You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Jan 7, 2024. It is now read-only.
As far as I see when the option -a is not setted, a request to the host is performed when there is a match between the cname fingerprint and the host alias. However, sometimes (I think) those requests are useless.
Example: I am currently working on a bug bounty program where dozen of hosts are alias to blabla-0708-427040690.us-east-1.elb.amazonaws.com, this trigger the s3 bucket fingerprint performing hundreds of useless requests.
A minor change could highly improved the tool. If the cname fingerprint would be a regexp like this: \.s3[a-zA-Z0-9\-\._]*\.amazonaws\.com$
Same for heroku, could be: \.herukapp\.com$ and all others.
I think this could also avoid some false positive.
Best regards,
The text was updated successfully, but these errors were encountered:
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Hi,
As far as I see when the option
-a
is not setted, a request to the host is performed when there is a match between the cname fingerprint and the host alias. However, sometimes (I think) those requests are useless.Example: I am currently working on a bug bounty program where dozen of hosts are alias to
blabla-0708-427040690.us-east-1.elb.amazonaws.com
, this trigger the s3 bucket fingerprint performing hundreds of useless requests.A minor change could highly improved the tool. If the cname fingerprint would be a regexp like this:
\.s3[a-zA-Z0-9\-\._]*\.amazonaws\.com$
Same for heroku, could be:
\.herukapp\.com$
and all others.I think this could also avoid some false positive.
Best regards,
The text was updated successfully, but these errors were encountered: