bbot
bbot copied to clipboard
Excavate with yara matching rules doesn't emit a unique enough description
Describe the bug When using yara rules, the excavate module doesn't generate a unique matching description which causes additional matches on different sites to be suppressed.
Expected behavior Every unique yara rule match should emit a FINDING
BBOT Command
Example: bbot -m httpx -t example.com -cy yararule.txt
OS, BBOT Installation Method + Version
OS: Arch Linux, Installation method: pip, BBOT version: dev
Example Output
[FINDING] {"description": "Custom Yara Rule [find_string] Matched via identifier [str1]", "host": "example.com", "path": "/", "url": "https://example.com/"} httpx->excavate
Debug Message
[DBUG] _scan_ingress: Not forwarding FINDING("{'description': 'Custom Yara Rule [find_string] Matched via identifier [str1]', ...", module=excavate, tags=set()) because event was already emitted by its module
Fixed in: https://github.com/blacklanternsecurity/bbot/pull/1938
Fixed in https://github.com/blacklanternsecurity/bbot/pull/1969.