Warn when v5 sees -brute / bruteforce.wordlists (#1122) - #1125
Open
ChrisJr404 wants to merge 1 commit into
Open
ChrisJr404 wants to merge 1 commit into
ChrisJr404 wants to merge 1 commit into
Conversation
The -brute CLI flag and bruteforce.wordlists YAML key are still parsed in v5: cmd-line -brute / -w lands in cfg.BruteForcing and cfg.Wordlist, and config/brute.go populates the same fields from YAML. But nothing in engine/ reads cfg.Wordlist; the only plugin under engine/plugins/brute/ is alterations.go, which uses cfg.AltWordlist. cfg.BruteForcing also gates FQDN-Alterations, so passing -brute does something - just not what a v4 user expects. The user gets no dictionary guesses of <word>.example.com despite the flag being accepted. Issue owasp-amass#1122 reports this, and the maintainer hasn't yet decided whether v5 will get a port of the v4 wordlist brute-force scripts. This change does not port that feature - it adds the smaller fix the issue suggests as fallback: warn at startup so users who pass -brute together with a wordlist see, in yellow, that the wordlist will be ignored on v5 and a link to track the issue. Adds a 5-case unit test covering the off, partial, and on permutations to pin the warning text and emission gate.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Refs #1122.
@je-bugshell pointed out that v5 still parses the `-brute` CLI flag and the `bruteforce.wordlists` YAML key — `cfg.BruteForcing` and `cfg.Wordlist` get populated from CLI (`internal/enum/cli.go:451`) and YAML (`config/brute.go`), respectively — but nothing in `engine/` reads `cfg.Wordlist`. The only plugin in `engine/plugins/brute/` is `alterations.go`, which uses `cfg.AltWordlist` (a separate field), and the `BruteForcing` toggle is reused there to mean "also do alterations." A v4 user expects `-brute -w wordlist.txt` to generate `.example.com` guesses; in v5 they currently get nothing of the sort.
The issue body offers two paths:
I went with path 2 here, since the porting question is yours to answer. @je-bugshell explicitly offered (1) as a follow-up if you decide to take it; this PR doesn't preempt that.
Change
Test
`internal/enum/cli_test.go` (new file) — `TestWarnUnsupportedConfig` covers 5 cases:
`go vet ./internal/enum/...` is clean.
Notes