Skip to content

[bug] is_http_accessible hard condition leading to false negative #56

@laluka

Description

@laluka

Hi there!

Image

While scanning a specific host with tomcat, I found out that the hard line below only proceeds to scan the tomcat infrance only when the main page returns 200, which might not always be the case..

return r.status_code == 200

Could we either allow any http status code, or add an option to bypass this check ?
My specific case was a GET / returning 404, but the tomcat manager enabled, but never scanned/reached even though it contained a matching <h3>Apache Tomcat/8.0.53</h3> leak 😅

As always, thanks for the epic work, and take care ! 🌷

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions