endpointscanner 7.2.3__tar.gz → 7.3__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- {endpointscanner-7.2.3 → endpointscanner-7.3}/PKG-INFO +87 -53
- {endpointscanner-7.2.3 → endpointscanner-7.3}/README.md +85 -52
- {endpointscanner-7.2.3 → endpointscanner-7.3}/endpointscanner.egg-info/PKG-INFO +87 -53
- {endpointscanner-7.2.3 → endpointscanner-7.3}/endpointscanner.egg-info/requires.txt +1 -0
- {endpointscanner-7.2.3 → endpointscanner-7.3}/enumerateendpoint.py +765 -330
- {endpointscanner-7.2.3 → endpointscanner-7.3}/pyproject.toml +3 -2
- {endpointscanner-7.2.3 → endpointscanner-7.3}/LICENSE +0 -0
- {endpointscanner-7.2.3 → endpointscanner-7.3}/endpointscanner.egg-info/SOURCES.txt +0 -0
- {endpointscanner-7.2.3 → endpointscanner-7.3}/endpointscanner.egg-info/dependency_links.txt +0 -0
- {endpointscanner-7.2.3 → endpointscanner-7.3}/endpointscanner.egg-info/entry_points.txt +0 -0
- {endpointscanner-7.2.3 → endpointscanner-7.3}/endpointscanner.egg-info/top_level.txt +0 -0
- {endpointscanner-7.2.3 → endpointscanner-7.3}/setup.cfg +0 -0
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.4
|
|
2
2
|
Name: endpointscanner
|
|
3
|
-
Version: 7.
|
|
3
|
+
Version: 7.3
|
|
4
4
|
Summary: Website endpoint reconnaissance tool and rate limit tester that can bypass simple captchas and WAFs.
|
|
5
5
|
Project-URL: Homepage, https://github.com/SphericalFlower52811/endpointscanner
|
|
6
6
|
Project-URL: Issues, https://github.com/SphericalFlower52811/endpointscanner/issues
|
|
@@ -14,9 +14,10 @@ Requires-Dist: beautifulsoup4
|
|
|
14
14
|
Requires-Dist: playwright
|
|
15
15
|
Requires-Dist: playwright-stealth
|
|
16
16
|
Requires-Dist: httpx[http2]>=0.27.0
|
|
17
|
+
Requires-Dist: colorama>=0.4.6
|
|
17
18
|
Dynamic: license-file
|
|
18
19
|
|
|
19
|
-
# Website Endpoint Scanner and Rate Limit Tester For Websites (Version 7.
|
|
20
|
+
# Website Endpoint Scanner and Rate Limit Tester For Websites (Version 7.3)
|
|
20
21
|
|
|
21
22
|
A fast automated website reconnaissance tool that extracts endpoints, files, and even external links from websites. Automates IDOR and broken access control vulnerability testing through replacing variables with 1 in endpoints. Has a built in rate limit tester that can test on any endpoint, and can bypass simple WAFs/captchas and client-side SPAs.
|
|
22
23
|
|
|
@@ -44,6 +45,7 @@ Passable arguments:
|
|
|
44
45
|
| Argument | Short Form | Description |
|
|
45
46
|
| :---------------------- | :--------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
46
47
|
| `target` | `NIL` | URL |
|
|
48
|
+
| `--local` | `-l` | Pass this flag if the target is a local site like development-server, but is not a localhost/IP address. |
|
|
47
49
|
| `--ratelimit` | `-r` | Number of requests to send during the rate limit test. Default is 100. |
|
|
48
50
|
| `--ratelimit-type` | `-rt` | HTTP Method to use for the rate limit test. Defaults to GET. |
|
|
49
51
|
| `--ratelimit-body` | `-rb` | Payload data to send in request to use for POST, PATCH and PUT requests. If the custom payload contains double quotes, please use single quotes instead of double quotes to pass this flag. |
|
|
@@ -53,13 +55,14 @@ Passable arguments:
|
|
|
53
55
|
| `--testpath` | `-t` | Endpoint to test for rate limiting. |
|
|
54
56
|
| `--show-404s` | `-s` | Show endpoints tested that returned a 404 |
|
|
55
57
|
| `--disable-extra-files` | `-d` | Disable scanning of extra structural mapping files (robots, sitemaps, manifests, etc.) |
|
|
56
|
-
| `--show-media` | `-m` | Include assets/media like images and fonts in scan results
|
|
57
|
-
| `--show-prog` | `-sp` | Print endpoints to the terminal one by one in real-time as they are found. Warning: will show duplicate paths if endpoints are defined multiple times in the code. Results will not contain duplicates.
|
|
58
|
+
| `--show-media` | `-m` | Include assets/media like images and fonts and videos in scan results |
|
|
59
|
+
| `--show-prog` | `-sp` | Print endpoints to the terminal one by one in real-time as they are found. Warning: Progress will show duplicate paths if endpoints are defined multiple times in the code. Use the flag -nd to remove duplicates from progress. Results will not contain duplicates. |
|
|
60
|
+
| `--no-duplicate-prog` | `-nd` | If --show-prog is passed, duplicate endpoints in progress will not be shown. |
|
|
58
61
|
| `--output-file` | `-o` | Save formatted results directly to a local text file. |
|
|
59
62
|
| `--disable-og` | `-do` | Disable code from showing the original endpoint with variables. Keeps output tidier. Will NOT remove original tag from progress if the --show-prog flag is present. |
|
|
60
63
|
| `--tidy` | `-ti` | Script will not show where it got extra endpoints from, and will not show if it is a client side route and requires login, or react shell etc (or any SPA shell). Will also not show if an endpoint is a potential service. |
|
|
61
64
|
| `--tidy-all` | `-ta` | Flags --disable-og and --tidy combined. |
|
|
62
|
-
| `--only-res` | `-or` | Only show summarised endpoints.
|
|
65
|
+
| `--only-res` | `-or` | Only show summarised endpoints, and not print out extra information. Has an exception if number of endpoints exceeds 3000. |
|
|
63
66
|
| `--only-original` | `-oo` | Only show the original version of the flag instead of it being replaced with a 1. Will also affect show prog. |
|
|
64
67
|
| `--show-source` | `-ss` | Print the source of each endpoint during progress, like printing out which file it found the endpoint from. |
|
|
65
68
|
| `--scan-timeout` | `-st` | Stop scan completely after given number of minutes and print/save any results found in that time window. Will leave unsorted endpoints in a section labelled 'UNSORTED', and will leave out sensitive endpoints. Will NOT interrupt rate limiting test. |
|
|
@@ -68,19 +71,33 @@ Passable arguments:
|
|
|
68
71
|
## Installation
|
|
69
72
|
|
|
70
73
|
You MUST have python 3.9 or above to use this tool!
|
|
71
|
-
To install the official [endpointscanner Python package](https://pypi.org/project/endpointscanner/)
|
|
74
|
+
To install the official [endpointscanner Python package](https://pypi.org/project/endpointscanner/):
|
|
75
|
+
Command for MacOS/Linux:
|
|
72
76
|
|
|
73
77
|
```bash
|
|
74
78
|
python3 -m pip install endpointscanner
|
|
75
79
|
```
|
|
76
80
|
|
|
81
|
+
Command for Windows Command Prompt:
|
|
82
|
+
|
|
83
|
+
```text
|
|
84
|
+
py -m pip install endpointscanner
|
|
85
|
+
```
|
|
86
|
+
|
|
77
87
|
After that, install chromium on playwright (playwright will be installed when you install endpointscanner):
|
|
88
|
+
Command for MacOS/Linux:
|
|
78
89
|
|
|
79
90
|
```bash
|
|
80
91
|
playwright install chromium
|
|
81
92
|
```
|
|
82
93
|
|
|
83
|
-
|
|
94
|
+
Command for Windows Command Prompt:
|
|
95
|
+
|
|
96
|
+
```text
|
|
97
|
+
py -m playwright install chromium
|
|
98
|
+
```
|
|
99
|
+
|
|
100
|
+
### You may need to create a virtual environment if PEP 668 blocks you. (For the endpointscanner installation, not playwright install chromium.) Windows users do not need this step as they will not face the PEP 668 restriction.
|
|
84
101
|
|
|
85
102
|
To create a virtual environment named 'myvenv':
|
|
86
103
|
|
|
@@ -88,25 +105,13 @@ To create a virtual environment named 'myvenv':
|
|
|
88
105
|
python3 -m venv myvenv
|
|
89
106
|
```
|
|
90
107
|
|
|
91
|
-
To activate virtual environment
|
|
108
|
+
To activate virtual environment:
|
|
92
109
|
|
|
93
110
|
```bash
|
|
94
111
|
source myvenv/bin/activate
|
|
95
112
|
```
|
|
96
113
|
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
```text
|
|
100
|
-
myvenv\Scripts\activate
|
|
101
|
-
```
|
|
102
|
-
|
|
103
|
-
To activate virtual environment on Windows PowerShell:
|
|
104
|
-
|
|
105
|
-
```powershell
|
|
106
|
-
myvenv\Scripts\Activate.ps1
|
|
107
|
-
```
|
|
108
|
-
|
|
109
|
-
### Alternative (Not Recommended)
|
|
114
|
+
### Alternative for Virtual Environment (Not Recommended)
|
|
110
115
|
|
|
111
116
|
If you do not want to create a virtual environment, you can run:
|
|
112
117
|
|
|
@@ -118,14 +123,36 @@ to install it without PEP 668.
|
|
|
118
123
|
|
|
119
124
|
**Warning**: Using `--break-system-packages` may corrupt your OS-managed python environment. Proceed entirely at your own risk. The author is not liable for any system damage if you run this.
|
|
120
125
|
|
|
126
|
+
### Troubleshooting Windows "Command Not Found" Error:
|
|
127
|
+
|
|
128
|
+
If you are on Windows (especially a non-admin account) and get an 'command not recognised' error when typing `endpointscanner` or `playwright`, run this command **on PowerShell** (not Command Prompt) to fix user environmental paths automatically:
|
|
129
|
+
|
|
130
|
+
```powershell
|
|
131
|
+
$pDir = (py -c "import sys, os; print(os.path.dirname(sys.executable))"); if ($pDir) { $s = "$pDir\Scripts"; $p = [Environment]::GetEnvironmentVariable("Path", "User"); if ($p -notlike "*$s*") { [Environment]::SetEnvironmentVariable("Path", "$p;$s", "User") } }
|
|
132
|
+
```
|
|
133
|
+
|
|
134
|
+
What the PowerShell command does:
|
|
135
|
+
Checks the current version of python being used, and adds that python version as an environmental variable in the computer so you can run `endpointscanner` as a standalone command. Does not require admin privileges.
|
|
136
|
+
|
|
137
|
+
**Requirements for this command:** Python must already be installed.
|
|
138
|
+
|
|
139
|
+
**Note:** You MUST close the terminal (not minimise) and open a new one for the changes to work.
|
|
140
|
+
|
|
121
141
|
### Updating script
|
|
122
142
|
|
|
123
143
|
To update the script, you can run:
|
|
144
|
+
MacOS and Linux Command:
|
|
124
145
|
|
|
125
146
|
```bash
|
|
126
147
|
python3 -m pip install --upgrade endpointscanner
|
|
127
148
|
```
|
|
128
149
|
|
|
150
|
+
Windows Command:
|
|
151
|
+
|
|
152
|
+
```bash
|
|
153
|
+
py -m pip install --upgrade endpointscanner
|
|
154
|
+
```
|
|
155
|
+
|
|
129
156
|
## Example Commands
|
|
130
157
|
|
|
131
158
|
Example command to run to scan a site (show inaccessible endpoints, show assets, show progress as it finds endpoints, and show files that it got endpoints from):
|
|
@@ -162,48 +189,55 @@ Example command to only show the original endpoint, only print endpoints and out
|
|
|
162
189
|
endpointscanner example.com -oo -or -o examplescan.txt
|
|
163
190
|
```
|
|
164
191
|
|
|
165
|
-
## Weaknesses
|
|
166
|
-
|
|
167
|
-
- If there is a login page, the script will either show that all of the pages require login, or label all of them as 403.
|
|
168
|
-
- If there are shells (e.g. React SPA shells) in the page, it may give false positives for sensitive endpoints. If you see sensitive endpoints in the scan, they may not actually be exposed on the website if the website has a shell. (E.g. .gitignore, .env.local)
|
|
169
|
-
- The rate limit test is more susceptible to captchas as it uses a module (httpx, not curl_cffi) that is not built to specifically pass through firewalls/captchas. This is as the httpx module for requests is better for asynchronous functions for rate limit testing on websites.
|
|
170
|
-
|
|
171
192
|
## What was added
|
|
172
193
|
|
|
173
|
-
Version 7.
|
|
174
|
-
|
|
175
|
-
-
|
|
176
|
-
-
|
|
177
|
-
-
|
|
178
|
-
-
|
|
179
|
-
-
|
|
180
|
-
-
|
|
181
|
-
-
|
|
182
|
-
-
|
|
183
|
-
-
|
|
184
|
-
|
|
185
|
-
|
|
186
|
-
|
|
187
|
-
-
|
|
188
|
-
-
|
|
189
|
-
|
|
190
|
-
|
|
191
|
-
|
|
192
|
-
|
|
194
|
+
Version 7.3 added:
|
|
195
|
+
|
|
196
|
+
- Recursive scanning for sitemaps (all xml files)
|
|
197
|
+
- Recursive scanning for javascript files
|
|
198
|
+
- Scanning of localhost:port and IP addresses like 127.0.0.1, not just example.com.
|
|
199
|
+
- Filtering out Emscripten + Pyodide Virtual File System endpoints as they were false positives.
|
|
200
|
+
- More JS Stacks to detect, and more accurate. Full list of stacks after 7.3:
|
|
201
|
+
- React
|
|
202
|
+
- Nuxt.js
|
|
203
|
+
- Next.js
|
|
204
|
+
- Node.js
|
|
205
|
+
- Vue.js
|
|
206
|
+
- Angular
|
|
207
|
+
- Astro
|
|
208
|
+
- Gatsby
|
|
209
|
+
- Remix
|
|
210
|
+
- Solid.js
|
|
211
|
+
- Svelte
|
|
212
|
+
- Alpine.js
|
|
213
|
+
- Backbone.js
|
|
214
|
+
- Ember.js
|
|
215
|
+
- Redux
|
|
216
|
+
- Ruby on Rails
|
|
217
|
+
- Forem (also ruby on rails)
|
|
218
|
+
- Deno
|
|
219
|
+
- Bun
|
|
220
|
+
- jQuery
|
|
221
|
+
- Webpack
|
|
222
|
+
- Vite
|
|
223
|
+
- Turbopack
|
|
224
|
+
- Parcel
|
|
193
225
|
|
|
194
226
|
## Plans for next version and the future
|
|
195
227
|
|
|
196
|
-
Version 7.
|
|
228
|
+
Version 7.4:
|
|
197
229
|
|
|
198
|
-
- More JS Stacks to detect
|
|
199
230
|
- Detecting what type of captcha was used if the script is blocked.
