The Wayback Machine - https://web.archive.org/web/20211230095803/https://github.com/nmap/nmap/issues/2183
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Script hostmap-crtsh does not return just subdomains #2183

Open
nnposter opened this issue Nov 15, 2020 · 2 comments
Open

Script hostmap-crtsh does not return just subdomains #2183

nnposter opened this issue Nov 15, 2020 · 2 comments
Labels
enhancement good first issue NSE

Comments

@nnposter
Copy link

@nnposter nnposter commented Nov 15, 2020

The script is described as

Finds subdomains of a web server by querying Google's Certificate Transparency logs database (https://crt.sh).

At the moment the script reports all hostname-like identities where the input/target hostname is present somewhere in the identity. Specifically, the script does not verify that a returned identity is truly a subdomain of the target hostname.

As an example, one of the returned identities for google.com is google.com.gr. An even more egregious example is that www.google.com returns www.google.com-----------------r.reflectiz.com.

I am inclined to fix this but first I am soliciting feedback whether there are users that use the script to fish out domains that are not strictly subdomains. One possibility is to control the script behavior with a script argument.
@nnposter nnposter added the NSE label Nov 15, 2020
@cldrn
Copy link
Member

@cldrn cldrn commented Nov 17, 2020

The original idea was subdomains but I do see value of discovering other domains, possibly malicious used for phishing. I think the best way would be to add an argument so we support both use cases.

Ps. Thanks for updating the script! We are currently down to only 1 hostmap script, hostmap-robtex is still broken!
@Rishabh-Kumar-07
Copy link

@Rishabh-Kumar-07 Rishabh-Kumar-07 commented Nov 24, 2020

Hi! I would like to work on it.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement good first issue NSE
3 participants
@cldrn @nnposter @Rishabh-Kumar-07