pax_global_header00006660000000000000000000000064146663414420014524gustar00rootroot0000000000000052 comment=2716816f86668b9dbf6e77612b28ff7ecac4238b CMSScanner-0.14.3/000077500000000000000000000000001466634144200135455ustar00rootroot00000000000000CMSScanner-0.14.3/.github/000077500000000000000000000000001466634144200151055ustar00rootroot00000000000000CMSScanner-0.14.3/.github/dependabot.yml000066400000000000000000000004061466634144200177350ustar00rootroot00000000000000version: 2 updates: - package-ecosystem: bundler directory: "/" schedule: interval: daily open-pull-requests-limit: 10 ignore: - dependency-name: rubocop-performance versions: - 1.10.0 - dependency-name: rubocop versions: - 1.9.0 CMSScanner-0.14.3/.github/workflows/000077500000000000000000000000001466634144200171425ustar00rootroot00000000000000CMSScanner-0.14.3/.github/workflows/build.yml000066400000000000000000000015021466634144200207620ustar00rootroot00000000000000name: Build on: [push, pull_request] jobs: build: runs-on: ubuntu-latest strategy: matrix: ruby: ['3.0', 3.1, 3.2, 3.3] steps: - name: Checkout code uses: actions/checkout@v3 - name: Set up Ruby ${{ matrix.ruby }} uses: ruby/setup-ruby@v1 with: ruby-version: ${{ matrix.ruby }} - name: Install GEMs run: | gem install bundler -v 2.4.22 bundle config force_ruby_platform true bundle config path vendor/bundle bundle install --jobs 4 --retry 3 - name: rubocop run: | bundle exec rubocop - name: rspec run: | bundle exec rspec - name: Coveralls uses: coverallsapp/github-action@master continue-on-error: true with: github-token: ${{ secrets.GITHUB_TOKEN }} CMSScanner-0.14.3/.github/workflows/gempush.yml000066400000000000000000000021271466634144200213370ustar00rootroot00000000000000name: Ruby Gem on: release: types: [published] jobs: build: name: Build + Publish runs-on: ubuntu-latest steps: - uses: actions/checkout@master - name: Set up Ruby 3.0 uses: ruby/setup-ruby@v1 with: ruby-version: '3.0' bundler-cache: true #- name: Publish to GPR # run: | # mkdir -p $HOME/.gem # touch $HOME/.gem/credentials # chmod 0600 $HOME/.gem/credentials # printf -- "---\n:github: Bearer ${GEM_HOST_API_KEY}\n" > $HOME/.gem/credentials # gem build *.gemspec # gem push --KEY github --host https://rubygems.pkg.github.com/${OWNER} *.gem # env: # GEM_HOST_API_KEY: ${{secrets.GITHUB_TOKEN}} # OWNER: wpscanteam - name: Publish to RubyGems run: | mkdir -p $HOME/.gem touch $HOME/.gem/credentials chmod 0600 $HOME/.gem/credentials printf -- "---\n:rubygems_api_key: ${GEM_HOST_API_KEY}\n" > $HOME/.gem/credentials gem build *.gemspec gem push *.gem env: GEM_HOST_API_KEY: ${{secrets.RUBYGEMS_AUTH_TOKEN}} CMSScanner-0.14.3/.gitignore000066400000000000000000000000661466634144200155370ustar00rootroot00000000000000*.gem *.rbc .bundle .config coverage pkg Gemfile.lock CMSScanner-0.14.3/.rspec000066400000000000000000000000511466634144200146560ustar00rootroot00000000000000--color --fail-fast --require spec_helperCMSScanner-0.14.3/.rubocop.yml000066400000000000000000000021401466634144200160140ustar00rootroot00000000000000require: rubocop-performance AllCops: NewCops: enable SuggestExtensions: false TargetRubyVersion: 2.5 Exclude: - '*.gemspec' - 'vendor/**/*' - 'example/**/*' Layout/LineLength: Max: 120 Lint/ConstantDefinitionInBlock: Enabled: false Lint/FloatComparison: Exclude: - spec/app/models/version_spec.rb Lint/MissingSuper: Enabled: false Lint/UriEscapeUnescape: Enabled: false Lint/UselessMethodDefinition: Exclude: - spec/lib/finders/same_type_finder_spec.rb - spec/lib/finders/unique_finder_spec.rb Metrics/AbcSize: Max: 28 Metrics/BlockLength: Exclude: - 'spec/**/*' Metrics/CyclomaticComplexity: Max: 10 Metrics/MethodLength: Max: 18 Exclude: - app/controllers/core/cli_options.rb Metrics/ParameterLists: Max: 6 MaxOptionalParameters: 4 Metrics/PerceivedComplexity: Max: 9 Style/ClassVars: Enabled: false Style/CombinableLoops: Exclude: - spec/lib/controllers_spec.rb Style/Documentation: Enabled: false Style/FormatStringToken: Exclude: - lib/cms_scanner/finders/finder.rb Style/MixinUsage: Exclude: - lib/cms_scanner/formatter.rb CMSScanner-0.14.3/.simplecov000066400000000000000000000006741466634144200155560ustar00rootroot00000000000000# frozen_string_literal: true if ENV['GITHUB_ACTION'] require 'simplecov-lcov' SimpleCov::Formatter::LcovFormatter.config do |c| c.single_report_path = 'coverage/lcov.info' c.report_with_single_file = true end SimpleCov.formatter = SimpleCov::Formatter::LcovFormatter end SimpleCov.start do enable_coverage :branch # Only supported for Ruby >= 2.5 add_filter '/example/' add_filter '/spec/' add_filter 'helper' end CMSScanner-0.14.3/Gemfile000066400000000000000000000001051466634144200150340ustar00rootroot00000000000000# frozen_string_literal: true source 'https://rubygems.org' gemspec CMSScanner-0.14.3/LICENSE000066400000000000000000000020451466634144200145530ustar00rootroot00000000000000Copyright (C) 2014-2015 - WPScanTeam Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. CMSScanner-0.14.3/README.md000066400000000000000000000024621466634144200150300ustar00rootroot00000000000000# CMSScanner [![Gem Version](https://badge.fury.io/rb/cms_scanner.svg)](https://badge.fury.io/rb/cms_scanner) ![Build](https://github.com/wpscanteam/CMSScanner/workflows/Build/badge.svg) [![Coverage Status](https://img.shields.io/coveralls/wpscanteam/CMSScanner.svg)](https://coveralls.io/r/wpscanteam/CMSScanner) [![Code Climate](https://api.codeclimate.com/v1/badges/b90b7f9f6982792ef8d6/maintainability)](https://codeclimate.com/github/wpscanteam/CMSScanner/maintainability) The goal of this gem is to provide a quick and easy way to create a CMS/WebSite Scanner by acting like a Framework and providing classes, formatters etc. ## /!\ This gem is currently Experimental /!\ ## A basic implementation example is available in the example folder. To start to play with it, copy all its files and folders into a new git repository and run `bundle install && rake install` inside it. It will create a `cmsscan` command that you can run against a target, ie `cmsscan --url https://www.google.com` Install Dependencies: `bundle install` ## Contributing 1. Fork it ( https://github.com/wpscanteam/CMSScanner/fork ) 2. Create your feature branch (`git checkout -b my-new-feature`) 3. Commit your changes (`git commit -am 'Add some feature'`) 4. Push to the branch (`git push origin my-new-feature`) 5. Create new Pull Request CMSScanner-0.14.3/Rakefile000066400000000000000000000003631466634144200152140ustar00rootroot00000000000000# frozen_string_literal: true require 'bundler/gem_tasks' require 'rspec/core/rake_task' require 'rubocop/rake_task' RuboCop::RakeTask.new RSpec::Core::RakeTask.new(:spec) # Run rubocop & rspec before the build task build: %i[rubocop spec] CMSScanner-0.14.3/app/000077500000000000000000000000001466634144200143255ustar00rootroot00000000000000CMSScanner-0.14.3/app/app.rb000066400000000000000000000012511466634144200154310ustar00rootroot00000000000000# frozen_string_literal: true # Formatters require_relative 'formatters/cli' require_relative 'formatters/cli_no_colour' require_relative 'formatters/cli_no_color' require_relative 'formatters/json' # Controllers require_relative 'controllers/core' require_relative 'controllers/interesting_findings' # Models require_relative 'models/interesting_finding' require_relative 'models/robots_txt' require_relative 'models/fantastico_fileslist' require_relative 'models/search_replace_db_2' require_relative 'models/headers' require_relative 'models/xml_rpc' require_relative 'models/version' require_relative 'models/user' # Finders require_relative 'finders/interesting_findings' CMSScanner-0.14.3/app/controllers/000077500000000000000000000000001466634144200166735ustar00rootroot00000000000000CMSScanner-0.14.3/app/controllers/core.rb000066400000000000000000000060641466634144200201560ustar00rootroot00000000000000# frozen_string_literal: true require_relative 'core/cli_options' module CMSScanner module Controller # Core Controller class Core < Base def setup_cache return unless NS::ParsedCli.cache_dir storage_path = File.join(NS::ParsedCli.cache_dir, Digest::MD5.hexdigest(target.url)) Typhoeus::Config.cache = Cache::Typhoeus.new(storage_path) Typhoeus::Config.cache.clean if NS::ParsedCli.clear_cache end def before_scan maybe_output_banner_help_and_version setup_cache check_target_availability end def maybe_output_banner_help_and_version output('banner') if NS::ParsedCli.banner output('help', help: option_parser.simple_help, simple: true) if NS::ParsedCli.help output('help', help: option_parser.full_help, simple: false) if NS::ParsedCli.hh output('version') if NS::ParsedCli.version exit(NS::ExitCode::OK) if NS::ParsedCli.help || NS::ParsedCli.hh || NS::ParsedCli.version end # Checks that the target is accessible, raises related errors otherwise # # @return [ Void ] def check_target_availability res = NS::Browser.get(target.url) case res.code when 0 raise Error::TargetDown, res when 401 raise Error::HTTPAuthRequired when 403 raise Error::AccessForbidden, NS::ParsedCli.random_user_agent unless NS::ParsedCli.force when 407 raise Error::ProxyAuthRequired end handle_redirection(res) end # Checks for redirects, an out of scope redirect will raise an Error::HTTPRedirect # # @param [ Typhoeus::Response ] res def handle_redirection(res) effective_url = target.homepage_res.effective_url # Basically get and follow location of target.url effective_uri = Addressable::URI.parse(effective_url) # Case of http://a.com => https://a.com (or the opposite) if !NS::ParsedCli.ignore_main_redirect && target.uri.domain == effective_uri.domain && target.uri.path == effective_uri.path && target.uri.scheme != effective_uri.scheme target.url = effective_url end return if target.in_scope?(effective_url) raise Error::HTTPRedirect, effective_url unless NS::ParsedCli.ignore_main_redirect # Sets back homepage_res to unfollowed location in case of ignore_main_redirect used target.homepage_res = res end def run @start_time = Time.now @start_memory = NS.start_memory output('started', url: target.url, ip: target.ip, effective_url: target.homepage_url) end def after_scan @stop_time = Time.now @elapsed = @stop_time - @start_time @used_memory = GetProcessMem.new.bytes - @start_memory output('finished', cached_requests: NS.cached_requests, requests_done: NS.total_requests, data_sent: NS.total_data_sent, data_received: NS.total_data_received) end end end end CMSScanner-0.14.3/app/controllers/core/000077500000000000000000000000001466634144200176235ustar00rootroot00000000000000CMSScanner-0.14.3/app/controllers/core/cli_options.rb000066400000000000000000000127501466634144200224770ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Controller # CLI Options for the Core Controller class Core < Base def cli_options formats = NS::Formatter.availables [ OptURL.new(['-u', '--url URL', 'The URL to scan'], required_unless: %i[help hh version], default_protocol: 'http'), OptBoolean.new(['--force', 'Do not check if target returns a 403']) ] + mixed_cli_options + [ OptFilePath.new(['-o', '--output FILE', 'Output to FILE'], writable: true, exists: false), OptChoice.new(['-f', '--format FORMAT', 'Output results in the format supplied'], choices: formats), OptChoice.new(['--detection-mode MODE'], choices: %w[mixed passive aggressive], normalize: :to_sym, default: :mixed), OptArray.new(['--scope DOMAINS', 'Comma separated (sub-)domains to consider in scope. ', 'Wildcard(s) allowed in the trd of valid domains, e.g: *.target.tld'], advanced: true) ] + cli_browser_options end def mixed_cli_options [ OptBoolean.new(['-h', '--help', 'Display the simple help and exit']), OptBoolean.new(['--hh', 'Display the full help and exit']), OptBoolean.new(['--version', 'Display the version and exit']), OptBoolean.new(['--ignore-main-redirect', 'Ignore the main redirect (if any) and scan the target url'], advanced: true), OptBoolean.new(['-v', '--verbose', 'Verbose mode']), OptBoolean.new(['--[no-]banner', 'Whether or not to display the banner'], default: true), OptPositiveInteger.new(['--max-scan-duration SECONDS', 'Abort the scan if it exceeds the time provided in seconds'], advanced: true) ] end # @return [ Array ] def cli_browser_options cli_browser_headers_options + [ OptBoolean.new(['--random-user-agent', '--rua', 'Use a random user-agent for each scan']), OptFilePath.new(['--user-agents-list FILE-PATH', 'List of agents to use with --random-user-agent'], exists: true, advanced: true, default: APP_DIR.join('user_agents.txt')), OptCredentials.new(['--http-auth login:password']), OptPositiveInteger.new(['-t', '--max-threads VALUE', 'The max threads to use'], default: 5), OptPositiveInteger.new(['--throttle MilliSeconds', 'Milliseconds to wait before doing another web request. ' \ 'If used, the max threads will be set to 1.']), OptPositiveInteger.new(['--request-timeout SECONDS', 'The request timeout in seconds'], default: 60), OptPositiveInteger.new(['--connect-timeout SECONDS', 'The connection timeout in seconds'], default: 30), OptBoolean.new(['--disable-tls-checks', 'Disables SSL/TLS certificate verification, and downgrade to TLS1.0+ ' \ '(requires cURL 7.66 for the latter)']) ] + cli_browser_proxy_options + cli_browser_cookies_options + cli_browser_cache_options end # @return [ Array ] def cli_browser_headers_options [ OptString.new(['--user-agent VALUE', '--ua']), OptHeaders.new(['--headers HEADERS', 'Additional headers to append in requests'], advanced: true), OptString.new(['--vhost VALUE', 'The virtual host (Host header) to use in requests'], advanced: true) ] end # @return [ Array ] def cli_browser_proxy_options [ OptProxy.new(['--proxy protocol://IP:port', 'Supported protocols depend on the cURL installed']), OptCredentials.new(['--proxy-auth login:password']) ] end # @return [ Array ] def cli_browser_cookies_options [ OptString.new(['--cookie-string COOKIE', 'Cookie string to use in requests, ' \ 'format: cookie1=value1[; cookie2=value2]']), OptFilePath.new(['--cookie-jar FILE-PATH', 'File to read and write cookies'], writable: true, readable: true, create: true, default: File.join(tmp_directory, 'cookie_jar.txt')) ] end # @return [ Array ] def cli_browser_cache_options [ OptInteger.new(['--cache-ttl TIME_TO_LIVE', 'The cache time to live in seconds'], default: 600, advanced: true), OptBoolean.new(['--clear-cache', 'Clear the cache before the scan'], advanced: true), OptDirectoryPath.new(['--cache-dir PATH'], readable: true, writable: true, create: true, default: File.join(tmp_directory, 'cache'), advanced: true) ] end end end end CMSScanner-0.14.3/app/controllers/interesting_findings.rb000066400000000000000000000013151466634144200234340ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Controller # InterestingFindings Controller class InterestingFindings < Base def cli_options [ OptChoice.new( ['--interesting-findings-detection MODE', 'Use the supplied mode for the interesting findings detection. '], choices: %w[mixed passive aggressive], normalize: :to_sym, advanced: true ) ] end def run mode = NS::ParsedCli.interesting_findings_detection || NS::ParsedCli.detection_mode findings = target.interesting_findings(mode: mode) output('findings', findings: findings) unless findings.empty? end end end end CMSScanner-0.14.3/app/finders/000077500000000000000000000000001466634144200157575ustar00rootroot00000000000000CMSScanner-0.14.3/app/finders/interesting_findings.rb000066400000000000000000000013601466634144200225200ustar00rootroot00000000000000# frozen_string_literal: true require_relative 'interesting_findings/headers' require_relative 'interesting_findings/robots_txt' require_relative 'interesting_findings/fantastico_fileslist' require_relative 'interesting_findings/search_replace_db_2' require_relative 'interesting_findings/xml_rpc' module CMSScanner module Finders module InterestingFindings # Interesting Files Finder class Base include IndependentFinder # @param [ CMSScanner::Target ] target def initialize(target) %w[Headers RobotsTxt FantasticoFileslist SearchReplaceDB2 XMLRPC].each do |f| finders << NS::Finders::InterestingFindings.const_get(f).new(target) end end end end end end CMSScanner-0.14.3/app/finders/interesting_findings/000077500000000000000000000000001466634144200221735ustar00rootroot00000000000000CMSScanner-0.14.3/app/finders/interesting_findings/fantastico_fileslist.rb000066400000000000000000000011451466634144200267320ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Finders module InterestingFindings # FantasticoFileslist finder class FantasticoFileslist < Finder # @return [ InterestingFinding ] def aggressive(_opts = {}) path = 'fantastico_fileslist.txt' res = target.head_and_get(path) return if res.body.strip.empty? return unless res.headers && res.headers['Content-Type']&.start_with?('text/plain') NS::Model::FantasticoFileslist.new(target.url(path), confidence: 70, found_by: found_by) end end end end end CMSScanner-0.14.3/app/finders/interesting_findings/headers.rb000066400000000000000000000006431466634144200241360ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Finders module InterestingFindings # Interesting Headers finder class Headers < Finder # @return [ InterestingFinding ] def passive(_opts = {}) r = NS::Model::Headers.new(target.homepage_url, confidence: 100, found_by: found_by) r.interesting_entries.empty? ? nil : r end end end end end CMSScanner-0.14.3/app/finders/interesting_findings/robots_txt.rb000066400000000000000000000010141466634144200247230ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Finders module InterestingFindings # Robots.txt finder class RobotsTxt < Finder # @return [ InterestingFinding ] def aggressive(_opts = {}) path = 'robots.txt' res = target.head_and_get(path) return unless res&.code == 200 && res.body =~ /(?:user-agent|(?:dis)?allow):/i NS::Model::RobotsTxt.new(target.url(path), confidence: 100, found_by: found_by) end end end end end CMSScanner-0.14.3/app/finders/interesting_findings/search_replace_db_2.rb000066400000000000000000000007701466634144200263520ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Finders module InterestingFindings # SearchReplaceDB2 finder class SearchReplaceDB2 < Finder # @return [ InterestingFinding ] def aggressive(_opts = {}) path = 'searchreplacedb2.php' return unless /by interconnect/i.match?(target.head_and_get(path).body) NS::Model::SearchReplaceDB2.new(target.url(path), confidence: 100, found_by: found_by) end end end end end CMSScanner-0.14.3/app/finders/interesting_findings/xml_rpc.rb000066400000000000000000000033051466634144200241650ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Finders module InterestingFindings # XML RPC finder class XMLRPC < Finder # @return [ Array ] The potential urls to the XMl RPC file def potential_urls @potential_urls ||= [] end # @return [ Array ] def passive(opts = {}) [passive_headers(opts), passive_body(opts)].compact end # @return [ XMLRPC ] def passive_headers(_opts = {}) url = target.homepage_res.headers['X-Pingback'] return unless target.in_scope?(url) potential_urls << url NS::Model::XMLRPC.new(url, confidence: 30, found_by: 'Headers (Passive Detection)') end # @return [ XMLRPC ] def passive_body(_opts = {}) target.homepage_res.html.css('link[rel="pingback"]').each do |tag| url = tag.attribute('href').to_s next unless target.in_scope?(url) potential_urls << url return NS::Model::XMLRPC.new(url, confidence: 30, found_by: 'Link Tag (Passive Detection)') end nil end # @return [ XMLRPC ] def aggressive(_opts = {}) potential_urls << target.url('xmlrpc.php') potential_urls.uniq.each do |potential_url| next unless target.in_scope?(potential_url) res = NS::Browser.post(potential_url, body: Digest::MD5.hexdigest(rand(999_999).to_s[0..5])) next unless //i.match?(res&.body) return NS::Model::XMLRPC.new(potential_url, confidence: 100, found_by: DIRECT_ACCESS) end nil end end end end end CMSScanner-0.14.3/app/formatters/000077500000000000000000000000001466634144200165135ustar00rootroot00000000000000CMSScanner-0.14.3/app/formatters/cli.rb000066400000000000000000000023011466634144200176030ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Formatter # CLI Formatter class Cli < Base # @return [ String ] def info_icon green('[+]') end # @return [ String ] def notice_icon blue('[i]') end # @return [ String ] def warning_icon amber('[!]') end # @return [ String ] def critical_icon red('[!]') end # @param [ String ] text # @return [ String ] def bold(text) colorize(text, 1) end # @param [ String ] text # @return [ String ] def red(text) colorize(text, 31) end # @param [ String ] text # @return [ String ] def green(text) colorize(text, 32) end # @param [ String ] text # @return [ String ] def amber(text) colorize(text, 33) end # @param [ String ] text # @return [ String ] def blue(text) colorize(text, 34) end # @param [ String ] text # @param [ Integer ] color_code # @return [ String ] def colorize(text, color_code) "\e[#{color_code}m#{text}\e[0m" end end end end CMSScanner-0.14.3/app/formatters/cli_no_color.rb000066400000000000000000000003011466634144200214730ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Formatter # Because Reason https://github.com/wpscanteam/CMSScanner/issues/56 class CliNoColor < CliNoColour end end end CMSScanner-0.14.3/app/formatters/cli_no_colour.rb000066400000000000000000000004351466634144200216700ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Formatter # CLI No Colour Formatter class CliNoColour < Cli # Override to get the cli views def format 'cli' end def colorize(text, _color_code) text end end end end CMSScanner-0.14.3/app/formatters/json.rb000066400000000000000000000004021466634144200200050ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Formatter # JSON Formatter class Json < Base include Buffer def beautify puts JSON.pretty_generate(JSON.parse("{#{buffer.chomp.chomp(',')}}")) end end end end CMSScanner-0.14.3/app/models/000077500000000000000000000000001466634144200156105ustar00rootroot00000000000000CMSScanner-0.14.3/app/models/fantastico_fileslist.rb000066400000000000000000000022161466634144200223470ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Model # Fantastico is a commercial script library that automates the installation of web applications to a website. # Fantastico scripts are executed from the administration area of a website control panel such as cPanel. # It creates a file named fantastico_fileslist.txt that is publicly available and contains a list of all the # files from the current directory. The contents of this file may expose sensitive information to an attacker. class FantasticoFileslist < InterestingFinding # @return [ String ] def to_s @to_s ||= "Fantastico list found: #{url}" end # @return [ Array ] The interesting files/dirs detected def interesting_entries results = [] entries.each do |entry| next unless /(?:admin|\.log|\.sql|\.db)/i.match?(entry) results << entry end results end def references @references ||= { url: ['https://web.archive.org/web/20140518040021/http://www.acunetix.com/vulnerabilities/fantastico-fileslist/'] } end end end end CMSScanner-0.14.3/app/models/headers.rb000066400000000000000000000023431466634144200175520ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Model # Interesting Headers class Headers < InterestingFinding # @return [ Hash ] The headers def entries res = NS::Browser.get(url) return [] unless res&.headers res.headers end # @return [ Array ] The interesting headers detected def interesting_entries results = [] entries.each do |header, value| next if known_headers.include?(header.downcase) results << "#{header}: #{Array(value).join(', ')}" end results end # @return [ Array ] Downcased known headers def known_headers %w[ age accept-ranges cache-control content-encoding content-length content-type connection date etag expires keep-alive location last-modified link pragma set-cookie strict-transport-security transfer-encoding vary x-cache x-content-security-policy x-content-type-options x-frame-options x-language x-permitted-cross-domain-policies x-pingback x-varnish x-webkit-csp x-xss-protection ] end # @return [ String ] def to_s @to_s ||= 'Headers' end end end end CMSScanner-0.14.3/app/models/interesting_finding.rb000066400000000000000000000020311466634144200221620ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Model # Interesting Finding class InterestingFinding include Finders::Finding attr_reader :url attr_writer :to_s # @param [ String ] url # @param [ Hash ] opts # :to_s (override the to_s method) # See Finders::Finding for other available options def initialize(url, opts = {}) @url = url @to_s = opts[:to_s] parse_finding_options(opts) end # @return [ Array ] def entries res = NS::Browser.get(url) return [] unless res && res.headers['Content-Type'] =~ %r{\Atext/plain;}i res.body.split("\n").reject { |s| s.strip.empty? } end # @return [ String ] def to_s @to_s || url end # @return [ String ] def type @type ||= self.class.to_s.demodulize.underscore end # @return [ Boolean ] def ==(other) self.class == other.class && to_s == other.to_s end end end end CMSScanner-0.14.3/app/models/robots_txt.rb000066400000000000000000000012651466634144200203500ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Model # Robots.txt class RobotsTxt < InterestingFinding # @return [ String ] def to_s @to_s ||= "robots.txt found: #{url}" end # @todo Better detection, currently everything not empty or / is returned # # @return [ Array ] The interesting Allow/Disallow rules detected def interesting_entries results = [] entries.each do |entry| next unless entry =~ /\A(?:dis)?allow:\s*(.+)\z/i match = Regexp.last_match(1) next if match == '/' results << match end results.uniq end end end end CMSScanner-0.14.3/app/models/search_replace_db_2.rb000066400000000000000000000006351466634144200217670ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Model # SearchReplaceDB2 class SearchReplaceDB2 < InterestingFinding # @return [ String ] def to_s @to_s ||= "Search Replace DB script found: #{url}" end def references @references ||= { url: ['https://interconnectit.com/products/search-and-replace-for-wordpress-databases/'] } end end end end CMSScanner-0.14.3/app/models/user.rb000066400000000000000000000013251466634144200171140ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Model # User class User include Finders::Finding attr_accessor :password attr_reader :id, :username # @param [ String ] username # @param [ Hash ] opts # @option opts [ Integer ] :id # @option opts [ String ] :password def initialize(username, opts = {}) @username = username @password = opts[:password] @id = opts[:id] parse_finding_options(opts) end def ==(other) return false unless self.class == other.class username == other.username && password == other.password end def to_s username end end end end CMSScanner-0.14.3/app/models/version.rb000066400000000000000000000020311466634144200176160ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Model # Version class Version include Finders::Finding attr_reader :number def initialize(number, opts = {}) @number = number.to_s @number = "0#{number}" if @number[0, 1] == '.' parse_finding_options(opts) end # @param [ Version, String ] other # rubocop:disable Style/NumericPredicate def ==(other) (self <=> other) == 0 end # rubocop:enable all # @param [ Version, String ] other def <(other) (self <=> other) == -1 end # @param [ Version, String ] other def >(other) (self <=> other) == 1 end # @param [ Version, String ] other def <=>(other) other = self.class.new(other) unless other.is_a?(self.class) # handle potential '.1' version Gem::Version.new(number) <=> Gem::Version.new(other.number) rescue ArgumentError false end def to_s number end end end end CMSScanner-0.14.3/app/models/xml_rpc.rb000066400000000000000000000037651466634144200176140ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Model # XML RPC class XMLRPC < InterestingFinding # @return [ String ] def to_s @to_s ||= "XML-RPC seems to be enabled: #{url}" end # @return [ Browser ] def browser @browser ||= NS::Browser.instance end # @return [ Array ] def available_methods return @available_methods if @available_methods @available_methods = [] res = method_call('system.listMethods').run doc = Nokogiri::XML.parse(res.body) doc.search('methodResponse params param value array data value string').each do |s| @available_methods << s.text end @available_methods end # @return [ Boolean ] Whether or not the XMLRPC is enabled def enabled? !available_methods.empty? end # @param [ String ] method_name # @param [ Array ] method_params # @param [ Hash ] request_params # # @return [ Typhoeus::Request ] def method_call(method_name, method_params = [], request_params = {}) browser.forge_request( url, request_params.merge( method: :post, body: ::XMLRPC::Create.new.methodCall(method_name, *method_params) ) ) end # @param [ Array ] methods_and_params # @param [ Hash ] request_params # # Example of methods_and_params: # [ # [method1, param1, param2], # [method2, param1], # [method3] # ] # # @return [ Typhoeus::Request ] def multi_call(methods_and_params = [], request_params = {}) browser.forge_request( url, request_params.merge( method: :post, body: ::XMLRPC::Create.new.methodCall( 'system.multicall', methods_and_params.collect { |m| { methodName: m[0], params: m[1..-1] } } ) ) ) end end end end CMSScanner-0.14.3/app/user_agents.txt000066400000000000000000000072011466634144200174050ustar00rootroot00000000000000# Windows Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.5 (KHTML, like Gecko) Chrome/4.0.249.0 Safari/532.5 Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/534.14 (KHTML, like Gecko) Chrome/9.0.601.0 Safari/534.14 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.27 (KHTML, like Gecko) Chrome/12.0.712.0 Safari/534.27 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.24 Safari/535.1 Mozilla/5.0 (Windows; U; Windows NT 5.1; tr; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8 ( .NET CLR 3.5.30729; .NET4.0E) Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1 Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko/20100101 Firefox/7.0.1 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.6 (KHTML, like Gecko) Chrome/20.0.1092.0 Safari/536.6 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1 Mozilla/5.0 (Windows NT 6.1; rv:12.0) Gecko/20120403211507 Firefox/12.0 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20120427 Firefox/15.0a1 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0) Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/6.0) Opera/9.80 (Windows NT 6.1; U; es-ES) Presto/2.9.181 Version/12.00 Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.19.4 (KHTML, like Gecko) Version/5.0.2 Safari/533.18.5 # MAC Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.15 Safari/534.13 Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.5; en-US; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100101 Firefox/4.0.1 Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/418.8 (KHTML, like Gecko) Safari/419.3 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit/536.3 (KHTML, like Gecko) Chrome/19.0.1063.0 Safari/536.3 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_2; rv:10.0.1) Gecko/20100101 Firefox/10.0.1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10 # Linux Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.20 Safari/535.1 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/534.24 (KHTML, like Gecko) Ubuntu/10.10 Chromium/12.0.703.0 Chrome/12.0.703.0 Safari/534.24 Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.9) Gecko/20100915 Gentoo Firefox/3.6.9 Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.16) Gecko/20120421 Gecko Firefox/11.0 Mozilla/5.0 (X11; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0 Opera/9.80 (X11; Linux x86_64; U; pl) Presto/2.7.62 Version/11.00 Mozilla/5.0 (X11; U; Linux x86_64; us; rv:1.9.1.19) Gecko/20110430 shadowfox/7.0 (like Firefox/7.0 # iPad Mozilla/5.0 (iPad; CPU OS 7_1_1 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D201 Safari/9537.53 Mozilla/5.0 (iPad; CPU OS 7_0_4 like Mac OS X) AppleWebKit/537.51.1 (KHTML, like Gecko) Version/7.0 Mobile/11B554a Safari/9537.53 Mozilla/5.0 (iPad; CPU OS 6_1_3 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10B329 Safari/8536.25 # iPhone Mozilla/5.0 (iPhone; CPU iPhone OS 7_0 like Mac OS X) AppleWebKit/537.51.1 (KHTML, like Gecko) Version/7.0 Mobile/11A465 Safari/9537.53 Mozilla/5.0 (iPhone; CPU iPhone OS 7_0_3 like Mac OS X) AppleWebKit/537.51.1 (KHTML, like Gecko) Version/7.0 Mobile/11B511 Safari/9537.53 Mozilla/5.0 (iPhone; CPU iPhone OS 7_1_1 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D201 Safari/9537.53 CMSScanner-0.14.3/app/views/000077500000000000000000000000001466634144200154625ustar00rootroot00000000000000CMSScanner-0.14.3/app/views/cli/000077500000000000000000000000001466634144200162315ustar00rootroot00000000000000CMSScanner-0.14.3/app/views/cli/core/000077500000000000000000000000001466634144200171615ustar00rootroot00000000000000CMSScanner-0.14.3/app/views/cli/core/banner.erb000066400000000000000000000001041466634144200211130ustar00rootroot00000000000000<% # Empty file, the banner should be implemented in each scanner %>CMSScanner-0.14.3/app/views/cli/core/finished.erb000066400000000000000000000006721466634144200214510ustar00rootroot00000000000000 <%= info_icon %> Finished: <%= @stop_time.asctime %> <%= info_icon %> Requests Done: <%= @requests_done %> <%= info_icon %> Cached Requests: <%= @cached_requests %> <%= info_icon %> Data Sent: <%= @data_sent.bytes_to_human %> <%= info_icon %> Data Received: <%= @data_received.bytes_to_human %> <%= info_icon %> Memory used: <%= @used_memory.bytes_to_human %> <%= info_icon %> Elapsed time: <%= Time.at(@elapsed).utc.strftime('%H:%M:%S') %> CMSScanner-0.14.3/app/views/cli/core/help.erb000066400000000000000000000001231466634144200205770ustar00rootroot00000000000000<%= @help %> <% if @simple -%> [!] To see full list of options use --hh. <% end -%>CMSScanner-0.14.3/app/views/cli/core/started.erb000066400000000000000000000003071466634144200213210ustar00rootroot00000000000000<%= info_icon %> URL: <%= @url %> [<%= @ip %>] <% if @url != @effective_url -%> <%= info_icon %> Effective URL: <%= @effective_url %> <% end -%> <%= info_icon %> Started: <%= @start_time.asctime %> CMSScanner-0.14.3/app/views/cli/core/version.erb000066400000000000000000000000341466634144200213350ustar00rootroot00000000000000Version: <%= NS::VERSION %> CMSScanner-0.14.3/app/views/cli/interesting_findings/000077500000000000000000000000001466634144200224455ustar00rootroot00000000000000CMSScanner-0.14.3/app/views/cli/interesting_findings/_array.erb000066400000000000000000000002621466634144200244140ustar00rootroot00000000000000<% unless @a.empty? -%> <% if @a.size == 1 -%> | <%= @s %>: <%= @a.first %> <% else -%> | <%= @p %>: <% @a.each do |line| -%> | - <%= line %> <% end -%> <% end -%> <% end -%>CMSScanner-0.14.3/app/views/cli/interesting_findings/findings.erb000066400000000000000000000015501466634144200247410ustar00rootroot00000000000000<% unless @findings.empty? -%> Interesting Finding(s): <% @findings.each do |finding| -%> <%= info_icon %> <%= finding %> <%= render('_array', a: finding.interesting_entries, s: 'Interesting Entry', p: 'Interesting Entries') -%> | Found By: <%= finding.found_by %> <% if finding.confidence > 0 -%> | Confidence: <%= finding.confidence %>% <% end -%> <% unless (confirmed = finding.confirmed_by).empty? -%> <% if confirmed.size == 1 -%> | Confirmed By: <%= confirmed.first.found_by %><% if confirmed.first.confidence > 0 %>, <%= confirmed.first.confidence %>% confidence<% end %> <% else -%> | Confirmed By: <% confirmed.each do |c| -%> | - <%= c.found_by %><% if c.confidence > 0 %>, <%= c.confidence %>% confidence<% end %> <% end -%> <% end -%> <% end -%> <%= render('_array', a: finding.references_urls, s: 'Reference', p: 'References') -%> <% end -%> <% end %> CMSScanner-0.14.3/app/views/cli/scan_aborted.erb000066400000000000000000000001321466634144200213430ustar00rootroot00000000000000 Scan Aborted: <%= @reason %> <% if @verbose -%> Trace: <%= @trace.join("\n") %> <% end %>CMSScanner-0.14.3/app/views/cli/usage.erb000066400000000000000000000001051466634144200200230ustar00rootroot00000000000000<%= @msg %> Please use --help/-h for the list of available options. CMSScanner-0.14.3/app/views/json/000077500000000000000000000000001466634144200164335ustar00rootroot00000000000000CMSScanner-0.14.3/app/views/json/core/000077500000000000000000000000001466634144200173635ustar00rootroot00000000000000CMSScanner-0.14.3/app/views/json/core/banner.erb000066400000000000000000000001041466634144200213150ustar00rootroot00000000000000<% # Empty file, the banner should be implemented in each scanner %>CMSScanner-0.14.3/app/views/json/core/finished.erb000066400000000000000000000007551466634144200216550ustar00rootroot00000000000000"stop_time": <%= @stop_time.to_i %>, "elapsed": <%= @elapsed.to_i %>, "requests_done": <%= @requests_done.to_i %>, "cached_requests": <%= @cached_requests.to_i %>, "data_sent": <%= @data_sent.to_i %>, "data_sent_humanised": <%= @data_sent.bytes_to_human.to_json %>, "data_received": <%= @data_received.to_i %>, "data_received_humanised": <%= @data_received.bytes_to_human.to_json %>, "used_memory": <%= @used_memory.to_i %>, "used_memory_humanised": <%= @used_memory.bytes_to_human.to_json %>,CMSScanner-0.14.3/app/views/json/core/help.erb000066400000000000000000000001651466634144200210070ustar00rootroot00000000000000"help": <%= @help.to_s.to_json %>, <% if @simple -%> "full_help": "To see full list of options use --hh.", <% end -%>CMSScanner-0.14.3/app/views/json/core/started.erb000066400000000000000000000003241466634144200215220ustar00rootroot00000000000000"start_time": <%= @start_time.to_i %>, "start_memory": <%= @start_memory.to_i %>, "target_url": <%= @url.to_s.to_json %>, "target_ip": <%= @ip.to_s.to_json %>, "effective_url": <%= @effective_url.to_s.to_json %>,CMSScanner-0.14.3/app/views/json/core/version.erb000066400000000000000000000000531466634144200215400ustar00rootroot00000000000000"version": <%= NS::VERSION.to_s.to_json %>,CMSScanner-0.14.3/app/views/json/interesting_findings/000077500000000000000000000000001466634144200226475ustar00rootroot00000000000000CMSScanner-0.14.3/app/views/json/interesting_findings/findings.erb000066400000000000000000000016761466634144200251540ustar00rootroot00000000000000"interesting_findings": [ <% unless @findings.empty? -%> <% last_index = @findings.size - 1 %> <% @findings.each.with_index do |finding, index| -%> { "url": <%= finding.url.to_s.to_json %>, "to_s": <%= finding.to_s.to_json %>, "type": <%= finding.type.to_json %>, "found_by": <%= finding.found_by.to_s.to_json %>, "confidence": <%= finding.confidence.to_json %>, "confirmed_by": { <% unless (confirmed = finding.confirmed_by).empty? -%> <% c_last_index = confirmed.size - 1 %> <% confirmed.each.with_index do |c, i| -%> <%= c.found_by.to_s.to_json %>: { "confidence": <%= c.confidence.to_json %> }<% unless i == c_last_index %>,<% end %> <% end -%> <% end -%> }, "references": <%= finding.references.to_json %>, "interesting_entries": <%= finding.interesting_entries.to_json %> }<% unless index == last_index %>,<% end %> <% end -%> <% end -%> ],CMSScanner-0.14.3/app/views/json/scan_aborted.erb000066400000000000000000000002071466634144200215500ustar00rootroot00000000000000"scan_aborted": <%= @reason.to_json %>, "target_url": <%= @url.to_json %>, <% if @verbose -%> "trace": <%= @trace.to_json %>, <% end %>CMSScanner-0.14.3/cms_scanner.gemspec000066400000000000000000000043211466634144200174050ustar00rootroot00000000000000lib = File.expand_path('../lib', __FILE__) $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib) require 'cms_scanner/version' Gem::Specification.new do |s| s.name = 'cms_scanner' s.version = CMSScanner::VERSION s.platform = Gem::Platform::RUBY s.required_ruby_version = '>= 3.0' s.authors = ['WPScanTeam'] s.email = ['contact@wpscan.com'] s.summary = 'CMS Scanner Framework (experimental)' s.description = 'Framework to provide an easy way to implement CMS Scanners' s.homepage = 'https://github.com/wpscanteam/CMSScanner' s.license = 'MIT' s.files = Dir.glob('lib/**/*') + Dir.glob('app/**/*') + %w[LICENSE README.md] s.test_files = [] s.require_paths = ['lib'] s.add_dependency 'ethon', '>= 0.14', '< 0.17' # https://github.com/typhoeus/ethon/issues/185 s.add_dependency 'get_process_mem', '~> 0.2.5' s.add_dependency 'nokogiri', '~> 1.16' s.add_dependency 'opt_parse_validator', '~> 1.10.0' s.add_dependency 'public_suffix', '>= 4.0.3', '< 6.1' s.add_dependency 'ruby-progressbar', '>= 1.10', '< 1.14' s.add_dependency 'typhoeus', '>= 1.3', '< 1.5' s.add_dependency 'xmlrpc', '~> 0.3' s.add_dependency 'yajl-ruby', '~> 1.4.1' # Better JSON parser regarding memory usage s.add_dependency 'sys-proctable', '>= 1.2.2', '< 1.4.0' # Required by get_process_mem for Windows OS. # Fixes warning: ostruct was loaded from the standard library if Gem::Version.new(RUBY_VERSION) >= Gem::Version.new('3.3') s.add_dependency('ostruct', '~> 0.6') end s.add_development_dependency 'bundler', '>= 1.6' s.add_development_dependency 'rake', '~> 13.0' s.add_development_dependency 'rspec', '~> 3.12.0' s.add_development_dependency 'rspec-its', '~> 1.3.0' s.add_development_dependency 'rubocop', '~> 1.26.0' s.add_development_dependency 'rubocop-performance', '~> 1.19.1' s.add_development_dependency 'simplecov', '~> 0.22.0' s.add_development_dependency 'simplecov-lcov', '~> 0.8.0' s.add_development_dependency 'webmock', '~> 3.19.1' end CMSScanner-0.14.3/example/000077500000000000000000000000001466634144200152005ustar00rootroot00000000000000CMSScanner-0.14.3/example/.gitignore000066400000000000000000000001421466634144200171650ustar00rootroot00000000000000*.gem *.rbc .bundle .config coverage pkg rdoc Gemfile.lock # YARD artifacts .yardoc _yardoc doc/ CMSScanner-0.14.3/example/.rspec000066400000000000000000000000511466634144200163110ustar00rootroot00000000000000--color --fail-fast --require spec_helperCMSScanner-0.14.3/example/.rubocop.yml000066400000000000000000000006161466634144200174550ustar00rootroot00000000000000require: rubocop-performance AllCops: TargetRubyVersion: 2.4 Exclude: - '*.gemspec' - 'vendor/**/*' Metrics/AbcSize: Max: 25 Metrics/CyclomaticComplexity: Max: 10 Metrics/LineLength: Max: 120 Metrics/MethodLength: Max: 17 Metrics/PerceivedComplexity: Max: 9 Style/ClassVars: Enabled: false Style/RescueModifier: Enabled: false Style/SignalException: EnforcedStyle: semantic CMSScanner-0.14.3/example/.simplecov000066400000000000000000000001021466634144200171730ustar00rootroot00000000000000SimpleCov.start do add_filter '/spec/' add_filter 'helper' endCMSScanner-0.14.3/example/.travis.yml000066400000000000000000000004271466634144200173140ustar00rootroot00000000000000language: ruby sudo: false cache: bundler rvm: - 2.4.9 - 2.5.7 - 2.6.5 - ruby-head before_install: - "echo 'gem: --no-ri --no-rdoc' > ~/.gemrc" - gem update --system matrix: allow_failures: - rvm: ruby-head script: - bundle exec rubocop - bundle exec rspec CMSScanner-0.14.3/example/Gemfile000066400000000000000000000001051466634144200164670ustar00rootroot00000000000000# frozen_string_literal: true source 'https://rubygems.org' gemspec CMSScanner-0.14.3/example/Rakefile000066400000000000000000000003631466634144200166470ustar00rootroot00000000000000# frozen_string_literal: true require 'bundler/gem_tasks' require 'rspec/core/rake_task' require 'rubocop/rake_task' RuboCop::RakeTask.new RSpec::Core::RakeTask.new(:spec) # Run rubocop & rspec before the build task build: %i[rubocop spec] CMSScanner-0.14.3/example/app/000077500000000000000000000000001466634144200157605ustar00rootroot00000000000000CMSScanner-0.14.3/example/app/app.rb000066400000000000000000000001061466634144200170620ustar00rootroot00000000000000# frozen_string_literal: true require_relative 'controllers/example' CMSScanner-0.14.3/example/app/controllers/000077500000000000000000000000001466634144200203265ustar00rootroot00000000000000CMSScanner-0.14.3/example/app/controllers/example.rb000066400000000000000000000015611466634144200223110ustar00rootroot00000000000000# frozen_string_literal: true module CMSScan module Controller # Example Controller class Example < CMSScanner::Controller::Core # @return [ Array ] def cli_options [ OptString.new(['--dummy VALUE', 'Dummy CLI Option']) ] end def before_scan # Anything to do before ? end def run # Let's check and display whether or not the word 'scan' is present in the homepage of the target is_present = target.homepage_res.body =~ /scan/ ? true : false output('scan_word', is_present: is_present) end # Alternative way of doing it def run2 @is_present = Browser.get(target.homepage_url).body =~ /scan/ ? true : false output('scan_word') end def after_scan # Anything after ? end end end end CMSScanner-0.14.3/example/app/views/000077500000000000000000000000001466634144200171155ustar00rootroot00000000000000CMSScanner-0.14.3/example/app/views/cli/000077500000000000000000000000001466634144200176645ustar00rootroot00000000000000CMSScanner-0.14.3/example/app/views/cli/core/000077500000000000000000000000001466634144200206145ustar00rootroot00000000000000CMSScanner-0.14.3/example/app/views/cli/core/banner.erb000066400000000000000000000000561466634144200225540ustar00rootroot00000000000000 CMS Scanner Example <%= CMSScan::VERSION %> CMSScanner-0.14.3/example/app/views/cli/example/000077500000000000000000000000001466634144200213175ustar00rootroot00000000000000CMSScanner-0.14.3/example/app/views/cli/example/scan_word.erb000066400000000000000000000002571466634144200237740ustar00rootroot00000000000000<% if @is_present -%> <%= warning_icon %> The word 'scan' is present in the homepage <% else -%> <%= notice_icon %> The word 'scan' was not detected in the homepage <% end %> CMSScanner-0.14.3/example/app/views/json/000077500000000000000000000000001466634144200200665ustar00rootroot00000000000000CMSScanner-0.14.3/example/app/views/json/core/000077500000000000000000000000001466634144200210165ustar00rootroot00000000000000CMSScanner-0.14.3/example/app/views/json/core/banner.erb000066400000000000000000000000731466634144200227550ustar00rootroot00000000000000"banner": { "version": <%= CMSScan::VERSION.to_json %> },CMSScanner-0.14.3/example/app/views/json/example/000077500000000000000000000000001466634144200215215ustar00rootroot00000000000000CMSScanner-0.14.3/example/app/views/json/example/scan_word.erb000066400000000000000000000000601466634144200241660ustar00rootroot00000000000000"scan_word_present": <%= @is_present.to_json %>,CMSScanner-0.14.3/example/bin/000077500000000000000000000000001466634144200157505ustar00rootroot00000000000000CMSScanner-0.14.3/example/bin/cmsscan000077500000000000000000000002401466634144200173210ustar00rootroot00000000000000#!/usr/bin/env ruby # frozen_string_literal: true require 'cmsscan' CMSScan::Scan.new do |s| s.controllers << CMSScan::Controller::Example.new s.run end CMSScanner-0.14.3/example/cmsscan.gemspec000066400000000000000000000031571466634144200202020ustar00rootroot00000000000000lib = File.expand_path('../lib', __FILE__) $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib) require 'cmsscan/version' Gem::Specification.new do |s| s.name = 'cmsscan' s.version = CMSScan::VERSION s.platform = Gem::Platform::RUBY s.required_ruby_version = '>= 2.3' s.authors = ['WPScanTeam'] s.date = Time.now.utc.strftime('%Y-%m-%d') s.email = ['team@wpscan.org'] s.summary = 'CMSScan Gem Example' s.description = 'CMSScanner Implementation Example' s.homepage = 'https://github.com/wpscanteam/CMSScanner' s.license = 'MIT' s.files = Dir.glob('lib/**/*') + Dir.glob('app/**/*') s.test_files = [] s.executables = ['cmsscan'] s.require_paths = ['lib'] s.add_dependency 'cms_scanner', '~> 0.13.5' s.add_development_dependency 'bundler', '>= 1.6' s.add_development_dependency 'memory_profiler', '~> 1.0.0' s.add_development_dependency 'rake', '~> 13.0' s.add_development_dependency 'rspec', '~> 3.10.0' s.add_development_dependency 'rspec-its', '~> 1.3.0' s.add_development_dependency 'rubocop', '~> 1.17.0' s.add_development_dependency 'rubocop-performance', '~> 1.11.0' s.add_development_dependency 'simplecov', '~> 0.21.0' s.add_development_dependency 'simplecov-lcov', '~> 0.8.0' s.add_development_dependency 'stackprof', '~> 0.2.12' s.add_development_dependency 'webmock', '~> 3.13.0' end CMSScanner-0.14.3/example/lib/000077500000000000000000000000001466634144200157465ustar00rootroot00000000000000CMSScanner-0.14.3/example/lib/cmsscan.rb000066400000000000000000000014111466634144200177170ustar00rootroot00000000000000# frozen_string_literal: true # Gems require 'cms_scanner' require 'yajl/json_gem' require 'addressable/uri' require 'active_support/all' # Standard Lib require 'uri' require 'time' require 'readline' require 'securerandom' # Custom Libs require 'cmsscan/target' require 'cmsscan/version' require 'cmsscan/controller' Encoding.default_external = Encoding::UTF_8 # CMSScan module CMSScan include CMSScanner APP_DIR = Pathname.new(__FILE__).dirname.join('..', 'app').expand_path # Not needed in this example # DB_DIR = File.join(Dir.home, '.cmsscan', 'db') # Override, otherwise it would be returned as 'cms_scan' # doesn't really matter in this example. # # @return [ String ] def self.app_name 'cmsscan' end end require "#{CMSScan::APP_DIR}/app" CMSScanner-0.14.3/example/lib/cmsscan/000077500000000000000000000000001466634144200173755ustar00rootroot00000000000000CMSScanner-0.14.3/example/lib/cmsscan/controller.rb000066400000000000000000000004411466634144200221040ustar00rootroot00000000000000# frozen_string_literal: true module CMSScan # Needed to load at least the Core controller # Otherwise, the following error will be raised: # `initialize': uninitialized constant CMSScan::Controller::Core (NameError) module Controller include CMSScanner::Controller end end CMSScanner-0.14.3/example/lib/cmsscan/target.rb000066400000000000000000000005321466634144200212100ustar00rootroot00000000000000# frozen_string_literal: true module CMSScan # Custom Target Class class Target < CMSScanner::Target # Put your own methods there # Method which should be defined. # Used to set a specific exit code if the scan found issues # See the CMSScanner/lib/cms_scanner/exit_code.rb def vulnerable? false end end end CMSScanner-0.14.3/example/lib/cmsscan/version.rb000066400000000000000000000001041466634144200214020ustar00rootroot00000000000000# frozen_string_literal: true module CMSScan VERSION = '1.0' end CMSScanner-0.14.3/example/spec/000077500000000000000000000000001466634144200161325ustar00rootroot00000000000000CMSScanner-0.14.3/example/spec/spec_helper.rb000066400000000000000000000006311466634144200207500ustar00rootroot00000000000000# frozen_string_literal: true $LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib')) require 'simplecov' require 'rspec/its' require 'webmock/rspec' require 'cmsscan' if ENV['TRAVIS'] require 'coveralls' SimpleCov.formatter = Coveralls::SimpleCov::Formatter end # See http://betterspecs.org/ RSpec.configure do |config| config.expect_with :rspec do |c| c.syntax = :expect end end CMSScanner-0.14.3/lib/000077500000000000000000000000001466634144200143135ustar00rootroot00000000000000CMSScanner-0.14.3/lib/cms_scanner.rb000066400000000000000000000070361466634144200171410ustar00rootroot00000000000000# frozen_string_literal: true # Gems require 'typhoeus' require 'nokogiri' require 'yajl/json_gem' require 'public_suffix' require 'addressable/uri' require 'get_process_mem' require 'ruby-progressbar' require 'opt_parse_validator' require 'active_support/concern' require 'active_support/inflector' # Standard Libs require 'erb' require 'uri' require 'fileutils' require 'pathname' require 'socket' require 'timeout' require 'xmlrpc/client' # Monkey Patches/Fixes require 'cms_scanner/typhoeus/response' # Adds a Response#html using Nokogiri to parse the body require 'cms_scanner/typhoeus/hydra' # https://github.com/typhoeus/typhoeus/issues/439 require 'cms_scanner/public_suffix/domain' # Adds a Domain#match method and logic, used in scope stuff require 'cms_scanner/numeric' # Adds a Numeric#bytes_to_human # Custom Libs require 'cms_scanner/scan' require 'cms_scanner/parsed_cli' require 'cms_scanner/helper' require 'cms_scanner/exit_code' require 'cms_scanner/errors' require 'cms_scanner/cache/typhoeus' require 'cms_scanner/target' require 'cms_scanner/browser' require 'cms_scanner/version' require 'cms_scanner/controller' require 'cms_scanner/controllers' require 'cms_scanner/formatter' require 'cms_scanner/references' require 'cms_scanner/finders' require 'cms_scanner/vulnerability' require 'cms_scanner/progressbar_null_output' # Module module CMSScanner APP_DIR = Pathname.new(__FILE__).dirname.join('..', 'app').expand_path NS = self # Avoid memory leak when using Hydra, see https://github.com/typhoeus/typhoeus/issues/562 # Requests are still cached via the provided Cache system Typhoeus::Config.memoize = false # Number of requests performed and data sent/received to display at the end of the scan Typhoeus.on_complete do |response| self.cached_requests += 1 if response.cached? next if response.cached? self.total_requests += 1 self.total_data_sent += response.request_size self.total_data_received += response.size NS::Browser.instance.trottle! end # Module to be able to use these class methods when the CMSScanner # is included in another module module ClassMethods # @return [ Integer ] def cached_requests @@cached_requests ||= 0 end # @param [ Integer ] value def cached_requests=(value) @@cached_requests = value end # @return [ Integer ] def total_requests @@total_requests ||= 0 end # @param [ Integer ] value def total_requests=(value) @@total_requests = value end # @return [ Integer ] def total_data_sent @@total_data_sent ||= 0 end # @param [ Integer ] value def total_data_sent=(value) @@total_data_sent = value end # @return [ Integer ] def total_data_received @@total_data_received ||= 0 end # @param [ Integer ] value def total_data_received=(value) @@total_data_received = value end # @return [ Integer ] The memory at the start of the scan (when Scan.new), in B def start_memory @@start_memory ||= 0 end # @param [ Integer ] value def start_memory=(value) @@start_memory = value end # The lowercase name of the scanner # Mainly used in directory paths like the default cookie-jar file and # path to load the cli options from files # # @return [ String ] def app_name to_s.underscore end end extend ClassMethods def self.included(base) remove_const(:NS) const_set(:NS, base) base.extend(ClassMethods) super(base) end end require "#{CMSScanner::APP_DIR}/app" CMSScanner-0.14.3/lib/cms_scanner/000077500000000000000000000000001466634144200166065ustar00rootroot00000000000000CMSScanner-0.14.3/lib/cms_scanner/browser.rb000066400000000000000000000054141466634144200206220ustar00rootroot00000000000000# frozen_string_literal: true require 'cms_scanner/browser/actions' require 'cms_scanner/browser/options' module CMSScanner # Singleton used to perform HTTP/HTTPS request to the target class Browser extend Actions # @param [ Hash ] parsed_options # # @return [ Void ] def initialize(parsed_options = {}) self.throttle = 0 load_options(parsed_options.dup) end private_class_method :new # @param [ Hash ] parsed_options # # @return [ Browser ] The instance def self.instance(parsed_options = {}) @@instance ||= new(parsed_options) end def self.reset @@instance = nil end # @param [ String ] url # @param [ Hash ] params # # @return [ Typhoeus::Request ] def forge_request(url, params = {}) Typhoeus::Request.new(url, request_params(params)) end # @return [ Hash ] The request params used to connect tothe target as well as potential other systems such as API def default_connect_request_params params = {} if disable_tls_checks # See http://curl.haxx.se/libcurl/c/CURLOPT_SSL_VERIFYHOST.html params[:ssl_verifypeer] = false params[:ssl_verifyhost] = 0 # TLSv1.0 and plus, allows to use a protocol potentially lower than the OS default params[:sslversion] = :tlsv1 end { connecttimeout: :connect_timeout, cache_ttl: :cache_ttl, proxy: :proxy, timeout: :request_timeout }.each do |typhoeus_opt, browser_opt| attr_value = public_send(browser_opt) params[typhoeus_opt] = attr_value unless attr_value.nil? end params end # @return [ Hash ] # The params are not cached (using @params ||= for example), so that they are set accordingly if updated # by a controller/other piece of code def default_request_params params = default_connect_request_params.merge( headers: { 'User-Agent' => user_agent, 'Referer' => url }.merge(headers || {}), accept_encoding: 'gzip, deflate', method: :get ) { cookiejar: :cookie_jar, cookiefile: :cookie_jar, cookie: :cookie_string }.each do |typhoeus_opt, browser_opt| attr_value = public_send(browser_opt) params[typhoeus_opt] = attr_value unless attr_value.nil? end params[:proxyuserpwd] = "#{proxy_auth[:username]}:#{proxy_auth[:password]}" if proxy_auth params[:userpwd] = "#{http_auth[:username]}:#{http_auth[:password]}" if http_auth params[:headers]['Host'] = vhost if vhost params end # @param [ Hash ] params # # @return [ Hash ] def request_params(params = {}) default_request_params.merge(params) do |key, oldval, newval| key == :headers ? oldval.merge(newval) : newval end end end end CMSScanner-0.14.3/lib/cms_scanner/browser/000077500000000000000000000000001466634144200202715ustar00rootroot00000000000000CMSScanner-0.14.3/lib/cms_scanner/browser/actions.rb000066400000000000000000000023171466634144200222610ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner class Browser # Browser Actions (get, post etc) module Actions # @param [ String ] url # @param [ Hash ] params # # @return [ Typhoeus::Request ] def forge_request(url, params = {}) NS::Browser.instance.forge_request(url, params) end # @param [ String ] url # @param [ Hash ] params # # @return [ Typhoeus::Response ] def get(url, params = {}) forge_request(url, params.merge(method: :get)).run end # @param [ String ] url # @param [ Hash ] params # # @return [ Typhoeus::Response ] def post(url, params = {}) forge_request(url, params.merge(method: :post)).run end # @param [ String ] url # @param [ Hash ] params # # @return [ Typhoeus::Response ] def head(url, params = {}) forge_request(url, params.merge(method: :head)).run end # @param [ String ] url # @param [ Hash ] params # # @return [ Typhoeus::Response ] def get_and_follow_location(url, params = {}) get(url, { followlocation: true, maxredirs: 3 }.merge(params)) end end end end CMSScanner-0.14.3/lib/cms_scanner/browser/options.rb000066400000000000000000000040221466634144200223070ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner # Options available in the Browser class Browser OPTIONS = %i[ cache_ttl cookie_jar cookie_string connect_timeout disable_tls_checks headers http_auth max_threads proxy proxy_auth random_user_agent request_timeout throttle url user_agent user_agents_list vhost ].freeze attr_accessor(*OPTIONS) # @return [ String ] def default_user_agent "#{NS} v#{NS::VERSION}" end # @return [ Typhoeus::Hydra ] def hydra @hydra ||= Typhoeus::Hydra.new(max_concurrency: max_threads || 1) end # @param [ Hash ] options def load_options(options = {}) OPTIONS.each do |sym| send("#{sym}=", options[sym]) if options.key?(sym) end end # Set the threads attribute and update hydra accordinly # If the throttle attribute is > 0, max_threads will be forced to 1 # # @param [ Integer ] number def max_threads=(number) @max_threads = number.to_i.positive? && throttle.zero? ? number.to_i : 1 hydra.max_concurrency = @max_threads end # @return [ String ] The user agent def user_agent @user_agent ||= random_user_agent ? user_agents.sample : default_user_agent end # @return [ Array ] def user_agents return @user_agents if @user_agents @user_agents = [] # The user_agents_list is managed by the CLI options, with the default being # APP_DIR/user_agents.txt File.open(user_agents_list).each do |line| next if line == "\n" || line[0, 1] == '#' @user_agents << line.chomp end @user_agents end # @param [ value ] The throttle time in milliseconds # # if value > 0, the max_threads will be set to 1 def throttle=(value) @throttle = value.to_i.abs / 1000.0 self.max_threads = 1 if @throttle.positive? end def trottle! sleep(throttle) if throttle.positive? end end end CMSScanner-0.14.3/lib/cms_scanner/cache/000077500000000000000000000000001466634144200176515ustar00rootroot00000000000000CMSScanner-0.14.3/lib/cms_scanner/cache/file_store.rb000066400000000000000000000040751466634144200223370ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Cache # Cache Implementation using files class FileStore attr_reader :storage_path, :serializer # The serializer must have the 2 methods #load and #dump # (Marshal and YAML have them) # YAML is Human Readable, contrary to Marshal which store in a binary format # Marshal does not need any "require" # # @param [ String ] storage_path # @param [ Constant ] serializer def initialize(storage_path, serializer = Marshal) @storage_path = File.expand_path(storage_path) @serializer = serializer FileUtils.mkdir_p(@storage_path) unless Dir.exist?(@storage_path) end # TODO: rename this to clear ? def clean Dir[File.join(storage_path, '*')].each do |f| File.delete(f) unless File.symlink?(f) end end # @param [ String ] key # # @return [ Mixed ] def read_entry(key) return if expired_entry?(key) serializer.load(File.read(entry_path(key))) rescue StandardError nil end # @param [ String ] key # @param [ Mixed ] data_to_store # @param [ Integer ] cache_ttl def write_entry(key, data_to_store, cache_ttl) return unless cache_ttl.to_i.positive? File.write(entry_path(key), serializer.dump(data_to_store)) File.write(entry_expiration_path(key), Time.now.to_i + cache_ttl) end # @param [ String ] key # # @return [ String ] The file path associated to the key def entry_path(key) File.join(storage_path, key) end # @param [ String ] key # # @return [ String ] The expiration file path associated to the key def entry_expiration_path(key) "#{entry_path(key)}.expiration" end private # @param [ String ] key # # @return [ Boolean ] def expired_entry?(key) File.read(entry_expiration_path(key)).to_i <= Time.now.to_i rescue StandardError true end end end end CMSScanner-0.14.3/lib/cms_scanner/cache/typhoeus.rb000066400000000000000000000011571466634144200220620ustar00rootroot00000000000000# frozen_string_literal: true require 'cms_scanner/cache/file_store' module CMSScanner module Cache # Cache implementation for Typhoeus class Typhoeus < FileStore # @param [ Typhoeus::Request ] request # # @return [ Typhoeus::Response ] def get(request) read_entry(request.hash.to_s) end # @param [ Typhoeus::Request ] request # @param [ Typhoeus::Response ] response def set(request, response) return if response.timed_out? || response.code&.zero? write_entry(request.hash.to_s, response, request.cache_ttl) end end end end CMSScanner-0.14.3/lib/cms_scanner/controller.rb000066400000000000000000000044741466634144200213270ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Controller # Base Controller class Base include OptParseValidator # @return [ Array ] def cli_options; end def before_scan; end def run; end def after_scan; end def ==(other) self.class == other.class end # Reset all the class attibutes # Currently only used in specs def self.reset @@target = nil @@datastore = nil @@formatter = nil end # @return [ Target ] def target @@target ||= NS::Target.new(NS::ParsedCli.url, NS::ParsedCli.options) end # @param [ OptParsevalidator::OptParser ] parser def self.option_parser=(parser) @@option_parser = parser end # @return [ OptParsevalidator::OptParser ] def option_parser @@option_parser end # @return [ Hash ] def datastore @@datastore ||= {} end # @return [ Formatter::Base ] def formatter @@formatter ||= NS::Formatter.load(NS::ParsedCli.format, datastore[:views]) end # @see Formatter#output # # @return [ Void ] def output(tpl, vars = {}) formatter.output(*tpl_params(tpl, vars)) end # @see Formatter#render # # @return [ String ] def render(tpl, vars = {}) formatter.render(*tpl_params(tpl, vars)) end # @return [ Boolean ] def user_interaction? formatter.user_interaction? && !NS::ParsedCli.output end # @return [ String ] def tmp_directory File.join('/tmp', NS.app_name) end protected # @param [ String ] tpl # @param [ Hash ] vars # # @return [ Array ] def tpl_params(tpl, vars) [ tpl, instance_variable_values.merge(vars), self.class.name.demodulize.underscore ] end # @return [ Hash ] All the instance variable keys (and their values) and the verbose value def instance_variable_values h = { verbose: NS::ParsedCli.verbose } instance_variables.each do |a| s = a.to_s n = s[1..s.size] h[n.to_sym] = instance_variable_get(a) end h end end end end CMSScanner-0.14.3/lib/cms_scanner/controllers.rb000066400000000000000000000042671466634144200215120ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner # Controllers Container class Controllers < Array attr_reader :option_parser, :running # @param [ OptParsevalidator::OptParser ] options_parser def initialize(option_parser = OptParseValidator::OptParser.new(nil, 40)) @option_parser = option_parser register_config_files option_parser.config_files.result_key = 'cli_options' end # Adds the potential option file paths to the option_parser def register_config_files [Dir.home, Dir.pwd].each do |dir| option_parser.config_files.class.supported_extensions.each do |ext| option_parser.config_files << Pathname.new(dir).join(".#{NS.app_name}", "scan.#{ext}").to_s end end end # @param [ Controller::Base ] controller # # @retun [ Controllers ] self def <<(controller) options = controller.cli_options unless include?(controller) option_parser.add(*options) if options super(controller) end self end def run NS::ParsedCli.options = option_parser.results first.class.option_parser = option_parser # To be able to output the help when -h/--hh redirect_output_to_file(NS::ParsedCli.output) if NS::ParsedCli.output Timeout.timeout(NS::ParsedCli.max_scan_duration, NS::Error::MaxScanDurationReached) do each(&:before_scan) @running = true each(&:run) end ensure # The rescue is there to prevent unfinished requests to raise an error, which would prevent # the reverse_each to run # rubocop:disable Style/RescueModifier NS::Browser.instance.hydra.abort rescue nil # rubocop:enable Style/RescueModifier # Reverse is used here as the app/controllers/core#after_scan finishes the output # and must be the last one to be executed. It also guarantee that stats will be output # even when an error occurs, which could help in debugging. # However, the #after_scan methods are only executed if the scan was running, and won't be # called when there is a CLI error, or just -h/--hh/--version for example reverse_each(&:after_scan) if running end end end CMSScanner-0.14.3/lib/cms_scanner/errors.rb000066400000000000000000000002641466634144200204510ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Error class Standard < StandardError end end end require_relative 'errors/http' require_relative 'errors/scan' CMSScanner-0.14.3/lib/cms_scanner/errors/000077500000000000000000000000001466634144200201225ustar00rootroot00000000000000CMSScanner-0.14.3/lib/cms_scanner/errors/http.rb000066400000000000000000000036341466634144200214340ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Error # Target Down Error class TargetDown < Standard attr_reader :response def initialize(response) @response = response end def to_s "The url supplied '#{response.request.url}' seems to be down (#{response.return_message})" end end # HTTP Authentication Required Error class HTTPAuthRequired < Standard # :nocov: def to_s 'HTTP authentication required (or was invalid), please provide it with --http-auth' end # :nocov: end # Proxy Authentication Required Error class ProxyAuthRequired < Standard # :nocov: def to_s 'Proxy authentication required (or was invalid), please provide it with --proxy-auth' end # :nocov: end # Access Forbidden Error class AccessForbidden < Standard attr_reader :random_user_agent_used # @param [ Boolean ] random_user_agent_used def initialize(random_user_agent_used) @random_user_agent_used = random_user_agent_used end def to_s msg = if random_user_agent_used 'Well... --random-user-agent didn\'t work, use --force to skip this check if needed.' else 'Please re-try with --random-user-agent' end "The target is responding with a 403, this might be due to a WAF. #{msg}" end end # HTTP Redirect Error class HTTPRedirect < Standard attr_reader :redirect_uri # @param [ String ] url def initialize(url) @redirect_uri = Addressable::URI.parse(url).normalize end def to_s "The URL supplied redirects to #{redirect_uri}. Use the --ignore-main-redirect "\ 'option to ignore the redirection and scan the target, or change the --url option ' \ 'value to the redirected URL.' end end end end CMSScanner-0.14.3/lib/cms_scanner/errors/scan.rb000066400000000000000000000004041466634144200213710ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Error # Used instead of the Timeout::Error class MaxScanDurationReached < Standard # :nocov: def to_s 'Max Scan Duration Reached' end # :nocov: end end end CMSScanner-0.14.3/lib/cms_scanner/exit_code.rb000066400000000000000000000011351466634144200210760ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner # Exit Code Values module ExitCode # No error, scan finished w/o any vulnerabilies found OK = 0 # All exceptions raised by OptParseValidator and OptionParser CLI_OPTION_ERROR = 1 # Interrupt received INTERRUPTED = 2 # Unhandled/unexpected Exception occured EXCEPTION = 3 # Error, scan did not finish ERROR = 4 # The target has at least one vulnerability. # Currently, the interesting findings do not count as vulnerable things VULNERABLE = 5 end end CMSScanner-0.14.3/lib/cms_scanner/finders.rb000066400000000000000000000007271466634144200205730ustar00rootroot00000000000000# frozen_string_literal: true require 'cms_scanner/finders/finder' require 'cms_scanner/finders/finding' require 'cms_scanner/finders/findings' require 'cms_scanner/finders/base_finders' require 'cms_scanner/finders/independent_finders' require 'cms_scanner/finders/independent_finder' require 'cms_scanner/finders/unique_finders' require 'cms_scanner/finders/unique_finder' require 'cms_scanner/finders/same_type_finders' require 'cms_scanner/finders/same_type_finder' CMSScanner-0.14.3/lib/cms_scanner/finders/000077500000000000000000000000001466634144200202405ustar00rootroot00000000000000CMSScanner-0.14.3/lib/cms_scanner/finders/base_finders.rb000066400000000000000000000023421466634144200232120ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Finders # Base class container for the Finders (i.e IndependentFinders etc) class BaseFinders < Array # @return [ Findings ] def findings @findings ||= NS::Finders::Findings.new end # Should be implemented in child classes def run; end protected # @param [ Symbol ] mode :mixed, :passive or :aggressive # @return [ Array ] The symbols to call for the mode def symbols_from_mode(mode) symbols = %i[passive aggressive] return symbols if mode.nil? || mode == :mixed symbols.include?(mode) ? Array(mode) : [] end # @param [ CMSScanner::Finders::Finder ] finder # @param [ Symbol ] symbol See return values of #symbols_from_mode # @param [ Hash ] opts def run_finder(finder, symbol, opts) Array(finder.send(symbol, opts.merge(found: findings))).compact.each do |found| findings << found end end # Allow child classes to filter the findings, such as return the best one # or remove the low confidence ones. # # @return [ Findings ] def filter_findings findings end end end end CMSScanner-0.14.3/lib/cms_scanner/finders/finder.rb000066400000000000000000000043571466634144200220450ustar00rootroot00000000000000# frozen_string_literal: true require 'cms_scanner/finders/finder/smart_url_checker' require 'cms_scanner/finders/finder/enumerator' require 'cms_scanner/finders/finder/fingerprinter' require 'cms_scanner/finders/finder/breadth_first_dictionary_attack' module CMSScanner module Finders # Finder class Finder # Constants for common found_by DIRECT_ACCESS = 'Direct Access (Aggressive Detection)' attr_accessor :target, :progress_bar def initialize(target) @target = target end # @return [ String ] The titleized name of the finder def titleize # Put a _ char before any digits except those at the end, which will be replaced by a space # Otherwise, class such as Error404Page are returned as Error404 Page instead of Error 404 page # The keep_id_suffix is to concevert classes such as CssId to Css Id instead of Css @titleize ||= self.class.to_s.demodulize.gsub(/(\d+)[a-z]+/i, '_\0').titleize(keep_id_suffix: true) end # @param [ Hash ] _opts def passive(_opts = {}); end # @param [ Hash ] _opts def aggressive(_opts = {}); end # @param [ Hash ] opts See https://github.com/jfelchner/ruby-progressbar/wiki/Options # @option opts [ Boolean ] :show_progression # # @return [ ProgressBar::Base ] def create_progress_bar(opts = {}) bar_opts = { format: '%t %a <%B> (%c / %C) %P%% %e' } bar_opts[:output] = ProgressBarNullOutput unless opts[:show_progression] @progress_bar = ::ProgressBar.create(bar_opts.merge(opts)) end # @return [ Browser ] def browser @browser ||= NS::Browser.instance end # @return [ Typhoeus::Hydra ] def hydra @hydra ||= browser.hydra end # @param [String, Class ] klass # @return [ String ] def found_by(klass = self.class) labels = %w[aggressive passive] caller_locations.each do |call| label = call.label next unless labels.include? label title = klass.to_s.demodulize.gsub(/(\d+)[a-z]+/i, '_\0').titleize(keep_id_suffix: true) return "#{title} (#{label.capitalize} Detection)" end nil end end end end CMSScanner-0.14.3/lib/cms_scanner/finders/finder/000077500000000000000000000000001466634144200215075ustar00rootroot00000000000000CMSScanner-0.14.3/lib/cms_scanner/finders/finder/breadth_first_dictionary_attack.rb000066400000000000000000000100501466634144200304240ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Finders class Finder # Module to provide an easy way to perform password attacks module BreadthFirstDictionaryAttack # @param [ Array ] users # @param [ String ] wordlist_path # @param [ Hash ] opts # @option opts [ Boolean ] :show_progression # # @yield [ CMSScanner::User ] When a valid combination is found # # Due to Typhoeus threads shenanigans, in rare cases the progress-bar might # be incorrectly updated, hence the 'rescue ProgressBar::InvalidProgressError' # # TODO: Make rubocop happy about metrics etc # # rubocop:disable all def attack(users, wordlist_path, opts = {}) wordlist = File.open(wordlist_path) create_progress_bar(total: users.size * wordlist.count, show_progression: opts[:show_progression]) queue_count = 0 # Keep the number of requests sent for each users # to be able to correctly update the progress when a password is found user_requests_count = {} users.each { |u| user_requests_count[u.username] = 0 } File.foreach(wordlist, chomp: true) do |password| remaining_users = users.select { |u| u.password.nil? } break if remaining_users.empty? remaining_users.each do |user| request = login_request(user.username, password) user_requests_count[user.username] += 1 request.on_complete do |res| progress_bar.title = "Trying #{user.username} / #{password}" progress_bar.increment unless progress_bar.progress == progress_bar.total if valid_credentials?(res) user.password = password begin progress_bar.total -= wordlist.count - user_requests_count[user.username] rescue ProgressBar::InvalidProgressError end yield user elsif errored_response?(res) output_error(res) end end hydra.queue(request) queue_count += 1 if queue_count >= hydra.max_concurrency hydra.run queue_count = 0 end end end hydra.run progress_bar.stop end # rubocop:enable all # @param [ String ] username # param [ String ] password # # @return [ Typhoeus::Request ] def login_request(username, password) # To Implement in the finder related to the attack end # @param [ Typhoeus::Response ] response # # @return [ Boolean ] Whether or not credentials related to the request are valid def valid_credentials?(response) # To Implement in the finder related to the attack end # @param [ Typhoeus::Response ] response # # @return [ Boolean ] Whether or not something wrong happened # other than wrong credentials def errored_response?(response) # To Implement in the finder related to the attack end protected # @param [ Typhoeus::Response ] response def output_error(response) error = if response.timed_out? 'Request timed out.' elsif response.code.zero? "No response from remote server. WAF/IPS? (#{response.return_message})" elsif response.code.to_s.start_with?('50') 'Server error, try reducing the number of threads.' elsif NS::ParsedCli.verbose? "Unknown response received Code: #{response.code}\nBody: #{response.body}" else "Unknown response received Code: #{response.code}" end progress_bar.log("Error: #{error}") end end end end end CMSScanner-0.14.3/lib/cms_scanner/finders/finder/enumerator.rb000066400000000000000000000047701466634144200242250ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Finders class Finder # Module to provide an easy way to enumerate items such as plugins, themes etc module Enumerator # @return [ Hash ] def head_or_get_request_params # Disabling the cache, as it causes a 'stack level too deep' exception # with a large number of requests. # See https://github.com/typhoeus/typhoeus/issues/408 @head_or_get_request_params ||= target.head_or_get_params.merge(cache_ttl: 0) end # @return [ Array ] def valid_response_codes @valid_response_codes ||= [200] end # @param [ Hash ] The target urls # @param [ Hash ] opts # @option opts [ Boolean ] :show_progression Wether or not to display the progress bar # @option opts [ Regexp ] :exclude_content # @option opts [ Boolean, Array, String ] :check_full_response # # @yield [ Typhoeus::Response, String ] def enumerate(urls, opts = {}) create_progress_bar(opts.merge(total: urls.size)) urls.each do |url, id| request = browser.forge_request(url, head_or_get_request_params) request.on_complete do |head_res| progress_bar.increment next unless valid_response_codes.include?(head_res.code) next if opts[:exclude_content] && head_res.response_headers&.match(opts[:exclude_content]) head_or_full_res = maybe_get_full_response(head_res, opts) yield head_or_full_res, id if head_or_full_res end hydra.queue(request) end hydra.run end # @param [ Typhoeus::Response ] head_res # @param [ Hash ] opts # # @return [ Typhoeus::Response, nil ] def maybe_get_full_response(head_res, opts) return head_res unless opts[:check_full_response] == true || Array(opts[:check_full_response]).include?(head_res.code) full_res = NS::Browser.get(head_res.effective_url, full_request_params) return unless valid_response_codes.include?(full_res.code) return if target.homepage_or_404?(full_res) || (opts[:exclude_content] && full_res.body&.match(opts[:exclude_content])) full_res end # @return [ Hash ] def full_request_params @full_request_params ||= {} end end end end end CMSScanner-0.14.3/lib/cms_scanner/finders/finder/fingerprinter.rb000066400000000000000000000030141466634144200247100ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Finders class Finder # Module to provide an easy way to fingerprint things such as versions module Fingerprinter include Enumerator # @param [ Hash ] fingerprints The fingerprints # Format should be like the following: # { # file_path_1: { # md5_hash_1: version_1, # md5_hash_2: [version_2] # }, # file_path_2: { # md5_hash_3: [version_1, version_2], # md5_hash_4: version_3 # } # } # Note that the version can either be an array or a string # # @param [ Hash ] opts # @option opts [ Boolean ] :show_progression Wether or not to display the progress bar # # @yield [ Mixed, String, String ] version/s, url, hash The version associated to the # fingerprint of the url def fingerprint(fingerprints, opts = {}) enum_opts = opts.merge(check_full_response: 200) enumerate(fingerprints.transform_keys { |k| target.url(k) }, enum_opts) do |res, fingerprint| md5sum = hexdigest(res.body) next unless fingerprint.key?(md5sum) yield fingerprint[md5sum], res.effective_url, md5sum end end # @return [ String ] The hashed value for the given body def hexdigest(body) Digest::MD5.hexdigest(body) end end end end end CMSScanner-0.14.3/lib/cms_scanner/finders/finder/smart_url_checker.rb000066400000000000000000000031541466634144200255330ustar00rootroot00000000000000# frozen_string_literal: true require 'cms_scanner/finders/finder/smart_url_checker/findings' module CMSScanner module Finders class Finder # Smart URL Checker # Typically used when some URLs are potentially in the homepage. If they are found # in it, they will be checked in the #passive (like a browser/client would do when loading the page). # Otherwise they will be checked in the #aggressive module SmartURLChecker # @param [ Array ] urls # @param [ Hash ] opts # # @return [] def process_urls(_urls, _opts = {}) raise NotImplementedError end # @param [ Hash ] opts # # @return [ Array ] def passive(opts = {}) process_urls(passive_urls(opts), opts) end # @param [ Hash ] opts # # @return [ Array ] def passive_urls(_opts = {}) target.in_scope_uris(target.homepage_res, passive_urls_xpath).map(&:to_s) end # @return [ String ] def passive_urls_xpath raise NotImplementedError end # @param [ Hash ] opts # # @return [ Array ] def aggressive(opts = {}) # To avoid scanning the same twice urls = aggressive_urls(opts) urls -= passive_urls(opts) if opts[:mode] == :mixed process_urls(urls, opts) end # @param [ Hash ] opts # # @return [ Array ] def aggressive_urls(_opts = {}) raise NotImplementedError end end end end end CMSScanner-0.14.3/lib/cms_scanner/finders/finder/smart_url_checker/000077500000000000000000000000001466634144200252035ustar00rootroot00000000000000CMSScanner-0.14.3/lib/cms_scanner/finders/finder/smart_url_checker/findings.rb000066400000000000000000000015221466634144200273310ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Finders class Finder module SmartURLChecker # Findings class Findings < Array def <<(finding) return self unless finding each do |f| next unless f == finding && f.found_by == finding.found_by # This makes sure entries added are unique # and prevent pages redirecting to the same one to be added twice entries_to_add = finding.interesting_entries - f.interesting_entries return self if entries_to_add.empty? entries_to_add.each { |entry| f.interesting_entries << entry } f.confidence += finding.confidence return self end super(finding) end end end end end end CMSScanner-0.14.3/lib/cms_scanner/finders/finding.rb000066400000000000000000000024431466634144200222060ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Finders # Finding module Finding # Fix for "Double/Dynamic Inclusion Problem" def self.included(base) base.include References super(base) end FINDING_OPTS = %i[confidence confirmed_by references found_by interesting_entries].freeze attr_accessor(*FINDING_OPTS) # @return [ Array ] def confirmed_by @confirmed_by ||= [] end # Should be overriden in child classes # @return [ Array ] def interesting_entries @interesting_entries ||= [] end # @return [ Integer ] def confidence @confidence ||= 0 end # @param [ Integer ] value def confidence=(value) @confidence = value >= 100 ? 100 : value end # @param [ Hash ] opts def parse_finding_options(opts = {}) FINDING_OPTS.each { |opt| send("#{opt}=", opts[opt]) if opts.key?(opt) } end # TODO: maybe also check for interesting_entries and confirmed_by ? # So far this is used in specs only def eql?