interactsh
interactsh copied to clipboard
Minor bug: AES-256 key generated from UUID has only 106 bits of entropy
In the storagedb code, the AES-256 key used for encrypting interactions is created as:
https://github.com/projectdiscovery/interactsh/blob/004720e6f4c0713003598ca1a463e3747f440117/pkg/storage/storagedb.go#L103
However, this means the key is the first 32 bytes of the UUID as a string (dashes and all). Since 6 bits in a 128-bit UUID are fixed and another 16 are thrown away by truncation, this means the total entropy of the key is reduced to just 106 bits.
Of course, 106 bits is still way too much to actually brute force so there's not much practical impact. But fixing it is very easy:
aesKey := make([]byte, 32)
rand.Read(aesKey)