Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed the OTX provider due do API path confusion #28

Merged
merged 2 commits into from
Dec 10, 2020

Conversation

BastienFaure
Copy link
Contributor

Hey !

First, thank you for this tool, I used it a lot during engagement and find it very handy :)

I realized no later than today that myself and one of my coworkers had different outputs but targeting the same hostname (subdomain.domain.com).

Intercepting the gau requests and reading a bit about the OTX documentation made me realize that the API endpoint currently used in the OTX provider would return data only when a domain is provided, but nothing when a subdomain is provided (https://otx.alienvault.com/assets/static/external_api.html)

I just made a couple of changes to make sure the right endpoint is used depending on the input (domain or subdomain) and also made sure that the -subs switch would still work. If you feed the x.y.z hostname to gau without the -subs switch, the OTX provider will use /api/v1/indicators/hostname/{hostname}/{section} as this endpoint returns URL for a hostname that is not a domain. Now if you want the subdomains of that hostname (e.g. a.x.y.z and b.x.y.z), it will use the /api/v1/indicators/domain/{domain}/{section} and for every key in the return dict, check if it contains the submitted hostname.

I didn't include the go.mod and the go.sum as I don't know your opinion about versioning but feel free to add them if you feel the PR useful and you're into reproductible builds :)

@lc
Copy link
Owner

lc commented Dec 1, 2020

Hey @BastienFaure,

Thanks for opening this PR! I'm currently busy this week with final exams, but I will review this as soon as I can.

@lc lc merged commit 7c76047 into lc:master Dec 10, 2020
@lc
Copy link
Owner

lc commented Dec 10, 2020

Looks good, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants