search

whoot / Typo3Scan

Enumerate Typo3 version and extensions
GNU General Public License v2.0
169 stars 32 forks source link

Basic auth option not working #16

Closed exploide closed 3 years ago

exploide commented 3 years ago

Describe the bug\

Invoking ./typo3scan.py -d http://url/ --auth user:pass has no effect and the basic authentication credentials will not be used.

This is because https://github.com/whoot/Typo3Scan/blob/7fb4fa0183c89683f3a836575c3bd7437f6336eb/lib/request.py#L38 loads the config from a file and ignores the command line options.

To Reproduce\ Steps to reproduce the behavior:

  1. Set up a Typo 3 with basic auth in front of it
  2. Scan with ./typo3scan.py -d http://url/ --auth user:pass
  3. Observe the message [x] It seems that Typo3 is not used on this domain

Expected behavior\ Command line option should be taken into consideration.

As a workaround I wrote the credentials into the config.json file.

whoot commented 3 years ago

thanks for your bug report. Everything should work as expected now. I actually wanted to get rid of the configuration file and use parameters instead. But so far I'm not done yet and I guess I forgot to re-enable the corresponding lines.

exploide commented 3 years ago

Thanks for your fast response.

Yes it's working now.

But there is the drawback that the credentials are persisted on disk now, i.e. they are written to config.json and remain there until the next run.

So I encourage you "to get rid of the configuration file and use parameters instead". :+1: