Mario Vilas
Mario Vilas
They can be extracted from SSLScan and Nmap results. Also we can autodiscover domain names from them. This would also enable us to pin SSL vulnerabilities to the certificates themselves...
From sha0: https://bitbucket.org/sha0coder/dirscan/src/c74f04b3d1575d70749ead19d8a9c77fb1e24441/wordlists/?at=master
We are currently using a SQLite database with a wrapper to simulate an object-oriented graph database on top of it. We would greatly benefit from using a NoSQL database instead.
That way some warnings may only be shown in more verbose levels if they are of little relevance, or in less verbose levels if they are very important.
Currently we only support plain text proxies, we should support SSL enabled proxies as well.
If a plugin dies without sending its ACK message, the Orchestrator might get stuck waiting forever. Other audits would continue normally, but this audit would sit there doing nothing, because...