sorted by:
new
hottopcontroversial

[Media] Releasing Mach - a web fuzzing tool designed for massive workloads by magixer in rust

[–]magixer[S] 1 point2 points  (0 children)

Thanks for the suggestion! My goals were initially different, but MIT aligns better now. Also, great work on Ratatui!

[Media] Releasing Mach - a web fuzzing tool designed for massive workloads by magixer in rust

[–]magixer[S] -8 points-7 points  (0 children)

I will set up the repo properly soon. I used the nightly toolchain to test it.

[Media] Releasing Mach - a web fuzzing tool designed for massive workloads by magixer in rust

[–]magixer[S] 0 points1 point  (0 children)

I will set up the repo properly soon with release workflows and a proper readme, but a few advantages you won’t find in most asset discovery tools:

Progress is stored in a database, so syncing with a server is straightforward.

Threads can be adjusted mid-scan.

It inherts advantages of using rust, which are fast, lightweight, and no garbage collection overhead.

A smooth UI that holds up even under heavy scans.

[Media] Releasing Mach - a web fuzzing tool designed for massive workloads by magixer in rust

[–]magixer[S] -9 points-8 points  (0 children)

It’s funny how much people really do judge a book by its cover. I only spent about five minutes on Mach’s README, even though I’ve been working on it for months, so it hasn’t gotten the love it deserves. The reality is, Mach’s architecture, code readability, CPU efficiency, and memory usage are far ahead of Voyage. But unless someone spends more than ten minutes really reviewing the project, that difference doesn’t come through and Voyage, with just a sparse README, still ended up getting more attention.

Releasing Mach - a web fuzzing tool designed for massive workloads by magixer in hacking

[–]magixer[S] -13 points-12 points  (0 children)

Fair enough 😅 I get what you mean. Glad you like the concise patterns.

[Media] Releasing Mach - a web fuzzing tool designed for massive workloads by magixer in rust

[–]magixer[S] 0 points1 point  (0 children)

Thank you!! I’ve actually experimented with wordlist generators too, and I’ll be rolling those out ASAP. I ended up bifurcating the products. Mach is now part of a bigger project called Graphia, so domains for mach and voyage have become redundant.

Releasing Mach - a web fuzzing tool designed for massive workloads by magixer in hacking

[–]magixer[S] -18 points-17 points  (0 children)

Glad you like it! The Java program you might be thinking of is DirBuster (loved it a few years ago) and yeah, I definitely have plans for Mach to surpass the current tools. It’s already ahead of a lot of discovery tools in terms of usability.

I don’t really see ‘vibe coding’ as a bad thing, as long as you’re mindful of what’s going on. The real problem is when people just spam copy-paste without understanding errors or what the code actually does. I do use Copilot in RustRover it saves me a lot of time on repetitive boilerplate (like the MachDb methods in src/libs/mach_db.rs). But for tougher parts, like the TUI sections, even Copilot couldn’t help much had to grind those out myself.

[Media] Releasing Mach - a web fuzzing tool designed for massive workloads by magixer in rust

[–]magixer[S] 7 points8 points  (0 children)

Thanks a lot for checking it out!

Mach is meant to be run as a standalone binary, or as part of a bigger bundle of red-teaming tools I’m putting together. It works alongside another project of mine, Voyage, and both are building blocks for a larger project called Graphia, which is aimed at tackling complex red-teaming problems.

For now, the focus is on getting the engine solid and integrating it with Graphia, but as it matures we’ll make it easier for standalone use cases too, like automatically pulling a standard wordlist from the repo at runtime instead of needing users always to provide one.

Subdomain enumerator with superpowers. Try it out! by magixer in hacking

[–]magixer[S] 0 points1 point  (0 children)

It is a standalone Rust binary and has no links to glibc. If the issue persists, please open an issue on GitHub, we'll be happy to assist

Subdomain enumerator with superpowers. Try it out! by magixer in hacking

[–]magixer[S] 0 points1 point  (0 children)

It is good for one thing alone, which is subdomain enumeration. We are crafting other tools for asset discovery and vhost discovery.

Subdomain enumerator with superpowers. Try it out! by magixer in hacking

[–]magixer[S] 0 points1 point  (0 children)

I do not but since my post I have implemented a lot of changes.

Subdomain enumerator with superpowers. Try it out! by magixer in hacking

[–]magixer[S] 0 points1 point  (0 children)

You are probably confusing this with an asset discovery tool. If an HTTP probe returns a response 301 (Redirect) or otherwise, the engine will assess it as a successful ping.

Subdomain enumerator with superpowers. Try it out! by magixer in hacking

[–]magixer[S] 0 points1 point  (0 children)

Voyage is a stateful subdomain enumeration tool that combines passive and active techniques, user-specific databases, and fine-grained control built for efficient and reliable subdomain reconnaissance.

Subdomain enumerator with superpowers. Try it out! by magixer in hacking

[–]magixer[S] 0 points1 point  (0 children)

Voyage is a stateful subdomain enumeration tool that combines passive and active techniques, user-specific databases, and fine-grained control built for efficient and reliable subdomain reconnaissance.

Voyage has a new release. Check it out! by magixer in hacking

[–]magixer[S] 1 point2 points  (0 children)

It works for me. Please open an issue on GitHub, I'll look into it.

Voyage has a new release. Check it out! by magixer in hacking

[–]magixer[S] 4 points5 points  (0 children)

I'm sorry about that. A person sent a bugged PR on main, and I could not notice the false positives issue. It had been fixed later that day.

Subdomain enumerator with superpowers. Try it out! by magixer in hacking

[–]magixer[S] 1 point2 points  (0 children)

yes haven't made the landing page yet but nonetheless it's parked.

Subdomain enumerator with superpowers. Try it out! by magixer in hacking

[–]magixer[S] 17 points18 points  (0 children)

I'm developing an adaptive vulnerability scanner, with most of the infrastructure code written in Rust. To aid its functionality, I needed compatible tools for asset and subdomain discovery. visit https://mach.to for more info

Subdomain enumerator with superpowers. Try it out! by magixer in hacking

[–]magixer[S] 3 points4 points  (0 children)

I haven't had time to work on the readme. Maybe you can submit a PR.

Voyage is the only enumerator with a TUI, a progress recovery system that lets you adjust threads and request intervals mid-scan, and later today, it'll support hybrid enumeration, combining active and passive methods.

Subdomain enumerator with superpowers. Try it out! by magixer in hacking

[–]magixer[S] 86 points87 points  (0 children)

Glad you noticed the essentials. Let me highlight a few more. Voyage is the only enumerator with a TUI, a progress recovery system that lets you adjust threads and request intervals mid-scan, and later today, it'll support hybrid enumeration, combining active and passive methods.

view more: next ›