(other) self == other && confidence == other.confidence && found_by == other.found_by end def <=>(other) to_s.downcase <=> other.to_s.downcase end end end end CMSScanner-0.14.3/lib/cms_scanner/finders/findings.rb000066400000000000000000000007761466634144200224000ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Finders # Findings container class Findings < Array # Override to include the confirmed_by logic # # @param [ Finding ] finding def <<(finding) return self unless finding each do |found| next unless found == finding found.confirmed_by << finding found.confidence += finding.confidence return self end super(finding) end end end end CMSScanner-0.14.3/lib/cms_scanner/finders/independent_finder.rb000066400000000000000000000011751466634144200244150ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Finders # Independent Finder module IndependentFinder extend ActiveSupport::Concern # See ActiveSupport::Concern module ClassMethods def find(target, opts = {}) new(target).find(opts) end end # @param [ Hash ] opts # @option opts [ Symbol ] mode (:mixed, :passive, :aggressive) # # @return [ Findings ] def find(opts = {}) finders.run(opts) end # @return [ Array ] def finders @finders ||= NS::Finders::IndependentFinders.new end end end end CMSScanner-0.14.3/lib/cms_scanner/finders/independent_finders.rb000066400000000000000000000011741466634144200245770ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Finders # This class is designed to handle independent results # which are not related with each others # e.g: interesting files class IndependentFinders < BaseFinders # @param [ Hash ] opts # @option opts [ Symbol ] mode :mixed, :passive or :aggressive # # @return [ Findings ] def run(opts = {}) methods = symbols_from_mode(opts[:mode]) each do |finder| methods.each do |symbol| run_finder(finder, symbol, opts) end end filter_findings end end end end CMSScanner-0.14.3/lib/cms_scanner/finders/same_type_finder.rb000066400000000000000000000005671466634144200241120ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Finders # Same Type Finder module SameTypeFinder def self.included(klass) klass.class_eval do include IndependentFinder # @return [ Array ] def finders @finders ||= NS::Finders::SameTypeFinders.new end end end end end end CMSScanner-0.14.3/lib/cms_scanner/finders/same_type_finders.rb000066400000000000000000000012671466634144200242730ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Finders # This class is designed to handle same type results, such as enumeration of plugins, # themes etc. class SameTypeFinders < BaseFinders # @param [ Hash ] opts # @option opts [ Symbol ] :mode :mixed, :passive or :aggressive # @option opts [ Boolean ] :sort Wether or not to sort the findings # # @return [ Findings ] def run(opts = {}) symbols_from_mode(opts[:mode]).each do |symbol| each do |finder| run_finder(finder, symbol, opts) end end findings.sort! if opts[:sort] filter_findings end end end end CMSScanner-0.14.3/lib/cms_scanner/finders/unique_finder.rb000066400000000000000000000005601466634144200234230ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Finders # Unique Finder module UniqueFinder def self.included(klass) klass.class_eval do include IndependentFinder # @return [ Array ] def finders @finders ||= NS::Finders::UniqueFinders.new end end end end end end CMSScanner-0.14.3/lib/cms_scanner/finders/unique_finders.rb000066400000000000000000000031531466634144200236070ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Finders # This class is designed to return a unique result such as a version # Note: Finders contained can return multiple results but the #run will only # returned the best finding class UniqueFinders < BaseFinders # @param [ Hash ] opts # @option opts [ Symbol ] :mode :mixed, :passive or :aggressive # @option opts [ Int ] :confidence_threshold If a finding's confidence reaches this value, # it will be returned as the best finding. # Default is 100. # If <= 0, all finders will be ran. # # @return [ Object, false ] The best finding or false if none def run(opts = {}) opts[:confidence_threshold] ||= 100 symbols_from_mode(opts[:mode]).each do |symbol| each do |finder| run_finder(finder, symbol, opts) next if opts[:confidence_threshold] <= 0 findings.each { |f| return f if f.confidence >= opts[:confidence_threshold] } end end filter_findings end protected # @return [ Object, false ] The best finding or false if none def filter_findings # results are sorted by confidence ASC findings.sort_by!(&:confidence) # If all findings have the same confidence, false is returned return false if findings.size > 1 && findings.first.confidence == findings.last.confidence findings.last || false end end end end CMSScanner-0.14.3/lib/cms_scanner/formatter.rb000066400000000000000000000107771466634144200211520ustar00rootroot00000000000000# frozen_string_literal: true require 'cms_scanner/formatter/buffer' module CMSScanner # Formatter module Formatter # Module to be able to do Formatter.load() & Formatter.availables # and do that as well when the Formatter is included in another module module ClassMethods # @param [ String ] format # @param [ Array ] custom_views # # @return [ Formatter::Base ] def load(format = nil, custom_views = nil) format ||= 'cli' custom_views ||= [] f = const_get(format.tr('-', '_').camelize).new custom_views.each { |v| f.views_directories << v } f end # @return [ Array ] The list of the available formatters (except the Base one) # @note: the #load method above should then be used to create the associated formatter def availables formatters = NS::Formatter.constants.select do |const| name = NS::Formatter.const_get(const) name.is_a?(Class) && name != NS::Formatter::Base end formatters.map { |sym| sym.to_s.underscore.dasherize } end end extend ClassMethods def self.included(base) base.extend(ClassMethods) end # This module should be implemented in the code which uses this Framework to # be able to override/implements instance methods for all the Formatters # w/o having to include/write the methods in each formatters. # # Example: to override the #views_directories (see the wpscan-v3/lib/wpscan/formatter.rb) module InstanceMethods end # Base Formatter class Base attr_reader :controller_name def initialize # Can't put this at the top level of the class, due to the NS:: extend NS::Formatter::InstanceMethods end # @return [ String ] The underscored name of the class def format self.class.name.demodulize.underscore end # @return [ Boolean ] def user_interaction? format == 'cli' end # @return [ String ] The underscored format to use as a base def base_format; end # @return [ Array ] def formats [format, base_format].compact end # This is called after the scan # and used in some formatters (e.g JSON) # to indent results def beautify; end # @see #render def output(tpl, vars = {}, controller_name = nil) puts render(tpl, vars, controller_name) end ERB_SUPPORTS_KVARGS = ::ERB.instance_method(:initialize).parameters.assoc(:key) # Ruby 2.6+ # @param [ String ] tpl # @param [ Hash ] vars # @param [ String ] controller_name def render(tpl, vars = {}, controller_name = nil) template_vars(vars) @controller_name = controller_name if controller_name # '-' is used to disable new lines when -%> is used # See http://www.ruby-doc.org/stdlib-2.1.1/libdoc/erb/rdoc/ERB.html # Since ruby 2.6, KVARGS are supported and passing argument is deprecated in ruby 3+ if ERB_SUPPORTS_KVARGS ERB.new(File.read(view_path(tpl)), trim_mode: '-').result(binding) else ERB.new(File.read(view_path(tpl)), nil, '-').result(binding) end end # @param [ Hash ] vars # # @return [ Void ] def template_vars(vars) vars.each do |key, value| instance_variable_set("@#{key}", value) unless key == :views_directories end end # @param [ String ] tpl # # @return [ String ] The path of the view def view_path(tpl) if tpl[0, 1] == '@' # Global Template tpl = tpl.delete('@') else raise 'The controller_name can not be nil' unless controller_name tpl = "#{controller_name}/#{tpl}" end raise "Wrong tpl format: '#{tpl}'" unless %r{\A[\w/_]+\z}.match?(tpl) views_directories.reverse_each do |dir| formats.each do |format| potential_file = File.join(dir, format, "#{tpl}.erb") return potential_file if File.exist?(potential_file) end end raise "View not found for #{format}/#{tpl}" end # @return [ Array ] The directories to look into for views def views_directories @views_directories ||= [ APP_DIR, NS::APP_DIR, File.join(Dir.home, ".#{NS.app_name}"), File.join(Dir.pwd, ".#{NS.app_name}") ].uniq.reduce([]) { |acc, elem| acc << Pathname.new(elem).join('views').to_s } end end end end CMSScanner-0.14.3/lib/cms_scanner/formatter/000077500000000000000000000000001466634144200206115ustar00rootroot00000000000000CMSScanner-0.14.3/lib/cms_scanner/formatter/buffer.rb000066400000000000000000000006601466634144200224110ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Formatter # Module used to output the rendered views into a buffer # and beautify it a the end of the scan module Buffer def output(tpl, vars = {}, controller_name = nil) buffer << render(tpl, vars, controller_name).encode('UTF-8', invalid: :replace, undef: :replace) end def buffer @buffer ||= +'' end end end end CMSScanner-0.14.3/lib/cms_scanner/helper.rb000066400000000000000000000002361466634144200204130ustar00rootroot00000000000000# frozen_string_literal: true # @param [ String ] file The file path def redirect_output_to_file(file) $stdout.reopen(file, 'w') $stdout.sync = true end CMSScanner-0.14.3/lib/cms_scanner/numeric.rb000066400000000000000000000005451466634144200206010ustar00rootroot00000000000000# frozen_string_literal: true # Hack of the Numeric class class Numeric # @return [ String ] A human readable string of the value def bytes_to_human units = %w[B KB MB GB TB] e = abs.zero? ? abs : (Math.log(abs) / Math.log(1024)).floor s = format('%.3f', s: (abs.to_f / (1024**e))) s.sub(/\.?0*$/, " #{units[e]}") end end CMSScanner-0.14.3/lib/cms_scanner/parsed_cli.rb000066400000000000000000000020431466634144200212370ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner # Class to hold the parsed CLI options and have them available via # methods, such as #verbose?, rather than from the hash. # This is similar to an OpenStruct, but class wise (rather than instance), and with # the logic to update the Browser options accordinly class ParsedCli # @return [ Hash ] def self.options @options ||= {} end # Sets the CLI options, and put them into the Browser as well # @param [ Hash ] options def self.options=(options) @options = options.dup || {} NS::Browser.reset NS::Browser.instance(@options) end # @return [ Boolean ] def self.verbose? options[:verbose] ? true : false end # Unknown methods will return nil, this is the expected behaviour # rubocop:disable Style/MissingRespondToMissing def self.method_missing(method_name, *_args, &_block) super if method_name == :new options[method_name.to_sym] end # rubocop:enable Style/MissingRespondToMissing end end CMSScanner-0.14.3/lib/cms_scanner/progressbar_null_output.rb000066400000000000000000000012401466634144200241330ustar00rootroot00000000000000# frozen_string_literal: true require 'ruby-progressbar/outputs/null' module CMSScanner # Adds the feature to log message sent to #log # So they can be retrieved at some point, like after a password attack with a JSON output # which won't display the progressbar but still call #log for errors etc class ProgressBarNullOutput < ::ProgressBar::Outputs::Null # @retutn [ Array ] def logs @logs ||= [] end # Override of parent method # @return [ Array ] return the logs when no string provided def log(string = nil) return logs if string.nil? logs << string unless logs.include?(string) end end end CMSScanner-0.14.3/lib/cms_scanner/public_suffix/000077500000000000000000000000001466634144200214505ustar00rootroot00000000000000CMSScanner-0.14.3/lib/cms_scanner/public_suffix/domain.rb000066400000000000000000000016571466634144200232550ustar00rootroot00000000000000# frozen_string_literal: true module PublicSuffix # Monkey Patch to include the match logic class Domain # For Sanity def ==(other) name == other.name end # @return [ Boolean ] # def match(pattern) pattern = PublicSuffix.parse(pattern) unless pattern.is_a?(PublicSuffix::Domain) return name == pattern.name unless pattern.trd return false unless tld == pattern.tld && sld == pattern.sld matching_pattern?(pattern) end protected # @rturn [ Boolean ] def matching_pattern?(pattern) pattern_trds = pattern.trd.split('.') domain_trds = trd.split('.') case pattern_trds.first when '*' pattern_trds[1..-1] == domain_trds[1..-1] when '**' pa = pattern_trds[1..-1] pa_size = pa.size domain_trds[domain_trds.size - pa_size, pa_size] == pa else name == pattern.name end end end end CMSScanner-0.14.3/lib/cms_scanner/references.rb000066400000000000000000000063251466634144200212620ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner # References related to the issue module References extend ActiveSupport::Concern # See ActiveSupport::Concern module ClassMethods # @return [ Array ] def references_keys @references_keys ||= %i[cve exploitdb url metasploit packetstorm securityfocus youtube] end end # @param [ Hash ] refs def references=(refs) @references = {} self.class.references_keys.each do |key| next unless refs.key?(key) @references[key] = if key == :youtube Array(refs[:youtube]).map { |id| youtube_url(id) } else Array(refs[key]).map(&:to_s) end end end # @return [ Hash ] def references @references ||= {} end # @return [ Array ] All the references URLs def references_urls cve_urls + exploitdb_urls + urls + msf_urls + packetstorm_urls + securityfocus_urls + youtube_urls end # @return [ Array ] The CVEs def cves references[:cve] || [] end # @return [ Array ] def cve_urls cves.reduce([]) { |acc, elem| acc << cve_url(elem) } end # @return [ String ] The URL to the CVE def cve_url(cve) "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-#{cve}" end # @return [ Array ] The ExploitDB ID def exploitdb_ids references[:exploitdb] || [] end # @return [ Array ] def exploitdb_urls exploitdb_ids.reduce([]) { |acc, elem| acc << exploitdb_url(elem) } end # @return [ String ] def exploitdb_url(id) "https://www.exploit-db.com/exploits/#{id}/" end # @return [ String ] def urls references[:url] || [] end # @return [ Array ] The metasploit modules def msf_modules references[:metasploit] || [] end # @return [ Array ] def msf_urls msf_modules.reduce([]) { |acc, elem| acc << msf_url(elem) } end # @return [ String ] The URL to the metasploit module page def msf_url(mod) "https://www.rapid7.com/db/modules/#{mod.sub(%r{^/}, '')}/" end # @return [ Array ] The Packetstormsecurity IDs def packetstorm_ids @packetstorm_ids ||= references[:packetstorm] || [] end # @return [ Array ] def packetstorm_urls packetstorm_ids.reduce([]) { |acc, elem| acc << packetstorm_url(elem) } end # @return [ String ] def packetstorm_url(id) "https://packetstormsecurity.com/files/#{id}/" end # @return [ Array ] The Security Focus IDs def securityfocus_ids references[:securityfocus] || [] end # @return [ Array ] def securityfocus_urls securityfocus_ids.reduce([]) { |acc, elem| acc << securityfocus_url(elem) } end # @return [ String ] def securityfocus_url(id) "https://www.securityfocus.com/bid/#{id}/" end # @return [ Array ] def youtube_urls references[:youtube] || [] end # @return [ String ] def youtube_url(id) "https://www.youtube.com/watch?v=#{id}" end end end CMSScanner-0.14.3/lib/cms_scanner/scan.rb000066400000000000000000000047551466634144200200720ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner # Scan class Scan attr_reader :run_error def initialize NS.start_memory = GetProcessMem.new.bytes controllers << NS::Controller::Core.new exit_hook yield self if block_given? end # @return [ Controllers ] def controllers @controllers ||= NS::Controllers.new end def run controllers.run rescue OptParseValidator::NoRequiredOption => e @run_error = e formatter.output('@usage', msg: e.message) rescue NoMemoryError, ScriptError, SecurityError, SignalException, StandardError, SystemStackError => e @run_error = e output_params = { reason: e.is_a?(Interrupt) ? 'Canceled by User' : e.message, trace: e.backtrace, verbose: NS::ParsedCli.verbose || run_error_exit_code == NS::ExitCode::EXCEPTION } output_params[:url] = controllers.first.target.url if NS::ParsedCli.url formatter.output('@scan_aborted', output_params) ensure formatter.beautify end # Used for convenience # @See Formatter def formatter controllers.first.formatter end # @return [ Hash ] def datastore controllers.first.datastore end # Hook to be able to have an exit code returned # depending on the findings / errors # :nocov: def exit_hook # Avoid hooking the exit when rspec is running, otherwise it will always return 0 # and Travis won't detect failed builds. Couldn't find a better way, even though # some people managed to https://github.com/rspec/rspec-core/pull/410 return if defined?(RSpec) at_exit do exit(run_error_exit_code) if run_error # The parsed_option[:url] must be checked to avoid raising erros when only -h/-v are given exit(NS::ExitCode::VULNERABLE) if NS::ParsedCli.url && controllers.first.target.vulnerable? exit(NS::ExitCode::OK) end end # :nocov: # @return [ Integer ] The exit code related to the run_error def run_error_exit_code return NS::ExitCode::CLI_OPTION_ERROR if run_error.is_a?(OptParseValidator::Error) || run_error.is_a?(OptionParser::ParseError) return NS::ExitCode::INTERRUPTED if run_error.is_a?(Interrupt) return NS::ExitCode::ERROR if run_error.is_a?(NS::Error::Standard) || run_error.is_a?(CMSScanner::Error::Standard) NS::ExitCode::EXCEPTION end end end CMSScanner-0.14.3/lib/cms_scanner/target.rb000066400000000000000000000074301466634144200204250ustar00rootroot00000000000000# frozen_string_literal: true require 'cms_scanner/web_site' require 'cms_scanner/target/platform' require 'cms_scanner/target/server' require 'cms_scanner/target/scope' require 'cms_scanner/target/hashes' module CMSScanner # Target to Scan class Target < WebSite include Server::Generic # @param [ String ] url # @param [ Hash ] opts # @option opts [ Array ] :scope def initialize(url, opts = {}) super(url, opts) scope << uri.host Array(opts[:scope]).each { |s| scope << s } end # @param [ Hash ] opts # # @return [ Findings ] def interesting_findings(opts = {}) @interesting_findings ||= NS::Finders::InterestingFindings::Base.find(self, opts) end # Weteher or not vulnerabilities have been found. # Used to set the exit code of the scanner # and it should be overriden in the implementation # # @return [ Boolean ] def vulnerable? raise NotImplementedError end # @return [ Regexp ] The pattern related to the target url, also matches escaped /, such as # in JSON JS data: http:\/\/t.com\/ def url_pattern @url_pattern ||= Regexp.new(Regexp.escape(url).gsub(/https?/i, 'https?').gsub('/', '\\\\\?/'), Regexp::IGNORECASE) end # @param [ String ] xpath # @param [ Regexp ] pattern # @param [ Typhoeus::Response, String ] page # # @return [ Array> ] # @yield [ MatchData, Nokogiri::XML::Element ] def xpath_pattern_from_page(xpath, pattern, page = nil) page = NS::Browser.get(url(page)) unless page.is_a?(Typhoeus::Response) matches = [] page.html.xpath(xpath).each do |node| next unless node.text.strip =~ pattern yield Regexp.last_match, node if block_given? matches << [Regexp.last_match, node] end matches end # @param [ Regexp ] pattern # @param [ Typhoeus::Response, String ] page # # @return [ Array> ] # @yield [ MatchData, Nokogiri::XML::Comment ] def comments_from_page(pattern, page = nil) xpath_pattern_from_page('//comment()', pattern, page) do |match, node| yield match, node if block_given? end end # @param [ Regexp ] pattern # @param [ Typhoeus::Response, String ] page # # @return [ Array> ] # @yield [ MatchData, Nokogiri::XML::Element ] def javascripts_from_page(pattern, page = nil) xpath_pattern_from_page('//script', pattern, page) do |match, node| yield match, node if block_given? end end # @param [ Typhoeus::Response, String ] page # @param [ String ] xpath # # @yield [ Addressable::URI, Nokogiri::XML::Element ] The url and its associated tag # # @return [ Array ] The absolute URIs detected in the response's body from the HTML tags # # @note It is highly recommended to use the xpath parameter to focus on the uris needed, as this method can be quite # time consuming when there are a lof of uris to check def uris_from_page(page = nil, xpath = '//@href|//@src|//@data-src') page = NS::Browser.get(url(page)) unless page.is_a?(Typhoeus::Response) found = [] page.html.xpath(xpath).each do |node| attr_value = node.text.to_s next unless attr_value && !attr_value.empty? node_uri = begin uri.join(attr_value.strip) rescue StandardError # Skip potential malformed URLs etc. next end next unless node_uri.host yield node_uri, node.parent if block_given? && !found.include?(node_uri) found << node_uri end found.uniq end end end CMSScanner-0.14.3/lib/cms_scanner/target/000077500000000000000000000000001466634144200200745ustar00rootroot00000000000000CMSScanner-0.14.3/lib/cms_scanner/target/hashes.rb000066400000000000000000000025531466634144200217010ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner # Scope system logic class Target < WebSite # @note Comments are deleted to avoid cache generation details # # @param [ Typhoeus::Response, String ] page # # @return [ String ] The md5sum of the page def self.page_hash(page) page = NS::Browser.get(page, followlocation: true) unless page.is_a?(Typhoeus::Response) # Removes comments and script tags before computing the hash # to remove any potential cached stuff html = Nokogiri::HTML(page.body) html.xpath('//script|//comment()').each(&:remove) Digest::MD5.hexdigest(html) end # @return [ String ] The hash of the homepage def homepage_hash @homepage_hash ||= self.class.page_hash(url) end # @note This is used to detect potential custom 404 responding with a 200 # @return [ String ] The hash of a 404 def error_404_hash @error_404_hash ||= self.class.page_hash(error_404_res) end # @param [ Typhoeus::Response, String ] page # @return [ Boolean ] Wether or not the page is a the homepage or a 404 based on its md5sum def homepage_or_404?(page) homepage_and_404_hashes.include?(self.class.page_hash(page)) end protected def homepage_and_404_hashes @homepage_and_404_hashes ||= [homepage_hash, error_404_hash].freeze end end end CMSScanner-0.14.3/lib/cms_scanner/target/platform.rb000066400000000000000000000001111466634144200222360ustar00rootroot00000000000000# frozen_string_literal: true require 'cms_scanner/target/platform/php' CMSScanner-0.14.3/lib/cms_scanner/target/platform/000077500000000000000000000000001466634144200217205ustar00rootroot00000000000000CMSScanner-0.14.3/lib/cms_scanner/target/platform/php.rb000066400000000000000000000042311466634144200230340ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner class Target < WebSite module Platform # Some PHP specific implementation module PHP DEBUG_LOG_PATTERN = /(?:\[\d{2}-[a-zA-Z]{3}-\d{4}\s\d{2}:\d{2}:\d{2}\s[A-Z]{3}\]| PHP\s(?:Fatal|Warning|Strict|Error|Notice):)/x.freeze FPD_PATTERN = /Fatal error:.+? in (.+?) on/.freeze ERROR_LOG_PATTERN = /PHP Fatal error/i.freeze # @param [ String ] path # @param [ Regexp ] pattern # @param [ Hash ] params The request params # # @return [ Boolean ] def log_file?(path, pattern, params = {}) # Only the first 700 bytes of the file are retrieved to avoid getting entire log file # which can be huge (~ 2Go) res = head_and_get(path, [200], get: params.merge(headers: { 'Range' => 'bytes=0-700' })) res.body&.match?(pattern) ? true : false end # @param [ String ] path # @param [ Hash ] params The request params # # @return [ Boolean ] true if url(path) is a debug log, false otherwise def debug_log?(path, params = {}) log_file?(path, DEBUG_LOG_PATTERN, params) end # @param [ String ] path # @param [ Hash ] params The request params # # @return [ Boolean ] Wether or not url(path) is an error log file def error_log?(path, params = {}) log_file?(path, ERROR_LOG_PATTERN, params) end # @param [ String ] path # @param [ Hash ] params The request params # # @return [ Boolean ] true if url(path) contains a FPD, false otherwise def full_path_disclosure?(path = nil, params = {}) !full_path_disclosure_entries(path, params).empty? end # @param [ String ] path # @param [ Hash ] params The request params # # @return [ Array ] The FPD found, or an empty array if none def full_path_disclosure_entries(path = nil, params = {}) res = NS::Browser.get(url(path), params) res.body.scan(FPD_PATTERN).flatten end end end end end CMSScanner-0.14.3/lib/cms_scanner/target/scope.rb000066400000000000000000000062341466634144200215370ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner # Scope system logic class Target < WebSite # @return [ Array ] def scope @scope ||= Scope.new end # @param [ String, Addressable::URI ] url An absolute URL or URI # # @return [ Boolean ] true if the url given is in scope def in_scope?(url_or_uri) url_or_uri = Addressable::URI.parse(url_or_uri.strip) unless url_or_uri.is_a?(Addressable::URI) scope.include?(url_or_uri.host) rescue StandardError false end # @param [ Typhoeus::Response ] res # @param [ String ] xpath # # @yield [ Addressable::URI, Nokogiri::XML::Element ] The in scope url and its associated tag # # @return [ Array ] The in scope absolute URIs detected in the response's body # # @note It is highly recommended to use the xpath parameter to focus on the uris needed, as this method can be quite # time consuming when there are a lof of uris to check def in_scope_uris(res, xpath = '//@href|//@src|//@data-src') found = [] uris_from_page(res, xpath) do |uri, tag| next unless in_scope?(uri) yield uri, tag if block_given? found << uri end found end # Similar to Target#url_pattern but considering the in scope domains as well # # @return [ Regexp ] The pattern related to the target url and in scope domains, # it also matches escaped /, such as in JSON JS data: http:\/\/t.com\/ # rubocop:disable Metrics/AbcSize def scope_url_pattern return @scope_url_pattern if @scope_url_pattern domains = [uri.host + uri.path] domains += if scope.domains.empty? Array(scope.invalid_domains[1..-1]) else Array(scope.domains[1..-1]).map(&:to_s) + scope.invalid_domains end domains.map! { |d| Regexp.escape(d.delete_suffix('/')).gsub('\*', '.*').gsub('/', '\\\\\?/') } domains[0].gsub!(Regexp.escape(uri.host), "#{Regexp.escape(uri.host)}(?::\\d+)?") if uri.port @scope_url_pattern = %r{https?:\\?/\\?/(?:#{domains.join('|')})\\?/?}i end # rubocop:enable Metrics/AbcSize # Scope Implementation class Scope # @return [ Array ] The valid domains in scope def domains @domains ||= [] end # @return [ Array ] The invalid domains in scope (such as IP addresses etc) def invalid_domains @invalid_domains ||= [] end def <<(element) if PublicSuffix.valid?(element, ignore_private: true) domains << PublicSuffix.parse(element, ignore_private: true) else invalid_domains << element end end # @return [ Boolean ] Wether or not the host is in the scope def include?(host) if PublicSuffix.valid?(host, ignore_private: true) domain = PublicSuffix.parse(host, ignore_private: true) domains.each { |d| return true if domain.match(d) } else invalid_domains.each { |d| return true if host == d } end false end end end end CMSScanner-0.14.3/lib/cms_scanner/target/server.rb000066400000000000000000000003101466634144200217210ustar00rootroot00000000000000# frozen_string_literal: true require 'cms_scanner/target/server/generic' require 'cms_scanner/target/server/apache' require 'cms_scanner/target/server/iis' require 'cms_scanner/target/server/nginx' CMSScanner-0.14.3/lib/cms_scanner/target/server/000077500000000000000000000000001466634144200214025ustar00rootroot00000000000000CMSScanner-0.14.3/lib/cms_scanner/target/server/apache.rb000066400000000000000000000013471466634144200231550ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner class Target < WebSite module Server # Some Apche specific implementation module Apache # @param [ String ] path # @param [ Hash ] params The request params # # @return [ Symbol ] :Apache def server(_path = nil, _params = {}) :Apache end # @param [ String ] path # @param [ Hash ] params The request params # # @return [ Array ] The first level of directories/files listed, # or an empty array if none def directory_listing_entries(path = nil, params = {}) super(path, params, 'td a') end end end end end CMSScanner-0.14.3/lib/cms_scanner/target/server/generic.rb000066400000000000000000000041451466634144200233470ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner class Target < WebSite module Server # Generic Server methods module Generic # @param [ String ] path # @param [ Hash ] params The request params # # @return [ Symbol ] The detected remote server (:Apache, :IIS, :Nginx) def server(path = nil, params = {}) headers = headers(path, params) return unless headers case headers[:server] when /\Aapache/i :Apache when /\AMicrosoft-IIS/i :IIS when /\Anginx/ :Nginx end end # @param [ String ] path # @param [ Hash ] params The request params # # @return [ Hash ] The headers def headers(path = nil, params = {}) # The HEAD method might be rejected by some servers ... maybe switch to GET ? NS::Browser.head(url(path), params).headers end # @param [ String ] path # @param [ Hash ] params The request params # # @return [ Boolean ] true if url(path) has the directory # listing enabled, false otherwise def directory_listing?(path = nil, params = {}) res = NS::Browser.get(url(path), params) res.code == 200 && res.body.include?('

