Merge pull request #40 from grimd34th/master

Add rate limiting - Untested

README.md

@@ -40,6 +40,7 @@ $ pip install -r requirements.txt
 | --unique-depth UNIQUE_DEPTH | Show likely matches of page content that is found x times (default 1). |
 | --ssl | If set then connections will be made over HTTPS instead of HTTP. |
 | --fuzzy-logic | If set then all unique content replies are compared and a similarity ratio is given for each pair. This helps to isolate vhosts in situations where a default page isn't static (such as having the time on it). |
+| --rate_limit | Amount of time in seconds to delay between each scan (default 0). |
 | --waf | If set then simple WAF bypass headers will be sent. |
 | -oN OUTPUT_NORMAL | Normal output printed to a file when the -oN option is specified with a filename argument. |
 | - | By passing a blank '-' you tell VHostScan to expect input from stdin (pipe). |

VHostScan.py

@@ -28,6 +28,7 @@ def main():
     parser.add_argument('--unique-depth', dest='unique_depth', type=int, help='Show likely matches of page content that is found x times (default 1).', default=1)
     parser.add_argument("--ssl", dest="ssl",   action="store_true", help="If set then connections will be made over HTTPS instead of HTTP (default http).", default=False)
     parser.add_argument("--fuzzy-logic", dest="fuzzy_logic", action="store_true", help="If set then fuzzy match will be performed against unique hosts (default off).", default=False)
+    parser.add_argument("--rate-limit", dest="rate_limit", type=int, help='Amount of time in seconds to delay between each scan (default 0).', default=0)
     parser.add_argument("--waf", dest="add_waf_bypass_headers",   action="store_true", help="If set then simple WAF bypass headers will be sent.", default=False)
     parser.add_argument("-oN",   dest="output_normal", help="Normal output printed to a file when the -oN option is specified with a filename argument." )
     parser.add_argument("-", dest="stdin", action="store_true", help="By passing a blank '-' you tell VHostScan to expect input from stdin (pipe).", default=False)

lib/core/virtual_host_scanner.py

@@ -2,10 +2,10 @@
 import requests
 import hashlib
 import pandas as pd
+import time
 from lib.core.discovered_host import *
 
 
-
 class virtual_host_scanner(object):
     """Virtual host scanning class
     
@@ -19,11 +19,13 @@ class virtual_host_scanner(object):
         ignore_content_length: integer value of content length to ignore
         output: folder to write output file to
     """
-
+
+
     def __init__(self, target, wordlist, **kwargs):
         self.target = target
         self.wordlist = wordlist
         self.base_host = kwargs.get('base_host')
+        self.rate_limit = int(kwargs.get('rate_limit', 0))
         self.port = int(kwargs.get('port', 80))
         self.real_port = int(kwargs.get('real_port', 80))
         self.ignore_content_length = int(kwargs.get('ignore_content_length', 0))
@@ -50,6 +52,7 @@ def ignore_http_codes(self):
     def ignore_http_codes(self, codes):
         self._ignore_http_codes = [int(code) for code in codes.replace(' ', '').split(',')]
 
+
     def scan(self):
         if not self.base_host:
             self.base_host = self.target
@@ -111,6 +114,9 @@ def scan(self):
 
             # add url and hash into array for likely matches
             self.results.append(hostname + ',' + page_hash)
+
+	    #rate limit the connection, if the int is 0 it is ignored
+	    time.sleep(self.rate_limit)
 
         self.completed_scan=True