httprobe icon indicating copy to clipboard operation
httprobe copied to clipboard

False Positive

Open Naategh opened this issue 5 years ago • 4 comments

Hi! I don't know why but it returns wrong results sometimes:

$ echo "genrih.resizer.mail.ru" | httprobe
https://genrih.resizer.mail.ru
http://genrih.resizer.mail.ru

Naategh avatar Jul 25 '20 13:07 Naategh

@Naategh it might be just appending both http/s by default without checking the domain? have you tried passing explicit flags like specifying a port and seeing if that yields better results?

gbiagomba avatar Oct 09 '20 13:10 gbiagomba

@gbiagomba thanks for your note. BTW I tried this and yet it returns wrong results.

Naategh avatar Oct 09 '20 18:10 Naategh

Hmmm I tried doing an nslookup and I didn't get a response. I wonder if you can run it and see the "traffic" coming out of it. Also it makes me wonder if it can't resolve a host does it just go into dumb mode and append http and https

gbiagomba avatar Oct 10 '20 05:10 gbiagomba

This can happen when the domain is using a wildcard subdomain redirect. Most of the time, it will redirect to a non-existent subdomain to the top-level domain's 404 page.

Since this functionality is pretty common, it may be good to add in a test for non-existent subdomains returning a response (ex, "probablynotreal12345678.yourdomain.com"), to notify the user that there will be false positives.

I'm not an expert with Go, but if it'd be helpful I'd be happy to do a pull request to add that functionality.

Back to the original question from last year. When I run $ echo "genrih.resizer.mail.ru" | httprobe it no longer returns a false positive. I think that is due to mail.ru changing a redirect policy on the second tier of subdomains. It will still return false positives for *.mail.ru, just not *.example.mail.ru.

BorrowedBastion avatar Apr 02 '21 23:04 BorrowedBastion