Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Rework htp module #344

Merged
merged 2 commits into from
Nov 2, 2022
Merged

Conversation

devl00p
Copy link
Contributor

@devl00p devl00p commented Nov 1, 2022

htp module has several drawbacks:

  • it is slow
  • inconsistency in sqlite DB may generate crashes (see below)
  • a range can be given while there is a single matching version
  • some version strings are odd (eg: from 10.0.0-alpha1 to start for Drupal)
  • there are frequent false positives

inconsistency

ValueError: '4.2.1-rc2' is not in list for Wordpress

sqlite> select * from version where technology = "WordPress" and version like '4.2.1%';
|WordPress|4.2.1
|WordPress|4.2.10
|WordPress|4.2.11
|WordPress|4.2.12
|WordPress|4.2.13
|WordPress|4.2.14
|WordPress|4.2.15
|WordPress|4.2.16
|WordPress|4.2.17
|WordPress|4.2.18
|WordPress|4.2.19

So it looks like a version is known for a given hash for that version is not part of the version table

frequent false positives

Detected magento2 technology seems to match versions from 2.3.0 to 2.4.4
Detected WordPress technology seems to match versions from 3.1 to 6.0
Detected joomla-cms technology seems to match version 4.0.0-alpha4x

I can fix some stuff like speed and deal with some inconsistency but the DB may also needs some fixes

@devl00p
Copy link
Contributor Author

devl00p commented Nov 2, 2022

improved speed and dealt with some inconsistencies but the db must be fixed to remove false-positives

@devl00p devl00p merged commit e0fdf84 into wapiti-scanner:master Nov 2, 2022
@devl00p devl00p deleted the rework_htp_module branch July 4, 2023 15:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant