JSFScan.sh icon indicating copy to clipboard operation
JSFScan.sh copied to clipboard

JS with & in url can break interlace - system crash

Open null-hyp0thesis opened this issue 2 years ago • 1 comments

Hi I've noticed, that JS urls with & in the url, can break out the JSLinkfinder.py script, This is because the interlace command is like so

 interlace -tL live_jsfile_links.txt -threads 5 -c "echo 'Scanning _target_ Now' ; python3 ./tools/LinkFinder/linkfinder.py -d -i _target_ -o cli >> endpoints.txt

Where the & would break-out of interlacce, and run &endofurl.js -o cli To which the error is: /bin/sh -o command not found.

null-hyp0thesis avatar Jul 01 '22 14:07 null-hyp0thesis

I've added ' to escape the command in here: https://github.com/KathanP19/JSFScan.sh/pull/38 Otherwise, thanks for a useful tool.

null-hyp0thesis avatar Jul 01 '22 14:07 null-hyp0thesis