Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add option to compute http BodySHA256 on decoded BodyText #275

Merged
merged 10 commits into from
Sep 18, 2020

Conversation

twschum
Copy link
Contributor

@twschum twschum commented Sep 17, 2020

Adds a new way to compute the BodyHash for http scanner.

How to Test

echo <ip> | ./zgrab2 http --port 443 --compute-decoded-body-hash-algorithm=sha256 | jq
 "body_hash": "sha256:ff990fc95970bd2fc6333663ae043aaef308117190507bbd7b4831244cd97c2d",

echo <ip> | ./zgrab2 http --port 443 --compute-decoded-body-hash-algorithm=sha1 | jq
"body_hash": "sha1:a829c753bb3e30296c1faeea6783edf7dd23824f",

./zgrab2 http --port 443 --compute-decoded-body-hash-algorithm=md5 | jq
Invalid value `md5' for option `--compute-decoded-body-hash-algorithm'. Allowed values are: sha256 or sha1

Notes & Caveats

If necessary, explain the motivation for this PR, and note any caveats that apply to your changes or future work that will be needed.

Issue Tracking

Add a link to the relevant GitHub issue(s) if the pull request resolves it.

@codyprime
Copy link
Member

If we are adding some new options to compute hash, can we also add an option for SHA1 as well? E.g., a config option like BodyHashAlgorithm that can be "sha1" or "sha256", and a corresponding new field in the Response for just Hash instead of BodySHA256. If the new flag is used populate Hash with the specified algorithm, otherwise it behaves as it currently does now. Also, can the Hash field then have a the algorithm prefix (e.g. ."sha1:")

@p-l-
Copy link

p-l- commented Sep 17, 2020

Quick question: would it be possible to have the possibility to select one or more hash functions, so that we could have MD5, SHA1 and SHA256 computed and reported? You never know which hash function are used by other applications.

@justinbastress justinbastress merged commit dae700e into zmap:master Sep 18, 2020
@codyprime
Copy link
Member

Quick question: would it be possible to have the possibility to select one or more hash functions, so that we could have MD5, SHA1 and SHA256 computed and reported? You never know which hash function are used by other applications.

I do think that would be nice to have, I guess now as a future enhancement to this patch.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants