Skip to content

Warn when v5 sees -brute / bruteforce.wordlists (#1122) - #1125

Open
ChrisJr404 wants to merge 1 commit into
owasp-amass:developfrom
ChrisJr404:feat/warn-brute-noop-1122
Open

ChrisJr404 wants to merge 1 commit into
owasp-amass:developfrom
ChrisJr404:feat/warn-brute-noop-1122

Conversation

@ChrisJr404

Copy link
Copy Markdown

Summary

Refs #1122.

@je-bugshell pointed out that v5 still parses the `-brute` CLI flag and the `bruteforce.wordlists` YAML key — `cfg.BruteForcing` and `cfg.Wordlist` get populated from CLI (`internal/enum/cli.go:451`) and YAML (`config/brute.go`), respectively — but nothing in `engine/` reads `cfg.Wordlist`. The only plugin in `engine/plugins/brute/` is `alterations.go`, which uses `cfg.AltWordlist` (a separate field), and the `BruteForcing` toggle is reused there to mean "also do alterations." A v4 user expects `-brute -w wordlist.txt` to generate `.example.com` guesses; in v5 they currently get nothing of the sort.

The issue body offers two paths:

  1. Port the v4 wordlist brute-force script to a v5 plugin.
  2. If a port isn't on the roadmap, log a clear warning so users aren't silently getting less than they asked for.

I went with path 2 here, since the porting question is yours to answer. @je-bugshell explicitly offered (1) as a follow-up if you decide to take it; this PR doesn't preempt that.

Change

  • New `warnUnsupportedConfig` helper in `internal/enum/cli.go`, called from `CLIWorkflow` immediately after `argsAndConfig`. It emits a single yellow line on `color.Error` if both `cfg.BruteForcing` and `cfg.Wordlist` are set, telling the user wordlist brute forcing isn't implemented in v5 yet, that `-brute` currently only gates FQDN alterations, and pointing at issue v5: -brute flag and bruteforce.wordlists config are accepted but never used #1122 for status.
  • No warning is emitted when only one of the two is set (a YAML wordlist alone with no `-brute`, or `-brute` with no wordlist) so existing alterations-only workflows aren't noisy.

Test

`internal/enum/cli_test.go` (new file) — `TestWarnUnsupportedConfig` covers 5 cases:

$ go test ./internal/enum/ -run TestWarnUnsupportedConfig -v
=== RUN   TestWarnUnsupportedConfig
--- PASS: TestWarnUnsupportedConfig (0.00s)
ok  	github.com/owasp-amass/amass/v5/internal/enum	0.011s

`go vet ./internal/enum/...` is clean.

Notes

  • I did not add this to `oam_enum` or other binaries — only `amass enum` reaches `CLIWorkflow`. If you'd like the warning surfaced from `oam_enum` too, happy to lift it into a shared helper.
  • Once the porting question is answered, this warning is one line to remove (or to repoint at a "deprecated, see X" message). It's intentionally cheap to undo.

The -brute CLI flag and bruteforce.wordlists YAML key are still parsed
in v5: cmd-line -brute / -w lands in cfg.BruteForcing and cfg.Wordlist,
and config/brute.go populates the same fields from YAML. But nothing in
engine/ reads cfg.Wordlist; the only plugin under engine/plugins/brute/
is alterations.go, which uses cfg.AltWordlist. cfg.BruteForcing also
gates FQDN-Alterations, so passing -brute does something - just not
what a v4 user expects. The user gets no dictionary guesses of
<word>.example.com despite the flag being accepted.

Issue owasp-amass#1122 reports this, and the maintainer hasn't yet decided whether
v5 will get a port of the v4 wordlist brute-force scripts.

This change does not port that feature - it adds the smaller fix the
issue suggests as fallback: warn at startup so users who pass -brute
together with a wordlist see, in yellow, that the wordlist will be
ignored on v5 and a link to track the issue.

Adds a 5-case unit test covering the off, partial, and on permutations
to pin the warning text and emission gate.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant