add len check for -cidn and -cidl options

README.md

@@ -65,8 +65,8 @@ CONFIG:
    -t, -token string                        authentication token to connect protected interactsh server
    -pi, -poll-interval int                  poll interval in seconds to pull interaction data (default 5)
    -nf, -no-http-fallback                   disable http fallback registration
-   -cidl, -correlation-id-length int        length of the correlation id preamble (default 20)
-   -cidn, -correlation-id-nonce-length int  length of the correlation id nonce (default 13)
+   -cidl, -correlation-id-length int        length of the correlation id preamble (min 3, default 20)
+   -cidn, -correlation-id-nonce-length int  length of the correlation id nonce (min 3, default 13)
    -sf, -session-file string                store/read from session file
 
 FILTER:
@@ -350,8 +350,8 @@ INPUT:
    -acao-url string                         origin url to send in acao header to use web-client) (default "*")
    -sa, -skip-acme                          skip acme registration (certificate checks/handshake + TLS protocols will be disabled)
    -se, -scan-everywhere                    scan canary token everywhere
-   -cidl, -correlation-id-length int        length of the correlation id preamble (default 20)
-   -cidn, -correlation-id-nonce-length int  length of the correlation id nonce (default 13)
+   -cidl, -correlation-id-length int        length of the correlation id preamble (min 3, default 20)
+   -cidn, -correlation-id-nonce-length int  length of the correlation id nonce (min 3, default 13)
    -cert string                             custom certificate path
    -privkey string                          custom private key path
    -oih, -origin-ip-header string           HTTP header containing origin ip (interactsh behind a reverse proxy)

cmd/interactsh-client/main.go

@@ -52,8 +52,8 @@ func main() {
 		flagSet.StringVarP(&cliOptions.Token, "token", "t", "", "authentication token to connect protected interactsh server"),
 		flagSet.IntVarP(&cliOptions.PollInterval, "poll-interval", "pi", 5, "poll interval in seconds to pull interaction data"),
 		flagSet.BoolVarP(&cliOptions.DisableHTTPFallback, "no-http-fallback", "nf", false, "disable http fallback registration"),
-		flagSet.IntVarP(&cliOptions.CorrelationIdLength, "correlation-id-length", "cidl", settings.CorrelationIdLengthDefault, "length of the correlation id preamble"),
-		flagSet.IntVarP(&cliOptions.CorrelationIdNonceLength, "correlation-id-nonce-length", "cidn", settings.CorrelationIdNonceLengthDefault, "length of the correlation id nonce"),
+		flagSet.IntVarP(&cliOptions.CorrelationIdLength, "correlation-id-length", "cidl", settings.CorrelationIdLengthDefault, fmt.Sprintf("length of the correlation id preamble (min %d, default %d)", settings.CorrelationIdLengthMinimum, settings.CorrelationIdLengthDefault)),
+		flagSet.IntVarP(&cliOptions.CorrelationIdNonceLength, "correlation-id-nonce-length", "cidn", settings.CorrelationIdNonceLengthDefault, fmt.Sprintf("length of the correlation id nonce (min %d, default %d)", settings.CorrelationIdNonceLengthMinimum, settings.CorrelationIdNonceLengthDefault)),
 		flagSet.StringVarP(&cliOptions.SessionFile, "session-file", "sf", "", "store/read from session file"),
 		flagSet.DurationVarP(&cliOptions.KeepAliveInterval, "keep-alive-interval", "kai", time.Minute, "keep alive interval"),
 	)

cmd/interactsh-server/main.go

@@ -53,8 +53,8 @@ func main() {
 		flagSet.StringVar(&cliOptions.OriginURL, "acao-url", "*", "origin url to send in acao header to use web-client)"), // cli flag set to deprecate
 		flagSet.BoolVarP(&cliOptions.SkipAcme, "skip-acme", "sa", false, "skip acme registration (certificate checks/handshake + TLS protocols will be disabled)"),
 		flagSet.BoolVarP(&cliOptions.ScanEverywhere, "scan-everywhere", "se", false, "scan canary token everywhere"),
-		flagSet.IntVarP(&cliOptions.CorrelationIdLength, "correlation-id-length", "cidl", settings.CorrelationIdLengthDefault, "length of the correlation id preamble"),
-		flagSet.IntVarP(&cliOptions.CorrelationIdNonceLength, "correlation-id-nonce-length", "cidn", settings.CorrelationIdNonceLengthDefault, "length of the correlation id nonce"),
+		flagSet.IntVarP(&cliOptions.CorrelationIdLength, "correlation-id-length", "cidl", settings.CorrelationIdLengthDefault, fmt.Sprintf("length of the correlation id preamble (min %d, default %d)", settings.CorrelationIdLengthMinimum, settings.CorrelationIdLengthDefault)),
+		flagSet.IntVarP(&cliOptions.CorrelationIdNonceLength, "correlation-id-nonce-length", "cidn", settings.CorrelationIdNonceLengthDefault, fmt.Sprintf("length of the correlation id nonce (min %d, default %d)", settings.CorrelationIdNonceLengthMinimum, settings.CorrelationIdNonceLengthDefault)),
 		flagSet.StringVar(&cliOptions.CertificatePath, "cert", "", "custom certificate path"),
 		flagSet.StringVar(&cliOptions.PrivateKeyPath, "privkey", "", "custom private key path"),
 		flagSet.StringVarP(&cliOptions.OriginIPHeader, "origin-ip-header", "oih", "", "HTTP header containing origin ip (interactsh behind a reverse proxy)"),
@@ -142,6 +142,13 @@ func main() {
 		gologger.Fatal().Msgf("No domains specified\n")
 	}
 
+	if cliOptions.CorrelationIdLength < settings.CorrelationIdLengthMinimum {
+		gologger.Fatal().Msgf("CorrelationIdLength (cidl) must be at least %d\n", settings.CorrelationIdLengthMinimum)
+	}
+	if cliOptions.CorrelationIdNonceLength < settings.CorrelationIdNonceLengthMinimum {
+		gologger.Fatal().Msgf("CorrelationIdNonceLength (cidn) must be at least %d\n", settings.CorrelationIdNonceLengthMinimum)
+	}
+
 	if cliOptions.IPAddress == "" && cliOptions.ListenIP == "0.0.0.0" {
 		publicIP, _ := getPublicIP()
 		outboundIP, _ := iputil.GetSourceIP("scanme.sh")

pkg/client/client.go

@@ -107,6 +107,14 @@ func New(options *Options) (*Client, error) {
 		options.CorrelationIdNonceLength = DefaultOptions.CorrelationIdNonceLength
 	}
 
+	// Validate minimum lengths
+	if options.CorrelationIdLength < settings.CorrelationIdLengthMinimum {
+		return nil, fmt.Errorf("CorrelationIdLength must be at least %d", settings.CorrelationIdLengthMinimum)
+	}
+	if options.CorrelationIdNonceLength < settings.CorrelationIdNonceLengthMinimum {
+		return nil, fmt.Errorf("CorrelationIdNonceLength must be at least %d", settings.CorrelationIdNonceLengthMinimum)
+	}
+
 	var httpclient *retryablehttp.Client
 	if options.HTTPClient != nil {
 		httpclient = options.HTTPClient

pkg/settings/default.go

@@ -3,5 +3,7 @@ package settings
 const (
 	CorrelationIdLengthDefault      = 20
 	CorrelationIdNonceLengthDefault = 13
+	CorrelationIdLengthMinimum      = 3
+	CorrelationIdNonceLengthMinimum = 3
 	StorePayloadFileDefault         = "interactsh_payload.txt"
 )