search

wapiti-scanner / wapiti

Web vulnerability scanner written in Python3
https://github.com/wapiti-scanner/wapiti
GNU General Public License v2.0
1.15k stars 176 forks source link

Use sslscan in place of sslyze #602

Closed devl00p closed 2 months ago

devl00p commented 2 months ago

Theer is still an issue related to certificate transparency logs.

Can't tell at the moment if crt.sh is broken or if I should do things differently.

codecov[bot] commented 2 months ago

Codecov Report

Attention: Patch coverage is 82.81938% with 39 lines in your changes missing coverage. Please review.

Project coverage is 79.53%. Comparing base (3a0f685) to head (cf646d7).

Files Patch % Lines
wapitiCore/attack/mod_ssl.py 82.81% 39 Missing :warning:
Additional details and impacted files ```diff @@ Coverage Diff @@ ## master #602 +/- ## ========================================== + Coverage 79.40% 79.53% +0.12% ========================================== Files 122 122 Lines 10296 10358 +62 ========================================== + Hits 8176 8238 +62 Misses 2120 2120 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

devl00p commented 2 months ago

related to https://github.com/wapiti-scanner/wapiti/issues/553

Did a simple check for a pattern in crt.sh responses for CT logs.

bretfourbe commented 2 months ago

Hi @devl00p, I think we should remove ssl from common_modules here : https://github.com/wapiti-scanner/wapiti/blob/master/wapitiCore/attack/attack.py#L81 since sslscan is not installed by default.

devl00p commented 2 months ago

Hi @devl00p, I think we should remove ssl from common_modules here : https://github.com/wapiti-scanner/wapiti/blob/master/wapitiCore/attack/attack.py#L81 since sslscan is not installed by default.

Hello,

No, this is on purpose to encourage users to install the dependency. They wil just get a warning telling them to install sslscan.

Qwarctick commented 2 months ago

No, this is on purpose to encourage users to install the dependency. They wil just get a warning telling them to install sslscan.

I does not work. If sslscan is not installed, subprocess will raise a FileNotFoundError and stop the execution. You will not have the correct warning.

EDIT: My bad, it does not work only in tests. It works in "normal" execution.