Execution After Redirect (EAR) / Long Response Redirection Vulnerability Scanner written in python3

Last update: Dec 12, 2022

Related tags

Overview

EARScanner

                    This small python script can do really awesome work.

Execution After Redirect (EAR) / Long Response Redirection Vulnerability Scanner written in python3, Can Scan Single & Multiple URLs, MultiThreaded, Fast & Reliable, Can Fuzz All URLs of target website & then can scan them for EAR

Disclaimer

💻 This project was created only for good purposes and personal use.

THIS SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. YOU MAY USE THIS SOFTWARE AT YOUR OWN RISK. THE USE IS COMPLETE RESPONSIBILITY OF THE END-USER. THE DEVELOPERS ASSUME NO LIABILITY AND ARE NOT RESPONSIBLE FOR ANY MISUSE OR DAMAGE CAUSED BY THIS PROGRAM.

Features

Works on Windows/Linux
MultiThreaded [Fast]
Uses GoBuster for Content Discovery (Fuzzing)
Can Scan Single URL
Can Scan Multiple URLs
Can Save Vulnerable URLs in text format
Reliable & Easy to Use [Very Less False Positive]

Tested On

Kali Linux

Windows 10

Prerequisite

Python 3.X
Few External Modules

How To Use in Linux

# Navigate to the /opt directory (optional)
$ cd /opt/

# Clone this repository
$ git clone https://github.com/PushpenderIndia/EARScanner.git

# Navigate to EARScanner folder
$ cd EARScanner

# Installing dependencies
$ sudo apt install python3-pip 
$ pip3 install -r requirements.txt

# Installing GoBuster (For More Installation Method, Visit: https://github.com/OJ/gobuster)
# NOTE: GoBuster Tool is Only Required for using --fuzz-scan flag
# PS: You need at least go 1.16.0 to compile gobuster.
$ go install github.com/OJ/gobuster/[email protected]

# Help Menu
$ chmod +x EARScanner.py
$ python3 EARScanner.py --help

# Scanning Single URL
$ python3 EARScanner.py -u https://example.com/admin/dashboard.php

# Scanning Multiple URLs
$ python3 EARScanner.py -uL url_list.txt

# Automatically FUZZ URLs and Scan Them for EAR 
$ python3 EARScanner.py -f https://www.example.com

How To Use in Windows

# Install dependencies 
$ Install latest python 3.x

# Clone this repository or Download this project
$ git clone https://github.com/PushpenderIndia/EARScanner.git

# Navigate to EARScanner folder
$ cd EARScanner

# Installing dependencies
$ pip install -r requirements.txt

# Help Menu
$ python EARScanner.py --help

# Scanning Single URL
$ python EARScanner.py -u https://example.com/admin/dashboard.php

# Scanning Multiple URLs
$ python EARScanner.py -uL url_list.txt

# Automatically FUZZ URLs and Scan Them for EAR 
$ python EARScanner.py -f https://www.example.com

Available Arguments

Short Hand	Full Hand	Description
-h	--help	show this help message and exit
-u URL	--url URL	Scan Single URL for EAR
-uL FILE_CONTAINING_URLS	--url-list FILE_CONTAINING_URLS	Provide a File Containing URLs [PRO_TIP: Fuzz ALL URLs using tools such as ffuf,gobuster,disbuter,etc & then pass urls_list.txt using this argument] [NOTE: One URL in One Line].
-f FUZZ_AND_SCAN	--fuzz-scan FUZZ_AND_SCAN	Provide a domain for scanning [It will Fuzz ALL URLs using GoBuster & Then It will scan them.]
-w WORDLIST	--wordlist WORDLIST	Provide a wordlist for fuzzing. [Only Use With --fuzz-scan]. default=content_discovery_all.txt
-t TIMEOUT	--timeout TIMEOUT	HTTP Request Timeout. default=60
-th THREADNUMBER	--thread THREADNUMBER	Parallel HTTP Request Number. default=100
-c CONTENTLENGTH	--content-length CONTENTLENGTH	Any Content Length for Confirming EAR Vulnerability. default=200
-o OUTPUT	--output OUTPUT	Output filename [Script will save vulnerable urls by given name]. default=vulnerable.txt

Screenshots:

Help Menu

Single URL Scan

Multiple URL Scan

Auto FUZZ & Scan

Contribute

All Contributors are welcome, this repo needs contributors who will improve this tool to make it best.

Execution After Redirect (EAR) / Long Response Redirection Vulnerability Scanner written in python3

Related tags

Overview

EARScanner

Disclaimer

Features

Tested On

Prerequisite

How To Use in Linux

How To Use in Windows

Available Arguments

Screenshots:

Help Menu

Single URL Scan

Multiple URL Scan

Auto FUZZ & Scan

Contribute

Owner

Pushpender Singh

RCE Exploit for Gitlab < 13.9.4

Proof of concept for CVE-2021-31166, a remote HTTP.sys use-after-free triggered remotely.

Windows Stack Based Auto Buffer Overflow Exploiter

Automatically fetch, measure, and merge subscription links on the network, use Github Action

🐝 ℹ️ Honeybee extension for export to IES-VE gem file format

Keystroke logging, often referred to as keylogging or keyboard capturing

信息收集自动化工具

This repository uses a mixture of numbers, alphabets, and other symbols found on the computer keyboard

Visibility and Mitigation for Log4J vulnerabilities

Moodle community-based vulnerability scanner

WpDisect is a wordpress hacking tool that finds vulnerabilities in wordpress.

Dome - Subdomain Enumeration Tool. Fast and reliable python script that makes active and/or passive scan to obtain subdomains and search for open ports.

Quickstart resources for the WiFi Nugget, a cat themed WiFi Security platform for beginners.

Port scanning tool that uses Python3. Created by Noble Wilson

Grafana-0Day-Vuln-POC

FTP-Exploits is a tool made in python that contains 4 diffrent types of ftp exploits that can be used in Penetration Testing.

RCE 0-day for GhostScript 9.50 - Payload generator

Cryptick is a stock ticker for cryptocurrency tokens, and a physical NFT.

PoC for CVE-2021-26855 -Just a checker-

OMIGOD! OM I GOOD? A free scanner to detect VMs vulnerable to one of the