-
-
Notifications
You must be signed in to change notification settings - Fork 397
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Dalfox uses the filename instead of it's content on the file mode #134
Comments
Thank you for your first issue report :D |
Hi @DEMON1A |
it's just a Wayback URLs with parameters and it's value is FUZZ. all of them are HTTP and HTTPs but not all of them are live URLs. |
Here's an example from the real file.
|
Also, lol sorry. the test file on the second results was |
@DEMON1A |
Oh. Sorry about that. you didn't really understand me. the
I think as a quick fix I won't use the binary anymore. I will create a bash alias that runs dalfox from the source code itself on the |
Hi @DEMON1A my test log
and If it's snapcraft, it could be about permission. snapcraft is very strict about permission. I'll look for more! Thank you very much. |
I installed the tool using |
@DEMON1A As you can see from the above commit, I did find a problem with snapcraft. So I just proceeded with an additional patch. First of all, if you had installed it with go get, it would have been built on the path ~/go/bin/dalfox, so please test it again with the tool of that path. |
@DEMON1A if your not installed
if you insatlled
|
Hi @hahwul I just tested it with snap now on the new version. it works fine now without any problems and it loads the file content.
|
Bless up ☝🏾
…On 31 Oct 2020, 00:51 +0000, Mohamed Dief ***@***.***>, wrote:
Hi @hahwul
I just tested it with snap now on the new version. it works fine now without any problems and it loads the file content.
***@***.***:~ - echo "https://slack.com/" > test.txt
***@***.***:~ - dalfox file test.txt
_..._
.' .::::. __ _ _ ___ _ __ __
: :::::::: | \ / \ | | | __/ \\ V /
: :::::::: | o ) o || |_ | _( o )) (
'. '::::::' |__/|_n_||___||_| \_//_n_\
'-.::''
Parameter Analysis and XSS Scanning tool based on golang
Finder Of XSS and Dal is the Korean pronunciation of moon. @hahwul
[*] Using file mode(targets list)
[*] Loaded 1 target urls
[*] Target URL: https://slack.com/
[*] Vaild target [ code:302 / size:0 ]
[*] Using dictionary mining option [list=GF-Patterns] 📚⛏
[*] Using DOM mining option 📦⛏
[*] Start BAV(Basic Another Vulnerability) analysis / [sqli, ssti, OpenRedirect] 🔍
[*] Start static analysis.. 🔍
[*] Start parameter analysis.. 🔍
[*] BAV analysis done ✓
[I] Found 2 testing point in DOM Mining
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or unsubscribe.
|
Just another update here.
|
@DEMON1A |
Ok thanks
Get Outlook for iOS<https://aka.ms/o0ukef>
…________________________________
From: HAHWUL <notifications@github.com>
Sent: Wednesday, November 18, 2020 2:32:11 PM
To: hahwul/dalfox <dalfox@noreply.github.com>
Cc: spook95 <spook95@msn.com>; Comment <comment@noreply.github.com>
Subject: Re: [hahwul/dalfox] Dalfox uses the filename instead of it's content on the file mode (#134)
Closed #134<#134>.
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<#134 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/APH5BTNDU62LPIPQKVJ2P4DSQPLGXANCNFSM4TB4YI2A>.
|
the tools seem to be loading the filename instead of its real content using the file mode. I'm using dalfox latest version.
here are the commands I used:
Command
Results:
Second Command:
Results:
The text was updated successfully, but these errors were encountered: