mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-10-20 23:31:31 +02:00
Yogesh OjhaandClaude Opus 5
56fe4d4b00
The wordlist field was a free-text absolute path, so the only lists anyone could actually use were the two baked into the image. Changing that meant a bind mount or a docker cp — a sysadmin action, not a product one — which in practice meant every install guessed from the same list. Bruteforce quality is almost entirely wordlist quality, so the knob was there and nobody could reach it. Wordlists are now a library, on the same shape as the nuclei check library. Shipped lists stay in the image and are indexed on read so the picker never starts empty; uploads land under a `wordlists` volume shared by api and worker. A config field holds a slug, never a path — `stages/config.py:wordlist(kind)` declares one the way `threads()` and `rate()` declare theirs, and carries the kind the picker filters on so a DNS stage is never offered a list of URL paths. `lookup()` still accepts the absolute paths older engines stored, so an existing engine keeps working. The UI is the Arsenal's second tab, which is why the Arsenal is now "what your scans run with" rather than only scanners and their checks: upload, filter by what the words are, preview the first 200 in the order a scan will read them, delete an upload. Every list shows the name an engine refers to it by, because that is the thing you type into a YAML document. `resolve_path()` refuses anything resolving outside its origin's root and `delete_custom()` refuses a shipped list — the guard the template library learned the hard way. A stage that cannot find its list says so and reports PARTIAL rather than quietly guessing from a different one; that is how the shared volume being absent was caught during the end-to-end run. Verified end to end: a seven-word list uploaded through the API, selected by slug, every passive source disabled — the scan returned six hosts, all attributed to bruteforce. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DPueZXQMbjLXMokXeA8LFP
96 lines
2.3 KiB
Python
96 lines
2.3 KiB
Python
"""The wordlist vocabulary: what a guessing stage reads, and where it may read it from."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from enum import StrEnum
|
|
|
|
from pydantic import BaseModel
|
|
|
|
BUILTIN_ROOT = "/app/tools/data"
|
|
CUSTOM_ROOT = "/app/wordlists/custom"
|
|
|
|
MAX_WORDLIST_BYTES = 8 * 1024 * 1024
|
|
MAX_WORDLIST_UPLOAD = 10
|
|
# a DNS label is 63 characters; a longer line is not a word
|
|
MAX_WORD_LENGTH = 63
|
|
MAX_SLUG_LENGTH = 64
|
|
|
|
|
|
class WordlistOrigin(StrEnum):
|
|
BUILTIN = "builtin"
|
|
CUSTOM = "custom"
|
|
|
|
|
|
class WordlistKind(StrEnum):
|
|
"""What the words are, so a stage never offers a list it cannot use."""
|
|
|
|
SUBDOMAIN = "subdomain"
|
|
VHOST = "vhost"
|
|
CONTENT = "content"
|
|
|
|
|
|
KIND_LABELS: dict[str, str] = {
|
|
WordlistKind.SUBDOMAIN.value: "Subdomain names",
|
|
WordlistKind.VHOST.value: "Virtual host names",
|
|
WordlistKind.CONTENT.value: "Paths and files",
|
|
}
|
|
|
|
|
|
class BuiltinWordlist(BaseModel):
|
|
slug: str
|
|
filename: str
|
|
name: str
|
|
kind: str
|
|
description: str
|
|
|
|
|
|
# shipped with the image, indexed on first read so they appear beside uploads
|
|
BUILTIN_WORDLISTS: tuple[BuiltinWordlist, ...] = (
|
|
BuiltinWordlist(
|
|
slug="common-subdomains",
|
|
filename="subdomains.txt",
|
|
name="Common subdomains",
|
|
kind=WordlistKind.SUBDOMAIN.value,
|
|
description=(
|
|
"Names ranked by how often they appear in public DNS data, best first. "
|
|
"A smaller word budget reads from the top of this ranking."
|
|
),
|
|
),
|
|
BuiltinWordlist(
|
|
slug="common-vhosts",
|
|
filename="vhosts.txt",
|
|
name="Common virtual hosts",
|
|
kind=WordlistKind.VHOST.value,
|
|
description="Short list of host names worth trying against an address directly.",
|
|
),
|
|
)
|
|
|
|
DEFAULT_WORDLIST: dict[str, str] = {
|
|
WordlistKind.SUBDOMAIN.value: "common-subdomains",
|
|
WordlistKind.VHOST.value: "common-vhosts",
|
|
}
|
|
|
|
|
|
def slugify(value: str) -> str:
|
|
out = "".join(c if c.isalnum() else "-" for c in value.strip().lower())
|
|
while "--" in out:
|
|
out = out.replace("--", "-")
|
|
return out.strip("-")[:MAX_SLUG_LENGTH]
|
|
|
|
|
|
__all__ = [
|
|
"BUILTIN_ROOT",
|
|
"BUILTIN_WORDLISTS",
|
|
"CUSTOM_ROOT",
|
|
"DEFAULT_WORDLIST",
|
|
"KIND_LABELS",
|
|
"MAX_SLUG_LENGTH",
|
|
"MAX_WORDLIST_BYTES",
|
|
"MAX_WORDLIST_UPLOAD",
|
|
"MAX_WORD_LENGTH",
|
|
"BuiltinWordlist",
|
|
"WordlistKind",
|
|
"WordlistOrigin",
|
|
"slugify",
|
|
]
|