Index of') end # @param [ String ] path # @param [ Hash ] params The request params # @param [ String ] selector # @param [ Regexp ] ignore # # @return [ Array ] The first level of directories/files listed, # or an empty array if none def directory_listing_entries(path = nil, params = {}, selector = 'pre a', ignore = /parent directory/i) return [] unless directory_listing?(path, params) found = [] NS::Browser.get(url(path), params).html.css(selector).each do |node| entry = node.text.to_s next if entry&.match?(ignore) found << entry end found end end end end end CMSScanner-0.14.3/lib/cms_scanner/target/server/iis.rb000066400000000000000000000014521466634144200225150ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner class Target < WebSite module Server # Some IIS specific implementation module IIS # @param [ String ] path # @param [ Hash ] params The request params # # @return [ Symbol ] :IIS def server(_path = nil, _params = {}) :IIS end # @param [ String ] path # @param [ Hash ] params The request params # # @return [ Boolean ] true if url(path) has the directory # listing enabled, false otherwise def directory_listing?(path = nil, params = {}) res = NS::Browser.get(url(path), params) res.code == 200 && res.body =~ %r{

#{uri.host} - /} ? true : false end end end end end CMSScanner-0.14.3/lib/cms_scanner/target/server/nginx.rb000066400000000000000000000013601466634144200230520ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner class Target < WebSite module Server # Some Nginx specific implementation module Nginx # @param [ String ] path # @param [ Hash ] params The request params # # @return [ Symbol ] :Nginx def server(_path = nil, _params = {}) :Nginx end # @param [ String ] path # @param [ Hash ] params The request params # # @return [ Array ] The first level of directories/files listed, # or an empty array if none def directory_listing_entries(path = nil, params = {}) super(path, params, 'pre a', /\A\.\./i) end end end end end CMSScanner-0.14.3/lib/cms_scanner/typhoeus/000077500000000000000000000000001466634144200204665ustar00rootroot00000000000000CMSScanner-0.14.3/lib/cms_scanner/typhoeus/hydra.rb000066400000000000000000000003151466634144200221210ustar00rootroot00000000000000# frozen_string_literal: true module Typhoeus # Ensure a clean abort of hydra # See https://github.com/typhoeus/typhoeus/issues/439 class Hydra def abort super run end end end CMSScanner-0.14.3/lib/cms_scanner/typhoeus/response.rb000066400000000000000000000013501466634144200226500ustar00rootroot00000000000000# frozen_string_literal: true module Typhoeus # Custom Response class class Response # @return [ Nokogiri::XML ] The response's body parsed by Nokogiri::HTML def html @html ||= Nokogiri::HTML(body.encode('UTF-8', invalid: :replace, undef: :replace)) end # @return [ Nokogiri::XML ] The response's body parsed by Nokogiri::XML def xml @xml ||= Nokogiri::XML(body.encode('UTF-8', invalid: :replace, undef: :replace)) end # Override of the original to ensure an integer is returned # @return [ Integer ] def request_size super || 0 end # @return [ Integer ] def size (body.nil? ? 0 : body.size) + (response_headers.nil? ? 0 : response_headers.size) end end end CMSScanner-0.14.3/lib/cms_scanner/version.rb000066400000000000000000000001241466634144200206150ustar00rootroot00000000000000# frozen_string_literal: true # Version module CMSScanner VERSION = '0.14.3' end CMSScanner-0.14.3/lib/cms_scanner/vulnerability.rb000066400000000000000000000030051466634144200220220ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner # Generic Vulnerability class Vulnerability include References attr_reader :title, :type, :fixed_in, :introduced_in, :cvss # @param [ String ] title # @param [ Hash ] references # @option references [ Array, String ] :cve # @option references [ Array, String ] :secunia # @option references [ Array, String ] :osvdb # @option references [ Array, String ] :exploitdb # @option references [ Array ] :url URL(s) to related advisories etc # @option references [ Array, String ] :metasploit The related metasploit module(s) # @option references [ Array ] :youtube # @param [ String ] type # @param [ String ] fixed_in # @param [ String ] introduced_in # @param [ HashSymbol ] cvss # @option cvss [ String ] :score # @option cvss [ String ] :vector def initialize(title, references: {}, type: nil, fixed_in: nil, introduced_in: nil, cvss: nil) @title = title @type = type @fixed_in = fixed_in @introduced_in = introduced_in @cvss = { score: cvss[:score], vector: cvss[:vector] } if cvss self.references = references end # param [ Vulnerability ] other # # @return [ Boolean ] def ==(other) title == other.title && type == other.type && references == other.references && fixed_in == other.fixed_in && cvss == other.cvss end end end CMSScanner-0.14.3/lib/cms_scanner/web_site.rb000066400000000000000000000077071466634144200207470ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner # WebSite Implementation class WebSite attr_reader :uri, :opts # @param [ String ] site_url # @param [ Hash ] opts def initialize(site_url, opts = {}) self.url = site_url @opts = opts end def url=(site_url) new_url = site_url.dup # Add a trailing slash to the URL new_url << '/' if new_url[-1, 1] != '/' # Use the validator to ensure the URL has a correct format OptParseValidator::OptURL.new([]).validate(new_url) @uri = Addressable::URI.parse(new_url).normalize end # @param [ String ] path Optional path to merge with the uri # # @return [ String ] def url(path = nil) return @uri.to_s unless path @uri.join(Addressable::URI.encode(path).gsub('#', '%23')).to_s end # @return [ String ] The IP address of the target def ip @ip ||= IPSocket.getaddress(uri.host) rescue SocketError 'Unknown' end attr_writer :homepage_res # @return [ Typhoeus::Response ] # # As webmock does not support redirects mocking, coverage is ignored # :nocov: def homepage_res @homepage_res ||= NS::Browser.get_and_follow_location(url) end # :nocov: # @return [ String ] def homepage_url @homepage_url ||= homepage_res.effective_url end # @return [ Typhoeus::Response ] def error_404_res @error_404_res ||= NS::Browser.get_and_follow_location(error_404_url) end # @return [ String ] The URL of an unlikely existant page def error_404_url @error_404_url ||= uri.join("#{Digest::MD5.hexdigest(rand(999_999).to_s)[0..6]}.html").to_s end # Checks if the remote website is up. # # @param [ String ] path # # @return [ Boolean ] def online?(path = nil) NS::Browser.get(url(path)).code.nonzero? ? true : false end # @param [ String ] path # # @return [ Boolean ] def http_auth?(path = nil) NS::Browser.get(url(path)).code == 401 end # @param [ String ] path # # @return [ Boolean ] def access_forbidden?(path = nil) NS::Browser.get(url(path)).code == 403 end # @param [ String ] path # # @return [ Boolean ] def proxy_auth?(path = nil) NS::Browser.get(url(path)).code == 407 end # @param [ String ] url # # @return [ String ] The redirection url or nil # # As webmock does not support redirects mocking, coverage is ignored # :nocov: def redirection(url = nil) url ||= @uri.to_s return unless [301, 302].include?(NS::Browser.get(url).code) res = NS::Browser.get(url, followlocation: true, maxredirs: 10) res.effective_url == url ? nil : res.effective_url end # :nocov: # @return [ Hash ] The Typhoeus params to use to perform head requests def head_or_get_params @head_or_get_params ||= if [0, 405, 501].include?(NS::Browser.head(homepage_url).code) { method: :get, maxfilesize: 1 } else { method: :head } end end # Perform a HEAD request to the path provided, then if its response code # is in the array of codes given, a GET is done and the response returned. Otherwise the # HEAD response is returned. # # @param [ String ] path # @param [ Array ] codes # @param [ Hash ] params The requests params # @option params [ Hash ] :head Request params for the HEAD # @option params [ hash ] :get Request params for the GET # # @return [ Typhoeus::Response ] def head_and_get(path, codes = [200], params = {}) url_to_get = url(path) head_params = (params[:head] || {}).merge(head_or_get_params) head_res = NS::Browser.forge_request(url_to_get, head_params).run codes.include?(head_res.code) ? NS::Browser.get(url_to_get, params[:get] || {}) : head_res end end end CMSScanner-0.14.3/spec/000077500000000000000000000000001466634144200144775ustar00rootroot00000000000000CMSScanner-0.14.3/spec/app/000077500000000000000000000000001466634144200152575ustar00rootroot00000000000000CMSScanner-0.14.3/spec/app/controllers/000077500000000000000000000000001466634144200176255ustar00rootroot00000000000000CMSScanner-0.14.3/spec/app/controllers/core_spec.rb000066400000000000000000000275001466634144200221200ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Controller::Core do subject(:core) { described_class.new } let(:target_url) { 'http://example.com/' } let(:cli_args) { "--url #{target_url}" } before do CMSScanner::ParsedCli.options = rspec_parsed_options(cli_args) end describe '#cli_options' do its(:cli_options) { should_not be_empty } its(:cli_options) { should be_a Array } it 'contains the expected options' do expect(core.cli_options.map(&:to_sym)).to match_array( %i[ banner cache_dir cache_ttl clear_cache connect_timeout cookie_jar cookie_string detection_mode disable_tls_checks force format headers help hh http_auth ignore_main_redirect max_scan_duration max_threads output proxy proxy_auth random_user_agent request_timeout scope throttle url user_agent user_agents_list verbose version vhost ] ) end end describe '#setup_cache' do context 'when no cache_dir supplied (or default)' do it 'returns nil' do expect(core.setup_cache).to eq nil end end context 'when cache_dir' do let(:cli_args) { "#{super()} --cache-dir #{CACHE}" } let(:cache) { Typhoeus::Config.cache } let(:storage) { File.join(CMSScanner::ParsedCli.cache_dir, Digest::MD5.hexdigest(target_url)) } before { core.setup_cache } after { Typhoeus::Config.cache = nil } it 'sets up the cache' do expect(cache).to be_a CMSScanner::Cache::Typhoeus expect(cache.storage_path).to eq storage end end end describe 'maybe_output_banner_help_and_version' do before { described_class.option_parser = OptParseValidator::OptParser.new(nil, 40) } let(:fixtures) { FIXTURES_CONTROLLERS.join('core', 'help') } context 'when --no-banner' do let(:cli_args) { "#{super()} --no-banner" } it 'calls output' do expect(core.formatter).to_not receive(:output) expect { core.maybe_output_banner_help_and_version }.to_not raise_error end end context 'when --help' do let(:cli_args) { '--help' } it 'calls the output' do expect(core.formatter).to receive(:output).with('banner', { verbose: nil }, 'core') expect(core.formatter) .to receive(:output) .with('help', hash_including(:help, simple: true), 'core') .and_call_original expect($stdout).to receive(:puts).with(File.read(fixtures.join('simple.txt'))) expect { core.maybe_output_banner_help_and_version }.to raise_error(SystemExit) end end context 'when --hh' do let(:cli_args) { '--hh' } it 'calls the output' do expect(core.formatter).to receive(:output).with('banner', { verbose: nil }, 'core') expect(core.formatter) .to receive(:output) .with('help', hash_including(:help, simple: false), 'core') .and_call_original expect($stdout).to receive(:puts).with(File.read(fixtures.join('full.txt'))) expect { core.maybe_output_banner_help_and_version }.to raise_error(SystemExit) end end context 'when --version' do let(:cli_args) { "#{super()} --version" } it 'calls the output' do expect(core.formatter).to receive(:output).with('banner', { verbose: nil }, 'core') expect(core.formatter).to receive(:output).with('version', { verbose: nil }, 'core') expect { core.maybe_output_banner_help_and_version }.to raise_error(SystemExit) end end end describe '#before_scan' do context 'when --no-banner' do let(:cli_args) { "#{super()} --no-banner" } before { expect(core.formatter).to_not receive(:output) } it 'does not raise an error when everything is fine' do stub_request(:get, target_url).to_return(status: 200) expect { core.before_scan }.to_not raise_error end end context 'when --banner (default)' do before { expect(core.formatter).to receive(:output) } it 'does not raise an error when everything is fine' do stub_request(:get, target_url).to_return(status: 200) expect { core.before_scan }.to_not raise_error end it 'raise an error when the site is down' do stub_request(:get, target_url).to_return(status: 0) expect { core.before_scan } .to raise_error( CMSScanner::Error::TargetDown, "The url supplied '#{target_url}' seems to be down ()" ) end context 'when it redirects' do before do stub_request(:get, target_url).to_return(status: 301, headers: { location: redirection }) expect(core.target).to receive(:homepage_res).and_return(Typhoeus::Response.new(effective_url: redirection)) end context 'when out of scope' do let(:redirection) { 'http://somewhere.com/' } context 'when the --ignore-main-redirect is not supplied' do it 'raises an error' do expect { core.before_scan }.to raise_error( CMSScanner::Error::HTTPRedirect, "The URL supplied redirects to #{redirection}." \ ' Use the --ignore-main-redirect option to ignore the redirection and scan the target,' \ ' or change the --url option value to the redirected URL.' ) end end context 'when the --ignore-main-redirect is supplied' do let(:cli_args) { "#{super()} --ignore-main-redirect" } it 'does not raise any error' do expect { core.before_scan }.to_not raise_error expect(core.target.url).to eql target_url expect(core.target).to receive(:homepage_res).and_call_original expect(core.target.homepage_url).to eql target_url end end end context 'when in scope' do let(:redirection) { "#{target_url}home" } it 'does not raise any error' do expect { core.before_scan }.to_not raise_error expect(core.target.url).to eql target_url # expect(core.target).to receive(:homepage_res).and_call_original # expect(core.target.homepage_url).to eql redirection # Doesn't work, no idea why :x end context 'when http to https' do let(:redirection) { target_url.gsub(/^http/, 'https') } it 'sets the target url to the redirection' do expect { core.before_scan }.to_not raise_error expect(core.target.url).to eql redirection # Needs that as the Target.url is set to the redirection # otherwise the next spec which will run have the target url of redirection rather than target_url CMSScanner::Controller::Base.reset end context 'when --ignore-main-redirect' do let(:cli_args) { "#{super()} --ignore-main-redirect" } it 'does not set the target url to the redirection' do stub_request(:get, redirection).to_return(status: 200) # because reason expect { core.before_scan }.to_not raise_error expect(core.target.url).to eql target_url expect(core.target).to receive(:homepage_res).and_call_original expect(core.target.homepage_url).to eql target_url end end end end end context 'when access is forbidden' do before { stub_request(:get, target_url).to_return(status: 403) } context 'when no --random-user-agent provided' do it 'raises an error with the correct message' do expect { core.before_scan }.to raise_error( CMSScanner::Error::AccessForbidden, 'The target is responding with a 403, this might be due to a WAF. Please re-try with --random-user-agent' ) end end context 'when --random-user-agent provided' do let(:cli_args) { "#{super()} --random-user-agent" } it 'raises an error with the correct message' do expect { core.before_scan }.to raise_error( CMSScanner::Error::AccessForbidden, 'The target is responding with a 403, this might be due to a WAF. ' \ 'Well... --random-user-agent didn\'t work, use --force to skip this check if needed.' ) end end context 'when --force provided' do let(:cli_args) { "#{super()} --force" } it 'does not raise an error' do expect { core.before_scan }.to_not raise_error expect(core.target.homepage_url).to eql target_url end end end # This is quite a mess (as Webmock doesn't issue itself another 401 # when credential are incorrect :/) context 'when http authentication' do context 'when no credentials' do before { stub_request(:get, target_url).to_return(status: 401) } it 'raises an error' do expect { core.before_scan }.to raise_error(CMSScanner::Error::HTTPAuthRequired) end end context 'when credentials' do context 'when valid' do before { stub_request(:get, 'http://example.com').with(basic_auth: %w[user pass]) } let(:cli_args) { "#{super()} --http-auth user:pass" } it 'does not raise any error' do expect { core.before_scan }.to_not raise_error end end context 'when invalid' do before do stub_request(:get, 'http://example.com') .with(basic_auth: %w[user p@ss]).to_return(status: 401) end let(:cli_args) { "#{super()} --http-auth user:p@ss" } it 'raises an error' do expect { core.before_scan }.to raise_error(CMSScanner::Error::HTTPAuthRequired) end end end end context 'when proxy authentication' do before { stub_request(:get, target_url).to_return(status: 407) } context 'when no credentials' do it 'raises an error' do expect { core.before_scan }.to raise_error(CMSScanner::Error::ProxyAuthRequired) end end context 'when invalid credentials' do let(:cli_args) { "#{super()} --proxy-auth user:p@ss" } it 'raises an error' do expect(CMSScanner::Browser.instance.proxy_auth).to eq(CMSScanner::ParsedCli.proxy_auth) expect { core.before_scan }.to raise_error(CMSScanner::Error::ProxyAuthRequired) end end context 'when valid credentials' do before { stub_request(:get, target_url) } let(:cli_args) { "#{super()} --proxy-auth user:pass" } it 'raises an error' do expect(CMSScanner::Browser.instance.proxy_auth).to eq(CMSScanner::ParsedCli.proxy_auth) expect { core.before_scan }.to_not raise_error end end end end end describe '#run' do it 'calls the formatter with the correct parameters' do expect(core.formatter).to receive(:output) .with('started', hash_including(:start_memory, :start_time, :verbose, url: target_url), 'core') core.run end end describe '#after_scan' do let(:keys) do %i[verbose start_time stop_time start_memory elapsed used_memory requests_done data_sent data_received] end it 'calls the formatter with the correct parameters' do # Call the #run once to ensure that @start_time & @start_memory are set expect(core).to receive(:output).with('started', hash_including(url: target_url)) core.run RSpec::Mocks.space.proxy_for(core).reset # Must reset due to the above statements expect(core.formatter).to receive(:output) .with('finished', hash_including(*keys), 'core') core.after_scan end end end CMSScanner-0.14.3/spec/app/controllers/interesting_findings_spec.rb000066400000000000000000000037771466634144200254160ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Controller::InterestingFindings do subject(:controller) { described_class.new } let(:target_url) { 'http://example.com/' } let(:cli_args) { "--url #{target_url}" } before do CMSScanner::ParsedCli.options = rspec_parsed_options(cli_args) end its(:before_scan) { should be_nil } its(:after_scan) { should be_nil } describe '#cli_options' do its(:cli_options) { should_not be_empty } its(:cli_options) { should be_a Array } it 'contains to correct options' do expect(controller.cli_options.map(&:to_sym)).to eq [:interesting_findings_detection] end end describe '#run' do before do expect(controller.target).to receive(:interesting_findings) .with( mode: CMSScanner::ParsedCli.interesting_findings_detection || CMSScanner::ParsedCli.detection_mode ).and_return(stubbed) end after { controller.run } %i[mixed passive aggressive].each do |mode| context "when --detection-mode #{mode}" do let(:cli_args) { "#{super()} --detection-mode #{mode}" } context 'when no findings' do let(:stubbed) { [] } before { expect(controller.formatter).to_not receive(:output) } it 'does not call the formatter' do # Handled by the before statements above end context 'when --interesting-files-detection mode supplied' do let(:cli_args) { "#{super()} --interesting-findings-detection passive" } it 'gives the correct detection paramter' do # Handled by before/after statements end end end context 'when findings' do let(:stubbed) { ['yolo'] } it 'calls the formatter with the correct parameter' do expect(controller.formatter).to receive(:output) .with('findings', hash_including(findings: stubbed), 'interesting_findings') end end end end end end CMSScanner-0.14.3/spec/app/finders/000077500000000000000000000000001466634144200167115ustar00rootroot00000000000000CMSScanner-0.14.3/spec/app/finders/interesting_findings/000077500000000000000000000000001466634144200231255ustar00rootroot00000000000000CMSScanner-0.14.3/spec/app/finders/interesting_findings/fantastico_fileslist_spec.rb000066400000000000000000000040731466634144200307010ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Finders::InterestingFindings::FantasticoFileslist do subject(:finder) { described_class.new(target) } let(:target) { CMSScanner::Target.new(url) } let(:url) { 'http://example.com/' } let(:file_url) { "#{url}fantastico_fileslist.txt" } let(:fixtures) { FIXTURES_FINDERS.join('interesting_findings', 'fantastico_fileslist') } before { expect(finder.target).to receive(:head_or_get_params).and_return(method: :head) } describe '#aggressive' do before do stub_request(:head, file_url).to_return(status: head_status) end context 'when 404' do let(:head_status) { 404 } its(:aggressive) { should eql nil } end context 'when 200' do let(:head_status) { 200 } context 'when body is empty' do it 'returns nil' do stub_request(:get, file_url).to_return(status: 200, body: '') expect(finder.aggressive).to eql nil end end context 'when no Content-Type header' do it 'return nil' do stub_request(:get, file_url) .to_return(status: 200, body: 'not empty', headers: {}) expect(finder.aggressive).to eql nil end end context 'when not a text/plain Content-Type' do it 'return nil' do stub_request(:get, file_url) .to_return(status: 200, body: 'not empty', headers: { 'Content-Type' => 'text/html' }) expect(finder.aggressive).to eql nil end end context 'when the body matches and Content-Type = text/plain' do it 'returns the InterestingFinding object' do stub_request(:get, file_url) .to_return(body: File.read(fixtures.join('fantastico_fileslist.txt')), headers: { 'Content-Type' => 'text/plain' }) expect(finder.aggressive).to eql CMSScanner::Model::FantasticoFileslist.new( file_url, confidence: 70, found_by: 'Fantastico Fileslist (Aggressive Detection)' ) end end end end end CMSScanner-0.14.3/spec/app/finders/interesting_findings/headers_spec.rb000066400000000000000000000020251466634144200260760ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Finders::InterestingFindings::Headers do subject(:finder) { described_class.new(target) } let(:target) { CMSScanner::Target.new(url) } let(:url) { 'http://example.com/' } let(:fixtures) { FIXTURES_FINDERS.join('interesting_findings', 'headers') } let(:fixture) { fixtures.join('interesting.txt') } let(:headers) { parse_headers_file(fixture) } describe '#passive' do before { stub_request(:get, url).to_return(headers: headers) } after do if @expected result = finder.passive expect(result).to be_a CMSScanner::Model::Headers expect(result).to eql @expected end end context 'when no headers' do let(:headers) { {} } its(:passive) { should be nil } end context 'when headers' do it 'returns the result' do opts = { confidence: 100, found_by: 'Headers (Passive Detection)' } @expected = CMSScanner::Model::Headers.new(url, opts) end end end end CMSScanner-0.14.3/spec/app/finders/interesting_findings/robots_txt_spec.rb000066400000000000000000000026041466634144200266750ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Finders::InterestingFindings::RobotsTxt do subject(:finder) { described_class.new(target) } let(:target) { CMSScanner::Target.new(url) } let(:url) { 'http://example.com/' } let(:robots_url) { "#{url}robots.txt" } let(:fixtures) { FIXTURES_FINDERS.join('interesting_findings', 'robots_txt') } before { expect(finder.target).to receive(:head_or_get_params).and_return(method: :head) } describe '#aggressive' do before { stub_request(:head, robots_url).to_return(status: head_status) } context 'when 404' do let(:head_status) { 404 } its(:aggressive) { should eql nil } end context 'when 200' do let(:head_status) { 200 } context 'when the body is empty' do it 'returns nil' do stub_request(:get, robots_url).to_return(status: 200, body: '') expect(finder.aggressive).to eql nil end end context 'when the body matches a robots.txt' do it 'returns the InterestingFinding result' do stub_request(:get, robots_url).to_return(status: 200, body: File.read(fixtures.join('robots.txt'))) expect(finder.aggressive).to eql CMSScanner::Model::RobotsTxt.new( robots_url, confidence: 100, found_by: 'Robots Txt (Aggressive Detection)' ) end end end end end CMSScanner-0.14.3/spec/app/finders/interesting_findings/search_replace_db_2_spec.rb000066400000000000000000000026141466634144200303150ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Finders::InterestingFindings::SearchReplaceDB2 do subject(:finder) { described_class.new(target) } let(:target) { CMSScanner::Target.new(url) } let(:url) { 'http://example.com/' } let(:file_url) { "#{url}searchreplacedb2.php" } let(:fixtures) { FIXTURES_FINDERS.join('interesting_findings', 'search_replace_db_2') } before { expect(finder.target).to receive(:head_or_get_params).and_return(method: :head) } describe '#aggressive' do before do stub_request(:head, file_url).to_return(status: head_status) end context 'when 404' do let(:head_status) { 404 } its(:aggressive) { should eql nil } end context 'when 200' do let(:head_status) { 200 } before { stub_request(:get, file_url).to_return(status: 200, body: body) } context 'when the body does not match' do let(:body) { 'not this one' } its(:aggressive) { should eql nil } end context 'when the body matches' do let(:body) { File.read(fixtures.join('searchreplacedb2.php')) } it 'returns the InterestingFinding object' do expect(finder.aggressive).to eql CMSScanner::Model::SearchReplaceDB2.new( file_url, confidence: 100, found_by: 'Search Replace Db2 (Aggressive Detection)' ) end end end end end CMSScanner-0.14.3/spec/app/finders/interesting_findings/xml_rpc_spec.rb000066400000000000000000000073201466634144200261320ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Finders::InterestingFindings::XMLRPC do subject(:finder) { described_class.new(target) } let(:target) { CMSScanner::Target.new(url) } let(:url) { 'http://e.org/' } let(:xml_rpc_url) { "#{url}xmlrpc.php" } let(:fixtures) { FIXTURES_FINDERS.join('interesting_findings', 'xml_rpc') } describe '#potential_urls' do its(:potential_urls) { should be_empty } end describe '#passive' do before do expect(finder).to receive(:passive_headers).and_return(headers_stub) expect(finder).to receive(:passive_body).and_return(body_stub) end context 'when both passives return nil' do let(:headers_stub) { nil } let(:body_stub) { nil } its(:passive) { should be_empty } end context 'when one passive is not nil' do let(:headers_stub) { nil } let(:body_stub) { 'test' } its(:passive) { should eq %w[test] } end end describe '#passive_headers' do before { stub_request(:get, url).to_return(headers: headers) } let(:headers) { {} } context 'when no headers' do its(:passive_headers) { should be_nil } end context 'when headers' do context 'when URL is out of scope' do let(:headers) { { 'X-Pingback' => 'http://ex.org/yolo' } } its(:passive_headers) { should be_nil } end context 'when URL is in scope' do let(:headers) { { 'X-Pingback' => xml_rpc_url } } it 'adds the url to #potential_urls and returns the XMLRPC' do result = finder.passive_headers expect(finder.potential_urls).to eq [xml_rpc_url] expect(result).to be_a CMSScanner::Model::XMLRPC expect(result).to eql CMSScanner::Model::XMLRPC.new( xml_rpc_url, confidence: 30, found_by: 'Headers (Passive Detection)' ) end end end end describe '#passive_body' do before { stub_request(:get, url).to_return(body: body) } context 'when no link rel="pingback" tag' do let(:body) { '' } its(:passive_body) { should be_nil } end context 'when the tag is present' do context 'when the URL is out of scope' do let(:body) { File.read(fixtures.join('homepage_out_of_scope_pingback.html')) } its(:passive_body) { should be_nil } end context 'when URL is in scope' do let(:body) { File.read(fixtures.join('homepage_in_scope_pingback.html')) } let(:expected_url) { 'http://e.org/wp/xmlrpc.php' } it 'adds the URL to the #potential_urls and returns the XMLRPC' do result = finder.passive_body expect(finder.potential_urls).to eq [expected_url] expect(result).to be_a CMSScanner::Model::XMLRPC expect(result).to eql CMSScanner::Model::XMLRPC.new( expected_url, confidence: 30, found_by: 'Link Tag (Passive Detection)' ) end end end end describe '#aggressive' do # Adds an out of scope URL which should be ignored before { finder.potential_urls << 'htpp://ex.org' } after do stub_request(:post, xml_rpc_url).to_return(body: body) expect(finder.aggressive).to eql @expected end context 'when the body does not match' do let(:body) { '' } it 'returns nil' do @expected = nil end end context 'when the body matches' do let(:body) { File.read(fixtures.join('xmlrpc.php')) } it 'returns the InterestingFinding result' do @expected = CMSScanner::Model::XMLRPC.new( xml_rpc_url, confidence: 100, found_by: described_class::DIRECT_ACCESS ) end end end end CMSScanner-0.14.3/spec/app/finders/interesting_findings_spec.rb000066400000000000000000000007371466634144200244730ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Finders::InterestingFindings::Base do it_behaves_like CMSScanner::Finders::IndependentFinder do let(:expected_finders) { %w[Headers RobotsTxt FantasticoFileslist SearchReplaceDB2 XMLRPC] } let(:expected_finders_class) { CMSScanner::Finders::IndependentFinders } end subject(:files) { described_class.new(target) } let(:target) { CMSScanner::Target.new(url) } let(:url) { 'http://example.com/' } end CMSScanner-0.14.3/spec/app/formatters/000077500000000000000000000000001466634144200174455ustar00rootroot00000000000000CMSScanner-0.14.3/spec/app/formatters/cli_no_colour_spec.rb000066400000000000000000000005421466634144200236330ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Formatter::CliNoColour do subject(:formatter) { described_class.new } its(:format) { should eq 'cli' } its(:user_interaction?) { should be true } describe '#colorize' do it 'returns the text w/o any colour' do expect(formatter.red('Text')).to eq 'Text' end end end CMSScanner-0.14.3/spec/app/formatters/cli_spec.rb000066400000000000000000000022661466634144200215610ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Formatter::Cli do subject(:formatter) { described_class.new } its(:format) { should eq 'cli' } its(:user_interaction?) { should be true } describe '#bold, #red, #green, #amber, #blue, #colorize' do it 'returns the correct bold string' do expect(formatter.bold('Text')).to eq "\e[1mText\e[0m" end it 'returns the correct red string' do expect(formatter.red('Text')).to eq "\e[31mText\e[0m" end it 'returns the correct green string' do expect(formatter.green('Another Text')).to eq "\e[32mAnother Text\e[0m" end it 'returns the correct amber string' do expect(formatter.amber('Text')).to eq "\e[33mText\e[0m" end it 'returns the correct blue string' do expect(formatter.blue('Text')).to eq "\e[34mText\e[0m" end end describe '#*_icon' do { info: "\e[32m[+]\e[0m", notice: "\e[34m[i]\e[0m", warning: "\e[33m[!]\e[0m", critical: "\e[31m[!]\e[0m" }.each do |icon_type, expected| it "returns the correct #{icon_type} icon" do expect(formatter.send("#{icon_type}_icon")).to eql expected end end end end CMSScanner-0.14.3/spec/app/formatters/json_spec.rb000066400000000000000000000022371466634144200217610ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Formatter::Json do it_behaves_like CMSScanner::Formatter::Buffer subject(:formatter) { described_class.new } let(:output_file) { FIXTURES.join('output.txt') } before { formatter.views_directories << FIXTURES_VIEWS } its(:format) { should eq 'json' } its(:user_interaction?) { should be false } describe '#output' do it 'puts the rendered text in the buffer' do 2.times { formatter.output('@render_me', test: 'Working') } expect(formatter.buffer).to eq "\"test\": \"Working\",\n" * 2 end end describe '#beautify' do it 'writes the buffer in the $stdout' do 2.times { formatter.output('@render_me', test: 'yolo') } expect($stdout).to receive(:puts).with(JSON.pretty_generate(JSON.parse('{"test": "yolo"}'))) formatter.beautify end context 'when invalid UTF-8 chars' do it 'tries to convert/replace them' do formatter.output('@render_me', test: 'it’s'.encode('CP1252')) expect($stdout).to receive(:puts).with(JSON.pretty_generate(JSON.parse('{"test": "it�s"}'))) formatter.beautify end end end end CMSScanner-0.14.3/spec/app/models/000077500000000000000000000000001466634144200165425ustar00rootroot00000000000000CMSScanner-0.14.3/spec/app/models/fantastico_fileslist_spec.rb000066400000000000000000000017031466634144200243130ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Model::FantasticoFileslist do subject(:file) { described_class.new(url) } let(:url) { 'http://example.com/robots.txt' } let(:fixtures) { FIXTURES_FINDERS.join('interesting_findings', 'fantastico_fileslist') } describe '#interesting_entries' do let(:headers) { { 'Content-Type' => 'text/plain; charset=utf-8' } } after do body = File.read(fixtures.join(fixture)) stub_request(:get, file.url).to_return(headers: headers, body: body) expect(file.interesting_entries).to eq @expected end context 'when empty or / entries' do let(:fixture) { 'fantastico_fileslist.txt' } it 'ignores them and only returns the others' do @expected = %w[data.sql admin.txt] end end end describe '#references' do its(:references) { should_not be_nil } end describe '#type' do its(:type) { should eql 'fantastico_fileslist' } end end CMSScanner-0.14.3/spec/app/models/headers_spec.rb000066400000000000000000000030541466634144200215160ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Model::Headers do subject(:file) { described_class.new(url) } let(:url) { 'http://example.com/' } let(:fixtures) { FIXTURES_FINDERS.join('interesting_findings', 'headers') } let(:fixture) { fixtures.join('interesting.txt') } let(:headers) { {} } before { stub_request(:get, file.url).to_return(headers: headers) } describe '#to_s' do its(:to_s) { should eql 'Headers' } end describe '#known_headers' do it 'does not contains dupliactes' do expect(file.known_headers).to eql file.known_headers.uniq end end describe '#entries' do after { expect(file.entries).to eq @expected if @expected } context 'when no headers' do its(:entries) { should eq({}) } end context 'when headers' do let(:headers) { parse_headers_file(fixture) } it 'returns the headers' do @expected = headers end end end describe '#interesting_entries' do after { expect(file.interesting_entries).to eq @expected if @expected } context 'when interesting headers' do let(:headers) { parse_headers_file(fixture) } it 'returns an array with the headers' do @expected = ['Server: nginx/1.1.19', 'X-Powered-By: ASP.NET, PHP', 'X-Article-Id: 12'] end end context 'when no interesting headers' do let(:headers) { parse_headers_file(fixtures.join('no_interesting.txt')) } its(:interesting_entries) { should eq [] } end end describe '#type' do its(:type) { should eql 'headers' } end end CMSScanner-0.14.3/spec/app/models/interesting_finding_spec.rb000066400000000000000000000056531466634144200241430ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Model::InterestingFinding do it_behaves_like CMSScanner::Finders::Finding subject(:finding) { described_class.new(url, opts) } let(:opts) { {} } let(:url) { 'http://example.com/' } let(:fixtures) { FIXTURES_FINDERS.join('interesting_findings') } describe '#to_s' do context 'when no opts[:to_s]' do its(:to_s) { should eql url } context 'when setter used' do it 'returns the value from the setter' do finding.to_s = 'also works' expect(finding.to_s).to eql 'also works' end end end context 'when opts[:to_s]' do let(:opts) { super().merge(to_s: 'works') } its(:to_s) { should eql 'works' } context 'when setter used' do it 'returns the value from the setter' do finding.to_s = 'also works' expect(finding.to_s).to eql 'also works' end end end end describe '#type' do its(:type) { should eql 'interesting_finding' } end describe '#entries' do after do stub_request(:get, finding.url).to_return(headers: headers, body: @body) expect(finding.entries).to eq @expected end context 'when content-type matches text/plain' do let(:headers) { { 'Content-Type' => 'text/plain; charset=utf-8' } } it 'returns the finding content as an array w/o empty strings' do @body = File.read(fixtures.join('file.txt')) @expected = ['This is', 'a test file', 'with some content'] end end context 'when other content-type' do let(:headers) { { 'Content-Type' => 'text.html; charset=utf-8' } } it 'returns an empty array' do @expected = [] end end end describe '#==' do context 'when same URL' do context 'when the same #to_s' do it 'returns true' do expect(finding == described_class.new(url)).to be true end end context 'when different #to_s' do it 'returns false' do expect(finding == described_class.new(url, to_s: 'another')).to be false end end end context 'when not the same URL' do it 'returns false' do expect(finding == described_class.new('http://e.org')).to be false end end end describe '#<=>' do context 'when same URL' do it 'returns 0' do expect(finding <=> described_class.new(url)).to eql 0 end end context 'when the other URL <= current one' do it 'returns 1' do expect(finding <=> described_class.new('http://e.org')).to eql 1 end end context 'when the other URL >= current one' do it 'returns -1' do expect(finding <=> described_class.new('http://exi.org/')).to eql(-1) end end context 'when using capitals' do it 'returns ' do expect(finding <=> described_class.new('Sftp://a.org')).to eql(-1) end end end end CMSScanner-0.14.3/spec/app/models/robots_txt_spec.rb000066400000000000000000000015301466634144200223070ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Model::RobotsTxt do subject(:file) { described_class.new(url) } let(:url) { 'http://example.com/robots.txt' } let(:fixtures) { FIXTURES_FINDERS.join('interesting_findings', 'robots_txt') } describe '#interesting_entries' do let(:headers) { { 'Content-Type' => 'text/plain; charset=utf-8' } } after do body = File.read(fixtures.join(fixture)) stub_request(:get, file.url).to_return(headers: headers, body: body) expect(file.interesting_entries).to eq @expected end context 'when empty or / entries' do let(:fixture) { 'robots.txt' } it 'ignores them and only returns the others w/o duplicate' do @expected = %w[/admin /public/home] end end end describe '#type' do its(:type) { should eql 'robots_txt' } end end CMSScanner-0.14.3/spec/app/models/search_replace_db_2_spec.rb000066400000000000000000000005361466634144200237330ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Model::SearchReplaceDB2 do subject(:file) { described_class.new(url) } let(:url) { 'http://example.com/searchreplacedb2.php' } describe '#references' do its(:references) { should_not be_nil } end describe '#type' do its(:type) { should eql 'search_replace_db2' } end end CMSScanner-0.14.3/spec/app/models/user_spec.rb000066400000000000000000000016561466634144200210670ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Model::User do subject(:user) { described_class.new(username, opts) } let(:username) { 'john' } let(:opts) { {} } describe '#new' do its(:username) { should eql username } context 'when opts' do let(:opts) { super().merge(id: 12, password: 'passwd') } its(:id) { should eql 12 } its(:password) { should eql 'passwd' } end end describe '#==' do context 'when another object' do it 'returns false' do expect(user == username).to be false end end context 'when the same username' do it 'return true' do expect(user == user.dup).to be true end end context 'when not the same username' do it 'returns false' do expect(user == described_class.new('test')).to be false end end end describe '#to_s' do its(:to_s) { should eql username } end end CMSScanner-0.14.3/spec/app/models/version_spec.rb000066400000000000000000000025651466634144200215760ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Model::Version do it_behaves_like CMSScanner::Finders::Finding subject(:version) { described_class.new(number, opts) } let(:opts) { {} } let(:number) { '1.0' } its(:to_s) { should eql '1.0' } describe '#number' do its(:number) { should eql '1.0' } context 'when float number supplied' do let(:number) { 2.0 } its(:number) { should eql '2.0' } its(:to_s) { should eql '2.0' } end context 'when starting with a dot' do let(:number) { '.2' } its(:number) { should eql '0.2' } end end describe '#<=>, #==, #>, #<' do it 'returns true' do expect(version == '1.0').to be true expect(version == 1.0).to be true expect(version == described_class.new('1.0')).to be true expect(version > '0.9').to be true expect(version < '2').to be true expect(described_class.new('0.1') == '.1').to be true expect(described_class.new('.1') == '0.1').to be true end it 'returns false' do expect(version == '2.0').to be false expect(version == described_class.new('2')).to be false expect(version > '2.0').to be false expect(version < '1.0').to be false expect(version < 'gg').to be false expect(version == '').to be false expect(version == true).to be false end end end CMSScanner-0.14.3/spec/app/models/xml_rpc_spec.rb000066400000000000000000000071131466634144200215470ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Model::XMLRPC do subject(:xml_rpc) { described_class.new(url) } let(:url) { 'http://example.com/xmlrpc' } let(:fixtures) { FIXTURES_MODELS.join('xml_rpc') } describe '#type' do its(:type) { should eql 'xmlrpc' } end describe '#to_s' do its(:to_s) { should eql 'XML-RPC seems to be enabled: http://example.com/xmlrpc' } end describe '#method_call' do after do request = xml_rpc.method_call(method, method_params, request_params) expect(request).to be_a Typhoeus::Request expect(request.options[:body]).to eql @expected_body expect(request.options).to include(request_params) unless request_params.empty? end let(:method) { 'rpc-test' } let(:method_params) { [] } let(:request_params) { {} } context 'when no params' do it 'sets the correct body in the request' do @expected_body = +'' @expected_body << "#{method}" @expected_body << "\n" end end context 'when method_params and request_params' do let(:method_params) { %w[p1 p2] } let(:request_params) { { spec_key: 'yolo' } } it 'set the correct body in the request' do @expected_body = +'' @expected_body << "#{method}" @expected_body << 'p1' @expected_body << 'p2' @expected_body << "\n" end end end describe '#multi_call' do after do request = xml_rpc.multi_call(methods_and_params, request_params) expect(request).to be_a Typhoeus::Request expect(request.options[:body]).to eql @expected_body expect(request.options).to include(request_params) unless request_params.empty? end let(:methods_and_params) { [%w[m1 p1 p2], %w[m2 p1], %w[m3]] } let(:request_params) { {} } it 'sets the correct body in the request' do @expected_body = File.read(fixtures.join('multi_call.xml')) end end describe '#available_methods' do after do expect(xml_rpc.available_methods).to eql @expected # When calling a second time, should not redo a request expect(xml_rpc).to_not receive(:method_call) expect(xml_rpc.available_methods).to eql @expected end context 'when an empty response' do it 'returns an empty array' do stub_request(:post, xml_rpc.url).and_return(body: '') @expected = [] end end context 'when a correct response' do it 'returns the expected array' do stub_request(:post, xml_rpc.url).and_return( body: ''\ 'system.listMethods'\ 'm1'\ '' ) @expected = %w[system.listMethods m1] end end end describe '#enabled?' do context 'when no methods available' do it 'returns false' do expect(xml_rpc).to receive(:available_methods).and_return([]) expect(xml_rpc.enabled?).to be false end end context 'when methods available' do it 'returns true' do expect(xml_rpc).to receive(:available_methods).and_return(%w[m1 m2]) expect(xml_rpc.enabled?).to be true end end end end CMSScanner-0.14.3/spec/app/views_spec.rb000066400000000000000000000024361466634144200177600ustar00rootroot00000000000000# frozen_string_literal: true describe 'App::Views' do let(:target_url) { 'http://e.org/' } let(:fixtures) { SPECS.join('output') } # CliNoColour is used to test the CLI output to avoid the painful colours # in the expected output. %i[JSON CliNoColour].each do |formatter| context "when #{formatter}" do it_behaves_like 'App::Views::Core' it_behaves_like 'App::Views::InterestingFindings' let(:parsed_options) { { url: target_url, format: formatter.to_s.underscore.dasherize } } before do CMSScanner::ParsedCli.options = parsed_options # Resets the formatter to ensure the correct one is loaded controller.class.class_variable_set(:@@formatter, nil) end after do view_filename = defined?(expected_view) ? expected_view : view view_filename = "#{view_filename}.#{formatter.to_s.underscore.downcase}" controller_dir = controller.class.to_s.demodulize.underscore.downcase expected_output = @expected_output || File.read(fixtures.join(controller_dir, view_filename)) expect($stdout).to receive(:puts).with(expected_output) controller.output(view, @tpl_vars) controller.formatter.beautify # Mandatory to be able to test formatter such as JSON end end end end CMSScanner-0.14.3/spec/cache/000077500000000000000000000000001466634144200155425ustar00rootroot00000000000000CMSScanner-0.14.3/spec/cache/.gitignore000066400000000000000000000001071466634144200175300ustar00rootroot00000000000000# Ignore everything in this directory * # Except this file !.gitignore CMSScanner-0.14.3/spec/dummy_finding.rb000066400000000000000000000006641466634144200176630ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner # Dummy Finding class DummyFinding include Finders::Finding attr_reader :r def initialize(finding, opts = {}) @r = finding parse_finding_options(opts) end def ==(other) r == other.r end def eql?(other) r == other.r && confidence == other.confidence && found_by == other.found_by end def to_s r end end end CMSScanner-0.14.3/spec/dummy_independent_finders.rb000066400000000000000000000012671466634144200222540ustar00rootroot00000000000000# frozen_string_literal: true require 'dummy_finding' module CMSScanner module Finders module Independent # Dummy Test Finder class DummyFinder < Finder def passive(_opts = {}) # the nil is there to ensure such value is ignored [DummyFinding.new('test', found_by: found_by), nil] end def aggressive(_opts = {}) DummyFinding.new('test', confidence: 100, found_by: 'override') end end # No aggressive result finder class NoAggressiveResult < Finder def passive(_opts = {}) DummyFinding.new('spotted', confidence: 10, found_by: found_by) end end end end end CMSScanner-0.14.3/spec/dummy_unique_finders.rb000066400000000000000000000014541466634144200212630ustar00rootroot00000000000000# frozen_string_literal: true require 'dummy_finding' module CMSScanner module Finders module Unique # Dummy Test Finder class Dummy < Finder def passive(_opts = {}) # the nil is there to ensure such value is ignored [DummyFinding.new('v1', found_by: found_by), nil] end def aggressive(_opts = {}) DummyFinding.new('v1', confidence: 100, found_by: 'override') end end # No aggressive result class NoAggressive < Finder def passive(_opts = {}) DummyFinding.new('v2', confidence: 10, found_by: found_by) end end # Dummy2 class Dummy2 < Finder def aggressive(_opts = {}) DummyFinding.new('v1', confidence: 90) end end end end end CMSScanner-0.14.3/spec/fixtures/000077500000000000000000000000001466634144200163505ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/controllers/000077500000000000000000000000001466634144200207165ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/controllers/core/000077500000000000000000000000001466634144200216465ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/controllers/core/help/000077500000000000000000000000001466634144200225765ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/controllers/core/help/full.txt000066400000000000000000000000301466634144200242720ustar00rootroot00000000000000Usage: rspec [options] CMSScanner-0.14.3/spec/fixtures/controllers/core/help/simple.txt000066400000000000000000000001021466634144200246210ustar00rootroot00000000000000Usage: rspec [options] [!] To see full list of options use --hh. CMSScanner-0.14.3/spec/fixtures/finders/000077500000000000000000000000001466634144200200025ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/finders/interesting_findings/000077500000000000000000000000001466634144200242165ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/finders/interesting_findings/fantastico_fileslist/000077500000000000000000000000001466634144200304275ustar00rootroot00000000000000fantastico_fileslist.txt000066400000000000000000000001671466634144200353260ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/finders/interesting_findings/fantastico_fileslistincludes misc modules .htaccess CHANGELOG.txt cron.php data.sql admin.txt robots.txt update.php UPGRADE.txt xmlrpc.php CMSScanner-0.14.3/spec/fixtures/finders/interesting_findings/file.txt000066400000000000000000000000471466634144200256770ustar00rootroot00000000000000This is a test file with some content CMSScanner-0.14.3/spec/fixtures/finders/interesting_findings/headers/000077500000000000000000000000001466634144200256315ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/finders/interesting_findings/headers/interesting.txt000066400000000000000000000006371466634144200307330ustar00rootroot00000000000000HTTP/1.1 200 OK Server: nginx/1.1.19 X-Powered-By: ASP.NET X-Powered-By: PHP Date: Thu Content-Type: text/plain; charset=utf-8 Connection: keep-alive X-Content-Type-Options: nosniff Cache-Control: s-maxage=3600, must-revalidate, max-age=0 X-Article-Id: 12 X-Language: en Last-Modified: Tue, 26 Nov 2013 17:39:43 GMT Vary: X-Subdomain,X-Use-HHVM X-Varnish: 11545 Age: 206 Set-Cookie: GeoIP=; Path=/; Domain=.test.lo CMSScanner-0.14.3/spec/fixtures/finders/interesting_findings/headers/no_interesting.txt000066400000000000000000000005211466634144200314170ustar00rootroot00000000000000HTTP/1.1 200 OK Date: Thu Content-Type: text/plain; charset=utf-8 Connection: keep-alive X-Content-Type-Options: nosniff Cache-Control: s-maxage=3600, must-revalidate, max-age=0 X-Language: en Last-Modified: Tue, 26 Nov 2013 17:39:43 GMT Vary: X-Subdomain,X-Use-HHVM X-Varnish: 15154 Age: 206 Set-Cookie: GeoIP=; Path=/; Domain=.test.lo CMSScanner-0.14.3/spec/fixtures/finders/interesting_findings/robots_txt/000077500000000000000000000000001466634144200264255ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/finders/interesting_findings/robots_txt/robots.txt000066400000000000000000000003121466634144200304720ustar00rootroot00000000000000# advertising-related bots: User-agent: Mediapartners-Google* Disallow: / # Wikipedia work bots: User-agent: IsraBot Disallow: Disallow: /admin Allow: /public/home # Because why not :o Allow: /admin CMSScanner-0.14.3/spec/fixtures/finders/interesting_findings/search_replace_db_2/000077500000000000000000000000001466634144200300445ustar00rootroot00000000000000searchreplacedb2.php000066400000000000000000000125271466634144200336760ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/finders/interesting_findings/search_replace_db_2 Search and replace DB.

