search

v3n0m-Scanner / V3n0M-Scanner

Popular Pentesting scanner in Python3.6 for SQLi/XSS/LFI/RFI and other Vulns
GNU General Public License v3.0
1.47k stars 408 forks source link

A few bugs ive noticed #43

Closed kattstof closed 8 years ago

kattstof commented 8 years ago

First let me say the print valid urls works soo much better than the auto save to text (the autosave always bugs out) 1st bug skip to custom list checking gives error : file not found Adminfinder: nomodule "cookielib" (easyfix) Also since ive been using the auto save to txt its only worked a handful i would take it out and opt for the print valid urls if i find anymore i'll let you know

NovaCygni commented 8 years ago

Thanks for the feedback, Yeh the save to file method is the old way I did it, I'll likely change it today and fix the other issues you mentioned, then get started on the CSRF detection features.

NovaCygni commented 8 years ago

Ok im working on the custom list importing now. Adminfinder doesnt use cookielib? it shouldnt be needed anywhere in the v3n0m modules? Oh btw Print valid urls will probably be altered to be the handler for the saving to text file, but in its native state its only 40/45% Positive hit rate, once its been parsed by the search_ignore it should be ready to go. Oh and i fixed the XSS and LFI Thread handlers so theyll actually work now instead of killing the program.

kattstof commented 8 years ago

adminfinder : function object has no attribute signal ftp crawler : add escape to main menu after scan completion

NovaCygni commented 8 years ago

Ok my bad I had a datetime.time and time.time import conflict, fix was "from datetime import time as dt_time", adminfinder still appears broken though im looking into it now, ive still got to clear up the cloudresolvers old __main__ and change the sys.call program wide into imports as really I shouldnt be sys.call'ing the Dns bruteforcer/admin-finder/ftp-crawler I "Should" be doing: import adminfinder :+1:

kattstof commented 8 years ago

Btw idk if u knew this but the script itself ticks off some ddos protections namely prolexic so its best to use a vpn or tor

kattstof commented 8 years ago

UPDATE: snooping through how prolexic works they simply pull ips from websites listing malicious ip addresses so i'm guessing the search engine itself flags the ips as malicious due to some security trigger something along the lines of too many headers /threads/searches done in a certain allotted time will flag the ip address , just a hunch, but the tool still works after your ip is flagged so idk, doing further tests with different isps once the search engine flags your ip address psn's ddos protection (prolexic) flags it as a ddos attack so does radware and imperva aswell as certain firewalls that pull malicious ip lists from public websites