mirror of
https://github.com/edoardottt/cariddi.git
synced 2026-09-05 09:17:44 +02:00
Merge branch 'add-json-output' of https://github.com/ocervell/cariddi into add-json-output
This commit is contained in:
Olivier Cervello
@@ -0,0 +1,14 @@
|
||||
# Set to true to add reviewers to pull requests
|
||||
addReviewers: true
|
||||
|
||||
# A list of reviewers to be added to pull requests (GitHub user name)
|
||||
reviewers:
|
||||
- edoardottt
|
||||
|
||||
# A list of keywords to be skipped the process that add reviewers if pull requests include it
|
||||
skipKeywords:
|
||||
- wip
|
||||
|
||||
# A number of reviewers added to the pull request
|
||||
# Set 0 to add all the reviewers (default: 0)
|
||||
numberOfReviewers: 0
|
||||
@@ -2,6 +2,7 @@
|
||||
cariddi
|
||||
output-cariddi/
|
||||
.cariddi_cache/
|
||||
*.snap
|
||||
|
||||
# Binaries for programs and plugins
|
||||
*.exe
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<img src="https://goreportcard.com/badge/github.com/edoardottt/cariddi" alt="go-report-card" />
|
||||
</a>
|
||||
<!-- workflows -->
|
||||
<a href="https://edoardoottavianelli.it">
|
||||
<a href="https://github.com/edoardottt/cariddi/actions">
|
||||
<img src="https://github.com/edoardottt/cariddi/workflows/Go/badge.svg?branch=main" alt="workflows" />
|
||||
</a>
|
||||
<!-- ubuntu-build -->
|
||||
@@ -47,7 +47,7 @@
|
||||
</sub>
|
||||
<br>
|
||||
<!--Tweet button-->
|
||||
<a href="https://twitter.com/intent/tweet?url=https://github.com/edoardottt/cariddi&text=Take%20a%20list%20of%20domains,%20crawl%20urls%20and%20scan%20for%20endpoints,%20secrets,%20api%20keys,%20file%20extensions,%20tokens%20and%20more...%20#network%20#security%20#infosec%20#oss%20#github%20#bugbounty%20#linux" target="_blank">Share on Twitter!
|
||||
<a href="https://twitter.com/intent/tweet?url=https://github.com/edoardottt/cariddi&text=Take%20a%20list%20of%20domains,%20crawl%20urls%20and%20scan%20for%20endpoints,%20secrets,%20api%20keys,%20file%20extensions,%20tokens%20and%20more...%20%23network%20%23security%20%23infosec%20%23oss%20%23github%20%23bugbounty%20%23linux" target="_blank">Share on Twitter!
|
||||
</a>
|
||||
</p>
|
||||
<p align="center">
|
||||
@@ -63,11 +63,20 @@
|
||||
Preview :bar_chart:
|
||||
----------
|
||||
|
||||
[](https://asciinema.org/a/415989)
|
||||
<!--[](https://asciinema.org/a/415989)-->
|
||||
|
||||
<p align="center">
|
||||
<img src="https://github.com/edoardottt/images/blob/main/cariddi/cariddi.gif">
|
||||
</p>
|
||||
|
||||
Installation 📡
|
||||
----------
|
||||
|
||||
### Using Snap
|
||||
```bash
|
||||
sudo snap install cariddi
|
||||
```
|
||||
|
||||
### Using Go
|
||||
```bash
|
||||
go install -v github.com/edoardottt/cariddi/cmd/cariddi@latest
|
||||
|
||||
@@ -1,29 +1,29 @@
|
||||
module github.com/edoardottt/cariddi
|
||||
|
||||
go 1.17
|
||||
go 1.18
|
||||
|
||||
require (
|
||||
github.com/fatih/color v1.14.1
|
||||
github.com/fatih/color v1.15.0
|
||||
github.com/gocolly/colly v1.2.0
|
||||
)
|
||||
|
||||
require (
|
||||
github.com/PuerkitoBio/goquery v1.8.0 // indirect
|
||||
github.com/PuerkitoBio/goquery v1.8.1 // indirect
|
||||
github.com/andybalholm/cascadia v1.3.1 // indirect
|
||||
github.com/antchfx/htmlquery v1.2.5 // indirect
|
||||
github.com/antchfx/xmlquery v1.3.13 // indirect
|
||||
github.com/antchfx/xpath v1.2.1 // indirect
|
||||
github.com/antchfx/htmlquery v1.3.0 // indirect
|
||||
github.com/antchfx/xmlquery v1.3.15 // indirect
|
||||
github.com/antchfx/xpath v1.2.4 // indirect
|
||||
github.com/gobwas/glob v0.2.3 // indirect
|
||||
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
|
||||
github.com/golang/protobuf v1.5.2 // indirect
|
||||
github.com/golang/protobuf v1.5.3 // indirect
|
||||
github.com/kennygrant/sanitize v1.2.4 // indirect
|
||||
github.com/mattn/go-colorable v0.1.13 // indirect
|
||||
github.com/mattn/go-isatty v0.0.17 // indirect
|
||||
github.com/saintfish/chardet v0.0.0-20120816061221-3af4cd4741ca // indirect
|
||||
github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d // indirect
|
||||
github.com/temoto/robotstxt v1.1.2 // indirect
|
||||
golang.org/x/net v0.4.0 // indirect
|
||||
golang.org/x/sys v0.3.0 // indirect
|
||||
golang.org/x/text v0.5.0 // indirect
|
||||
golang.org/x/net v0.8.0 // indirect
|
||||
golang.org/x/sys v0.6.0 // indirect
|
||||
golang.org/x/text v0.8.0 // indirect
|
||||
google.golang.org/appengine v1.6.7 // indirect
|
||||
google.golang.org/protobuf v1.28.1 // indirect
|
||||
google.golang.org/protobuf v1.30.0 // indirect
|
||||
)
|
||||
|
||||
@@ -1,17 +1,26 @@
|
||||
github.com/PuerkitoBio/goquery v1.8.0 h1:PJTF7AmFCFKk1N6V6jmKfrNH9tV5pNE6lZMkG0gta/U=
|
||||
github.com/PuerkitoBio/goquery v1.8.0/go.mod h1:ypIiRMtY7COPGk+I/YbZLbxsxn9g5ejnI2HSMtkjZvI=
|
||||
github.com/PuerkitoBio/goquery v1.8.1 h1:uQxhNlArOIdbrH1tr0UXwdVFgDcZDrZVdcpygAcwmWM=
|
||||
github.com/PuerkitoBio/goquery v1.8.1/go.mod h1:Q8ICL1kNUJ2sXGoAhPGUdYDJvgQgHzJsnnd3H7Ho5jQ=
|
||||
github.com/andybalholm/cascadia v1.3.1 h1:nhxRkql1kdYCc8Snf7D5/D3spOX+dBgjA6u8x004T2c=
|
||||
github.com/andybalholm/cascadia v1.3.1/go.mod h1:R4bJ1UQfqADjvDa4P6HZHLh/3OxWWEqc0Sk8XGwHqvA=
|
||||
github.com/antchfx/htmlquery v1.2.5 h1:1lXnx46/1wtv1E/kzmH8vrfMuUKYgkdDBA9pIdMJnk4=
|
||||
github.com/antchfx/htmlquery v1.2.5/go.mod h1:2MCVBzYVafPBmKbrmwB9F5xdd+IEgRY61ci2oOsOQVw=
|
||||
github.com/antchfx/htmlquery v1.3.0 h1:5I5yNFOVI+egyia5F2s/5Do2nFWxJz41Tr3DyfKD25E=
|
||||
github.com/antchfx/htmlquery v1.3.0/go.mod h1:zKPDVTMhfOmcwxheXUsx4rKJy8KEY/PU6eXr/2SebQ8=
|
||||
github.com/antchfx/xmlquery v1.3.13 h1:wqhTv2BN5MzYg9rnPVtZb3IWP8kW6WV/ebAY0FCTI7Y=
|
||||
github.com/antchfx/xmlquery v1.3.13/go.mod h1:3w2RvQvTz+DaT5fSgsELkSJcdNgkmg6vuXDEuhdwsPQ=
|
||||
github.com/antchfx/xmlquery v1.3.15 h1:aJConNMi1sMha5G8YJoAIF5P+H+qG1L73bSItWHo8Tw=
|
||||
github.com/antchfx/xmlquery v1.3.15/go.mod h1:zMDv5tIGjOxY/JCNNinnle7V/EwthZ5IT8eeCGJKRWA=
|
||||
github.com/antchfx/xpath v1.2.1 h1:qhp4EW6aCOVr5XIkT+l6LJ9ck/JsUH/yyauNgTQkBF8=
|
||||
github.com/antchfx/xpath v1.2.1/go.mod h1:i54GszH55fYfBmoZXapTHN8T8tkcHfRgLyVwwqzXNcs=
|
||||
github.com/antchfx/xpath v1.2.3/go.mod h1:i54GszH55fYfBmoZXapTHN8T8tkcHfRgLyVwwqzXNcs=
|
||||
github.com/antchfx/xpath v1.2.4 h1:dW1HB/JxKvGtJ9WyVGJ0sIoEcqftV3SqIstujI+B9XY=
|
||||
github.com/antchfx/xpath v1.2.4/go.mod h1:i54GszH55fYfBmoZXapTHN8T8tkcHfRgLyVwwqzXNcs=
|
||||
github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
|
||||
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/fatih/color v1.14.1 h1:qfhVLaG5s+nCROl1zJsZRxFeYrHLqWroPOQ8BWiNb4w=
|
||||
github.com/fatih/color v1.14.1/go.mod h1:2oHN61fhTpgcxD3TSWCgKDiH1+x4OiDVVGH8WlgGZGg=
|
||||
github.com/fatih/color v1.15.0 h1:kOqh6YHBtK8aywxGerMG2Eq3H6Qgoqeo13Bk2Mv/nBs=
|
||||
github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBDUSsw=
|
||||
github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
|
||||
github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
|
||||
github.com/gocolly/colly v1.2.0 h1:qRz9YAn8FIH0qzgNUw+HT9UN7wm1oF9OBAilwEWpyrI=
|
||||
@@ -23,6 +32,8 @@ github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5y
|
||||
github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
|
||||
github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
|
||||
github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
|
||||
github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
|
||||
github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
|
||||
github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
|
||||
github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
|
||||
github.com/kennygrant/sanitize v1.2.4 h1:gN25/otpP5vAsO2djbMhF/LQX6R7+O1TB4yv8NzpJ3o=
|
||||
@@ -36,6 +47,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
|
||||
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||
github.com/saintfish/chardet v0.0.0-20120816061221-3af4cd4741ca h1:NugYot0LIVPxTvN8n+Kvkn6TrbMyxQiuvKdEwFdR9vI=
|
||||
github.com/saintfish/chardet v0.0.0-20120816061221-3af4cd4741ca/go.mod h1:uugorj2VCxiV1x+LzaIdVa9b4S4qGAcH6cbhh4qVxOU=
|
||||
github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d h1:hrujxIzL1woJ7AwssoOcM/tq5JjjG2yYOc8odClEiXA=
|
||||
github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d/go.mod h1:uugorj2VCxiV1x+LzaIdVa9b4S4qGAcH6cbhh4qVxOU=
|
||||
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
||||
github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
|
||||
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
|
||||
@@ -52,8 +65,11 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
|
||||
golang.org/x/net v0.0.0-20210916014120-12bc252f5db8/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
|
||||
golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
|
||||
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
|
||||
golang.org/x/net v0.4.0 h1:Q5QPcMlvfxFTAPV0+07Xz/MpK9NTXu2VDUuy0FeMfaU=
|
||||
golang.org/x/net v0.4.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
|
||||
golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
|
||||
golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g=
|
||||
golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
|
||||
golang.org/x/net v0.8.0 h1:Zrh2ngAOFYneWTAIAPethzeaQLuHwhuBkuV6ZiRnUaQ=
|
||||
golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
|
||||
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
@@ -65,18 +81,24 @@ golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBc
|
||||
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.3.0 h1:w8ZOecv6NaNa/zC8944JTU3vz4u6Lagfk4RPQxv92NQ=
|
||||
golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ=
|
||||
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||
golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
|
||||
golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
|
||||
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
|
||||
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
|
||||
golang.org/x/text v0.5.0 h1:OLmvp0KP+FVG99Ct/qFiL/Fhk4zp4QQnZ7b2U+5piUM=
|
||||
golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
|
||||
golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
|
||||
golang.org/x/text v0.7.0 h1:4BRB4x83lYWy72KwLD/qYDuTu7q9PjSagHvijDw7cLo=
|
||||
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
|
||||
golang.org/x/text v0.8.0 h1:57P1ETyNKtuIjB4SRd15iJxuhj8Gc416Y78H3qgMh68=
|
||||
golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
|
||||
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
|
||||
@@ -89,3 +111,5 @@ google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp0
|
||||
google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
|
||||
google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
