-
Notifications
You must be signed in to change notification settings - Fork 1.5k
Description
Describe the bug
If a domain is provided by the user that is not capitalized and a source that provides a subdomain contains an FQDN with a domain that is not all lower case (e.g., crt.sh with certs with upper-case SANs, then the Extractor.FindString will not match and return the FQDN since it does a case sensitive match. I only tested with crtsh but other providers/sources can be affected if they use Extractor.FindString() to match FQDNs.
Apologies for the lack of a PR but it needs more review and there are probably better ways to address the issue that a core dev would know about.
Subfinder version
See screenshot.
Complete command you used to reproduce this
See screenshot.
Screenshots
Patched version on the right.
Patch
Incomplete and inefficient patch but it's effective for crt.sh. Makes Extractor.FindString case insensitive and adds a ToLower() to the crtsh scraper to pass additional checks. Someone ought to ensure other scrapers that can return a domain with one or more capitals have a similar ToLower() added, as needed.
# report non-lowercase subdomains (at least from crtsh)
sed -i 's/session.Extractor.FindString(subdomain)/strings.ToLower(session.Extractor.FindString(subdomain))/' v2/pkg/subscraping/sources/crtsh/crtsh.go
sed -i 's/\.Compile(`/\.Compile(`(?i)/' v2/pkg/subscraping/utils.go
cd v2 && make && sudo cp ./subfinder /usr/local/bin/