Execution After Redirect (EAR) / Long Response Redirection Vulnerability Scanner written in python3

Last update: Dec 12, 2022

Related tags

Overview

EARScanner

                    This small python script can do really awesome work.

Execution After Redirect (EAR) / Long Response Redirection Vulnerability Scanner written in python3, Can Scan Single & Multiple URLs, MultiThreaded, Fast & Reliable, Can Fuzz All URLs of target website & then can scan them for EAR

Disclaimer

💻 This project was created only for good purposes and personal use.

THIS SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. YOU MAY USE THIS SOFTWARE AT YOUR OWN RISK. THE USE IS COMPLETE RESPONSIBILITY OF THE END-USER. THE DEVELOPERS ASSUME NO LIABILITY AND ARE NOT RESPONSIBLE FOR ANY MISUSE OR DAMAGE CAUSED BY THIS PROGRAM.

Features

Works on Windows/Linux
MultiThreaded [Fast]
Uses GoBuster for Content Discovery (Fuzzing)
Can Scan Single URL
Can Scan Multiple URLs
Can Save Vulnerable URLs in text format
Reliable & Easy to Use [Very Less False Positive]

Tested On

Kali Linux

Windows 10

Prerequisite

Python 3.X
Few External Modules

How To Use in Linux

# Navigate to the /opt directory (optional)
$ cd /opt/

# Clone this repository
$ git clone https://github.com/PushpenderIndia/EARScanner.git

# Navigate to EARScanner folder
$ cd EARScanner

# Installing dependencies
$ sudo apt install python3-pip 
$ pip3 install -r requirements.txt

# Installing GoBuster (For More Installation Method, Visit: https://github.com/OJ/gobuster)
# NOTE: GoBuster Tool is Only Required for using --fuzz-scan flag
# PS: You need at least go 1.16.0 to compile gobuster.
$ go install github.com/OJ/gobuster/[email protected]

# Help Menu
$ chmod +x EARScanner.py
$ python3 EARScanner.py --help

# Scanning Single URL
$ python3 EARScanner.py -u https://example.com/admin/dashboard.php

# Scanning Multiple URLs
$ python3 EARScanner.py -uL url_list.txt

# Automatically FUZZ URLs and Scan Them for EAR 
$ python3 EARScanner.py -f https://www.example.com

How To Use in Windows

# Install dependencies 
$ Install latest python 3.x

# Clone this repository or Download this project
$ git clone https://github.com/PushpenderIndia/EARScanner.git

# Navigate to EARScanner folder
$ cd EARScanner

# Installing dependencies
$ pip install -r requirements.txt

# Help Menu
$ python EARScanner.py --help

# Scanning Single URL
$ python EARScanner.py -u https://example.com/admin/dashboard.php

# Scanning Multiple URLs
$ python EARScanner.py -uL url_list.txt

# Automatically FUZZ URLs and Scan Them for EAR 
$ python EARScanner.py -f https://www.example.com

Available Arguments

Short Hand	Full Hand	Description
-h	--help	show this help message and exit
-u URL	--url URL	Scan Single URL for EAR
-uL FILE_CONTAINING_URLS	--url-list FILE_CONTAINING_URLS	Provide a File Containing URLs [PRO_TIP: Fuzz ALL URLs using tools such as ffuf,gobuster,disbuter,etc & then pass urls_list.txt using this argument] [NOTE: One URL in One Line].
-f FUZZ_AND_SCAN	--fuzz-scan FUZZ_AND_SCAN	Provide a domain for scanning [It will Fuzz ALL URLs using GoBuster & Then It will scan them.]
-w WORDLIST	--wordlist WORDLIST	Provide a wordlist for fuzzing. [Only Use With --fuzz-scan]. default=content_discovery_all.txt
-t TIMEOUT	--timeout TIMEOUT	HTTP Request Timeout. default=60
-th THREADNUMBER	--thread THREADNUMBER	Parallel HTTP Request Number. default=100
-c CONTENTLENGTH	--content-length CONTENTLENGTH	Any Content Length for Confirming EAR Vulnerability. default=200
-o OUTPUT	--output OUTPUT	Output filename [Script will save vulnerable urls by given name]. default=vulnerable.txt

Screenshots:

Help Menu

Single URL Scan

Multiple URL Scan

Auto FUZZ & Scan

Contribute

All Contributors are welcome, this repo needs contributors who will improve this tool to make it best.

Execution After Redirect (EAR) / Long Response Redirection Vulnerability Scanner written in python3

Related tags

Overview

EARScanner

Disclaimer

Features

Tested On

Prerequisite

How To Use in Linux

How To Use in Windows

Available Arguments

Screenshots:

Help Menu

Single URL Scan

Multiple URL Scan

Auto FUZZ & Scan

Contribute

Owner

Pushpender Singh

JavaScript Raider is a coverage-guided JavaScript fuzzing framework designed for the v8 JavaScript engine

DNSpooq - dnsmasq cache poisoning (CVE-2020-25686, CVE-2020-25684, CVE-2020-25685)

Unsafe Twig processing of static pages leading to RCE in Grav CMS 1.7.10

command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.

Python implementation of the diceware password generating algorithm.

Tools for investigating Log4j CVE-2021-44228

Malware Configuration And Payload Extraction

Proof of concept for CVE-2021-24086, a NULL dereference in tcpip.sys triggered remotely.

A fully automated, accurate, and extensive scanner for finding vulnerable log4j hosts

Backdoor is a term that refers to the access of the software or hardware of a computer system without being detected.

The next level Python obfuscator, nearly impossible to deobfuscate.

GitLab CI security tools runner

SSLyze is a fast and powerful SSL/TLS scanning tool and Python library.

Wireguard VPN Server Installer for: on Ubuntu, Debian, Arch, Fedora and CentOS

Easily retargetable and hackable interactive disassembler with IDAPython-compatible plugin API

Sample exploits for Zephyr CVE-2021-3625

Using python 3 and Flask an MVC system where the AES 128 CBC and Trivium algorithms

Community Repository for Unofficial Saltbox Add-ons

Automated tool to exploit basic buffer overflow remotely and locally & x32 and x64

It's a simple tool for test vulnerability Apache Path Traversal