Safe Search Replace

by interconnect/it

Database details

interconnect/it Safe Search and Replace on Database with Serialized Data v2.0.0

This developer/sysadmin tool helps solve the problem of doing a search and replace on a WordPress site when doing a migration to a domain name with a different length.

WARNING! Take a backup first, and carefully test the results of this code. If you don't, and you vape your data then you only have yourself to blame. Seriously. And if you're English is bad and you don't fully understand the instructions then STOP. Right there. Yes. Before you do any damage.

Don't Forget to Remove Me!

Delete this utility from your server after use. It represents a major security threat to your database if maliciously used.

Use Of This Script Is Entirely At Your Own Risk

We accept no liability from the use of this tool.

If you're not comfortable with this kind of stuff, get an expert, like us, to do this work for you. You do this ENTIRELY AT YOUR OWN RISK! We accept no responsibility if you mess up your data. There is NO UNDO here!

The easiest way to use it is to copy your site's files and DB to the new location. You then, if required, fix up your .htaccess and wp-config.php appropriately. Once done, run this script, select your tables (in most cases all of them) and then enter the search replace strings. You can press back in your browser to do this several times, as may be required in some cases.

Of course, you can use the script in many other ways - for example, finding all references to a company name and changing it when a rebrand comes along. Or perhaps you changed your name. Whatever you want to search and replace the code will help.

Got feedback on this script? Come tell us!

CMSScanner-0.14.3/spec/fixtures/finders/interesting_findings/xml_rpc/000077500000000000000000000000001466634144200256625ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/finders/interesting_findings/xml_rpc/homepage_in_scope_pingback.html000066400000000000000000000004121466634144200340470ustar00rootroot00000000000000 WordPress 4.0 | Just another WordPress site homepage_out_of_scope_pingback.html000066400000000000000000000004261466634144200346620ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/finders/interesting_findings/xml_rpc WordPress 4.0 | Just another WordPress site CMSScanner-0.14.3/spec/fixtures/finders/interesting_findings/xml_rpc/xmlrpc.php000066400000000000000000000006231466634144200277010ustar00rootroot00000000000000 faultCode -32700 faultString parse error. not well formed CMSScanner-0.14.3/spec/fixtures/models/000077500000000000000000000000001466634144200176335ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/models/xml_rpc/000077500000000000000000000000001466634144200212775ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/models/xml_rpc/multi_call.xml000066400000000000000000000014571466634144200241550ustar00rootroot00000000000000system.multicallmethodNamem1paramsp1p2methodNamem2paramsp1methodNamem3params CMSScanner-0.14.3/spec/fixtures/output.txt000066400000000000000000000000001466634144200204370ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/passwords.txt000066400000000000000000000000221466634144200211300ustar00rootroot00000000000000pwd admin P@ssw0rdCMSScanner-0.14.3/spec/fixtures/target/000077500000000000000000000000001466634144200176365ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/target/comments.html000066400000000000000000000023121466634144200223470ustar00rootroot00000000000000 WP 4.1.1 | Just another WordPress site CMSScanner-0.14.3/spec/fixtures/target/javascripts.html000066400000000000000000000005071466634144200230570ustar00rootroot00000000000000 CMSScanner-0.14.3/spec/fixtures/target/platform/000077500000000000000000000000001466634144200214625ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/target/platform/php/000077500000000000000000000000001466634144200222515ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/target/platform/php/debug_log/000077500000000000000000000000001466634144200242005ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/target/platform/php/debug_log/db_error.log000066400000000000000000000004131466634144200264770ustar00rootroot00000000000000[12-Apr-2012 10:20:30 UTC] WordPress database error Table 'xxxx.xxxx' doesn't exist for query DELETE FROM xxx WHERE id NOT IN( SELECT entry_id FROM xxxx ) made by do_action_ref_array, WP_Hook->do_action, WP_Hook->apply_filters, XXX::cron, XXX::delete_orphaned_entriesCMSScanner-0.14.3/spec/fixtures/target/platform/php/debug_log/debug.log000066400000000000000000000004061466634144200257710ustar00rootroot00000000000000[11-Oct-2012 00:00:00] PHP Notice: Undefined index: ec_email in /var/www/wp/wp-content/plugins/easy-contact/econtact.php on line 33 [11-Oct-2012 00:00:00] PHP Notice: Undefined index: ec_url in /var/www/wp/wp-content/plugins/easy-contact/econtact.php on line 34 CMSScanner-0.14.3/spec/fixtures/target/platform/php/error_log/000077500000000000000000000000001466634144200242435ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/target/platform/php/error_log/error.log000066400000000000000000000013441466634144200261010ustar00rootroot00000000000000[13-Jan-2009 01:53:25] PHP Fatal error: Class 'Log' not found in /home/****/public_html/lab/wp-content/plugins/fbconnect/Log/null.php on line 19 [13-Jan-2009 01:55:58] PHP Fatal error: Class 'Log' not found in /home/****/public_html/lab/wp-content/plugins/fbconnect/Log/file.php on line 20 [13-Jan-2009 02:13:34] PHP Fatal error: Class 'Log' not found in /home/****/public_html/lab/wp-content/plugins/fbconnect/Log/error_log.php on line 19 [15-Feb-2009 10:47:54] PHP Fatal error: Class 'Log' not found in /home/****/public_html/lab/wp-content/plugins/fbconnect/Log/error_log.php on line 19 [15-Feb-2009 11:36:15] PHP Fatal error: Class 'Log' not found in /home/****/public_html/lab/wp-content/plugins/fbconnect/Log/null.php on line 19 CMSScanner-0.14.3/spec/fixtures/target/platform/php/fpd/000077500000000000000000000000001466634144200230225ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/target/platform/php/fpd/wp_rss_functions.php000066400000000000000000000001371466634144200271410ustar00rootroot00000000000000 Fatal error: Call to undefined function _deprecated_file() in /short-path/rss-f.php on line 8 CMSScanner-0.14.3/spec/fixtures/target/scope/000077500000000000000000000000001466634144200207475ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/target/scope/index.html000066400000000000000000000015131466634144200227440ustar00rootroot00000000000000Link Link eMail me! Click me Fool ! Empty Link CMSScanner-0.14.3/spec/fixtures/target/server/000077500000000000000000000000001466634144200211445ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/target/server/apache/000077500000000000000000000000001466634144200223655ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/target/server/apache/directory_listing/000077500000000000000000000000001466634144200261225ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/target/server/apache/directory_listing/2.2.16.html000066400000000000000000000023221466634144200275350ustar00rootroot00000000000000 Index of /wordpress-4.0/wp-content/plugins/wp-dbmanager

Index of /wordpress-4.0/wp-content/plugins/wp-dbmanager

[ICO]NameLast modifiedSizeDescription
[DIR]Parent Directory  -  
[ ]backup.php07-Oct-2014 18:43 10K 
[ ]database-empty.php07-Oct-2014 18:43 3.9K 
Apache/2.2.16 (Debian) Server at wp.lab Port 80
CMSScanner-0.14.3/spec/fixtures/target/server/apache/directory_listing/empty.html000066400000000000000000000010441466634144200301450ustar00rootroot00000000000000 Index of /wordpress-4.0/wp-content/plugins/wp-dbmanager

Index of /wordpress-4.0/wp-content/plugins/wp-dbmanager

[ICO]NameLast modifiedSizeDescription
Apache/2.2.16 (Debian) Server at wp.lab Port 80
CMSScanner-0.14.3/spec/fixtures/target/server/generic/000077500000000000000000000000001466634144200225605ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/target/server/generic/server/000077500000000000000000000000001466634144200240665ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/target/server/generic/server/apache/000077500000000000000000000000001466634144200253075ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/target/server/generic/server/apache/basic.txt000066400000000000000000000002251466634144200271300ustar00rootroot00000000000000Date: Sun, 12 Oct 2014 19:44:42 GMT Server: Apache/2.2.16 (Debian) X-Powered-By: PHP/5.3.3-7+squeeze19 Vary: Accept-Encoding Content-Type: text/html CMSScanner-0.14.3/spec/fixtures/target/server/generic/server/iis/000077500000000000000000000000001466634144200246525ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/target/server/generic/server/iis/basic.txt000066400000000000000000000002571466634144200265000ustar00rootroot00000000000000Content-Length: 1027 Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET X-UA-Compatible: IE=EmulateIE7 Date: Sun, 12 Oct 2014 20:15:14 GMT CMSScanner-0.14.3/spec/fixtures/target/server/generic/server/nginx/000077500000000000000000000000001466634144200252115ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/target/server/generic/server/nginx/basic.txt000066400000000000000000000001611466634144200270310ustar00rootroot00000000000000HTTP/1.1 200 OK Server: nginx Date: Sun, 15 Mar 2015 19:43:52 GMT Content-Type: text/html Connection: keep-alive CMSScanner-0.14.3/spec/fixtures/target/server/generic/server/not_detected.txt000066400000000000000000000001221466634144200272630ustar00rootroot00000000000000Date: Sun, 12 Oct 2014 19:44:42 GMT Vary: Accept-Encoding Content-Type: text/html CMSScanner-0.14.3/spec/fixtures/target/server/iis/000077500000000000000000000000001466634144200217305ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/target/server/iis/directory_listing/000077500000000000000000000000001466634144200254655ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/target/server/iis/directory_listing/no_parent.html000066400000000000000000000003751466634144200303450ustar00rootroot00000000000000e.org - /dir/

e.org - /dir/

10/8/2014 11:00 PM        <dir> sub-dir10/10/2014 10:00 PM          168 web.config
CMSScanner-0.14.3/spec/fixtures/target/server/iis/directory_listing/with_parent.html000066400000000000000000000004531466634144200307010ustar00rootroot00000000000000e.org - /dir/

e.org - /dir/

[To Parent Directory]

 10/8/2014 11:00 PM        <dir> sub-dir10/10/2014 10:00 PM          168 web.config
CMSScanner-0.14.3/spec/fixtures/target/server/nginx/000077500000000000000000000000001466634144200222675ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/target/server/nginx/directory_listing/000077500000000000000000000000001466634144200260245ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/target/server/nginx/directory_listing/empty.html000066400000000000000000000001771466634144200300550ustar00rootroot00000000000000 Index of /fanart/

Index of /fanart/

CMSScanner-0.14.3/spec/fixtures/target/server/nginx/directory_listing/fanart.html000066400000000000000000000007441466634144200301720ustar00rootroot00000000000000 Index of /fanart/