|
||||
google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
|
||||
google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
|
||||
google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
|
||||
|
||||
+96
-96
@@ -144,98 +144,20 @@ func New(scan *Scan) *Results {
|
||||
c := CreateColly(scan.Delay, scan.Concurrency, scan.Cache, scan.Timeout,
|
||||
scan.Intensive, scan.Rua, scan.Proxy, scan.UserAgent, scan.Target)
|
||||
|
||||
// On every request that Colly is making, print the URL it's currently visiting
|
||||
c.OnRequest(func(e *colly.Request) {
|
||||
if scan.JSON == false {
|
||||
fmt.Println(e.URL.String())
|
||||
}
|
||||
})
|
||||
event := &Event{
|
||||
ProtocolTemp: protocolTemp,
|
||||
TargetTemp: targetTemp,
|
||||
Target: scan.Target,
|
||||
Intensive: scan.Intensive,
|
||||
Ignore: ignoreBool,
|
||||
Debug: scan.Debug,
|
||||
JSON: scan.JSON,
|
||||
IgnoreSlice: ignoreSlice,
|
||||
URLs: &results.URLs,
|
||||
}
|
||||
|
||||
// On every a element which has href attribute call callback
|
||||
c.OnHTML("a[href]", func(e *colly.HTMLElement) {
|
||||
link := e.Attr("href")
|
||||
if len(link) != 0 && link[0] != '#' {
|
||||
visitHTMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive,
|
||||
ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c)
|
||||
}
|
||||
})
|
||||
|
||||
// On every script element which has src attribute call callback
|
||||
c.OnHTML("script[src]", func(e *colly.HTMLElement) {
|
||||
link := e.Attr("src")
|
||||
visitHTMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive,
|
||||
ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c)
|
||||
})
|
||||
|
||||
// On every link element which has href attribute call callback
|
||||
c.OnHTML("link[href]", func(e *colly.HTMLElement) {
|
||||
link := e.Attr("href")
|
||||
visitHTMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive,
|
||||
ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c)
|
||||
})
|
||||
|
||||
// On every iframe element which has src attribute call callback
|
||||
c.OnHTML("iframe[src]", func(e *colly.HTMLElement) {
|
||||
link := e.Attr("src")
|
||||
visitHTMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive,
|
||||
ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c)
|
||||
})
|
||||
|
||||
// On every svg element which has src attribute call callback
|
||||
c.OnHTML("svg[src]", func(e *colly.HTMLElement) {
|
||||
link := e.Attr("src")
|
||||
visitHTMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive,
|
||||
ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c)
|
||||
})
|
||||
|
||||
// On every img element which has src attribute call callback
|
||||
c.OnHTML("img[src]", func(e *colly.HTMLElement) {
|
||||
link := e.Attr("src")
|
||||
visitHTMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive,
|
||||
ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c)
|
||||
})
|
||||
|
||||
// On every from element which has action attribute call callback
|
||||
c.OnHTML("form[action]", func(e *colly.HTMLElement) {
|
||||
link := e.Attr("action")
|
||||
visitHTMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive,
|
||||
ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c)
|
||||
})
|
||||
|
||||
// Create a callback on the XPath query searching for the URLs
|
||||
c.OnXML("//url", func(e *colly.XMLElement) {
|
||||
link := e.Text
|
||||
visitXMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive,
|
||||
ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c)
|
||||
})
|
||||
|
||||
// Create a callback on the XPath query searching for the URLs
|
||||
c.OnXML("//link", func(e *colly.XMLElement) {
|
||||
link := e.Text
|
||||
visitXMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive,
|
||||
ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c)
|
||||
})
|
||||
|
||||
// Create a callback on the XPath query searching for the URLs
|
||||
c.OnXML("//href", func(e *colly.XMLElement) {
|
||||
link := e.Text
|
||||
visitXMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive,
|
||||
ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c)
|
||||
})
|
||||
|
||||
// Create a callback on the XPath query searching for the URLs
|
||||
c.OnXML("//loc", func(e *colly.XMLElement) {
|
||||
link := e.Text
|
||||
visitXMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive,
|
||||
ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c)
|
||||
})
|
||||
|
||||
// Create a callback on the XPath query searching for the URLs
|
||||
c.OnXML("//fileurl", func(e *colly.XMLElement) {
|
||||
link := e.Text
|
||||
visitXMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive,
|
||||
ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c)
|
||||
})
|
||||
registerHTMLEvents(c, event)
|
||||
registerXMLEvents(c, event)
|
||||
|
||||
// Add headers (if needed) on each request
|
||||
if (len(scan.Headers)) > 0 {
|
||||
@@ -260,13 +182,13 @@ func New(scan *Scan) *Results {
|
||||
(1 <= scan.FileType && scan.FileType <= 7) || scan.ErrorsFlag || scan.InfoFlag {
|
||||
// HERE SCAN FOR SECRETS
|
||||
if scan.SecretsFlag && lengthOk {
|
||||
secretsSlice := huntSecrets(scan.SecretsSlice, r.Request.URL.String(), string(r.Body))
|
||||
secretsSlice := huntSecrets(r.Request.URL.String(), string(r.Body), &scan.SecretsSlice)
|
||||
results.Secrets = append(results.Secrets, secretsSlice...)
