Sherlock: Website rate limiting leads to False Positives
As we can see in the above snapshot,
BitCoinForum,
EyeEm,
HackerNews,
Tinder,
VirusTotal,
Wattpad,
forum_guns
display urls for the account name " noonewlouduse" but actually this username don't exist for them.
h20190563
All 7 comments
Can't reproduce, I only see four false positives as described in https://github.com/sherlock-project/sherlock/issues/813
pkubiak
on 27 Oct 2020
There are issues where if you're doing it often and some sites will return essentially status codes as a form of rate limiting but if it's looking for a message, it'll consider it 'passed'. I think maybe it would be good if 403's and >500's were automatically considered a fail rather than a pass. I can see why this happens since the whole error styles are just a big switch (ok if/elif) and can't support multiple types of failures.
darvell
on 27 Oct 2020
Yes, what @darvell suggested is actually happening. @pkubiak if you query with that username multiple times, you will be able to reproduce the same.
h20190563
on 28 Oct 2020
@h20190563 Sure, but it is not the fault of configuration of individual sites, but more the way how sherlock handle rate limits errors (403, >500 as mentioned by @darvell). Maybe the better title for that issue would be Website rate limiting leads to False Positives?
pkubiak
on 28 Oct 2020
@pkubiak thanks! I have changed the title.
h20190563
on 28 Oct 2020
@h20190563 Im new at this but what can i do to contribute that may close this issue?
lostnco1
on 7 Nov 2020
https://github.com/sherlock-project/sherlock/pull/852
ez. enjoy :)
darvell
on 8 Nov 2020
Related issues
senthilnayagam
路
4Comments
bialybudyn
路
6Comments
ptalmeida
路
4Comments
zero77
路
7Comments
hoadlck
路
3Comments
Most helpful comment
There are issues where if you're doing it often and some sites will return essentially status codes as a form of rate limiting but if it's looking for a message, it'll consider it 'passed'. I think maybe it would be good if 403's and >500's were automatically considered a fail rather than a pass. I can see why this happens since the whole error styles are just a big switch (ok if/elif) and can't support multiple types of failures.