Index of /fanart/

../
1931/                                              16-Jun-2013 05:46                   -
720/                                               16-Jun-2013 05:46                   -
down                                               16-Jun-2013 05:46                  53
CMSScanner-0.14.3/spec/fixtures/target/uris_from_page.html000066400000000000000000000015161466634144200235300ustar00rootroot00000000000000Link Duplicates should be ignored Link eMail me! Click me Fool ! Head and tail spaces should be removed Empty Link should be ignored no host, should be ignored Don't parse that either XXX <%= render('local') %> <%= render('@global') %>CMSScanner-0.14.3/spec/fixtures/views/base/global.erb000066400000000000000000000000131466634144200223430ustar00rootroot00000000000000Global ViewCMSScanner-0.14.3/spec/fixtures/views/base/test.erb000066400000000000000000000000651466634144200220710ustar00rootroot00000000000000It <%= @test %> Views Dirs: <%= @views_directories %>CMSScanner-0.14.3/spec/fixtures/views/based_format/000077500000000000000000000000001466634144200221335ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/views/based_format/test.erb000066400000000000000000000000321466634144200235770ustar00rootroot00000000000000Override the base/test.erbCMSScanner-0.14.3/spec/fixtures/views/json/000077500000000000000000000000001466634144200204565ustar00rootroot00000000000000CMSScanner-0.14.3/spec/fixtures/views/json/render_me.erb000066400000000000000000000001201466634144200231010ustar00rootroot00000000000000"test": <%= @test.to_json %>, <% if @var %> "var": <%= @var.to_json %> <% end %>CMSScanner-0.14.3/spec/lib/000077500000000000000000000000001466634144200152455ustar00rootroot00000000000000CMSScanner-0.14.3/spec/lib/browser_spec.rb000066400000000000000000000150671466634144200203000ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Browser do it_behaves_like described_class::Actions subject(:browser) { described_class.instance(options) } before { described_class.reset } let(:options) { {} } let(:default) do { headers: { 'User-Agent' => "CMSScanner v#{CMSScanner::VERSION}", 'Referer' => nil }, accept_encoding: 'gzip, deflate', method: :get } end describe '#forge_request' do it 'returns a Typhoeus::Request' do expect(browser.forge_request('http://example.com')).to be_a Typhoeus::Request end end describe '#default_request_params' do its(:default_request_params) { should eq default } context 'when some attributes are set' do let(:options) do { url: 'http://wp.lo/', cache_ttl: 200, connect_timeout: 10, http_auth: { username: 'log', password: 'pwd' }, cookie_jar: '/tmp/cookie_jar.txt', vhost: 'testing', headers: { 'Test' => 'aa' }, proxy_auth: { username: 'u', password: 'pwd' }, disable_tls_checks: true } end let(:expected) do default.merge( cache_ttl: 200, connecttimeout: 10, userpwd: 'log:pwd', proxyuserpwd: 'u:pwd', cookiejar: options[:cookie_jar], cookiefile: options[:cookie_jar], ssl_verifypeer: false, ssl_verifyhost: 0, sslversion: :tlsv1 ).merge(headers: default[:headers].merge('Host' => 'testing', 'Test' => 'aa', 'Referer' => 'http://wp.lo/')) end its(:default_request_params) { should eq expected } end end describe '#request_params' do context 'when no param is given' do its(:request_params) { should eq default } end context 'when params are supplied' do let(:params) { { another_param: true, headers: { 'Accept' => 'None' } } } it 'merges them (headers should be correctly merged)' do expect(browser.request_params(params)).to eq default .merge(params) { |key, oldval, newval| key == :headers ? oldval.merge(newval) : newval } end context 'when browser options' do let(:options) { { proxy: 'http://127.0.0.1:8080', headers: { 'T' => 'a' } } } it 'returns the correct hash' do expect(browser.request_params(params)).to eq default .merge(options) { |key, oldval, newval| key == :headers ? oldval.merge(newval) : newval } .merge(params) { |key, oldval, newval| key == :headers ? oldval.merge(newval) : newval } end end end end describe '#load_options' do context 'when no options' do it 'does not load anything' do described_class::OPTIONS.each do |sym| expected = case sym when :user_agent browser.default_user_agent when :throttle 0.0 end expect(browser.send(sym)).to eq expected end end end context 'when options are supplied' do module CMSScanner # Test accessor class Browser attr_accessor :test end end let(:options) do { cache_ttl: 200, max_threads: 10, test: 'should not be set', throttle: 0, user_agent: 'UA', proxy: false, user_agents_list: 'test.txt' } end it 'merges the browser options only' do described_class::OPTIONS.each do |sym| expected = options.key?(sym) ? options[sym] : nil expect(browser.send(sym)).to eq expected end expect(browser.test).to be nil end end end describe '#hydra' do context 'when #max_threads is nil' do its('hydra.max_concurrency') { should eq 1 } end context 'when #max_threads' do let(:options) { { max_threads: 20 } } its('hydra.max_concurrency') { should eq options[:max_threads] } end end describe '#max_threads=' do after do browser.max_threads = @threads expect(browser.max_threads).to eq @expected expect(browser.hydra.max_concurrency).to eq @expected end context 'when <= 0' do it 'sets max_threads to 1' do @threads = -2 @expected = 1 end end context 'when > 0' do it 'sets max_threads to 20' do @threads = 20 @expected = @threads end end context 'when throttle is used' do let(:options) { { throttle: 2000 } } it 'sets max_threads to 1' do @threads = 20 @expected = 1 end end end describe '#throttle=, #throttle' do context 'when not used' do let(:options) { { max_threads: 20 } } its(:throttle) { should eql 0.0 } its(:max_threads) { should eql 20 } end context 'when max_threads and throttle supplied as options' do let(:options) { { max_threads: 20, throttle: 200 } } its(:throttle) { should eql 0.2 } its(:max_threads) { should eql 1 } end context 'when used' do let(:options) { { max_threads: 10 } } after do browser.throttle = @throttle expect(browser.throttle).to eql @throttle.to_i.abs / 1000.0 # This one is in seconds expect(browser.max_threads).to eql 1 expect(browser.hydra.max_concurrency).to eql 1 end context 'when a negative value is supplied' do it 'uses the absolute value and set the max_threads to 1' do @throttle = -100 end end context 'when a positive value is supplied' do it 'sets and set the max_threads to 1' do @throttle = 1000 end end end end describe '#user_agent' do context 'when no --random-user-agent' do context 'when no --user-agent' do its(:user_agent) { should eql browser.default_user_agent } end context 'when --user-agent' do let(:options) { super().merge(user_agent: 'Test UA') } its(:user_agent) { should eql 'Test UA' } end end context 'when --random-user-agent' do let(:options) { super().merge(random_user_agent: true) } it 'selects a random UA in the user_agents' do expect(browser).to receive(:user_agents_list).and_return(FIXTURES.join('user_agents.txt')) expect(browser.user_agent).to_not eql browser.default_user_agent # Should not pick up a random one each time expect(browser.user_agent).to eql browser.user_agent end end end describe '#user_agents' do let(:options) { { user_agents_list: FIXTURES.join('user_agents.txt') } } its(:user_agents) { should eql %w[UA-1 UA-2] } end end CMSScanner-0.14.3/spec/lib/cache/000077500000000000000000000000001466634144200163105ustar00rootroot00000000000000CMSScanner-0.14.3/spec/lib/cache/file_store_spec.rb000066400000000000000000000050201466634144200217770ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Cache::FileStore do let(:cache_dir) { CACHE.join('cache_file_store').to_s } subject(:cache) { described_class.new(cache_dir) } before { FileUtils.rm_r(cache_dir, secure: true) if Dir.exist?(cache_dir) } after { cache.clean } describe '#new, #storage_path, #serializer' do its(:serializer) { should be Marshal } its(:storage_path) { should eq cache_dir } end describe '#clean' do it 'removes all files from the cache dir' do # let's create some files into the directory first (0..5).each do |i| File.new(File.join(cache.storage_path, "file_#{i}.txt"), File::CREAT) end expect(count_files_in_dir(cache.storage_path, 'file_*.txt')).to eq 6 cache.clean expect(count_files_in_dir(cache.storage_path)).to eq 0 end end describe '#read_entry?' do let(:key) { 'key1' } after do File.write(cache.entry_expiration_path(key), @expiration) if @expiration expect(cache.read_entry(key)).to eq @expected end context 'when the entry does not exists' do it 'returns nil' do @expected = nil end end context 'when the file is empty (marshal data too short error)' do it 'returns nil' do File.new(cache.entry_path(key), File::CREAT) @expiration = Time.now.to_i + 200 @expected = nil end end context 'when the entry has expired' do it 'returns nil' do @expiration = Time.now.to_i - 200 @expected = nil end end context 'when the entry has not expired' do it 'returns the entry' do File.write(cache.entry_path(key), cache.serializer.dump('testing data')) @expiration = Time.now.to_i + 600 @expected = 'testing data' end end end describe '#write_entry' do after do cache.write_entry(@key, @data, @ttl) expect(cache.read_entry(@key)).to eq @expected end it 'should get the correct entry (string)' do @ttl = 10 @key = 'some_key' @data = 'Hello World !' @expected = @data end context 'when cache_ttl <= 0' do it 'does not write the entry' do @ttl = 0 @key = 'another_key' @data = 'Another Hello World !' @expected = nil end end context 'when cache_ttl is nil' do it 'does not write the entry' do @ttl = nil @key = 'test' @data = 'test' @expected = nil end end end end CMSScanner-0.14.3/spec/lib/cache/typhoeus_spec.rb000066400000000000000000000024471466634144200215360ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Cache::Typhoeus do subject(:cache) { described_class.new(cache_dir) } let(:cache_dir) { CACHE.join('typhoeus_cache') } let(:url) { 'http://example.com' } let(:request) { Typhoeus::Request.new(url, cache_ttl: 20) } let(:key) { request.hash.to_s } describe '#get' do it 'calls #read_entry' do expect(cache).to receive(:read_entry).with(key) cache.get(request) end end describe '#set' do context 'when response did not time out' do let(:response) { Typhoeus::Response.new(return_code: :ok, code: 200) } it 'calls #write_entry' do expect(cache).to receive(:write_entry).with(key, response, request.cache_ttl) cache.set(request, response) end end context 'when response timed out' do let(:response) { Typhoeus::Response.new(return_code: :operation_timedout) } it 'does not write the entry' do expect(cache).to_not receive(:write_entry) cache.set(request, response) end end context 'when response code is 0' do let(:response) { Typhoeus::Response.new(code: 0) } it 'does not write the entry' do expect(cache).to_not receive(:write_entry) cache.set(request, response) end end end end CMSScanner-0.14.3/spec/lib/cms_scanner_spec.rb000066400000000000000000000034401466634144200211000ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner do let(:target_url) { 'http://wp.lab/' } before do CMSScanner::Scan.new # To initialize the start memory CMSScanner::ParsedCli.options = rspec_parsed_options("--url #{target_url}") end describe 'typhoeus memoize' do it 'should be false' do expect(Typhoeus::Config.memoize).to be false end end describe 'typhoeus_on_complete' do before do CMSScanner.cached_requests = 0 CMSScanner.total_requests = 0 CMSScanner.total_data_sent = 0 CMSScanner.total_data_received = 0 end it 'returns the expected number of requests' do stub_request(:get, /.*/).and_return(body: 'aa', headers: { 'key' => 'field' }) CMSScanner::Browser.get(target_url) expect(CMSScanner.cached_requests).to eql 0 expect(CMSScanner.total_requests).to eql 1 expect(CMSScanner.total_data_sent).to eql 0 # can't really test this one it seems expect(CMSScanner.total_data_received).to eql 29 end context 'when cached request' do it 'returns the expected values' do allow_any_instance_of(Typhoeus::Response).to receive(:cached?).and_return(true) stub_request(:get, target_url) CMSScanner::Browser.get(target_url) CMSScanner::Browser.get(target_url) expect(CMSScanner.cached_requests).to eql 2 expect(CMSScanner.total_requests).to eql 0 expect(CMSScanner.total_data_sent).to eql 0 expect(CMSScanner.total_data_received).to eql 0 end end end describe '#start_memory' do it 'is set by Scan.new' do expect(CMSScanner.start_memory).to be_positive end end describe '#app_name' do it 'returns the excpected string' do expect(CMSScanner.app_name).to eql 'cms_scanner' end end end CMSScanner-0.14.3/spec/lib/controller_spec.rb000066400000000000000000000020211466634144200207620ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Controller do subject(:controller) { described_class::Base.new } before do described_class::Base.option_parser = nil CMSScanner::ParsedCli.options = parsed_options end let(:parsed_options) { { url: 'http://example.com/' } } its(:option_parser) { should be nil } its(:formatter) { should be_a CMSScanner::Formatter::Cli } its(:user_interaction?) { should be true } its(:tmp_directory) { should eql '/tmp/cms_scanner' } its(:target) { should be_a CMSScanner::Target } its('target.scope.domains') { should eq [PublicSuffix.parse('example.com')] } context 'when output option' do let(:parsed_options) { super().merge(output: '/tmp/spec.txt') } its(:user_interaction?) { should be false } end describe '#render' do it 'calls the formatter#render' do expect(controller.formatter).to receive(:render).with('test', { verbose: nil }, 'base') controller.render('test') end end end CMSScanner-0.14.3/spec/lib/controllers_spec.rb000066400000000000000000000113411466634144200211520ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Controller class Spec < Base def before_scan output('help', help: option_parser.simple_help, simple: true) if NS::ParsedCli.help exit(NS::ExitCode::OK) if NS::ParsedCli.help end end class SpecTooLong < Spec def run sleep(2) end end end end describe CMSScanner::Controllers do subject(:controllers) { described_class.new } let(:controller_mod) { CMSScanner::Controller } its(:'option_parser.config_files.result_key') { should eql 'cli_options' } describe '#<<' do its(:size) { should be 0 } context 'when controllers are added' do before { controllers << controller_mod::Spec.new << controller_mod::Base.new } its(:size) { should be 2 } end context 'when a controller is added twice' do before { 2.times { controllers << controller_mod::Spec.new } } its(:size) { should be 1 } end it 'returns self' do expect(controllers << controller_mod::Spec.new).to be_a described_class end end describe '#run' do let(:hydra) { CMSScanner::Browser.instance.hydra } it 'runs the before_scan, run and after_scan methods of each controller' do spec = controller_mod::Spec.new base = controller_mod::Base.new controllers << base << spec # Needed otherwise the default_argv is taken from rspec # (@default_argv=["--pattern", "spec/**{,/*/**}/*_spec.rb"]>) expect(controllers.option_parser).to receive(:results).and_return({}) [base, spec].each { |c| expect(c).to receive(:before_scan).ordered } [base, spec].each { |c| expect(c).to receive(:run).ordered } expect_any_instance_of(Typhoeus::Hydra).to receive(:abort) [spec, base].each { |c| expect(c).to receive(:after_scan).ordered } controllers.run end context 'when just calling --help' do before { controllers << controller_mod::Spec.new } it 'does no call #run and #after_scan on the controllers' do expect(controllers.option_parser).to receive(:results).and_return(help: true) controllers.each do |c| expect(c).to_not receive(:run) expect(c).to_not receive(:after_scan) end expect(controllers.first.formatter).to receive(:output) .ordered .with('help', hash_including(:help, :simple), 'spec') expect_any_instance_of(Typhoeus::Hydra).to receive(:abort) expect { controllers.run }.to raise_error(SystemExit) end end context 'when max_scan_duration is provided' do before do expect(controllers.option_parser).to receive(:results) .and_return(max_scan_duration: max_scan_duration) controllers << controller_mod::Spec.new << controller_mod::SpecTooLong.new end context 'when the scan exceeds the max duration' do let(:max_scan_duration) { 1 } it 'raises an exception' do expect_any_instance_of(Typhoeus::Hydra).to receive(:abort) controllers.reverse_each { |c| expect(c).to receive(:after_scan).ordered } expect { controllers.run }.to raise_error(CMSScanner::Error::MaxScanDurationReached) end end context 'when the scan does not exceed to max duration' do let(:max_scan_duration) { 4 } it 'does not raise an exception' do expect { controllers.run }.to_not raise_error end end end context 'when an error is raised by abort' do it 'ignores it and runs the after_scan methods of each controller' do spec = controller_mod::Spec.new base = controller_mod::Base.new controllers << base << spec # Needed otherwise the default_argv is taken from rspec # (@default_argv=["--pattern", "spec/**{,/*/**}/*_spec.rb"]>) expect(controllers.option_parser).to receive(:results).and_return({}) [base, spec].each { |c| expect(c).to receive(:before_scan).ordered } [base, spec].each { |c| expect(c).to receive(:run).ordered } expect_any_instance_of(Typhoeus::Hydra).to receive(:abort).and_raise('Should be Ignored') [spec, base].each { |c| expect(c).to receive(:after_scan).ordered } controllers.run end end end describe '#register_config_files' do it 'register the correct files' do expect(File).to receive(:exist?).exactly(4).times.and_return(true) expected = [] option_parser = controllers.option_parser [Dir.home, Dir.pwd].each do |dir| option_parser.config_files.class.supported_extensions.each do |ext| expected << File.join(dir, '.cms_scanner', "scan.#{ext}") end end expect(option_parser.config_files.map(&:path)).to eql expected end end end CMSScanner-0.14.3/spec/lib/finders/000077500000000000000000000000001466634144200166775ustar00rootroot00000000000000CMSScanner-0.14.3/spec/lib/finders/base_finders_spec.rb000066400000000000000000000020371466634144200226640ustar00rootroot00000000000000# frozen_string_literal: true require 'spec_helper' require 'dummy_independent_finders' describe CMSScanner::Finders::BaseFinders do subject(:finders) { described_class.new } describe '#symbols_from_mode' do after { expect(finders.send(:symbols_from_mode, @mode)).to eq @expected } context 'when :mixed' do it 'returns [:passive, :aggressive]' do @mode = :mixed @expected = %i[passive aggressive] end end context 'when :passive or :aggresssive' do %i[passive aggressive].each do |symbol| it 'returns it in an array' do @mode = symbol @expected = Array(symbol) end end end context 'otherwise' do it 'returns []' do @mode = :unallowed @expected = [] end end end describe '#run_finder' do # currently handled in independent_finders_spec end describe '#findings' do it 'returns a Findings object' do expect(finders.findings).to be_a CMSScanner::Finders::Findings end end end CMSScanner-0.14.3/spec/lib/finders/finder/000077500000000000000000000000001466634144200201465ustar00rootroot00000000000000CMSScanner-0.14.3/spec/lib/finders/finder/breadth_first_dictionary_attack_spec.rb000066400000000000000000000115401466634144200301020ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Finders::Finder::BreadthFirstDictionaryAttack do # Dummy class to test the module class DummyBreadthFirstDictionaryAttack < CMSScanner::Finders::Finder include CMSScanner::Finders::Finder::BreadthFirstDictionaryAttack def login_request(username, password) Typhoeus::Request.new('http://e.org/login.php', method: :post, body: { username: username, pwd: password }) end def valid_credentials?(response) response.code == 302 end def errored_response?(response) response.timed_out? || response.body.include?('Error:') end end subject(:finder) { DummyBreadthFirstDictionaryAttack.new(target) } let(:target) { CMSScanner::Target.new('http://e.org') } let(:login_url) { target.url('login.php') } describe '#attack' do let(:users) { %w[admin root user].map { |u| CMSScanner::Model::User.new(u) } } let(:wordlist_path) { FIXTURES.join('passwords.txt').to_s } before do # Mock all login requests to 401 File.foreach(wordlist_path) do |password| users.each do |user| stub_request(:post, login_url) .with(body: { username: user.username, pwd: password.chomp }) .to_return(status: 401) end end end context 'when no valid credentials' do it 'does not yield anything' do expect { |block| finder.attack(users, wordlist_path, &block) }.not_to yield_control end context 'when trying to increment above current progress' do it 'does not call #increment' do # Set the progress of the bar to the total expect_any_instance_of(ProgressBar::Base) .to receive(:progress) .at_least(1) .and_return(users.size * File.open(wordlist_path).count) expect_any_instance_of(ProgressBar::Base) .not_to receive(:increment) expect { |block| finder.attack(users, wordlist_path, &block) }.not_to yield_control end end end context 'when valid credentials' do before do stub_request(:post, login_url) .with(body: { username: 'admin', pwd: 'admin' }) .to_return(status: 302) end it 'yields the matching user' do expect { |block| finder.attack(users, wordlist_path, &block) } .to yield_with_args(CMSScanner::Model::User.new('admin', password: 'admin')) end context 'when the progressbar total= failed' do it 'does not raise an error' do expect_any_instance_of(ProgressBar::Base).to receive(:total=).and_raise ProgressBar::InvalidProgressError expect { |block| finder.attack(users, wordlist_path, &block) } .to yield_with_args(CMSScanner::Model::User.new('admin', password: 'admin')) end end end context 'when an error is present in a response' do before do if defined?(stub_params) stub_request(:post, login_url) .with(body: { username: 'admin', pwd: 'pwd' }) .to_return(stub_params) else stub_request(:post, login_url) .with(body: { username: 'admin', pwd: 'pwd' }) .to_timeout end CMSScanner::ParsedCli.options = { verbose: defined?(verbose) ? verbose : false } finder.attack(users, wordlist_path) end context 'when request timeout' do it 'logs to correct message' do expect(finder.progress_bar.log).to eql [ 'Error: Request timed out.' ] end end context 'when status/code = 0' do let(:stub_params) { { status: 0, body: 'Error: Down' } } it 'logs to correct message' do expect(finder.progress_bar.log).to eql [ 'Error: No response from remote server. WAF/IPS? ()' ] end end context 'when error 500' do let(:stub_params) { { status: 500, body: 'Error: 500' } } it 'logs to correct message' do expect(finder.progress_bar.log).to eql [ 'Error: Server error, try reducing the number of threads.' ] end end context 'when unknown error' do let(:stub_params) { { status: 200, body: 'Error: Something went wrong' } } context 'when no --verbose' do let(:verbose) { false } it 'logs to correct message' do expect(finder.progress_bar.log).to eql [ 'Error: Unknown response received Code: 200' ] end end context 'when --verbose' do let(:verbose) { true } it 'logs to correct message' do expect(finder.progress_bar.log).to eql [ "Error: Unknown response received Code: 200\nBody: Error: Something went wrong" ] end end end end end end CMSScanner-0.14.3/spec/lib/finders/finder/enumerator_spec.rb000066400000000000000000000212541466634144200236720ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Finders::Finder::Enumerator do # Dummy class to test the module class DummyEnumeratorFinder < CMSScanner::Finders::Finder include CMSScanner::Finders::Finder::Enumerator end subject(:finder) { DummyEnumeratorFinder.new(target) } let(:target) { CMSScanner::Target.new('http://e.org') } before { allow(target).to receive(:head_or_get_params).and_return(method: :head) } its(:head_or_get_request_params) { should eql(method: :head, cache_ttl: 0) } its(:valid_response_codes) { should eql [200] } its(:full_request_params) { should eql({}) } describe '#maybe_get_full_response' do let(:head_res) { Typhoeus::Response.new(code: 200, effective_url: effective_url) } let(:effective_url) { target.url('maybe_get_full_response') } let(:opts) { {} } context 'when check_full_response is false/nil' do it 'returns the head response' do expect(finder.maybe_get_full_response(head_res, {})).to eql head_res expect(finder.maybe_get_full_response(head_res, check_full_response: false)).to eql head_res end end context 'when check_full_response is true' do let(:opts) { super().merge(check_full_response: true) } let(:body) { '' } let(:status) { 200 } before { stub_request(:get, effective_url).to_return(body: body, status: status) } context 'when the body matches the 404 homepage' do it 'returns nil' do expect(target).to receive(:homepage_or_404?).and_return(true) expect(finder.maybe_get_full_response(head_res, opts)).to eql nil end end context 'when the status is not valid' do let(:status) { 404 } it 'returns nil' do allow(target).to receive(:homepage_or_404?).and_return(false) expect(finder.maybe_get_full_response(head_res, opts)).to eql nil end end context 'when the exclude_content is set' do before { expect(target).to receive(:homepage_or_404?).and_return(false) } let(:opts) { super().merge(exclude_content: /ignored/) } context 'when the body matches' do let(:body) { 'should be ignored' } it 'returns nil' do expect(finder.maybe_get_full_response(head_res, opts)).to eql nil end end context 'when the body does not match' do let(:body) { 'should pass' } it 'returns the GET response' do res = finder.maybe_get_full_response(head_res, opts) expect(res).to be_a Typhoeus::Response expect(res.request.options[:method]).to eql :get expect(res.body).to eql body end end end context 'when not 404 and no exclude_content' do before { expect(target).to receive(:homepage_or_404?).and_return(false) } it 'returns the GET response' do res = finder.maybe_get_full_response(head_res, opts) expect(res).to be_a Typhoeus::Response expect(res.request.options[:method]).to eql :get expect(res.body).to eql body end end end context 'when check_full_response is an array of status codes' do let(:opts) { super().merge(check_full_response: [200]) } context 'when the head_res status is not in the array' do let(:head_res) { Typhoeus::Response.new(code: 400, effective_url: effective_url) } it 'returns the HEAD response' do expect(finder.maybe_get_full_response(head_res, opts)).to eql head_res end end context 'when the head_res status is in the array' do let(:head_res) { Typhoeus::Response.new(code: 200, effective_url: effective_url) } before do stub_request(:get, effective_url).to_return(body: 'body') expect(target).to receive(:homepage_or_404?).and_return(false) end it 'returns the GET response' do res = finder.maybe_get_full_response(head_res, opts) expect(res).to be_a Typhoeus::Response expect(res.request.options[:method]).to eql :get expect(res.body).to eql 'body' end end end context 'when check_full_response is a status code (string)' do let(:opts) { super().merge(check_full_response: 200) } context 'when the head_res status has not the same status' do let(:head_res) { Typhoeus::Response.new(code: 400, effective_url: effective_url) } it 'returns the HEAD response' do expect(finder.maybe_get_full_response(head_res, opts)).to eql head_res end end context 'when the head_res status has the same status' do let(:head_res) { Typhoeus::Response.new(code: 200, effective_url: effective_url) } before do stub_request(:get, effective_url).to_return(body: 'body') expect(target).to receive(:homepage_or_404?).and_return(false) end it 'returns the GET response' do res = finder.maybe_get_full_response(head_res, opts) expect(res).to be_a Typhoeus::Response expect(res.request.options[:method]).to eql :get expect(res.body).to eql 'body' end end end end describe '#enumerate' do let(:target_urls) do { target.url('1') => 1, target.url('2') => 2 } end let(:opts) { {} } context ' when no opts' do context 'when all HEADS are 404' do before do target_urls.each_key do |url| stub_request(:head, url).to_return(status: 404) end end it 'does not yield anything' do expect { |b| finder.enumerate(target_urls, opts, &b) }.to_not yield_control end end context 'when some pages are 200 (default valid_response_codes)' do before do stub_request(:head, target_urls.key(1)).to_return(status: 404) stub_request(:head, target_urls.key(2)).to_return(status: 200) stub_request(:get, target_urls.key(2)).to_return(status: 200, body: 'rspec') end it 'yield the expected item' do expect { |b| finder.enumerate(target_urls, opts, &b) }.to yield_with_args(Typhoeus::Response, 2) end end end context 'when opts' do context 'when :exclude_content' do before do target_urls.each_key do |url| stub_request(:head, url).to_return(status: 200, headers: { 'Key' => 'aa' }) end end context 'when header matches' do let(:opts) { super().merge(exclude_content: /Key: aa/i) } it 'does not yield anything' do expect { |b| finder.enumerate(target_urls, opts, &b) }.to_not yield_control end end context 'when header does not match' do let(:opts) { super().merge(exclude_content: /not aa/i) } before do target_urls.each_key { |url| stub_request(:get, url).to_return(status: 200) } end it 'yield the expected items' do expect { |b| finder.enumerate(target_urls, opts, &b) }.to yield_successive_args( [Typhoeus::Response, 1], [Typhoeus::Response, 2] ) end end context 'when one header matches but the other not, using negative look-arounds' do let(:opts) { super().merge(exclude_content: /\A((?!x-cacheable)[\s\S])*\z/i) } before do stub_request(:head, target_urls.keys.last).and_return(status: 200, headers: { 'x-cacheable' => 'YES' }) end it 'yield the expected item' do expect { |b| finder.enumerate(target_urls, opts, &b) }.to yield_with_args(Typhoeus::Response, 2) end end end context 'when check_full_response' do let(:opts) { super().merge(check_full_response: true) } before do target_urls.each_key do |url| stub_request(:head, url).to_return(status: 200) end end context 'when #maybe_get_full_response returns nil' do it 'does not yield anything' do expect(finder).to receive(:maybe_get_full_response).twice.and_return(nil) expect { |b| finder.enumerate(target_urls, opts, &b) }.to_not yield_control end end context 'when #check_full_response' do it 'yields the GET responses' do expect(finder) .to receive(:maybe_get_full_response) .twice .and_return(Typhoeus::Response.new(code: 200)) expect { |b| finder.enumerate(target_urls, opts, &b) }.to yield_successive_args( [Typhoeus::Response, 1], [Typhoeus::Response, 2] ) end end end end end end CMSScanner-0.14.3/spec/lib/finders/finder/fingerprinter_spec.rb000066400000000000000000000033051466634144200243640ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Finders::Finder::Fingerprinter do # Dummy class to test the module class DummyFingerprinterFinder < CMSScanner::Finders::Finder include CMSScanner::Finders::Finder::Fingerprinter end subject(:finder) { DummyFingerprinterFinder.new(target) } let(:target) { CMSScanner::Target.new('http://e.org/') } describe '#fingerprint' do let(:fingerprints) do { 'f1.css' => { finder.hexdigest('f1_body') => 'v1' }, 'f2.js' => { finder.hexdigest('f2_body') => %w[v1 v2], finder.hexdigest('f2_2_body') => %w[v3] } } end before { expect(target).to receive(:head_or_get_params).and_return(method: :head) } context 'when no matches' do before { stub_request(:head, /.*/).to_return(status: 404) } it 'does not yield anything' do expect { |b| finder.fingerprint(fingerprints, &b) }.not_to yield_control end end context 'when matches' do before do # Used to simulate a custom 404 homepage with status 200 stub_request(:get, /.