wireghoul/dotdotpwn

too slow

OmarAtallahh opened this issue · 3 comments

OmarAtallahh commented

is there any option to increase the speed of the tool?
thanks in advance

wireghoul commented

What are you doing? What have you tried? How slow is it?

OmarAtallahh commented

this is my command

sudo dotdotpwn -m http-url -u "https://domain.net/TRAVERSAL" -O -k "root:"

and the tool sends the request pretty slow kinda 1 request per second, have i done anything wrong?

wireghoul commented

There's a bit going on here, TL;DR you might want to use https://github.com/wireghoul/traversty instead.

  1. Don't use sudo, most web tools don't need it and if there was a vulnerability in dotdotpwn you get exploited as root
  2. The http-url module is used for testing server side scripting/pages and the traversal string should be supplied as a parameter, your invocation is essentially the same as -m http and is useful for testing specific web server versions
  3. -O is an awful hack, you're much better off if you run nmap separately
  4. -O os detection also doesn't matter since your use of -k root: only works on *nix type OSs
  5. If you're using -k you might as well specify -f /etc/passwd to speed things up
  6. You can adjust scan delay via command line (read documentation)

With all of that out of the way, dotdotpwn isn't great for fast scanning of remote systems, it's better used in a lab for research than it is at bug bounty style blind scanning. If you scan too fast it tends to break the script or the server it is scanning. If you ned a quick "works most of the time" solution instead, checkout traversty (linked above). Otherwise you might want to use the dotdotpwn stdout option and do a custom script for scanning with threads.