yellow.git


yellow

~ opinionated web scanning pipeline for pentesters in a hurry
git clone https://github.com/djnnvx/yellow.git
log | files | refs | archive | README | LICENSE

commit 0d4d95cb9927e4f3b9d49b162439fd95108332dd
parent 095edb7cade26fd69e8d6a8c08f1f1fef9027f40
Author: djnn <[email protected]>
Date: Wed, 4 Dec 2024 23:41:15 +0900

fix(meta): output things

Diffstat:
Mhelpers/file.go | 3+--
Mhelpers/strings.go | 2+-
Mosint/run.go | 2+-
Mscan/naabu.go | 2++
Mscan/run.go | 17++++++++++++++---
Mscan/sitemap.go | 2+-
Mscan/wappalyzergo.go | 2+-

7 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/helpers/file.go b/helpers/file.go
@@ -6,7 +6,6 @@ import (
 	"io"
 	"io/ioutil"
 	"os"
-	"strings"
 )
 
 type FileScanner struct {
@@ -26,7 +25,7 @@ func LoadTargetFile(targetPath string) *FileScanner {
 		fmt.Printf("%v, %+v", err, targetPath)
 	}
 
-	fmt.Println("Loaded target: \n%v", strings.Replace(string(body), "\n", ", ", -1))
+	fmt.Println("[+] Loaded targets: \n", string(body))
 
 	return &FileScanner{file, scanner}
 }
diff --git a/helpers/strings.go b/helpers/strings.go
@@ -21,7 +21,7 @@ func ReplaceWithHyphen(input string) string {
 // if its not a valid domain in the end, not too big of a deal,
 // we just want an approximate response
 func StringHasUnwantedCharacters(url string) bool {
-    badChars := ":;\t\n, +\\\"[]{}()"
+	badChars := ":;\t\n, +\\\"[]{}()"
 	for _, b := range badChars {
 		if strings.Contains(url, string(b)) {
 			return true
diff --git a/osint/run.go b/osint/run.go
@@ -158,6 +158,6 @@ func (opts OsintOpts) Run() {
 	}
 
 	fmt.Printf("[OSINT %s] Registered %v IP addresses and assets.\n", opts.domain, len(domains))
-    fmt.Printf("[OSINT %s] Location of unique domain names: %s.\n", opts.domain, uniqueOutfile)
+	fmt.Printf("[OSINT %s] Location of unique domain names: %s.\n", opts.domain, uniqueOutfile)
 	fmt.Printf("[OSINT %s] done.\n", opts.domain)
 }
diff --git a/scan/naabu.go b/scan/naabu.go
@@ -28,6 +28,8 @@ func (d *Naabu) Configure(c interface{}) {
 
 func (d *Naabu) Run(url string) {
 
+	/* TODO(djnn): check if ASN is cloudflare / fly.io / or a cdn and if so, bypass */
+
 	var fullScan string
 	options := runner.Options{
 		Host:     goflags.StringSlice{url},
diff --git a/scan/run.go b/scan/run.go
@@ -114,10 +114,21 @@ func (opts *ScanOpts) Run() {
 		}
 	}
 
-	naabuScanFile := fullPath + "/open-ports-top-1000.txt"
-	opts.SetScanPath(naabuScanFile)
+	/*
+
+	    oldScan := opts.scanPath
+		naabuScanFile := fullPath + "/open-ports-top-1000.txt"
+		opts.SetScanPath(naabuScanFile)
+
+		opts.runNaabu()
+	    opts.SetScanPath(oldScan) */
+
+	if opts.forceInsecure {
+		opts.SetDomain("http://" + opts.domain)
+	} else {
+		opts.SetDomain("https://" + opts.domain)
+	}
 
-	opts.runNaabu()
 	opts.runSitemap()
 	opts.runRobots()
 	opts.runWappalyzerGo()
diff --git a/scan/sitemap.go b/scan/sitemap.go
@@ -64,7 +64,7 @@ func (d *Sitemap) Run(domain string) {
 		}
 	}
 
-	fmt.Printf("[SCAN %s] Sitemap scan for %s completed\n\n", domain)
+	fmt.Printf("[SCAN %s] Sitemap scan for %s completed\n\n", domain, domain)
 }
 
 func contains(slice []string, item string) bool {
diff --git a/scan/wappalyzergo.go b/scan/wappalyzergo.go
@@ -50,5 +50,5 @@ func (d *WappalyzerGo) Run(url string) {
 		fmt.Printf("%v\n", fingerprints)
 	}
 
-	fmt.Printf("[SCAN %s] WappalyzerGo scan for %s completed\n\n", url)
+	fmt.Printf("[SCAN %s] WappalyzerGo scan for %s completed\n\n", url, url)
 }