Compare commits

..

2 Commits

Author SHA1 Message Date
VainXploits d6520f1c2c
Merge 96643ad806 into fd87c99abc 2025-07-19 15:05:12 +00:00
VainXploits 96643ad806 improved redirect-host-discovery plugin 2025-07-19 20:31:05 +05:30
1 changed files with 42 additions and 48 deletions

View File

@ -24,13 +24,9 @@ class RedirectHostnameDiscovery(ServiceScan):
) )
async def run(self, service): async def run(self, service):
try: url = f"{'https' if service.secure else 'http'}://{service.target.address}:{service.port}/"
ipaddress.ip_address(service.target.address)
except ValueError:
return
try: try:
url = f"{'https' if service.secure else 'http'}://{service.target.address}:{service.port}/"
resp = requests.get(url, verify=False, allow_redirects=False) resp = requests.get(url, verify=False, allow_redirects=False)
if 'Location' in resp.headers: if 'Location' in resp.headers:
@ -38,9 +34,9 @@ class RedirectHostnameDiscovery(ServiceScan):
parsed = urlparse(location) parsed = urlparse(location)
redirect_host = parsed.hostname redirect_host = parsed.hostname
if redirect_host: if redirect_host and redirect_host != service.target.address:
service.info(f"[+] Redirect detected: {url}{location}") service.info(f"Redirect detected: {url}{location}")
service.info(f"[+] Hostname found in redirect: {redirect_host}") service.info(f"Hostname found in redirect: {redirect_host}")
if self.get_option('update-hosts'): if self.get_option('update-hosts'):
if os.geteuid() != 0: if os.geteuid() != 0:
@ -48,21 +44,19 @@ class RedirectHostnameDiscovery(ServiceScan):
return return
ip = service.target.address ip = service.target.address
hostname = redirect_host
with open("/etc/hosts", "r") as hosts_file: with open("/etc/hosts", "r") as hosts_file:
for line in hosts_file: for line in hosts_file:
parts = line.strip().split() parts = line.strip().split()
if len(parts) >= 2 and parts[0] == ip and hostname in parts[1:]: if len(parts) >= 2 and parts[0] == ip and redirect_host in parts[1:]:
return # entry exists, skip writing return
with open("/etc/hosts", "a") as hosts_file: with open("/etc/hosts", "a") as hosts_file:
hosts_file.write(f"{ip} {hostname}\n") hosts_file.write(f"{ip} {redirect_host}\n")
service.info(f"[+] Hostname {hostname} added to /etc/hosts with IP {ip}") service.info(f"Hostname {redirect_host} added to /etc/hosts with IP {ip}")
else: else:
service.info(f"[+] Redirect detected, but no hostname found in: {location}") service.info(f"Redirect detected, but no new hostname found in: {location}")
else: else:
service.info(f"[-] No redirect detected at {url}") service.info(f"No redirect detected at {url}")
except Exception as e: except Exception as e:
service.error(f"[!] Error during redirect check on {service.target.address}:{service.port}{e}") service.error(f"[!] Error during redirect check on {url}{e}")