Skip to content

Add lightfuzz SSRF submodule, fix interactsh issues#2950

Merged
TheTechromancer merged 2 commits into3.0from
lightfuzz-ssrf-and-interactsh-fix
Mar 5, 2026
Merged

Add lightfuzz SSRF submodule, fix interactsh issues#2950
TheTechromancer merged 2 commits into3.0from
lightfuzz-ssrf-and-interactsh-fix

Conversation

@liquidsec
Copy link
Collaborator

@liquidsec liquidsec commented Mar 4, 2026

  • Fixes interactsh issues, such as those reported in Interactsh Errors #1053, and others
  • New SSRF lightfuzz submodule
  • Generalized the interactsh callback so any lightfuzz submodule (not just cmdi) can store its own name/description/severity/confidence in the subdomain tag dict
  • Protocol-aware findings: DNS-only interactions → HIGH/MODERATE, HTTP interactions → HIGH/CONFIRMED
  • Added debug logging to interactsh poll loop and lightfuzz finish() poll

- SSRF submodule with OOB detection via interactsh (http/https/bare domain probes)
- Protocol-aware severity: DNS=MODERATE, HTTP=CONFIRMED
- Interactsh debug logging in poll loop and finish()
@liquidsec liquidsec changed the title Add lightfuzz SSRF submodule, generalize interactsh callback Add lightfuzz SSRF submodule, fix interactsh issues Mar 4, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Mar 4, 2026

📊 Performance Benchmark Report

Comparing 3.0 (baseline) vs lightfuzz-ssrf-and-interactsh-fix (current)

📈 Detailed Results (All Benchmarks)

📋 Complete results for all benchmarks - includes both significant and insignificant changes

🧪 Test Name 📏 Base 📏 Current 📈 Change 🎯 Status
Bloom Filter Dns Mutation Tracking Performance 4.27ms 4.29ms +0.5%
Bloom Filter Large Scale Dns Brute Force 17.56ms 17.84ms +1.6%
Large Closest Match Lookup 362.42ms 349.87ms -3.5%
Realistic Closest Match Workload 195.67ms 192.66ms -1.5%
Event Validation Full Scan Startup Small Batch 502.21ms 490.80ms -2.3%
Event Validation Full Scan Startup Large Batch 777.86ms 758.47ms -2.5%
Make Event Autodetection Small 31.83ms 30.85ms -3.1%
Make Event Autodetection Large 317.78ms 317.99ms +0.1%
Make Event Explicit Types 13.90ms 14.10ms +1.4%
Excavate Single Thread Small 4.092s 4.110s +0.4%
Excavate Single Thread Large 9.749s 9.815s +0.7%
Excavate Parallel Tasks Small 4.245s 4.283s +0.9%
Excavate Parallel Tasks Large 7.357s 7.376s +0.3%
Is Ip Performance 3.21ms 3.23ms +0.6%
Make Ip Type Performance 11.53ms 11.50ms -0.3%
Mixed Ip Operations 4.59ms 4.54ms -1.1%
Typical Queue Shuffle 61.30µs 60.95µs -0.6%
Priority Queue Shuffle 700.75µs 691.59µs -1.3%

🎯 Performance Summary

No significant performance changes detected (all changes <10%)


🐍 Python Version 3.11.14

@liquidsec liquidsec mentioned this pull request Mar 4, 2026
@codecov
Copy link

codecov bot commented Mar 4, 2026

Codecov Report

❌ Patch coverage is 84.53608% with 15 lines in your changes missing coverage. Please review.
✅ Project coverage is 92%. Comparing base (389b8aa) to head (34d5895).
⚠️ Report is 16 commits behind head on 3.0.

Files with missing lines Patch % Lines
bbot/core/helpers/interactsh.py 56% 11 Missing ⚠️
bbot/modules/lightfuzz/lightfuzz.py 79% 3 Missing ⚠️
bbot/modules/lightfuzz/submodules/ssrf.py 94% 1 Missing ⚠️
Additional details and impacted files
@@          Coverage Diff          @@
##             3.0   #2950   +/-   ##
=====================================
- Coverage     92%     92%   -0%     
=====================================
  Files        436     437    +1     
  Lines      35642   35735   +93     
=====================================
+ Hits       32504   32580   +76     
- Misses      3138    3155   +17     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@TheTechromancer TheTechromancer merged commit f57c72f into 3.0 Mar 5, 2026
15 of 16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants