Added probe to identify copyright year #1955
Conversation
|
Thanks for your contribution @nyxgeek ! We also have a Discord server, which you’re more than welcome to join. It's a great place to connect with fellow contributors and stay updated with the latest developments! |
httpx v1.6.9 release prep
|
Updated and tested, should be good. |
| "strings" | ||
| ) | ||
|
|
||
| var crreYear = regexp.MustCompile(`(?:copyright|Copyright|COPYRIGHT|\(C\)|\(c\)|©|©|©)?\s*(?:[a-zA-Z0-9 ,-]+\s*)?[\s,]*(199[0-9]|20[0-1][0-9]|202[0-4])[\s,<-]+(?:copyright|Copyright|COPYRIGHT|\(C\)|\(c\)|©|©|©|199[0-9]|20[0-1][0-9]|202[0-4])?`) |
There was a problem hiding this comment.
We're limiting the year statically with 2024. This must be dynamic. It'll not detect © 2025 Dummy Media Group. All Rights Reserved., for example.
There was a problem hiding this comment.
That makes sense, I'll extend it through 2029 if that is acceptable. I am trying to avoid false positives so trying to keep it to a realistic range.
| } | ||
| } | ||
|
|
||
| green := "\033[32m" |
There was a problem hiding this comment.
We're using aurora for colored output. We can do the same here.
|
|
||
|
|
||
| // Apply regex to extract the years and check for indicators | ||
| matches := crreYear.FindAllStringSubmatch(textContent, -1) |
There was a problem hiding this comment.
Do we expect multiple copyright text in pages? If not, we should rethink post-processing.
There was a problem hiding this comment.
The regex will match strings like Copyright 2024, as well as Copyright 1995-2001, in which case it will display both dates.
| @@ -1800,6 +1801,21 @@ retry: | |||
| builder.WriteRune(']') | |||
| } | |||
|
|
|||
| var copyright string | |||
| if httpx.CanHaveTitleTag(resp.GetHeaderPart("Content-Type", ";")) { | |||
| copyright = httpx.ExtractCopyright(resp) // This will return a space-delimited string of years | |||
There was a problem hiding this comment.
Why do we extract copyright text here and not under scanopts.OutputCopyright if block?
There was a problem hiding this comment.
I basically just copied the same functions that exist for Title extraction, but changed them to copyright instead. If there is a better way, or if I mis-copied that format from Title extraction, happy to mod.
|
Isn't better a nuclei template? |
I don't use nuclei, but I do use my fork of httpx all the time on giant internal pentests because it's super easy to find the old software with this feature. |
Added copyright probe, useful for identifying old software
Closes #1965