Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ability to disable dirbusting via --dirbuster.tool=none argument #193

Open
wants to merge 10 commits into
base: main
Choose a base branch
from

Conversation

ShyftXero
Copy link

I was always hitting tarpits dirbusting http-based services that didn't need to be dirbusted.

Something like tcp/5357 is less useful to dirbust than 5000 or the like. (might consider avoiding known HTTP services that don't do much or killing dirbuster if no new dirs found in a given amount of time? idk... for another time)

--dirbuster.tool=none or --dirbuster.tool none

poetry run autorecon shyft.us --dirbuster.tool none -vvv

image


Also a slight deviation from the way the choices are passed into argparse.
It was helpful to have the tools tied to an attribute of the plugin and then referenced in the configure method.

image

@Tib3rius
Copy link
Owner

You can disable the plugin using the tagging system by doing --exclude-tags=dirbuster

Is there a reason why adding a "none" tool option would be better? Your point about only running dirbuster against specific ports, or excluding ports is an interesting feature idea though.

@ShyftXero
Copy link
Author

Well, had I taken the time to read or understand the docs thoroughly I might have gotten that...

I was thinking about the plugin devs having the list upfront and making that a valid option.

It might be useful to allow a different dirbuster binary to be specified.

--dirbuster.tool='somesuper1337dirbtool -u %url% -o %output_file%'
That way you wouldn't have to write a plugin to support a new tool dirb tool.
Bit of a new set of params that are passed via those %something% vars.
I feel like that's feature creep, but as I'm thinking about that it feels useful.

@ShyftXero
Copy link
Author

ShyftXero commented Feb 23, 2023

I think it might require something of a community survey to collect "Top 10 useless http ports to dirbust on a pentest" so there'd be some community guidance about "useless/not useless".

Or not... It's your project. Pick whatever ports you want. Lol

@Tib3rius
Copy link
Owner

Tib3rius commented Mar 2, 2023

I think adding a disabled-by-default --dirbuster.onlyports would be worth implementing. Then users could choose their own ports to include, e.g. --dirbuster.onlyports=80,443,8080,8443 etc.

As for writing a plugin to support a new tool, I have no issue with doing that, it's kinda the point of the plugin system, which replaced the config file based system in v1. Going back to passing full commands either via a config file or on the command line would be something I'd be against, since ideally you could easily just create a plugin.

Heck, you could create a plugin which matched all services and then ran commands based off a config file it loaded in if you wanted to.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants