EARScanner
This small python script can do really awesome work.
Execution After Redirect (EAR) / Long Response Redirection Vulnerability Scanner written in python3, Can Scan Single & Multiple URLs, MultiThreaded, Fast & Reliable, Can Fuzz All URLs of target website & then can scan them for EAR
Disclaimer
THIS SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. YOU MAY USE THIS SOFTWARE AT YOUR OWN RISK. THE USE IS COMPLETE RESPONSIBILITY OF THE END-USER. THE DEVELOPERS ASSUME NO LIABILITY AND ARE NOT RESPONSIBLE FOR ANY MISUSE OR DAMAGE CAUSED BY THIS PROGRAM.
Features
- Works on Windows/Linux
- MultiThreaded [Fast]
- Uses GoBuster for Content Discovery (Fuzzing)
- Can Scan Single URL
- Can Scan Multiple URLs
- Can Save Vulnerable URLs in text format
- Reliable & Easy to Use [Very Less False Positive]
Tested On
Kali Linux
Windows 10
Prerequisite
- Python 3.X
- Few External Modules
How To Use in Linux
# Navigate to the /opt directory (optional)
$ cd /opt/
# Clone this repository
$ git clone https://github.com/PushpenderIndia/EARScanner.git
# Navigate to EARScanner folder
$ cd EARScanner
# Installing dependencies
$ sudo apt install python3-pip
$ pip3 install -r requirements.txt
# Installing GoBuster (For More Installation Method, Visit: https://github.com/OJ/gobuster)
# NOTE: GoBuster Tool is Only Required for using --fuzz-scan flag
# PS: You need at least go 1.16.0 to compile gobuster.
$ go install github.com/OJ/gobuster/[email protected]
# Help Menu
$ chmod +x EARScanner.py
$ python3 EARScanner.py --help
# Scanning Single URL
$ python3 EARScanner.py -u https://example.com/admin/dashboard.php
# Scanning Multiple URLs
$ python3 EARScanner.py -uL url_list.txt
# Automatically FUZZ URLs and Scan Them for EAR
$ python3 EARScanner.py -f https://www.example.com
How To Use in Windows
# Install dependencies
$ Install latest python 3.x
# Clone this repository or Download this project
$ git clone https://github.com/PushpenderIndia/EARScanner.git
# Navigate to EARScanner folder
$ cd EARScanner
# Installing dependencies
$ pip install -r requirements.txt
# Help Menu
$ python EARScanner.py --help
# Scanning Single URL
$ python EARScanner.py -u https://example.com/admin/dashboard.php
# Scanning Multiple URLs
$ python EARScanner.py -uL url_list.txt
# Automatically FUZZ URLs and Scan Them for EAR
$ python EARScanner.py -f https://www.example.com
Available Arguments
| Short Hand | Full Hand | Description |
|---|---|---|
| -h | --help | show this help message and exit |
| -u URL | --url URL | Scan Single URL for EAR |
| -uL FILE_CONTAINING_URLS | --url-list FILE_CONTAINING_URLS | Provide a File Containing URLs [PRO_TIP: Fuzz ALL URLs using tools such as ffuf,gobuster,disbuter,etc & then pass urls_list.txt using this argument] [NOTE: One URL in One Line]. |
| -f FUZZ_AND_SCAN | --fuzz-scan FUZZ_AND_SCAN | Provide a domain for scanning [It will Fuzz ALL URLs using GoBuster & Then It will scan them.] |
| -w WORDLIST | --wordlist WORDLIST | Provide a wordlist for fuzzing. [Only Use With --fuzz-scan]. default=content_discovery_all.txt |
| -t TIMEOUT | --timeout TIMEOUT | HTTP Request Timeout. default=60 |
| -th THREADNUMBER | --thread THREADNUMBER | Parallel HTTP Request Number. default=100 |
| -c CONTENTLENGTH | --content-length CONTENTLENGTH | Any Content Length for Confirming EAR Vulnerability. default=200 |
| -o OUTPUT | --output OUTPUT | Output filename [Script will save vulnerable urls by given name]. default=vulnerable.txt |
Screenshots:
Help Menu
Single URL Scan
Multiple URL Scan
Auto FUZZ & Scan
Contribute
- All Contributors are welcome, this repo needs contributors who will improve this tool to make it best.
4 Jan 13, 2022
56 Mar 25, 2022
364 Dec 30, 2022
362 Nov 28, 2022
53 Dec 31, 2022
2.8k Jan 03, 2023
15 May 21, 2022
6 Sep 22, 2022
1 Jan 24, 2022
1 Jan 09, 2022
2.1k Jan 08, 2023
232 Nov 21, 2022
826 Jan 01, 2023
81 Dec 23, 2022
29 Jul 14, 2022
1.7k Dec 28, 2022
0 Aug 28, 2022
33 Sep 28, 2022
133 Dec 18, 2022
39 May 24, 2022