|
||||
secrets = append(secrets, secretsSlice...)
|
||||
}
|
||||
// HERE SCAN FOR ENDPOINTS
|
||||
if scan.EndpointsFlag {
|
||||
endpointsSlice := huntEndpoints(scan.EndpointsSlice, r.Request.URL.String())
|
||||
endpointsSlice := huntEndpoints(r.Request.URL.String(), &scan.EndpointsSlice)
|
||||
for _, elem := range endpointsSlice {
|
||||
if len(elem.Parameters) != 0 {
|
||||
results.Endpoints = append(results.Endpoints, elem)
|
||||
@@ -297,7 +219,7 @@ func New(scan *Scan) *Results {
|
||||
}
|
||||
}
|
||||
if scan.JSON {
|
||||
jsonOutput, err := output.GetJsonString(
|
||||
jsonOutput, err := output.GetJSONString(
|
||||
r, secrets, parameters, filetype, errors, infos,
|
||||
)
|
||||
if err == nil {
|
||||
@@ -322,7 +244,7 @@ func New(scan *Scan) *Results {
|
||||
|
||||
if path == "" || path == "/" {
|
||||
absoluteURL = protocolTemp + "://" + scan.Target + addPath + "robots.txt"
|
||||
if !ignoreBool || (ignoreBool && !IgnoreMatch(absoluteURL, ignoreSlice)) {
|
||||
if !ignoreBool || (ignoreBool && !IgnoreMatch(absoluteURL, &ignoreSlice)) {
|
||||
err = c.Visit(absoluteURL)
|
||||
if err != nil && scan.Debug && !errors.Is(err, colly.ErrAlreadyVisited) {
|
||||
log.Println(err)
|
||||
@@ -330,7 +252,7 @@ func New(scan *Scan) *Results {
|
||||
}
|
||||
|
||||
absoluteURL = protocolTemp + "://" + scan.Target + addPath + "sitemap.xml"
|
||||
if !ignoreBool || (ignoreBool && !IgnoreMatch(absoluteURL, ignoreSlice)) {
|
||||
if !ignoreBool || (ignoreBool && !IgnoreMatch(absoluteURL, &ignoreSlice)) {
|
||||
err = c.Visit(absoluteURL)
|
||||
if err != nil && scan.Debug && !errors.Is(err, colly.ErrAlreadyVisited) {
|
||||
log.Println(err)
|
||||
@@ -435,3 +357,81 @@ func CreateColly(delayTime int, concurrency int, cache bool, timeout int,
|
||||
|
||||
return c
|
||||
}
|
||||
|
||||
// registerHTMLEvents registers the associated functions for each
|
||||
// HTML event triggering an action.
|
||||
func registerHTMLEvents(c *colly.Collector, event *Event) {
|
||||
// On every request that Colly is making, print the URL it's currently visiting
|
||||
c.OnRequest(func(e *colly.Request) {
|
||||
if (!event.JSON){
|
||||
fmt.Println(e.URL.String())
|
||||
}
|
||||
})
|
||||
|
||||
// On every a element which has href attribute call callback
|
||||
c.OnHTML("a[href]", func(e *colly.HTMLElement) {
|
||||
link := e.Attr("href")
|
||||
if len(link) != 0 && link[0] != '#' {
|
||||
visitHTMLLink(link, event, e, c)
|
||||
}
|
||||
})
|
||||
|
||||
// On every script element which has src attribute call callback
|
||||
c.OnHTML("script[src]", func(e *colly.HTMLElement) {
|
||||
visitHTMLLink(e.Attr("src"), event, e, c)
|
||||
})
|
||||
|
||||
// On every link element which has href attribute call callback
|
||||
c.OnHTML("link[href]", func(e *colly.HTMLElement) {
|
||||
visitHTMLLink(e.Attr("href"), event, e, c)
|
||||
})
|
||||
|
||||
// On every iframe element which has src attribute call callback
|
||||
c.OnHTML("iframe[src]", func(e *colly.HTMLElement) {
|
||||
visitHTMLLink(e.Attr("src"), event, e, c)
|
||||
})
|
||||
|
||||
// On every svg element which has src attribute call callback
|
||||
c.OnHTML("svg[src]", func(e *colly.HTMLElement) {
|
||||
visitHTMLLink(e.Attr("src"), event, e, c)
|
||||
})
|
||||
|
||||
// On every img element which has src attribute call callback
|
||||
c.OnHTML("img[src]", func(e *colly.HTMLElement) {
|
||||
visitHTMLLink(e.Attr("src"), event, e, c)
|
||||
})
|
||||
|
||||
// On every from element which has action attribute call callback
|
||||
c.OnHTML("form[action]", func(e *colly.HTMLElement) {
|
||||
visitHTMLLink(e.Attr("action"), event, e, c)
|
||||
})
|
||||
}
|
||||
|
||||
// registerXMLEvents registers the associated functions for each
|
||||
// XML event triggering an action.
|
||||
func registerXMLEvents(c *colly.Collector, event *Event) {
|
||||
// Create a callback on the XPath query searching for the URLs
|
||||
c.OnXML("//url", func(e *colly.XMLElement) {
|
||||
visitXMLLink(e.Text, event, e, c)
|
||||
})
|
||||
|
||||
// Create a callback on the XPath query searching for the URLs
|
||||
c.OnXML("//link", func(e *colly.XMLElement) {
|
||||
visitXMLLink(e.Text, event, e, c)
|
||||
})
|
||||
|
||||
// Create a callback on the XPath query searching for the URLs
|
||||
c.OnXML("//href", func(e *colly.XMLElement) {
|
||||
visitXMLLink(e.Text, event, e, c)
|
||||
})
|
||||
|
||||
// Create a callback on the XPath query searching for the URLs
|
||||
c.OnXML("//loc", func(e *colly.XMLElement) {
|
||||
visitXMLLink(e.Text, event, e, c)
|
||||
})
|
||||
|
||||
// Create a callback on the XPath query searching for the URLs
|
||||
c.OnXML("//fileurl", func(e *colly.XMLElement) {
|
||||
visitXMLLink(e.Text, event, e, c)
|
||||
})
|
||||
}
|
||||
|
||||
+49
-46
@@ -12,46 +12,49 @@ import (
|
||||
"github.com/gocolly/colly"
|
||||
)
|
||||
|
||||
type Event struct {
|
||||
ProtocolTemp string
|
||||
TargetTemp string
|
||||
Target string
|
||||
Intensive bool
|
||||
Ignore bool
|
||||
Debug bool
|
||||
JSON bool
|
||||
IgnoreSlice []string
|
||||
URLs *[]string
|
||||
}
|
||||
|
||||
// visitHTMLLink checks if the collector should visit a link or not.
|
||||
func visitHTMLLink(link, protocolTemp, targetTemp, target string, intensive, ignoreBool, debug bool,
|
||||
ignoreSlice []string, finalResults *[]string, e *colly.HTMLElement, c *colly.Collector) {
|
||||
if len(link) != 0 {
|
||||
absoluteURL := urlUtils.AbsoluteURL(protocolTemp, targetTemp, e.Request.AbsoluteURL(link))
|
||||
func visitHTMLLink(link string, event *Event, e *colly.HTMLElement, c *colly.Collector) {
|
||||
if len(link) != 0 && !strings.HasPrefix(link, "data:image") {
|
||||
absoluteURL := urlUtils.AbsoluteURL(event.ProtocolTemp, event.TargetTemp, e.Request.AbsoluteURL(link))
|
||||
// Visit link found on page
|
||||
// Only those links are visited which are in AllowedDomains
|
||||
if (!intensive && urlUtils.SameDomain(protocolTemp+"://"+target, absoluteURL)) ||
|
||||
(intensive && intensiveOk(targetTemp, absoluteURL, debug)) {
|
||||
if !ignoreBool || (ignoreBool && !IgnoreMatch(absoluteURL, ignoreSlice)) {
|
||||
err := c.Visit(absoluteURL)
|
||||
if !errors.Is(err, colly.ErrAlreadyVisited) {
|
||||
*finalResults = append(*finalResults, absoluteURL)
|
||||
|
||||
if err != nil && debug {
|
||||
log.Println(err)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
visitLink(event, c, absoluteURL)
|
||||
}
|
||||
}
|
||||
|
||||
// visitXMLLink checks if the collector should visit a link or not.
|
||||
func visitXMLLink(link, protocolTemp, targetTemp, target string, intensive, ignoreBool, debug bool,
|
||||
ignoreSlice []string, finalResults *[]string, e *colly.XMLElement, c *colly.Collector) {
|
||||
if len(link) != 0 {
|
||||
absoluteURL := urlUtils.AbsoluteURL(protocolTemp, targetTemp, e.Request.AbsoluteURL(link))
|
||||
func visitXMLLink(link string, event *Event, e *colly.XMLElement, c *colly.Collector) {
|
||||
if len(link) != 0 && !strings.HasPrefix(link, "data:image") {
|
||||
absoluteURL := urlUtils.AbsoluteURL(event.ProtocolTemp, event.TargetTemp, e.Request.AbsoluteURL(link))
|
||||
// Visit link found on page
|
||||
// Only those links are visited which are in AllowedDomains
|
||||
if (!intensive && urlUtils.SameDomain(protocolTemp+"://"+target, absoluteURL)) ||
|
||||
(intensive && intensiveOk(targetTemp, absoluteURL, debug)) {
|
||||
if !ignoreBool || (ignoreBool && !IgnoreMatch(absoluteURL, ignoreSlice)) {
|
||||
err := c.Visit(absoluteURL)
|
||||
if !errors.Is(err, colly.ErrAlreadyVisited) {
|
||||
*finalResults = append(*finalResults, absoluteURL)
|
||||
visitLink(event, c, absoluteURL)
|
||||
}
|
||||
}
|
||||
|
||||
if err != nil && debug {
|
||||
log.Println(err)
|
||||
}
|
||||
// visitLink is a protocol agnostic wrapper to visit a link.
|
||||
func visitLink(event *Event, c *colly.Collector, absoluteURL string) {
|
||||
if (!event.Intensive && urlUtils.SameDomain(event.ProtocolTemp+"://"+event.Target, absoluteURL)) ||
|
||||
(event.Intensive && intensiveOk(event.TargetTemp, absoluteURL, event.Debug)) {
|
||||
if !event.Ignore || (event.Ignore && !IgnoreMatch(absoluteURL, &event.IgnoreSlice)) {
|
||||
err := c.Visit(absoluteURL)
|
||||
if !errors.Is(err, colly.ErrAlreadyVisited) {
|
||||
*event.URLs = append(*event.URLs, absoluteURL)
|
||||
|
||||
if err != nil && event.Debug {
|
||||
log.Println(err)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -59,16 +62,16 @@ func visitXMLLink(link, protocolTemp, targetTemp, target string, intensive, igno
|
||||
}
|
||||
|
||||
// huntSecrets hunts for secrets.
|
||||
func huntSecrets(secretsFile []string, target string, body string) []scanner.SecretMatched {
|
||||
func huntSecrets(target, body string, secretsFile *[]string) []scanner.SecretMatched {
|
||||
secrets := SecretsMatch(target, body, secretsFile)
|
||||
return secrets
|
||||
}
|
||||
|
||||
// SecretsMatch checks if a body matches some secrets.
|
||||
func SecretsMatch(url string, body string, secretsFile []string) []scanner.SecretMatched {
|
||||
func SecretsMatch(url, body string, secretsFile *[]string) []scanner.SecretMatched {
|
||||
var secrets []scanner.SecretMatched
|
||||
|
||||
if len(secretsFile) == 0 {
|
||||
if len(*secretsFile) == 0 {
|
||||
for _, secret := range scanner.GetSecretRegexes() {
|
||||
if matched, err := regexp.Match(secret.Regex, []byte(body)); err == nil && matched {
|
||||
re := regexp.MustCompile(secret.Regex)
|
||||
@@ -91,7 +94,7 @@ func SecretsMatch(url string, body string, secretsFile []string) []scanner.Secre
|
||||
}
|
||||
}
|
||||
} else {
|
||||
for _, secret := range secretsFile {
|
||||
for _, secret := range *secretsFile {
|
||||
if matched, err := regexp.Match(secret, []byte(body)); err == nil && matched {
|
||||
re := regexp.MustCompile(secret)
|
||||
match := re.FindStringSubmatch(body)
|
||||
@@ -106,18 +109,18 @@ func SecretsMatch(url string, body string, secretsFile []string) []scanner.Secre
|
||||
}
|
||||
|
||||
// huntEndpoints hunts for juicy endpoints.
|
||||
func huntEndpoints(endpointsFile []string, target string) []scanner.EndpointMatched {
|
||||
func huntEndpoints(target string, endpointsFile *[]string) []scanner.EndpointMatched {
|
||||
endpoints := EndpointsMatch(target, endpointsFile)
|
||||
return endpoints
|
||||
}
|
||||
|
||||
// EndpointsMatch check if an endpoint matches a juicy parameter.
|
||||
func EndpointsMatch(target string, endpointsFile []string) []scanner.EndpointMatched {
|
||||
func EndpointsMatch(target string, endpointsFile *[]string) []scanner.EndpointMatched {
|
||||
endpoints := []scanner.EndpointMatched{}
|
||||
matched := []scanner.Parameter{}
|
||||
parameters := urlUtils.RetrieveParameters(target)
|
||||
|
||||
if len(endpointsFile) == 0 {
|
||||
if len(*endpointsFile) == 0 {
|
||||
for _, parameter := range scanner.GetJuicyParameters() {
|
||||
for _, param := range parameters {
|
||||
if strings.ToLower(param) == parameter.Parameter {
|
||||
@@ -127,7 +130,7 @@ func EndpointsMatch(target string, endpointsFile []string) []scanner.EndpointMat
|
||||
}
|
||||
endpoints = append(endpoints, scanner.EndpointMatched{Parameters: matched, URL: target})
|
||||
} else {
|
||||
for _, parameter := range endpointsFile {
|
||||
for _, parameter := range *endpointsFile {
|
||||
for _, param := range parameters {
|
||||
if param == parameter {
|
||||
matched = append(matched, scanner.Parameter{Parameter: parameter, Attacks: []string{}})
|
||||
@@ -162,13 +165,13 @@ func huntExtensions(target string, severity int) scanner.FileTypeMatched {
|
||||
}
|
||||
|
||||
// huntErrors hunts for errors.
|
||||
func huntErrors(target string, body string) []scanner.ErrorMatched {
|
||||
func huntErrors(target, body string) []scanner.ErrorMatched {
|
||||
errorsSlice := ErrorsMatch(target, body)
|
||||
return errorsSlice
|
||||
}
|
||||
|
||||
// ErrorsMatch checks the patterns for errors.
|
||||
func ErrorsMatch(url string, body string) []scanner.ErrorMatched {
|
||||
func ErrorsMatch(url, body string) []scanner.ErrorMatched {
|
||||
errors := []scanner.ErrorMatched{}
|
||||
|
||||
for _, errorItem := range scanner.GetErrorRegexes() {
|
||||
@@ -186,13 +189,13 @@ func ErrorsMatch(url string, body string) []scanner.ErrorMatched {
|
||||
}
|
||||
|
||||
// huntInfos hunts for infos.
