-
-
Notifications
You must be signed in to change notification settings - Fork 890
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Ability to disable dirbusting via --dirbuster.tool=none argument #193
base: main
Are you sure you want to change the base?
Conversation
…ature-disable_dirbuster
You can disable the plugin using the tagging system by doing --exclude-tags=dirbuster Is there a reason why adding a "none" tool option would be better? Your point about only running dirbuster against specific ports, or excluding ports is an interesting feature idea though. |
Well, had I taken the time to read or understand the docs thoroughly I might have gotten that... I was thinking about the plugin devs having the list upfront and making that a valid option. It might be useful to allow a different dirbuster binary to be specified.
|
I think it might require something of a community survey to collect "Top 10 useless http ports to dirbust on a pentest" so there'd be some community guidance about "useless/not useless". Or not... It's your project. Pick whatever ports you want. Lol |
I think adding a disabled-by-default --dirbuster.onlyports would be worth implementing. Then users could choose their own ports to include, e.g. As for writing a plugin to support a new tool, I have no issue with doing that, it's kinda the point of the plugin system, which replaced the config file based system in v1. Going back to passing full commands either via a config file or on the command line would be something I'd be against, since ideally you could easily just create a plugin. Heck, you could create a plugin which matched all services and then ran commands based off a config file it loaded in if you wanted to. |
I was always hitting tarpits dirbusting http-based services that didn't need to be dirbusted.
Something like tcp/5357 is less useful to dirbust than 5000 or the like. (might consider avoiding known HTTP services that don't do much or killing dirbuster if no new dirs found in a given amount of time? idk... for another time)
--dirbuster.tool=none
or--dirbuster.tool none
poetry run autorecon shyft.us --dirbuster.tool none -vvv
Also a slight deviation from the way the choices are passed into argparse.
It was helpful to have the tools tied to an attribute of the plugin and then referenced in the configure method.