Tags: matro7sh/Yelaa
Tags
Improving dorks (#74) * (mod/dorks)gork v0.0.3 -> v0.0.4 * (fix/httpx)setting proxy before execution * (mod/version)bump to 1.7.1 * (mod/*)linting+updating gork to v0.0.5 addressing concern that too many HTML files in the dork results would be bloated, v0.0.5 comes with a filter that will remove .html files by default from the results, but this can be extended to anything else later through the interface
(fix/tools)proxy usage with socks & http (#69) * (fix/proxy)using GetHttpTransport() to configure http settings still a some work to do in order to have Proxy set for every tool if it is specified by the user, but having a helper function to easily fetch http.Transport with the correct values is a good start (also fixed some english spelling mistakes) next step is to add the proxy to the configuration of bigger projects, like httpx & nuclei. AFAIK httpx does not use ProxyFromEnvironment in order to set the proxy, which means we probably will have to set it manually. This can be annoying as this is not a mandatory setting will also probably need to rework dorks through a cleaner interface, because using exec.Command() prevents us from manually setting a proxy. * (mod/build)adding rule to dynamically build Yelaa To run Yelaa with Proxychains, one needs to have a dynamically compiled program. This is because Proxychains uses LD_PRELOAD tricks to hook to connect() and set the proxy, which is not possible with a statically program such as one compile with gc (standard go compiler) the script used to compile is still very much a WIP and other options could be explored instead: - use a TUN interface (https://github.com/nicocha30/ligolo-ng) - TUN to SOCKS (https://github.com/russdill/tunsocks) - iptables tricks (https://github.com/n1nj4sec/pr0cks) but this would not work very well with docker * (mod/gowitness)setting proxy option in chrome - dorks was broken with socksproxy so the option for that was removed. scan command is broken, further testing is required * (fix/tools)manually setting proxy for most interfaces * (mod/docs)improving docs regarding make dynamic rule * (mod/main)removing YELAA_PROXY env value usage * (mod/ci)bumping tool version & improving docs a little
Refactoring google dorks (#68) * (mod/dorks)using dorks package instead of google-chrome browser yesterday, i wrote a little go package to run dorks and retrieve files, so that we no longer need to have the chrome browser installed. this will greatly reduce the size of the docker image, and allow us to use a proxy to run dorks, which is cool. there is still a lot of room for improvements for the dork package but this is a good start, i guess * (mod/_)bumping version using go 1.19 for docker image updated download link in the README to have a newer version * (fix/dorks)comment * (mod/meta)bumping version to 1.6.2 also added a little log line to specify where would the dorks file be stored
Dorks (#62) * start to ad dork * fix: move dorks in tool interface * fix: remove debug print * fix: add domain support * fix: add scan domain call * docs: update yella version and readme Co-authored-by: enaylal <jenaye@protonmail.com> Co-authored-by: VidsSkids <victor.massonnat@epitech.com>
Adding `--dry-run` and `--path` CLI option (#60) * (mod/main)adding --path flag This flag should help the user specify where should le scan result be stored (this will not be appended to `.yelaa`; it is more intuitive to let the user chose the whole path * (mod/tools)adapting interface to accept scanPath option This commit adds the scanPath option where necessary for every tool that requires an out-directory. Extensive testing must still be done, but everything seems to work so far. * (fix/gb)gobuster running rule GoBuster should be excluded from ToolList since we configure it manually. It should also run outside of the loop iterating over all tools, for obvious reasons. * (fix/tool)assetfinder configuration assetfinder functions config would break the initalisation of scan. * (mod/main)support for --dryRun option adding support for dry run option from the CLI also fixed an issue where gobuster dir would not get created if its parent didnt exist * (fix/main)creating out-dir only after CLI parsing Since we need the directory name after it has been parsed, we run `createOutDirectory()` in the `Run()` functions of the commands parsed by Cobra. Otherwise, we would have always gotten the default interface, which is not the desired behaviour.
PreviousNext