|
||||
func huntInfos(target string, body string) []scanner.InfoMatched {
|
||||
func huntInfos(target, body string) []scanner.InfoMatched {
|
||||
infosSlice := InfoMatch(target, body)
|
||||
return infosSlice
|
||||
}
|
||||
|
||||
// InfoMatch checks the patterns for infos.
|
||||
func InfoMatch(url string, body string) []scanner.InfoMatched {
|
||||
func InfoMatch(url, body string) []scanner.InfoMatched {
|
||||
infos := []scanner.InfoMatched{}
|
||||
|
||||
for _, infoItem := range scanner.GetInfoRegexes() {
|
||||
@@ -210,8 +213,8 @@ func InfoMatch(url string, body string) []scanner.InfoMatched {
|
||||
}
|
||||
|
||||
// RetrieveBody retrieves the body (in the response) of a url.
|
||||
func RetrieveBody(target string) string {
|
||||
sb, err := GetRequest(target)
|
||||
func RetrieveBody(target *string) string {
|
||||
sb, err := GetRequest(*target)
|
||||
if err == nil && sb != "" {
|
||||
return sb
|
||||
}
|
||||
@@ -220,8 +223,8 @@ func RetrieveBody(target string) string {
|
||||
}
|
||||
|
||||
// IgnoreMatch checks if the URL should be ignored or not.
|
||||
func IgnoreMatch(url string, ignoreSlice []string) bool {
|
||||
for _, ignore := range ignoreSlice {
|
||||
func IgnoreMatch(url string, ignoreSlice *[]string) bool {
|
||||
for _, ignore := range *ignoreSlice {
|
||||
if strings.Contains(url, ignore) {
|
||||
return true
|
||||
}
|
||||
|
||||
@@ -39,8 +39,8 @@ func Beautify() {
|
||||
banner2 := " ___ __ _ _ __(_) __| | __| (_)\n"
|
||||
banner3 := " / __/ _` | '__| |/ _` |/ _` | |\n"
|
||||
banner4 := " | (_| (_| | | | | (_| | (_| | |\n"
|
||||
banner5 := " \\___\\__,_|_| |_|\\__,_|\\__,_|_| v1.2.1\n"
|
||||
banner6 := "\n"
|
||||
banner5 := " \\___\\__,_|_| |_|\\__,_|\\__,_|_| v1.3.0\n"
|
||||
banner6 := ""
|
||||
banner7 := " > github.com/edoardottt/cariddi\n"
|
||||
banner8 := " > edoardoottavianelli.it\n"
|
||||
banner9 := "========================================\n"
|
||||
@@ -49,7 +49,7 @@ func Beautify() {
|
||||
bannerPart2 := banner6 + banner7 + banner8 + banner9
|
||||
|
||||
color.Set(color.FgCyan)
|
||||
fmt.Fprintf(os.Stderr, bannerPart1)
|
||||
fmt.Fprint(os.Stderr, bannerPart1)
|
||||
color.Unset()
|
||||
fmt.Fprintf(os.Stderr, bannerPart2)
|
||||
fmt.Fprint(os.Stderr, bannerPart2)
|
||||
}
|
||||
|
||||
+12
-8
@@ -35,7 +35,7 @@ import (
|
||||
"github.com/gocolly/colly"
|
||||
)
|
||||
|
||||
type JsonData struct {
|
||||
type JSONData struct {
|
||||
URL string `json:"url"`
|
||||
Method string `json:"method"`
|
||||
StatusCode int `json:"status_code"`
|
||||
@@ -60,7 +60,7 @@ type MatcherResult struct {
|
||||
Match string `json:"match"`
|
||||
}
|
||||
|
||||
func GetJsonString(
|
||||
func GetJSONString(
|
||||
r *colly.Response,
|
||||
secrets []scanner.SecretMatched,
|
||||
parameters []scanner.Parameter,
|
||||
@@ -68,22 +68,28 @@ func GetJsonString(
|
||||
errors []scanner.ErrorMatched,
|
||||
infos []scanner.InfoMatched,
|
||||
) ([]byte, error) {
|
||||
|
||||
// Parse response headers
|
||||
headers := r.Headers
|
||||
contentTypes := (*headers)["Content-Type"]
|
||||
contentLengths := (*headers)["Content-Length"]
|
||||
contentType := ""
|
||||
contentLength := 0
|
||||
errorList := []MatcherResult{}
|
||||
infoList := []MatcherResult{}
|
||||
secretList := []MatcherResult{}
|
||||
|
||||
// Set content type
|
||||
if len(contentTypes) > 0 {
|
||||
contentType = contentTypes[0]
|
||||
contentType = strings.Split(contentTypes[0], "; ")[0]
|
||||
}
|
||||
|
||||
contentLength := 0
|
||||
contentLengths := (*headers)["Content-Length"]
|
||||
// Set content length
|
||||
if len(contentLengths) > 0 {
|
||||
ret, err := strconv.Atoi(contentLengths[0])
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
contentLength = ret
|
||||
}
|
||||
|
||||
@@ -94,14 +100,12 @@ func GetJsonString(
|
||||
lines := len(strings.Split(string(r.Body), "\n"))
|
||||
|
||||
// Process secrets
|
||||
secretList := []MatcherResult{}
|
||||
for _, secret := range secrets {
|
||||
secretMatch := MatcherResult{secret.Secret.Name, secret.Match}
|
||||
secretList = append(secretList, secretMatch)
|
||||
}
|
||||
|
||||
// Process infos
|
||||
infoList := []MatcherResult{}
|
||||
for _, info := range infos {
|
||||
secretMatch := MatcherResult{info.Info.Name, info.Match}
|
||||
infoList = append(infoList, secretMatch)
|
||||
|
||||
+42
-7
@@ -86,14 +86,14 @@ func GetSecretRegexes() []Secret {
|
||||
"Facebook Secret Key",
|
||||
"Facebook Secret Key",
|
||||
`(?i)(facebook|fb)(.{0,20})?(?-i)['\"][0-9a-f]{32}['\"]`,
|
||||
[]string{"facebook.com/", "facebook.svg"},
|
||||
[]string{"facebook.com", "facebook.svg"},
|
||||
"?",
|
||||
},
|
||||
{
|
||||
"Facebook Client ID",
|
||||
"Facebook Client ID",
|
||||
`(?i)(facebook|fb)(.{0,20})?['\"][0-9]{13,17}['\"]`,
|
||||
[]string{"facebook.com/", "facebook.svg"},
|
||||
[]string{"facebook.com", "facebook.svg"},
|
||||
"?",
|
||||
},
|
||||
{
|
||||
@@ -114,14 +114,14 @@ func GetSecretRegexes() []Secret {
|
||||
"Twitter Secret Key",
|
||||
"Twitter Secret Key",
|
||||
`(?i)twitter(.{0,20})?[0-9a-z]{35,44}`,
|
||||
[]string{},
|
||||
[]string{"twitter.com"},
|
||||
"?",
|
||||
},
|
||||
{
|
||||
"Twitter Client ID",
|
||||
"Twitter Client ID",
|
||||
`(?i)twitter(.{0,20})?[0-9a-z]{18,25}`,
|
||||
[]string{},
|
||||
[]string{"twitter.com"},
|
||||
"?",
|
||||
},
|
||||
{
|
||||
@@ -156,14 +156,14 @@ func GetSecretRegexes() []Secret {
|
||||
"LinkedIn Client ID",
|
||||
"LinkedIn Client ID",
|
||||
`(?i)linkedin(.{0,20})?(?-i)[0-9a-z]{12}`,
|
||||
[]string{"linkedin.com/", "linkedin.svg"},
|
||||
[]string{"linkedin.com", "linkedin.svg"},
|
||||
"?",
|
||||
},
|
||||
{
|
||||
"LinkedIn Secret Key",
|
||||
"LinkedIn Secret Key",
|
||||
`(?i)linkedin(.{0,20})?[0-9a-z]{16}`,
|
||||
[]string{"linkedin.com/", "linkedin.svg"},
|
||||
[]string{"linkedin.com", "linkedin.svg"},
|
||||
"?",
|
||||
},
|
||||
{
|
||||
@@ -333,7 +333,42 @@ func GetSecretRegexes() []Secret {
|
||||
"S3 Bucket",
|
||||
`(?:[a-zA-Z0-9_-]+s3\.amazonaws\.com|[a-zA-Z0-9_.-]+amazonaws\.com|` +
|
||||
`[a-zA-Z0-9-\.\_]+\.s3\.amazonaws\.com|s3\:\/\/[a-zA-Z0-9-\.\_]+|` +
|
||||
`s3-[a-zA-Z0-9-\.\_\/]+|s3\.amazonaws\.com/[a-zA-Z0-9-\.\_]+)`,
|
||||
`s3\.amazonaws\.com/[a-zA-Z0-9-\.\_]+)`,
|
||||
[]string{},
|
||||
"?",
|
||||
},
|
||||
{
|
||||
"Discord Webhook",
|
||||
"Discord Webhook",
|
||||
`https\:\/\/discordapp\.com\/api\/webhooks\/[0-9]+/[A-Za-z0-9\-]+`,
|
||||
[]string{},
|
||||
"?",
|
||||
},
|
||||
{
|
||||
"Google Calendar URI",
|
||||
"Google Calendar URI",
|
||||
`https\:\/\/(.*)calendar\.google\.com\/calendar\/[0-9a-z\/]+\/embed\?src=[A-Za-z0-9%@&;=\-_\.\/]+`,
|
||||
[]string{},
|
||||
"?",
|
||||
},
|
||||
{
|
||||
"Google OAuth Access Key",
|
||||
"Google OAuth Access Key",
|
||||
`ya29\.[0-9A-Za-z\-_]+`,
|
||||
[]string{},
|
||||
"?",
|
||||
},
|
||||
{
|
||||
"Mapbox Token Disclosure",
|
||||
"Mapbox Token Disclosure",
|
||||
`(pk|sk)\.eyJ1Ijoi\w+\.[\w-]*`,
|
||||
[]string{},
|
||||
"?",
|
||||
},
|
||||
{
|
||||
"Microsoft Teams Webhook",
|
||||
"Microsoft Teams Webhook",
|
||||
`https\:\/\/outlook\.office\.com\/webhook\/[A-Za-z0-9\-@]+\/IncomingWebhook\/[A-Za-z0-9\-]+\/[A-Za-z0-9\-]+`,
|
||||
[]string{},
|
||||
"?",
|
||||
},
|
||||
|
||||
@@ -0,0 +1,22 @@
|
||||
name: cariddi
|
||||
summary: Fast web crawler and scanner
|
||||
description: |
|
||||
Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more
|
||||
version: 1.3.0
|
||||
grade: stable
|
||||
base: core20
|
||||
|
||||
confinement: strict
|
||||
|
||||
apps:
|
||||
cariddi:
|
||||
command: bin/cariddi
|
||||
plugs:
|
||||
- home
|
||||
- network
|
||||
|
||||
parts:
|
||||
cariddi:
|
||||
plugin: go
|
||||
source-type: git
|
||||
source: https://github.com/edoardottt/cariddi
|
||||
Reference in New Issue
Block a user