Repository navigation
fix(recon): always include the seed host in the HTTP probe list - #178
Open
themiguelamador wants to merge 1 commit into
Open
themiguelamador wants to merge 1 commit into
themiguelamador wants to merge 1 commit into
Conversation
Deep (4+-level) hostnames, DNS-only zones and internal names return nothing from passive subdomain enum, so the domain branch produced an empty all.txt and Phase 2 skipped HTTP probing entirely. Mirrors the ip/local seeding. Verified against tenant.dast.complear.com.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
For
domain-type targets, Phase 1 builds the HTTP probe list (subdomains/all.txt) purely from passive subdomain enumeration output (subfinder/amass/crt.sh/wayback). When that returns nothing, Phase 2 skips HTTP probing entirely — including the seed host itself — and the summary reports0 subdomains / 0 live hosts / 0 URLsfor a host that is live.This hits every case where passive enum is empty:
tenant.dast.example.com) — wordlists don't contain themThe
ip,local,listandcidrbranches all seed the probe list with the target itself; only thedomainbranch doesn't.Fix
Mirror the ip/local seeding: after the enum merge into
all.txt, append "${TARGET}${TARGET_PORT:+:$TARGET_PORT}" andsort -u— so the seed host is always probed by httpx in Phase 2. 8 lines, no behavior change for targets where enum already returns results (dedup viasort -u).Verification
Against a live 4-label host (multi-tenant web app on Fly.io), same
--quickrun before/after:Also confirmed the AI surface analysis on the unpatched run independently flags the empty probe list (
resolved_hosts: 0including the seed) as a pipeline bug rather than a clean target.