yellow.git


yellow

~ opinionated web scanning pipeline for pentesters in a hurry
git clone https://github.com/djnnvx/yellow.git
log | files | refs | archive | README | LICENSE

commit 7e2d03fbe8150041c13dbdc58b859c44022cfc5e
parent 4822d8df75fa71b2691b25641533901b96e7f852
Author: djnn <[email protected]>
Date: Thu, 5 Dec 2024 18:52:45 +0900

fix(scan): `gobuster` call

Diffstat:
Mscan/gobuster.go | 10++++++++--
Mscan/run.go | 40+++++++++++++++++++---------------------

2 files changed, 27 insertions(+), 23 deletions(-)

diff --git a/scan/gobuster.go b/scan/gobuster.go
@@ -42,6 +42,11 @@ func (g *Gobuster) Run(url string) {
 	pluginOpts.Proxy = g.proxy
 	pluginOpts.NoTLSValidation = g.insecure
 	pluginOpts.UserAgent = helper.GetUserAgent()
+	pluginOpts.URL = url
+	pluginOpts.Method = "GET"
+
+	ssc, _ := libgobuster.ParseCommaSeparatedInt("302,404,500")
+	pluginOpts.StatusCodesBlacklistParsed = ssc
 
 	plugin, err := gobusterdir.NewGobusterDir(GlobalOpts, pluginOpts)
 	if err != nil {
@@ -54,9 +59,10 @@ func (g *Gobuster) Run(url string) {
 
 		var wErr *gobusterdir.ErrWildcard
 		if errors.As(err, &wErr) {
-			fmt.Printf("%w. To continue please exclude the status code or the length\n", wErr)
+			fmt.Printf("%v.\nTo continue please exclude the status code or the length\n", wErr)
+			fmt.Printf("\nSince gobuster cannot make the difference between good and bad urls, it will be skipped.\n\n")
+			return
 		}
-		panic(err)
 	}
 
 	fmt.Printf("[SCAN %s] Gobuster scan for %s completed\n\n", url)
diff --git a/scan/run.go b/scan/run.go
@@ -16,24 +16,6 @@ type ScanOpts struct {
 	withPortScan  bool
 }
 
-func (opts ScanOpts) runGobusterDir() {
-
-	nb := Naabu{}
-	nbCfg := make(map[string]interface{})
-
-	nbCfg["scanPath"] = opts.scanPath
-	nbCfg["proxy"] = opts.proxy
-	nbCfg["rateLimit"] = opts.rateLimit
-	nbCfg["wordlist"] = opts.wordlistPath
-	nbCfg["insecure"] = opts.forceInsecure
-
-	nb.Configure(nbCfg)
-	nb.Info(opts.domain)
-	if !opts.dryRun {
-		nb.Run(opts.domain)
-	}
-}
-
 func (opts *ScanOpts) SetWithPortScan(data bool) {
 	opts.withPortScan = data
 }
@@ -143,6 +125,24 @@ func (opts *ScanOpts) runHttpx() {
 	}
 }
 
+func (opts ScanOpts) runGobusterDir() {
+
+	nb := Gobuster{}
+	nbCfg := make(map[string]interface{})
+
+	nbCfg["scanPath"] = opts.scanPath
+	nbCfg["proxy"] = opts.proxy
+	nbCfg["rateLimit"] = opts.rateLimit
+	nbCfg["wordlist"] = opts.wordlistPath
+	nbCfg["insecure"] = opts.forceInsecure
+
+	nb.Configure(nbCfg)
+	nb.Info(opts.domain)
+	if !opts.dryRun {
+		nb.Run(opts.domain)
+	}
+}
+
 func (opts *ScanOpts) Run() {
 	fmt.Printf("\n[SCAN] domain: %s\n", opts.domain)
 
@@ -169,10 +169,8 @@ func (opts *ScanOpts) Run() {
 		opts.runRobots()
 		opts.runWappalyzerGo()
 		opts.runHttpx()
+		opts.runGobusterDir()
 
-		/*
-		   - gobuster
-		*/
 	} else {
 		fmt.Printf("[SCAN %s] => no web panel online. skipping\n", opts.domain)
 	}