|
|
200
|
-
-
|
|
201
|
-
- Fix bug in scanning extra file: openid configuration. (currently no verification that the file is in the config format, meaning on SPAs it will be mistaken as a real file.)
|
|
231
|
+
- Optimisation to make sorting of endpoints faster (called parallel requests or something)
|
|
202
232
|
|
|
203
233
|
Future plans (May be added in the next version):
|
|
234
|
+
none. please leave any suggestions you want.
|
|
204
235
|
|
|
205
|
-
|
|
206
|
-
|
|
236
|
+
## Weaknesses
|
|
237
|
+
|
|
238
|
+
- If there is a login page, the script will either show that all of the pages require login, or label all of them as 403.
|
|
239
|
+
- If there are shells (e.g. React SPA shells) in the page, it may give false positives for sensitive endpoints. If you see sensitive endpoints in the scan, they may not actually be exposed on the website if the website has a shell. (E.g. .gitignore, .env.local)
|
|
240
|
+
- The rate limit test is more susceptible to captchas as it uses a module (httpx, not curl_cffi) that is not built to specifically pass through firewalls/captchas. This is as the httpx module for requests is better for asynchronous functions for rate limit testing on websites.
|
|
207
241
|
|
|
208
242
|
ai assisted code btw
|
|
209
243
|
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
# Website Endpoint Scanner and Rate Limit Tester For Websites (Version 7.
|
|
1
|
+
# Website Endpoint Scanner and Rate Limit Tester For Websites (Version 7.3)
|
|
2
2
|
|
|
3
3
|
A fast automated website reconnaissance tool that extracts endpoints, files, and even external links from websites. Automates IDOR and broken access control vulnerability testing through replacing variables with 1 in endpoints. Has a built in rate limit tester that can test on any endpoint, and can bypass simple WAFs/captchas and client-side SPAs.
|
|
4
4
|
|
|
@@ -26,6 +26,7 @@ Passable arguments:
|
|
|
26
26
|
| Argument | Short Form | Description |
|
|
27
27
|
| :---------------------- | :--------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
28
28
|
| `target` | `NIL` | URL |
|
|
29
|
+
| `--local` | `-l` | Pass this flag if the target is a local site like development-server, but is not a localhost/IP address. |
|
|
29
30
|
| `--ratelimit` | `-r` | Number of requests to send during the rate limit test. Default is 100. |
|
|
30
31
|
| `--ratelimit-type` | `-rt` | HTTP Method to use for the rate limit test. Defaults to GET. |
|
|
31
32
|
| `--ratelimit-body` | `-rb` | Payload data to send in request to use for POST, PATCH and PUT requests. If the custom payload contains double quotes, please use single quotes instead of double quotes to pass this flag. |
|
|
@@ -35,13 +36,14 @@ Passable arguments:
|
|
|
35
36
|
| `--testpath` | `-t` | Endpoint to test for rate limiting. |
|
|
36
37
|
| `--show-404s` | `-s` | Show endpoints tested that returned a 404 |
|
|
37
38
|
| `--disable-extra-files` | `-d` | Disable scanning of extra structural mapping files (robots, sitemaps, manifests, etc.) |
|
|
38
|
-
| `--show-media` | `-m` | Include assets/media like images and fonts in scan results
|
|
39
|
-
| `--show-prog` | `-sp` | Print endpoints to the terminal one by one in real-time as they are found. Warning: will show duplicate paths if endpoints are defined multiple times in the code. Results will not contain duplicates.
|
|
39
|
+
| `--show-media` | `-m` | Include assets/media like images and fonts and videos in scan results |
|
|
40
|
+
| `--show-prog` | `-sp` | Print endpoints to the terminal one by one in real-time as they are found. Warning: Progress will show duplicate paths if endpoints are defined multiple times in the code. Use the flag -nd to remove duplicates from progress. Results will not contain duplicates. |
|
|
41
|
+
| `--no-duplicate-prog` | `-nd` | If --show-prog is passed, duplicate endpoints in progress will not be shown. |
|
|
40
42
|
| `--output-file` | `-o` | Save formatted results directly to a local text file. |
|
|
41
43
|
| `--disable-og` | `-do` | Disable code from showing the original endpoint with variables. Keeps output tidier. Will NOT remove original tag from progress if the --show-prog flag is present. |
|
|
42
44
|
| `--tidy` | `-ti` | Script will not show where it got extra endpoints from, and will not show if it is a client side route and requires login, or react shell etc (or any SPA shell). Will also not show if an endpoint is a potential service. |
|
|
43
45
|
| `--tidy-all` | `-ta` | Flags --disable-og and --tidy combined. |
|
|
44
|
-
| `--only-res` | `-or` | Only show summarised endpoints.
|
|
46
|
+
| `--only-res` | `-or` | Only show summarised endpoints, and not print out extra information. Has an exception if number of endpoints exceeds 3000. |
|
|
45
47
|
| `--only-original` | `-oo` | Only show the original version of the flag instead of it being replaced with a 1. Will also affect show prog. |
|
|
46
48
|
| `--show-source` | `-ss` | Print the source of each endpoint during progress, like printing out which file it found the endpoint from. |
|
|
47
49
|
| `--scan-timeout` | `-st` | Stop scan completely after given number of minutes and print/save any results found in that time window. Will leave unsorted endpoints in a section labelled 'UNSORTED', and will leave out sensitive endpoints. Will NOT interrupt rate limiting test. |
|
|
@@ -50,19 +52,33 @@ Passable arguments:
|
|
|
50
52
|
## Installation
|
|
51
53
|
|
|
52
54
|
You MUST have python 3.9 or above to use this tool!
|
|
53
|
-
To install the official [endpointscanner Python package](https://pypi.org/project/endpointscanner/)
|
|
55
|
+
To install the official [endpointscanner Python package](https://pypi.org/project/endpointscanner/):
|
|
56
|
+
Command for MacOS/Linux:
|
|
54
57
|
|
|
55
58
|
```bash
|
|
56
59
|
python3 -m pip install endpointscanner
|
|
57
60
|
```
|
|
58
61
|
|
|
62
|
+
Command for Windows Command Prompt:
|
|
63
|
+
|
|
64
|
+
```text
|
|
65
|
+
py -m pip install endpointscanner
|
|
66
|
+
```
|
|
67
|
+
|
|
59
68
|
After that, install chromium on playwright (playwright will be installed when you install endpointscanner):
|
|
69
|
+
Command for MacOS/Linux:
|
|
60
70
|
|
|
61
71
|
```bash
|
|
62
72
|
playwright install chromium
|
|
63
73
|
```
|
|
64
74
|
|
|
65
|
-
|
|
75
|
+
Command for Windows Command Prompt:
|
|
76
|
+
|
|
77
|
+
```text
|
|
78
|
+
py -m playwright install chromium
|
|
79
|
+
```
|
|
80
|
+
|
|
81
|
+
### You may need to create a virtual environment if PEP 668 blocks you. (For the endpointscanner installation, not playwright install chromium.) Windows users do not need this step as they will not face the PEP 668 restriction.
