katana
katana copied to clipboard
Headless issue with root user
Context: #131.
⚠️⚠️I know the tests I have just added are failing, I would like to know if accepting custom headers with empty key or empty value is an intended implementation.⚠️⚠️
sudo /home/edoardottt/go/bin/katana -hl -u http://edoardottt.com
[sudo] password for edoardottt:
__ __
/ /_____ _/ /____ ____ ___ _
/ '_/ _ / __/ _ / _ \/ _ /
/_/\_\\_,_/\__/\_,_/_//_/\_,_/ v0.0.1
projectdiscovery.io
[WRN] Use with caution. You are responsible for your actions.
[WRN] Developers assume no liability and are not responsible for any misuse or damage.
[FTL] could not create runner: could not create standard crawler: [launcher] Failed to get the debug url: [1107/180405.382126:ERROR:zygote_host_impl_linux.cc(90)] Running as root without --no-sandbox is not supported. See https://crbug.com/638180.
This PR adds two flags as suggested:
-hoa, -headless-optional-arguments string[] pass optional arguments to chrome
-hns, -headless-no-sandbox start chrome in --no-sandbox mode
I don't know actually if this is the best solution possible, -hns seems redundant when -hoa is present. Another solution could be try to detect if the user has sudo privileges (only on Linux?).
However, now it seems to work well with both two new flags:
Using -hoa
sudo ./cmd/katana/katana -hl -hoa no-sandbox=true -u http://edoardottt.com
__ __
/ /_____ _/ /____ ____ ___ _
/ '_/ _ / __/ _ / _ \/ _ /
/_/\_\\_,_/\__/\_,_/_//_/\_,_/ v0.0.1
projectdiscovery.io
[WRN] Use with caution. You are responsible for your actions.
[WRN] Developers assume no liability and are not responsible for any misuse or damage.
http://edoardottt.com/blog.html
http://edoardottt.com/cve.html
http://edoardottt.com/aboutme.html
http://edoardottt.com/cv.html
Using -hns
sudo ./cmd/katana/katana -hl -hns -u http://edoardottt.com
__ __
/ /_____ _/ /____ ____ ___ _
/ '_/ _ / __/ _ / _ \/ _ /
/_/\_\\_,_/\__/\_,_/_//_/\_,_/ v0.0.1
projectdiscovery.io
[WRN] Use with caution. You are responsible for your actions.
[WRN] Developers assume no liability and are not responsible for any misuse or damage.
http://edoardottt.com/blog.html
http://edoardottt.com/cve.html
http://edoardottt.com/aboutme.html
http://edoardottt.com/cv.html
Moreover, I have added some tests in order to check errors in the new function ParseHeadlessOptionalArguments() and the function ParseCustomHeaders().
This PR closes #131.