briskinfosec / bhhit-v1.0 Goto Github PK

I am trying to leverage this tool to prove whether a site really is at risk, that a security consultant claims.

If I plug in the site as a URL (-u ) then I get:

 [+] Invoking the scrapy crawler...

[!] Please wait until the crawling process gets over...

[!] Please maintain the patience for at least 30 secs. Crawling delay depends upon the scope of target domain...

[!] No redirections occured to perform the attack.

[+] Exiting!...

[+] Finished automated host-header-attack scripts in 1 secs.

Is this GOOD? Is this BAD? Did the test fail for some undeclared reason in the code level and not the actual test?

Or:

[*] Trying with modified host header... 

:(  Bad Request, Unable to fetch the location header.

[*] Trying with X-Forwarded-Host header... 

:(  Bad Request, Unable to fetch the location header.

[+] Finished automated host-header-attack scripts in 3 secs.

Is this a failure at the site? Or does it mean things are good?

Documentation isn't clear for expected outputs in a result that is not 'everything is on fire, run!!!'.

Alternate issue: don't know how to make a 'word list'. Created a simple file with one word per line. Wasn't rejected with the '-w' command line switch. README file could add a one line statement on what the file should look like.