|
|
66
82
|
|
|
67
83
|
To create a virtual environment named 'myvenv':
|
|
68
84
|
|
|
@@ -70,25 +86,13 @@ To create a virtual environment named 'myvenv':
|
|
|
70
86
|
python3 -m venv myvenv
|
|
71
87
|
```
|
|
72
88
|
|
|
73
|
-
To activate virtual environment
|
|
89
|
+
To activate virtual environment:
|
|
74
90
|
|
|
75
91
|
```bash
|
|
76
92
|
source myvenv/bin/activate
|
|
77
93
|
```
|
|
78
94
|
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
```text
|
|
82
|
-
myvenv\Scripts\activate
|
|
83
|
-
```
|
|
84
|
-
|
|
85
|
-
To activate virtual environment on Windows PowerShell:
|
|
86
|
-
|
|
87
|
-
```powershell
|
|
88
|
-
myvenv\Scripts\Activate.ps1
|
|
89
|
-
```
|
|
90
|
-
|
|
91
|
-
### Alternative (Not Recommended)
|
|
95
|
+
### Alternative for Virtual Environment (Not Recommended)
|
|
92
96
|
|
|
93
97
|
If you do not want to create a virtual environment, you can run:
|
|
94
98
|
|
|
@@ -100,14 +104,36 @@ to install it without PEP 668.
|
|
|
100
104
|
|
|
101
105
|
**Warning**: Using `--break-system-packages` may corrupt your OS-managed python environment. Proceed entirely at your own risk. The author is not liable for any system damage if you run this.
|
|
102
106
|
|
|
107
|
+
### Troubleshooting Windows "Command Not Found" Error:
|
|
108
|
+
|
|
109
|
+
If you are on Windows (especially a non-admin account) and get an 'command not recognised' error when typing `endpointscanner` or `playwright`, run this command **on PowerShell** (not Command Prompt) to fix user environmental paths automatically:
|
|
110
|
+
|
|
111
|
+
```powershell
|
|
112
|
+
$pDir = (py -c "import sys, os; print(os.path.dirname(sys.executable))"); if ($pDir) { $s = "$pDir\Scripts"; $p = [Environment]::GetEnvironmentVariable("Path", "User"); if ($p -notlike "*$s*") { [Environment]::SetEnvironmentVariable("Path", "$p;$s", "User") } }
|
|
113
|
+
```
|
|
114
|
+
|
|
115
|
+
What the PowerShell command does:
|
|
116
|
+
Checks the current version of python being used, and adds that python version as an environmental variable in the computer so you can run `endpointscanner` as a standalone command. Does not require admin privileges.
|
|
117
|
+
|
|
118
|
+
**Requirements for this command:** Python must already be installed.
|
|
119
|
+
|
|
120
|
+
**Note:** You MUST close the terminal (not minimise) and open a new one for the changes to work.
|
|
121
|
+
|
|
103
122
|
### Updating script
|
|
104
123
|
|
|
105
124
|
To update the script, you can run:
|
|
125
|
+
MacOS and Linux Command:
|
|
106
126
|
|
|
107
127
|
```bash
|
|
108
128
|
python3 -m pip install --upgrade endpointscanner
|
|
109
129
|
```
|
|
110
130
|
|
|
131
|
+
Windows Command:
|
|
132
|
+
|
|
133
|
+
```bash
|
|
134
|
+
py -m pip install --upgrade endpointscanner
|
|
135
|
+
```
|
|
136
|
+
|
|
111
137
|
## Example Commands
|
|
112
138
|
|
|
113
139
|
Example command to run to scan a site (show inaccessible endpoints, show assets, show progress as it finds endpoints, and show files that it got endpoints from):
|
|
@@ -144,48 +170,55 @@ Example command to only show the original endpoint, only print endpoints and out
|
|
|
144
170
|
endpointscanner example.com -oo -or -o examplescan.txt
|
|
145
171
|
```
|
|
146
172
|
|
|
147
|
-
## Weaknesses
|
|
148
|
-
|
|
149
|
-
- If there is a login page, the script will either show that all of the pages require login, or label all of them as 403.
|
|
150
|
-
- If there are shells (e.g. React SPA shells) in the page, it may give false positives for sensitive endpoints. If you see sensitive endpoints in the scan, they may not actually be exposed on the website if the website has a shell. (E.g. .gitignore, .env.local)
|
|
151
|
-
- The rate limit test is more susceptible to captchas as it uses a module (httpx, not curl_cffi) that is not built to specifically pass through firewalls/captchas. This is as the httpx module for requests is better for asynchronous functions for rate limit testing on websites.
