Fixed the OTX provider due do API path confusion #28
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hey !
First, thank you for this tool, I used it a lot during engagement and find it very handy :)
I realized no later than today that myself and one of my coworkers had different outputs but targeting the same hostname (subdomain.domain.com).
Intercepting the
gau
requests and reading a bit about the OTX documentation made me realize that the API endpoint currently used in the OTX provider would return data only when a domain is provided, but nothing when a subdomain is provided (https://otx.alienvault.com/assets/static/external_api.html)I just made a couple of changes to make sure the right endpoint is used depending on the input (domain or subdomain) and also made sure that the
-subs
switch would still work. If you feed thex.y.z
hostname togau
without the-subs
switch, the OTX provider will use/api/v1/indicators/hostname/{hostname}/{section}
as this endpoint returns URL for a hostname that is not a domain. Now if you want the subdomains of that hostname (e.g.a.x.y.z
andb.x.y.z
), it will use the/api/v1/indicators/domain/{domain}/{section}
and for every key in the return dict, check if it contains the submitted hostname.I didn't include the
go.mod
and thego.sum
as I don't know your opinion about versioning but feel free to add them if you feel the PR useful and you're into reproductible builds :)