DiffCD

A Content Discovery tool using response diffing for finding more interesting/hidden content on web applications.

• Disclaimers
• Requirements
• Why
• Help

Disclaimers

• This is considered to be a beta release, and may contain bugs and unintentional behavior. Consider yourself warned!

Requirements

DiffCD requires HTTPDiff and HTTPInsert and can be install with python3 -m pip install httpdiff httpinsert or python3 -m pip install -r requirements.txt.

Why

Why create another content discovery tool when so many already exists?

Most (not all) content discovery tools rely solely on status codes for determining which endpoints "exists". Many applications have endpoints that are hidden due to the status code being the same as non-existant endpoints. Some websites even changes the reason phrase(!) and nothing else for certain endpoint. These types of behavior is really interesting when performing a pentest and can yield information about configuration etc. Relying only on the status code is a poor strategy resulting in subpar output. HTTPDiff analyzes all parts of the response; the status code, reason, headers, body, response times, errors, etc., this allows to find some interesting endpoints impossible to find with traditional tools, or even manually.

DiffCD uses HTTPDiff to determine the normal behavior of an application and checks for any differences when scanning for endpoints. This way it is possible to find endpoints based on any change of behavior, not only limited to the status code!

Help

usage: diffcd [-h] --wordlist WORDLIST [--extensions EXTENSIONS [EXTENSIONS ...]] (--url URL | --request REQUEST)
              [--method METHOD] [--header HEADER [HEADER ...]] [--body BODY] [--threads THREADS] [--proxy PROXY]
              [--https] [--verify] [--disable-encoding] [--allow-redirects] [--output-format {pretty,json,paths}]
              [--json] [--paths-only] [--output OUTPUT] [--no-color] [--verbose] [--debug] [--quiet] [--sleep SLEEP]
              [--calibration-sleep CALIBRATION_SLEEP] [--timeout TIMEOUT] [--ignore-errors] [--no-analyze-all]
              [--num-calibrations NUM_CALIBRATIONS] [--num-verifications NUM_VERIFICATIONS]

A Content Discovery tool for finding more interesting/hidden content on web applications

options:
  -h, --help            show this help message and exit
  --wordlist WORDLIST, -w WORDLIST
                        Specify wordlist to scan for filenames (extensions will be appended to all filenames)
  --extensions EXTENSIONS [EXTENSIONS ...], -e EXTENSIONS [EXTENSIONS ...]

target:
  --url URL, -u URL
  --request REQUEST, --req REQUEST, -r REQUEST
                        Specify a file containing a raw request for scanning

request:
  --method METHOD, -m METHOD
  --header HEADER [HEADER ...]
  --body BODY, -b BODY  Specify content to be in the body of the request
  --threads THREADS, -t THREADS
  --proxy PROXY, -p PROXY
  --https, --tls
  --verify              Verify SSL certificates
  --disable-encoding    Disable default encoding of payloads
  --allow-redirects, -ar
                        Specify if requests should follow redirects

output:
  --output-format {pretty,json,paths}, -of {pretty,json,paths}
                        How to print findings: 'pretty' (human readable, default), 'json' (one JSON object per line
                        with full detail), 'paths' (just the URL of each finding, one per line)
  --json, -j            Shortcut for --output-format json
  --paths-only, -po     Shortcut for --output-format paths (minimal: just the paths)
  --output OUTPUT, -o OUTPUT
                        Write findings to a file instead of stdout (logs still go to stderr)
  --no-color            Disable colored output (color is auto-disabled when piping)

verbosisty:
  --verbose, -v
  --debug, -d
  --quiet, -q           Suppress calibration/progress logs on stderr (only errors + findings)

scan:
  --sleep SLEEP, -ss SLEEP, -s SLEEP
                        Determines how long (ms) the scanner should sleep between each request during scan
  --calibration-sleep CALIBRATION_SLEEP, -cs CALIBRATION_SLEEP
                        Determines how long (ms) the scanner should sleep between each request while calibrating
  --timeout TIMEOUT     Determines the timeout duration (s) for each request
  --ignore-errors, -ie  Ignore errors if any errors occurs during calibration

analyzer:
  --no-analyze-all      Make analyzer skip analyzing the body if the content length is static
  --num-calibrations NUM_CALIBRATIONS
                        Specify how many requests should be sent during calibration
  --num-verifications NUM_VERIFICATIONS
                        Specify how many times an endpoint should be verified/re-tested