|
|
152
|
-
|
|
153
173
|
## What was added
|
|
154
174
|
|
|
155
|
-
Version 7.
|
|
156
|
-
|
|
157
|
-
-
|
|
158
|
-
-
|
|
159
|
-
-
|
|
160
|
-
-
|
|
161
|
-
-
|
|
162
|
-
-
|
|
163
|
-
-
|
|
164
|
-
-
|
|
165
|
-
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
|
|
169
|
-
-
|
|
170
|
-
-
|
|
171
|
-
|
|
172
|
-
|
|
173
|
-
|
|
174
|
-
|
|
175
|
+
Version 7.3 added:
|
|
176
|
+
|
|
177
|
+
- Recursive scanning for sitemaps (all xml files)
|
|
178
|
+
- Recursive scanning for javascript files
|
|
179
|
+
- Scanning of localhost:port and IP addresses like 127.0.0.1, not just example.com.
|
|
180
|
+
- Filtering out Emscripten + Pyodide Virtual File System endpoints as they were false positives.
|
|
181
|
+
- More JS Stacks to detect, and more accurate. Full list of stacks after 7.3:
|
|
182
|
+
- React
|
|
183
|
+
- Nuxt.js
|
|
184
|
+
- Next.js
|
|
185
|
+
- Node.js
|
|
186
|
+
- Vue.js
|
|
187
|
+
- Angular
|
|
188
|
+
- Astro
|
|
189
|
+
- Gatsby
|
|
190
|
+
- Remix
|
|
191
|
+
- Solid.js
|
|
192
|
+
- Svelte
|
|
193
|
+
- Alpine.js
|
|
194
|
+
- Backbone.js
|
|
195
|
+
- Ember.js
|
|
196
|
+
- Redux
|
|
197
|
+
- Ruby on Rails
|
|
198
|
+
- Forem (also ruby on rails)
|
|
199
|
+
- Deno
|
|
200
|
+
- Bun
|
|
201
|
+
- jQuery
|
|
202
|
+
- Webpack
|
|
203
|
+
- Vite
|
|
204
|
+
- Turbopack
|
|
205
|
+
- Parcel
|
|
175
206
|
|
|
176
207
|
## Plans for next version and the future
|
|
177
208
|
|
|
178
|
-
Version 7.
|
|
209
|
+
Version 7.4:
|
|
179
210
|
|
|
180
|
-
- More JS Stacks to detect
|
|
181
211
|
- Detecting what type of captcha was used if the script is blocked.
|
|
182
|
-
-
|
|
183
|
-
- Fix bug in scanning extra file: openid configuration. (currently no verification that the file is in the config format, meaning on SPAs it will be mistaken as a real file.)
|
|
212
|
+
- Optimisation to make sorting of endpoints faster (called parallel requests or something)
|
|
184
213
|
|
|
185
214
|
Future plans (May be added in the next version):
|
|
215
|
+
none. please leave any suggestions you want.
|
|
186
216
|
|
|
187
|
-
|
|
188
|
-
|
|
217
|
+
## Weaknesses
|
|
218
|
+
|
|
219
|
+
- If there is a login page, the script will either show that all of the pages require login, or label all of them as 403.
|
|
220
|
+
- If there are shells (e.g. React SPA shells) in the page, it may give false positives for sensitive endpoints. If you see sensitive endpoints in the scan, they may not actually be exposed on the website if the website has a shell. (E.g. .gitignore, .env.local)
|
|
221
|
+
- The rate limit test is more susceptible to captchas as it uses a module (httpx, not curl_cffi) that is not built to specifically pass through firewalls/captchas. This is as the httpx module for requests is better for asynchronous functions for rate limit testing on websites.
|
|
189
222
|
|
|
190
223
|
ai assisted code btw
|
|
191
224
|
|