urbanadventurer / WhatWeb

Next generation web scanner
https://www.morningstarsecurity.com/research/whatweb
GNU General Public License v2.0
5.2k stars 885 forks source link

PHP Slim and Dockerfile #301

Closed cgimenes closed 4 years ago

urbanadventurer commented 4 years ago

Thanks for sharing your plugin and Dockerfile @cgimenes 👍

urbanadventurer commented 4 years ago

Your php-slim plugin is great but I have some tips to make it even better. Instead of defining functions for generating random strings and fetching a random URL, you can use the randstr() function. This can keep the functionality within a single match hash.

Here's an example of using randstr() from the Zend plugin. In this case there's no need to check if the page returns 404 or not because it's a random URL that should not exist.

zend.rb:{:string=>'Zend_Controller_Router_Exception',:url=>randstr(),:text=>"/Zend/Controller/Router/Rewrite.php</b> on line <b>"}

Note that this random URL will only be tested and matched if the plugin is doing an aggressive match.

When Aggression is set to 3, a passive match must trigger first, then all aggressive tests for the plugin will be launched. When Aggression is set to 4, all aggressive tests for all plugins are launched. This is slow, and I don't recommend anyone use WhatWeb this way unless as a last resort to identify a website.

Without any passive matches defined in the php-slim plugin to trigger first, it will only identify php-slim if aggression is set to 4. If you could find a way to identify php-slim passively without the 404 page, it would be much more helpful.

A docker image is a good idea, but instead of accepting the pull request I'd like to create an official Docker image on Docker Hub first.

Please let me know if I can help in any way.

cgimenes commented 4 years ago

Could you check my plugin again? I've just updated it.

I'd imagined that you would want to create an official Docker image, this is why I wrote how to build an image at README.md. I think it's good to have it this way while you don't have an official image.