bbot 2.3.2.5838rc0__tar.gz → 2.3.2.5848rc0__tar.gz

{bbot-2.3.2.5838rc0 → bbot-2.3.2.5848rc0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: bbot
-Version: 2.3.2.5838rc0
+Version: 2.3.2.5848rc0
 Summary: OSINT automation for hackers.
 License: GPL-3.0
 Keywords: python,cli,automation,osint,threat-intel,intelligence,neo4j,scanner,python-library,hacking,recursion,pentesting,recon,command-line-tool,bugbounty,subdomains,security-tools,subdomain-scanner,osint-framework,attack-surface,subdomain-enumeration,osint-tool

{bbot-2.3.2.5838rc0 → bbot-2.3.2.5848rc0}/bbot/__init__.py

@@ -1,4 +1,4 @@
 # version placeholder (replaced by poetry-dynamic-versioning)
-__version__ = "v2.3.2.5838rc"
+__version__ = "v2.3.2.5848rc"
 
 from .scanner import Scanner, Preset

{bbot-2.3.2.5838rc0 → bbot-2.3.2.5848rc0}/bbot/core/helpers/web/web.py

@@ -336,6 +336,7 @@ class WebHelper(EngineClient):
         ignore_bbot_global_settings = kwargs.get("ignore_bbot_global_settings", False)
 
         if ignore_bbot_global_settings:
+            http_timeout = 20  # setting 20 as a worse-case setting
             log.debug("ignore_bbot_global_settings enabled. Global settings will not be applied")
         else:
             http_timeout = self.parent_helper.web_config.get("http_timeout", 20)
@@ -349,12 +350,12 @@ class WebHelper(EngineClient):
                 for hk, hv in self.web_config.get("http_headers", {}).items():
                     headers[hk] = hv
 
-            # add the timeout
-            if "timeout" not in kwargs:
-                timeout = http_timeout
+        # add the timeout
+        if "timeout" not in kwargs:
+            timeout = http_timeout
 
-            curl_command.append("-m")
-            curl_command.append(str(timeout))
+        curl_command.append("-m")
+        curl_command.append(str(timeout))
 
         for k, v in headers.items():
             if isinstance(v, list):
@@ -400,7 +401,7 @@ class WebHelper(EngineClient):
         if raw_body:
             curl_command.append("-d")
             curl_command.append(raw_body)
-
+        log.verbose(f"Running curl command: {curl_command}")
         output = (await self.parent_helper.run(curl_command)).stdout
         return output
 

{bbot-2.3.2.5838rc0 → bbot-2.3.2.5848rc0}/bbot/modules/internal/excavate.py

@@ -9,7 +9,7 @@ from bbot.errors import ExcavateError
 import bbot.core.helpers.regexes as bbot_regexes
 from bbot.modules.base import BaseInterceptModule
 from bbot.modules.internal.base import BaseInternalModule
-from urllib.parse import urlparse, urljoin, parse_qs, urlunparse
+from urllib.parse import urlparse, urljoin, parse_qs, urlunparse, urldefrag
 
 
 def find_subclasses(obj, base_class):
@@ -736,7 +736,7 @@ class excavate(BaseInternalModule, BaseInterceptModule):
                             continue
                         unescaped_url = html.unescape(m.group(1))
                         source_url = event.parsed_url.geturl()
-                        final_url = urljoin(source_url, unescaped_url)
+                        final_url = urldefrag(urljoin(source_url, unescaped_url)).url
                         if not await self.helpers.re.search(self.full_url_regex_strict, final_url):
                             self.excavate.debug(
                                 f"Rejecting reconstructed URL [{final_url}] as did not match full_url_regex_strict"

{bbot-2.3.2.5838rc0 → bbot-2.3.2.5848rc0}/bbot/modules/telerik.py

@@ -316,7 +316,7 @@ class telerik(BaseModule):
             # The standard behavior for the spellcheck handler without parameters is a 500
             if status_code == 500:
                 # Sometimes webapps will just return 500 for everything, so rule out the false positive
-                validate_result, _ = await self.test_detector(base_url, self.helpers.rand_string())
+                validate_result, _ = await self.test_detector(base_url, f"{self.helpers.rand_string()}.axd")
                 self.debug(validate_result)
                 validate_status_code = getattr(validate_result, "status_code", 0)
                 if validate_status_code not in (0, 500):

{bbot-2.3.2.5838rc0 → bbot-2.3.2.5848rc0}/bbot/test/test_step_2/module_tests/test_module_excavate.py

@@ -30,6 +30,7 @@ class TestExcavate(ModuleTestBase):
         <a href="/a_relative.txt">
         <link href="/link_relative.txt">
         <a href="mailto:bob@evilcorp.org?subject=help">Help</a>
+        <li class="toctree-l3"><a class="reference internal" href="miscellaneous.html#x50-uart-driver">16x50 UART Driver</a></li>
         """
         expect_args = {"method": "GET", "uri": "/"}
         respond_args = {"response_data": response_data}
@@ -103,6 +104,11 @@ class TestExcavate(ModuleTestBase):
             for e in events
         )
 
+        assert any(
+            e.type == "URL_UNVERIFIED" and "miscellaneous.html" in e.data and "x50-uart-driver" not in e.data
+            for e in events
+        )
+
 
 class TestExcavate2(TestExcavate):
     targets = ["http://127.0.0.1:8888/", "test.notreal", "http://127.0.0.1:8888/subdir/"]

{bbot-2.3.2.5838rc0 → bbot-2.3.2.5848rc0}/bbot/test/test_step_2/module_tests/test_module_telerik.py

@@ -33,6 +33,11 @@ class TestTelerik(ModuleTestBase):
         respond_args = {"status": 500}
         module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
 
+        # Simulate SpellCheckHandler false positive detection
+        expect_args = {"method": "GET", "uri": "/AAAAAAAAAAAAAA.axd"}
+        respond_args = {"status": 200}
+        module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
+
         # Simulate DialogHandler detection
         expect_args = {"method": "GET", "uri": "/App_Master/Telerik.Web.UI.DialogHandler.aspx"}
         respond_args = {
@@ -64,6 +69,7 @@ class TestTelerik(ModuleTestBase):
         module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)
 
     async def setup_after_prep(self, module_test):
+        module_test.scan.modules["telerik"].helpers.rand_string = lambda *args, **kwargs: "AAAAAAAAAAAAAA"
         module_test.scan.modules["telerik"].telerikVersions = ["2014.2.724", "2014.3.1024", "2015.1.204"]
         module_test.scan.modules["telerik"].DialogHandlerUrls = [
             "Admin/ServerSide/Telerik.Web.UI.DialogHandler.aspx",

{bbot-2.3.2.5838rc0 → bbot-2.3.2.5848rc0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "bbot"
-version = "v2.3.2.5838rc"
+version = "v2.3.2.5848rc"
 description = "OSINT automation for hackers."
 authors = [
     "TheTechromancer",