Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor: update wordlists and configuration defaults #221

Merged
merged 3 commits into from
Nov 5, 2024

Conversation

psyray
Copy link
Contributor

@psyray psyray commented Nov 4, 2024

As reported on the Discord, dir fuzzing is very long to run and generates heavy traffic on the targeted server when using default Full scan engine.
So I've changed the default dir dicc by fuzz-Bo0oM, more quick to run and which show a lot of quick findings, reduced the recursivity level to 0 and removed all the extensions.

Tested and working

Details here :

  • Updated the wordlist used in default from dicc.txt to fuzz-Bo0oM.txt for directory scanning commands.
  • Refactored the configuration in tasks.py to use default wordlist names and paths for Amass and FFUF, improving maintainability.
  • Modified definitions.py to define default wordlist names and paths for Amass and FFUF, centralizing configuration.
  • Adjusted default_scan_engines.yaml and default_yaml_config.yaml to remove file extensions from the dir_file_fuzz configuration and set the recursive level to 0.
  • Updated scanEngine.json configurations to reflect changes in wordlist names and recursive levels, aligning with the new defaults.

Summary by Sourcery

Update the default wordlist for directory scanning from dicc.txt to fuzz-Bo0oM.txt, reduce the recursive level to 0, and remove file extensions from the configuration. Refactor configuration files to use default wordlist names and paths for Amass and FFUF, enhancing maintainability and centralizing configuration.

Enhancements:

  • Refactor configuration in tasks.py to use default wordlist names and paths for Amass and FFUF, improving maintainability.
  • Modify definitions.py to define default wordlist names and paths for Amass and FFUF, centralizing configuration.

- Updated the wordlist used in startScan.json from dicc.txt to fuzz-Bo0oM.txt for directory scanning commands.
- Refactored the configuration in tasks.py to use default wordlist names and paths for Amass and FFUF, improving maintainability.
- Modified definitions.py to define default wordlist names and paths for Amass and FFUF, centralizing configuration.
- Adjusted default_scan_engines.yaml and default_yaml_config.yaml to remove file extensions from the dir_file_fuzz configuration and set the recursive level to 0.
- Updated scanEngine.json configurations to reflect changes in wordlist names and recursive levels, aligning with the new defaults.
- Converted wordlist paths to string format using Path for compatibility.
- Changed the default recursive level for FFUF from 2 to 0.
@psyray psyray added the enhancement New feature or request label Nov 4, 2024
@psyray psyray requested a review from AnonymousWP November 4, 2024 23:22
@psyray psyray self-assigned this Nov 4, 2024
Copy link
Contributor

sourcery-ai bot commented Nov 4, 2024

Reviewer's Guide by Sourcery

This PR optimizes directory fuzzing performance by switching to a faster wordlist and reducing scan depth. The changes include updating the default wordlist from 'dicc.txt' to 'fuzz-Bo0oM.txt', setting recursive level to 0, and removing file extensions from the configuration to reduce server load and scan duration while maintaining effective discovery capabilities.

Class diagram for updated configuration defaults

classDiagram
    class Configuration {
        +String AMASS_DEFAULT_WORDLIST_NAME = "deepmagic.com-prefixes-top50000"
        +String AMASS_DEFAULT_WORDLIST_PATH = "Path(RENGINE_WORDLISTS)"
        +String FFUF_DEFAULT_WORDLIST_NAME = "fuzz-Bo0oM"
        +String FFUF_DEFAULT_WORDLIST_PATH = "Path(RENGINE_WORDLISTS)"
        +List FFUF_DEFAULT_MATCH_HTTP_STATUS = [200, 204]
        +int FFUF_DEFAULT_RECURSIVE_LEVEL = 0
        +boolean FFUF_DEFAULT_FOLLOW_REDIRECT = false
    }
Loading

File-Level Changes

Change Details Files
Updated directory fuzzing configuration to improve performance
  • Changed default wordlist from 'dicc.txt' to 'fuzz-Bo0oM.txt'
  • Set recursive level from 2 to 0 to reduce scan depth
  • Removed all file extensions from the configuration
  • Updated command line parameters in directory scan fixtures
web/startScan/fixtures/startScan.json
web/fixtures/default_scan_engines.yaml
web/config/default_yaml_config.yaml
web/scanEngine/fixtures/scanEngine.json
Refactored wordlist configuration management
  • Added default wordlist name constants
  • Centralized wordlist path configuration
  • Updated path construction for wordlist files
web/reNgine/definitions.py
web/reNgine/tasks.py

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time. You can also use
    this command to specify where the summary should be inserted.

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

Copy link
Contributor

@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @psyray - I've reviewed your changes and they look great!

Here's what I looked at during the review
  • 🟢 General issues: all looks good
  • 🟢 Security: all looks good
  • 🟢 Testing: all looks good
  • 🟢 Complexity: all looks good
  • 🟢 Documentation: all looks good

Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

- Added a commented list of file extensions to the default_yaml_config.yaml file for potential future use or reference.
@AnonymousWP AnonymousWP merged commit bdb2d01 into release/2.1.0 Nov 5, 2024
5 checks passed
@AnonymousWP AnonymousWP deleted the fix-dir-fuzz-too-heavy branch November 5, 2024 20:19
@psyray psyray added refactor and removed enhancement New feature or request labels Nov 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants