Conversation
Resolve baddns conflicts by taking dev's versions wholesale. Domino-specific files (domino.py, presets) preserved.
- Migrate options/options_desc to Pydantic Config class - Use event.url instead of event.data (now a dict) - Emit all findings as FINDING with severity/confidence/name - Remove redundant log property override - Rename domino-medium preset to domino (standard naming) - Update presets: httpx -> http
Replace single shared browser with a pool of dedicated browser instances (one per thread) to prevent deadlocking under concurrent load. Add 120s timeout per URL that kills and replaces hung browsers. Make instance count configurable via browser_instances config option (default 2) with memory usage warning on startup. Add domino-heavy to kitchen-sink preset.
…ent hash Attach body_mmh3 hash to URL events in HTTP module so downstream consumers can access it. Use it in domino's _incoming_dedup_hash to skip URLs with identical response bodies on the same host, avoiding redundant scans of templated pages (e.g. product listings).
📊 Performance Benchmark Report
📈 Detailed Results (All Benchmarks)
🎯 Performance Summary! 1 regression ⚠️
30 unchanged ✅🔍 Significant Changes (>10%)
🐍 Python Version 3.11.15 |
Chromium accumulates internal state (IPC buffers, renderer state) when reused across thousands of URLs, ballooning to 48GB+ virtual memory. Launch and close a browser per URL instead.
# Conflicts: # bbot/modules/http.py
|
Ran an A/B to gauge the resource cost. Same bounded scan both arms against ginandjuice.shop (
The RAM tracks domino activity rather than sitting resident. Functionally it delivered: 6 CONFIRMED findings the rest of the pipeline can't produce, including prototype pollution via The 6 findings below came only from the domino arm. The dev arm produced zero client-side findings, since nothing else in the pipeline exercises the DOM:
Pros
Cons
Note: web-focused preset, not full kitchen-sink, to isolate the domino delta. Happy to share the sampler and CSVs. |
singlerider
changed the title
2 participants
Summary
Adds the
dominomodule, wrapping DOMino (Chromium/Playwright) to detect confirmed client-side / DOM-based web vulnerabilities. The module watchesURLevents, drives a headless browser per URL, and emitsFINDINGevents for confirmed DOM XSS, HTML injection, prototype pollution, unsafe eval/jQuery, PostMessage issues, remote script includes, and reflected GET-parameter sinks.What it detects
DOM XSS (basic, onclick/getparam, onclick/hash, referer, window.name, PostMessage, direct JS), DOM-based HTML injection, prototype pollution, unsafe eval, unsafe jQuery, PostMessage sinks, remote JavaScript includes, hash decoding, and GET-parameter reflection/discovery/transformation. Rules are opt-in per scan;
Noneruns all.Changes
bbot/modules/domino.py: new active/safe module. WatchesURL, producesFINDING. One headless Chromium per URL, 120s per-URL timeout,DominoErrorand fatal-exception handling that setserroredinstead of crashing the scan. Only scans URLs taggedstatus-200(filter_event).bbot/modules/http.py+bbot/core/event/base.py: exposebody_sha256from the httpx response as a newhttp_body_hashevent property, used by domino's_incoming_dedup_hashso identical response bodies on the same host are only browsed once (avoids launching Chromium against N URLs that render the same page).bbot/presets/web/domino-light.yml,domino.yml,domino-heavy.yml: three tiers from "confirmed-only, minimal rules" to "all rules + spider + wayback".bbot/presets/kitchen-sink.yml: includesdomino-heavy.Config
rules(list, defaultNone= all): rule set to run.browser_instances(int, default 2): concurrent Chromium instances. Each uses ~800-1600 MB under load; drivesmodule_threads.suppress_parameter_discovery_reports(bool, default true): let parameter discovery feed rules without emitting a FINDING for the discovery itself.Open items
deps_piplistsd0m1n0. Confirm the intended release is published to PyPI before merge, or CI/fresh installs will fail dependency resolution.test_module_domino.pyyet. A mocked-target module test would keep this covered in CI, since it is browser-driven.domino-heavyis memory-heavy (2x Chromium by default) and is pulled intokitchen-sink; confirm that is intended for the everything preset.bbot/presets/web/domino.ymllistsremote-includeandremote-include-get-parameterstwice and is missing a trailing newline.