specifically it does the following:
Exposes a Django admin management command that accepts (1) a host domain (this is the domain that we expect to receive HTTP requests on) as well as (2) target domains that it should map to (the highest-level domains that a payload should be generated for)
Upon invocation sublist3r is invoked to find as many "internal" subdomains of the target domains as possible
The database is updated to reflect a mapping from the host domain to all of the "internal" subdomains that were discovered
This mapping will be used in a follow-on PR to generate the service worker payload.
NOTE - After some testing it looks like sublist3r is pretty not great at finding subdomains. OWASP's AMASS tool looks much better (and empirically works much better) so we should convert over to using that tool instead in a future PR.
Impact of Change
Initial foundation for database state necessary to serve up payloads
Management action that will be used in dynamic configuration on deployment
Description of Change
This PR introduces functionality for configuring a "target" within the software package (hereon referred to as CORS Hunter for ease of reference). More specifically it does the following:
sublist3ris invoked to find as many "internal" subdomains of the target domains as possibleThis mapping will be used in a follow-on PR to generate the service worker payload.
NOTE - After some testing it looks like
sublist3ris pretty not great at finding subdomains. OWASP's AMASS tool looks much better (and empirically works much better) so we should convert over to using that tool instead in a future PR.Impact of Change
Collateral Work
Testing
Full test coverage is included in this PR.