*/).to_return(body: '404 body') stub_request(:head, target.url('f1.css')) stub_request(:get, target.url('f1.css')).to_return(body: 'f1_body') stub_request(:head, target.url('f2.js')) stub_request(:get, target.url('f2.js')).to_return(body: 'f2_body') end it 'yields the expected arguments' do expect { |b| finder.fingerprint(fingerprints, &b) }.to yield_successive_args( ['v1', target.url('f1.css'), finder.hexdigest('f1_body')], [%w[v1 v2], target.url('f2.js'), finder.hexdigest('f2_body')] ) end end end end CMSScanner-0.14.3/spec/lib/finders/finder/smart_url_checker/000077500000000000000000000000001466634144200236425ustar00rootroot00000000000000CMSScanner-0.14.3/spec/lib/finders/finder/smart_url_checker/findings_spec.rb000066400000000000000000000022551466634144200270060ustar00rootroot00000000000000# frozen_string_literal: true require 'spec_helper' require 'dummy_finding' describe CMSScanner::Finders::Finder::SmartURLChecker::Findings do subject(:findings) { described_class.new } let(:finding) { CMSScanner::DummyFinding } describe '#<<' do after { expect(findings).to match_array(@expected.map { |f| eql(f) }) } context 'when no findings already in' do it 'adds it' do findings << finding.new('empty-test') @expected = [finding.new('empty-test')] end end context 'when findings already in' do let(:confirmed) { finding.new('confirmed', interesting_entries: entries) } let(:entries) { %w[e1 e2] } before { findings << nil << nil << finding.new('test') << confirmed } it 'adds a confirmed result correctly and ignore nil values' do confirmed_dup = confirmed.dup confirmed_dup.confidence = 100 confirmed_dup.interesting_entries = %w[e2 e3] findings << confirmed_dup confirmed.confirmed_by = confirmed_dup @expected = [] << finding.new('test') << confirmed expect(findings[1].interesting_entries).to eql(%w[e1 e2 e3]) end end end end CMSScanner-0.14.3/spec/lib/finders/finder/smart_url_checker_spec.rb000066400000000000000000000026601466634144200252050ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Finders::Finder::SmartURLChecker do # Dummy class to test the module class DummyFinder < CMSScanner::Finders::Finder include CMSScanner::Finders::Finder::SmartURLChecker end subject(:finder) { DummyFinder.new(target) } let(:target) { CMSScanner::Target.new('http://e.org') } before { stub_request(:get, target.url) } context 'when methods are not implemented' do it 'raises errors' do expect { finder.process_urls([]) }.to raise_error NotImplementedError expect { finder.passive }.to raise_error NotImplementedError expect { finder.aggressive_urls }.to raise_error NotImplementedError end end describe '#aggressive' do before { expect(finder).to receive(:aggressive_urls).and_return(%w[u1 u2 u3]) } after do expect(finder).to receive(:process_urls).with(@expected_urls, { mode: mode }) finder.aggressive(mode: mode) end context 'when :mode = :mixed' do before { expect(finder).to receive(:passive_urls).and_return(%w[u2]) } let(:mode) { :mixed } it 'calls #process_urls with the correct argument' do @expected_urls = %w[u1 u3] end end %i[passive aggressive].each do |m| context "when :mode = #{m}" do let(:mode) { m } it 'calls #process_urls with the correct argument' do @expected_urls = %w[u1 u2 u3] end end end end end CMSScanner-0.14.3/spec/lib/finders/finder_spec.rb000066400000000000000000000055151466634144200215130ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Finders::Finder do subject(:finder) { described_class.new('target') } its(:titleize) { should eql 'Finder' } its(:browser) { should be_a CMSScanner::Browser } its(:hydra) { should be_a Typhoeus::Hydra } describe '#create_progress_bar' do before { finder.create_progress_bar(opts) } context 'when opts[:show_progression] is true' do let(:opts) { { show_progression: true } } it 'uses the default progress-bar output' do expected_bar_class = ENV['GITHUB_ACTION'] ? ProgressBar::Outputs::NonTty : ProgressBar::Outputs::Tty expect(finder.progress_bar.send(:output)).to be_a expected_bar_class end end context 'when opts[:show_progression] is false' do let(:opts) { { show_progression: false } } it 'uses the null progress_bar outout' do expect(finder.progress_bar.send(:output)).to be_a ProgressBar::Outputs::Null end context 'when logging data' do context 'when no logs' do it 'returns an empty array' do expect(finder.progress_bar.log).to eql([]) end end context 'when adding messages' do it 'returns the messages' do finder.progress_bar.log 'Hello' finder.progress_bar.log 'World' expect(finder.progress_bar.log).to eql(%w[Hello World]) end end end end end class SpecCallerLocation attr_reader :call def initialize(call) @call = call end def label @label ||= call[/`([^']+)'$/, 1] end def to_s call end end describe '#found_by' do context 'when no klass supplied' do context 'when no passive or aggresive match' do it 'returns nil' do expect(finder).to receive(:caller_locations).and_return([]) expect(finder.found_by).to be_nil end end context 'when aggressive match' do it 'returns the expected string' do expect(finder).to receive(:caller_locations) .and_return([SpecCallerLocation.new("/aaaaa/file.rb:xx:in `aggressive'")]) expect(finder.found_by).to eql 'Finder (Aggressive Detection)' end end end { Rspec: 'Rspec', Error404Page: 'Error 404 Page', CssId: 'Css Id', Something12Db2: 'Something 12 Db2' }.each do |klass, expected_title| context "when class #{klass} supplied" do it 'returns the expected string' do allow(finder).to receive(:caller_locations) .and_return([SpecCallerLocation.new("/aaaaa/file.rb:xx:in `passive'")]) expected = "#{expected_title} (Passive Detection)" # klass = Object.const_set(klass_name, Class.new(described_class)) expect(finder.found_by(klass)).to eql expected end end end end end CMSScanner-0.14.3/spec/lib/finders/findings_spec.rb000066400000000000000000000021411466634144200220350ustar00rootroot00000000000000# frozen_string_literal: true require 'spec_helper' require 'dummy_finding' describe CMSScanner::Finders::Findings do subject(:findings) { described_class.new } let(:finding) { CMSScanner::DummyFinding } describe '#<<' do after { expect(findings).to match_array(@expected.map { |f| eql(f) }) } context 'when no findings already in' do it 'adds it' do findings << finding.new('empty-test', found_by: 'rspec', confidence: 20) @expected = [finding.new('empty-test', found_by: 'rspec', confidence: 20)] end end context 'when findings already in' do let(:confirmed) { finding.new('confirmed') } before { findings << nil << nil << finding.new('test') << confirmed } it 'adds a confirmed result correctly and ignore the nil values' do confirmed_dup = confirmed.dup confirmed_dup.confidence = 100 findings << finding.new('test2') findings << confirmed_dup confirmed.confirmed_by = confirmed_dup @expected = [] << finding.new('test') << confirmed << finding.new('test2') end end end end CMSScanner-0.14.3/spec/lib/finders/independent_finders_spec.rb000066400000000000000000000057021466634144200242510ustar00rootroot00000000000000# frozen_string_literal: true require 'spec_helper' require 'dummy_independent_finders' describe CMSScanner::Finders::IndependentFinders do subject(:finders) { described_class.new } describe '#run' do let(:target) { 'target' } let(:finding) { CMSScanner::DummyFinding } let(:expected_aggressive) { [finding.new('test', found_by: 'override', confidence: 100)] } let(:expected_passive) do [ finding.new('test', found_by: 'Dummy Finder (Passive Detection)'), finding.new('spotted', found_by: 'No Aggressive Result (Passive Detection)', confidence: 10) ] end before do finders << CMSScanner::Finders::Independent::DummyFinder.new(target) << CMSScanner::Finders::Independent::NoAggressiveResult.new(target) end describe 'method calls order' do after { finders.run(mode: mode) } %i[passive aggressive].each do |current_mode| context "when #{current_mode} mode" do let(:mode) { current_mode } it "calls the #{current_mode} method on each finder" do finders.each do |f| expect(f).to receive(current_mode).with(hash_including(found: [])).ordered end end end end context 'when :mixed mode' do let(:mode) { :mixed } let(:modes) { %i[passive aggressive] } it 'calls :passive then :aggressive on each finder' do finders.each do |finder| modes.each do |method| expect(finder).to receive(method).with(hash_including(found: [])).ordered end end end end end describe 'returned results' do before do @found = finders.run(mode: mode) expect(@found).to be_a(CMSScanner::Finders::Findings) @found.each { |f| expect(f).to be_a finding } end context 'when :passive mode' do let(:mode) { :passive } it 'returns 2 results' do expect(@found).to match_array(expected_passive.map { |f| eql(f) }) end end context 'when :aggressive mode' do let(:mode) { :aggressive } it 'returns 1 result' do expect(@found).to match_array(expected_aggressive.map { |f| eql(f) }) end end context 'when :mixed mode' do let(:mode) { :mixed } it 'returns 2 results' do # As the first passive is confirmed by the expected_aggressive, the confidence # increases and should be 100% due to the expected_aggressive.confidence first_passive = expected_passive.first.dup first_passive.confidence = 100 expect(@found.size).to eq 2 expect(@found.first).to eql first_passive expect(@found.first.confirmed_by).to eql expected_aggressive expect(@found.last).to eql expected_passive.last end end context 'when multiple results returned' do xit end end end end CMSScanner-0.14.3/spec/lib/finders/same_type_finder_spec.rb000066400000000000000000000011231466634144200235500ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Finders # Dummy Class to test the module class PluginsFinderSpec include SameTypeFinder def initialize(_target); end end end end describe CMSScanner::Finders::PluginsFinderSpec do it_behaves_like CMSScanner::Finders::IndependentFinder do let(:expected_finders) { [] } let(:expected_finders_class) { CMSScanner::Finders::SameTypeFinders } end subject(:plugins) { described_class.new(target) } let(:target) { CMSScanner::Target.new(url) } let(:url) { 'http://example.com/' } end CMSScanner-0.14.3/spec/lib/finders/same_type_finders_spec.rb000066400000000000000000000104461466634144200237430ustar00rootroot00000000000000# frozen_string_literal: true require 'spec_helper' require 'dummy_independent_finders' # will use those for convenience describe CMSScanner::Finders::SameTypeFinders do subject(:finders) { described_class.new } let(:independent_finders) { CMSScanner::Finders::Independent } describe '#run' do let(:target) { 'target' } let(:finding) { CMSScanner::DummyFinding } let(:opts) { {} } before do finders << independent_finders::DummyFinder.new(target) << independent_finders::NoAggressiveResult.new(target) end after do result = finders.run(opts) expect(result).to be_a CMSScanner::Finders::Findings expect(result).to match_array(@expected.map { |f| eql(f) }) end let(:dummy_passive) { independent_finders::DummyFinder.new(target).passive(opts) } let(:dummy_aggresssive) { independent_finders::DummyFinder.new(target).aggressive(opts) } let(:noaggressive) { independent_finders::NoAggressiveResult.new(target).passive(opts) } context 'when :mixed mode' do let(:opts) { super().merge(mode: :mixed) } it 'calls all #passive then #aggressive on finders and returns the results' do expect(finders[0]).to receive(:passive) .with(hash_including(found: [])).ordered.and_call_original expect(finders[1]).to receive(:passive) .with(hash_including(found: [dummy_passive.first])).ordered.and_call_original expect(finders[0]).to receive(:aggressive) .with(hash_including(found: [dummy_passive.first, noaggressive])) .ordered.and_call_original expect(finders[1]).to receive(:aggressive) .with(hash_including(:found)) .ordered @expected = [] @expected << finding.new('test', confidence: 100, found_by: 'Dummy Finder (Passive Detection)') @expected.first.confirmed_by << finding.new('test', confidence: 100, found_by: 'override') @expected << finding.new('spotted', confidence: 10, found_by: 'No Aggressive Result (Passive Detection)') end end context 'when :passive mode' do let(:opts) { super().merge(mode: :passive) } before do expect(finders[0]).to receive(:passive) .with(hash_including(found: [])).ordered.and_call_original expect(finders[1]).to receive(:passive) .with(hash_including(found: [dummy_passive.first])).ordered.and_call_original finders.each { |f| expect(f).to_not receive(:aggressive) } end it 'calls #passive on all finders and returns the results' do @expected = [] @expected << finding.new('test', found_by: 'Dummy Finder (Passive Detection)') @expected << finding.new('spotted', confidence: 10, found_by: 'No Aggressive Result (Passive Detection)') end context 'when :sort used' do let(:opts) { super().merge(sort: true) } it 'returns the sorted results' do @expected = [] @expected << finding.new('spotted', confidence: 10, found_by: 'No Aggressive Result (Passive Detection)') @expected << finding.new('test', found_by: 'Dummy Finder (Passive Detection)') end end # TODO: make this work # context 'when :vulnerable used' do # let(:opts) { super().merge(vulnerable: true) } # it 'returns the vulnerable results' do # expect(dummy_passive).to receive(:vulnerable?).and_return(true) # expect(noaggressive).to receive(:vulnerable?) # @expected = [finding.new('test', found_by: 'Dummy Finder (Passive Detection)')] # end # end end context 'when :aggressive mode' do let(:opts) { super().merge(mode: :aggressive) } it 'calls #aggressive on all finders and returns the results' do finders.each { |f| expect(f).to_not receive(:passive) } expect(finders[0]).to receive(:aggressive) .with(hash_including(found: [])).ordered.and_call_original expect(finders[1]).to receive(:aggressive) .with(hash_including(found: [dummy_aggresssive])).ordered @expected = [finding.new('test', confidence: 100, found_by: 'override')] end end end end CMSScanner-0.14.3/spec/lib/finders/unique_finder_spec.rb000066400000000000000000000011171466634144200230730ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Finders # Dummy Class to test the module class VersionFinderSpec include UniqueFinder def initialize(_target); end end end end describe CMSScanner::Finders::VersionFinderSpec do it_behaves_like CMSScanner::Finders::IndependentFinder do let(:expected_finders) { [] } let(:expected_finders_class) { CMSScanner::Finders::UniqueFinders } end subject(:version) { described_class.new(target) } let(:target) { CMSScanner::Target.new(url) } let(:url) { 'http://example.com/' } end CMSScanner-0.14.3/spec/lib/finders/unique_finders_spec.rb000066400000000000000000000171421466634144200232630ustar00rootroot00000000000000# frozen_string_literal: true require 'spec_helper' require 'dummy_unique_finders' describe CMSScanner::Finders::UniqueFinders do subject(:finders) { described_class.new } let(:unique_finders) { CMSScanner::Finders::Unique } describe '#filter_finding' do let(:findings) { [] } after do finders.instance_variable_set(:@findings, findings) expect(finders.send(:filter_findings)).to eql @expected end context 'when no findings' do it 'returns false' do @expected = false end end context 'when one finding' do let(:findings) { [CMSScanner::DummyFinding.new('one', confidence: 40)] } it 'returns it' do @expected = findings[0] end end context 'when multiple findings' do let(:findings) do (1..5).reduce([]) { |acc, elem| acc << CMSScanner::DummyFinding.new(elem, confidence: 20) } end context 'when they have the same confidence' do it 'returns false' do @expected = false end end context 'when there is a best confidence' do (0..4).each do |position| context "when at [#{position}]" do it 'returns it' do findings[position].confidence = 100 @expected = findings[position] end end end end end end describe '#run' do let(:target) { 'target' } let(:finding) { CMSScanner::DummyFinding } let(:opts) { {} } before do finders << unique_finders::Dummy.new(target) << unique_finders::NoAggressive.new(target) << unique_finders::Dummy2.new(target) end after do result = finders.run(opts) expect(result).to be_a finding if @expected expect(result).to eql @expected end let(:dummy_passive) { unique_finders::Dummy.new(target).passive(opts) } let(:dummy_aggresssive) { unique_finders::Dummy.new(target).aggressive(opts) } let(:noaggressive) { unique_finders::NoAggressive.new(target).passive(opts) } let(:dummy2_aggressive) { unique_finders::Dummy2.new(target).aggressive } context 'when :confidence_threshold <= 0' do let(:opts) { super().merge(confidence_threshold: 0) } context 'when :mixed mode' do let(:opts) { super().merge(mode: :mixed) } it 'calls all #passive then #aggressive on finders and returns the best result' do # Maybe there is a way to factorise this expect(finders[0]).to receive(:passive) .with(hash_including(found: [])).ordered.and_call_original expect(finders[1]).to receive(:passive) .with(hash_including(found: [dummy_passive.first])).ordered.and_call_original expect(finders[2]).to receive(:passive) .with(hash_including(found: [dummy_passive.first, noaggressive])).ordered expect(finders[0]).to receive(:aggressive).with(hash_including(:found)).ordered .and_call_original expect(finders[1]).to receive(:aggressive).with(hash_including(:found)).ordered expect(finders[2]).to receive(:aggressive).with(hash_including(:found)).ordered .and_call_original @expected = finding.new('v1', confidence: 100, found_by: 'Dummy (Passive Detection)') @expected.confirmed_by << finding.new('v1', confidence: 100, found_by: 'override') @expected.confirmed_by << finding.new('v1', confidence: 90) end end context 'when :passive mode' do let(:opts) { super().merge(mode: :passive) } it 'calls #passive on all finders and returns the best result' do expect(finders[0]).to receive(:passive) .with(hash_including(found: [])).ordered.and_call_original expect(finders[1]).to receive(:passive) .with(hash_including(found: [dummy_passive.first])).ordered.and_call_original expect(finders[2]).to receive(:passive) .with(hash_including(found: [dummy_passive.first, noaggressive])).ordered finders.each { |f| expect(f).to_not receive(:aggressive) } @expected = finding.new('v2', confidence: 10, found_by: 'No Aggressive (Passive Detection)') end end context 'when :aggressive mode' do let(:opts) { super().merge(mode: :aggressive) } it 'calls #aggressive on all finders and returns the best result' do finders.each { |f| expect(f).to_not receive(:passive) } expect(finders[0]).to receive(:aggressive) .with(hash_including(found: [])).ordered.and_call_original expect(finders[1]).to receive(:aggressive) .with(hash_including(found: [dummy_aggresssive])).ordered expect(finders[2]).to receive(:aggressive) .with(hash_including(:found)).ordered.and_call_original @expected = finding.new('v1', confidence: 100, found_by: 'override') @expected.confirmed_by << finding.new('v1', confidence: 90) end end end context 'when :confidence_threshold = 100 (default)' do context 'when :mixed mode' do let(:opts) { super().merge(mode: :mixed) } it 'calls all #passive then #aggressive methods on finders and returns the '\ 'result which reaches 100% confidence during the process' do expect(finders[0]).to receive(:passive) .with(hash_including(found: [])).ordered.and_call_original expect(finders[1]).to receive(:passive) .with(hash_including(found: [dummy_passive.first])).ordered.and_call_original expect(finders[2]).to receive(:passive) .with(hash_including(found: [dummy_passive.first, noaggressive])).ordered expect(finders[0]).to receive(:aggressive).with(hash_including(:found)).ordered .and_call_original expect(finders[1]).to_not receive(:aggressive) expect(finders[2]).to_not receive(:aggressive) @expected = finding.new('v1', confidence: 100, found_by: 'Dummy (Passive Detection)') @expected.confirmed_by << finding.new('v1', confidence: 100, found_by: 'override') end end context 'when :passive mode' do let(:opts) { super().merge(mode: :passive) } it 'calls all #passive and returns the best result' do expect(finders[0]).to receive(:passive) .with(hash_including(found: [])).ordered.and_call_original expect(finders[1]).to receive(:passive) .with(hash_including(found: [dummy_passive.first])).ordered.and_call_original expect(finders[2]).to receive(:passive) .with(hash_including(found: [dummy_passive.first, noaggressive])).ordered finders.each { |f| expect(f).to_not receive(:aggressive) } @expected = finding.new('v2', confidence: 10, found_by: 'No Aggressive (Passive Detection)') end end context 'when :aggressive mode' do let(:opts) { super().merge(mode: :aggressive) } it 'calls all #aggressive and returns the result which reaches 100% confidence' do finders.each { |f| expect(f).to_not receive(:passive) } expect(finders[0]).to receive(:aggressive) .with(hash_including(found: [])).ordered.and_call_original expect(finders[1]).to_not receive(:aggressive) expect(finders[2]).to_not receive(:aggressive) @expected = finding.new('v1', confidence: 100, found_by: 'override') end end end end end CMSScanner-0.14.3/spec/lib/formatter_spec.rb000066400000000000000000000073031466634144200206120ustar00rootroot00000000000000# frozen_string_literal: true module CMSScanner module Formatter module Spec # Base Format Test Class class BasedFormat < Base def base_format 'base' end end end end end describe CMSScanner::Formatter::Base do subject(:formatter) { described_class.new } describe '#format' do its(:format) { should eq 'base' } end describe '#user_interaction?' do context 'when not a cli format' do its(:user_interaction?) { should be false } end context 'when a cli format' do before { expect(formatter).to receive(:format).and_return('cli') } its(:user_interaction?) { should be true } end end describe '#render, output' do before { formatter.views_directories << FIXTURES_VIEWS } it 'renders the global template and does not override the @views_directories' do expect($stdout).to receive(:puts) .with("It Works!\nViews Dirs: #{formatter.views_directories}") formatter.output('@test', test: 'Works!', views_directories: 'owned') end context 'when global and local rendering are used inside a template' do it 'renders them correcly' do rendered = formatter.render('test', { var: 'Works' }, 'ctrl') expect(rendered).to eq "Test: Works\nLocal View\nGlobal View" end end it 'raises an error if the controller_name is nil and tpl is not a global one' do expect { formatter.output('test') }.to raise_error('The controller_name can not be nil') end end describe '#view_path' do before do formatter.views_directories << FIXTURES_VIEWS formatter.render('local', {}, 'ctrl') # Used to set the @controller_name end context 'when the tpl format is invalid' do let(:tpl) { '../try-this' } it 'raises an error' do expect { formatter.view_path(tpl) }.to raise_error("Wrong tpl format: 'ctrl/#{tpl}'") end end context 'when the tpl is not found' do let(:tpl) { 'not_there' } it 'raises an error' do expect { formatter.view_path(tpl) }.to raise_error("View not found for base/ctrl/#{tpl}") end end context 'when the tpl is found' do after { expect(formatter.view_path(@tpl)).to eq @expected.to_s } context 'if it\'s a global tpl' do it 'returns its path' do @expected = FIXTURES_VIEWS.join('base', 'test.erb') @tpl = '@test' end end context 'if it\s a local tpl' do it 'retuns its path' do @expected = FIXTURES_VIEWS.join('base', 'ctrl', 'local.erb') @tpl = 'local' end end end context 'when base_format' do subject(:formatter) { CMSScanner::Formatter::Spec::BasedFormat.new } after { expect(formatter.view_path(@tpl)).to eq @expected.to_s } context 'when the ovverided view exists' do it 'returns it' do @expected = FIXTURES_VIEWS.join('based_format', 'test.erb') @tpl = '@test' end end it 'returns the base views otherwise' do @expected = FIXTURES_VIEWS.join('base', 'ctrl', 'local.erb') @tpl = 'local' end end end describe '#views_directories' do let(:default_directories) do [Dir.home, Dir.pwd].reduce([APP_VIEWS]) do |a, e| a << Pathname.new(e).join(".#{CMSScanner.app_name}", 'views').to_s end end context 'when default directories' do its(:views_directories) { should eq(default_directories) } end context 'when adding directories' do it 'adds them' do formatter.views_directories << 'testing' expect(formatter.views_directories).to eq(default_directories << 'testing') end end end end CMSScanner-0.14.3/spec/lib/numeric_spec.rb000066400000000000000000000010631466634144200202460ustar00rootroot00000000000000# frozen_string_literal: true describe Numeric do describe '#bytes_to_human' do context 'when positive' do it 'returns the expected value' do expect(100.bytes_to_human).to eql '100 B' expect(11_497_472.bytes_to_human).to eql '10.965 MB' end end context 'when negative' do it 'uses the absolute value' do expect(-11_497_472.bytes_to_human).to eql '10.965 MB' end end context 'when zero' do it 'returns zero' do expect(0.bytes_to_human).to eql '0 B' end end end end CMSScanner-0.14.3/spec/lib/parsed_cli_spec.rb000066400000000000000000000023401466634144200207100ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::ParsedCli do subject(:parsed_cli) { described_class } let(:options) { { key: 'value', cache_ttl: 10 } } describe '#options=' do it 'sets them, reset the Browser and pass them to it' do expect(CMSScanner::Browser.instance.cache_ttl).to eql nil # Not yet set parsed_cli.options = options expect(CMSScanner::Browser.instance.cache_ttl).to eql 10 end context 'when the options are modified from the top after being passed' do it 'does not modify them' do parsed_cli.options = options options[:key3] = 'value3' expect(parsed_cli.options).to eql(key: 'value', cache_ttl: 10) end end context 'when passing nil' do it 'sets an empty hash' do parsed_cli.options = nil expect(parsed_cli.options).to eql({}) end end end describe '.options, .verbose etc' do it 'has the correct values' do parsed_cli.options = options expect(parsed_cli.options).to eql options expect(parsed_cli.verbose?).to be false expect(parsed_cli.key).to eql 'value' expect(parsed_cli.cache_ttl).to eql 10 expect(parsed_cli.nothing).to eql nil end end end CMSScanner-0.14.3/spec/lib/progressbar_null_output_spec.rb000066400000000000000000000013241466634144200236070ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::ProgressBarNullOutput do subject(:output) { described_class.new } describe '#log, #logs' do context 'when no log added' do its(:logs) { should eql([]) } end context 'when adding log' do it 'contains the added logs' do output.log 'M1' expect(output.logs).to eql(%w[M1]) output.log 'M2' expect(output.logs).to eql(%w[M1 M2]) expect(output.log).to eql(%w[M1 M2]) end it 'does not add duplicate' do output.log 'M1' output.log 'M1' output.log 'M2' expect(output.logs).to eql(%w[M1 M2]) expect(output.log).to eql(%w[M1 M2]) end end end end CMSScanner-0.14.3/spec/lib/public_suffix/000077500000000000000000000000001466634144200201075ustar00rootroot00000000000000CMSScanner-0.14.3/spec/lib/public_suffix/domain_spec.rb000066400000000000000000000024551466634144200227230ustar00rootroot00000000000000# frozen_string_literal: true describe PublicSuffix::Domain do describe '#match' do it 'returns true' do expect(PublicSuffix.parse('g.com').match('g.com')).to eql true end it 'returns true' do expect(PublicSuffix.parse('s.g.com').match('*.g.com')).to eql true end it 'returns false' do expect(PublicSuffix.parse('a.b.g.com').match('*.g.com')).to eql false end it 'returns true' do expect(PublicSuffix.parse('a.b.g.com').match('*.b.g.com')).to eql true end it 'returns true' do expect(PublicSuffix.parse('a.b.g.com').match('**.g.com')).to eql true end it 'returns false' do expect(PublicSuffix.parse('a.b.y.g.com').match('**.b.g.com')).to eql false end it 'returns false' do expect(PublicSuffix.parse('w.g.com').match('*.g2.com')).to eql false end it 'returns true' do expect(PublicSuffix.parse('a.b.g.com').match('a.b.g.com')).to eql true end it 'returns false' do expect(PublicSuffix.parse('a.b.g.com').match('a.y.g.com')).to eql false end it 'returns true' do expect(PublicSuffix.parse('a.b.c.d.g.com').match('**.c.d.g.com')).to eql true end it 'returns true' do expect(PublicSuffix.parse('a.b.c.d.g.com').match('*.b.c.d.g.com')).to eql true end end end CMSScanner-0.14.3/spec/lib/scan_spec.rb000066400000000000000000000070621466634144200175350ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Scan do subject(:scanner) { described_class.new } let(:controller) { CMSScanner::Controller } let(:target_url) { 'http://example.com/' } before do Object.send(:remove_const, :ARGV) Object.const_set(:ARGV, []) end describe '#new, #controllers' do its(:controllers) { should eq([controller::Core.new]) } it 'sets the CMSScanner.start_memory' do CMSScanner.start_memory = 0 # to avoid getting it from previous specs described_class.new expect(CMSScanner.start_memory).to be_positive end end describe '#run' do after do scanner.run if defined?(run_error) expect(scanner.run_error).to be_a run_error.class expect(scanner.run_error.message).to eql run_error.message end end it 'runs the controlllers and calls the formatter#beautify' do expect(scanner.controllers).to receive(:run).ordered expect(scanner.formatter).to receive(:beautify).ordered end context 'when no required option supplied' do it 'calls the formatter to display the usage view' do expect(scanner.formatter).to receive(:output) .with('@usage', msg: 'One of the following options is required: --url, --help, --hh, --version') end end context 'when an error is raised by OptParseValidator' do it 'aborts the scan with the correct output (ie w/o the url key)' do expect(scanner.controllers.option_parser).to receive(:results).and_return({}) expect(scanner.controllers.first).to receive(:before_scan).and_raise(OptParseValidator::Error, 'cli option') expect(scanner.formatter).to receive(:output).with( '@scan_aborted', { reason: 'cli option', trace: anything, verbose: false } ) end end context 'when an Interrupt is raised during the scan' do it 'aborts the scan with the correct output' do expect(scanner.controllers.option_parser).to receive(:results).and_return({ url: target_url }) expect(scanner.controllers.first).to receive(:before_scan).and_raise(Interrupt) expect(scanner.formatter).to receive(:output).with( '@scan_aborted', { reason: 'Canceled by User', trace: anything, verbose: false, url: target_url } ) end end { NoMemoryError.new => true, ScriptError.new => true, SecurityError.new => true, SignalException.new('SIGTERM') => true, Interrupt.new('Canceled by User') => false, RuntimeError.new('error spotted') => true, CMSScanner::Error::Standard.new('aa') => false, CMSScanner::Error::MaxScanDurationReached.new => false, SystemStackError.new => true }.each do |error, expected_verbose| context "when an/a #{error.class} is raised during the scan" do let(:run_error) { error } it 'aborts the scan with the associated output' do expect(scanner.controllers.option_parser).to receive(:results).and_return({ url: target_url }) expect(scanner.controllers.first) .to receive(:before_scan) .and_raise(run_error.class, run_error.message) expect(scanner.formatter).to receive(:output).with( '@scan_aborted', { reason: run_error.message, trace: anything, verbose: expected_verbose, url: target_url } ) end end end end describe '#datastore' do its(:datastore) { should eq({}) } end describe '#exit_hook' do # No idea how to test that, maybe with another at_exit hook ? oO xit end end CMSScanner-0.14.3/spec/lib/sub_scanner_spec.rb000066400000000000000000000104661466634144200211150ustar00rootroot00000000000000# frozen_string_literal: true describe 'SubScanner' do before :all do # Module including the CMSScanner to test its correct inclusion module SubScanner include CMSScanner # Override to make sure it can be overriden def self.app_name 'subscanner' end VERSION = '1.0-Spec' APP_DIR = '/tmp/sub_scanner/spec' # This Target class should be called in the CMSScanner::Controller::Base # instead of the CMSScanner::Target class Target < CMSScanner::Target def new_method 'working' end end class ParsedCli < CMSScanner::ParsedCli end # Testing the override of the register_options_files class Controllers < CMSScanner::Controllers def register_config_files option_parser.config_files << File.join(".#{SubScanner.app_name}", 'rspec.yml') end end # Custom method for all formatters module Formatter include CMSScanner::Formatter # Implements a #custom method which should be available in all formatters module InstanceMethods def custom 'It Works!' end end end end CMSScanner::Controller::Base.reset CMSScanner::Browser.reset end after :all do CMSScanner.send(:remove_const, :NS) CMSScanner.const_set(:NS, CMSScanner) CMSScanner::Controller::Base.reset end subject(:scanner) { SubScanner::Scan.new } let(:formatter_class) { SubScanner::Formatter } let(:target_url) { 'http://ex.lo/' } context 'when no CLI options given' do it 'runs the controlllers and calls the formatter in the correct order' do expect(scanner.controllers).to receive(:run).ordered.and_call_original expect(scanner.formatter).to receive(:output) .ordered .with('@usage', msg: 'One of the following options is required: --url, --help, --hh, --version') expect(scanner.formatter).to receive(:beautify).ordered scanner.run end end context 'when CLI options provided' do before do SubScanner::ParsedCli.options = { url: target_url } end describe '#app_name' do it 'returns the correct app_name' do expect(SubScanner.app_name).to eql 'subscanner' end end describe 'Browser#default_user_agent' do it 'returns the correct user_agent' do expect(SubScanner::Browser.instance.default_user_agent).to eql 'SubScanner v1.0-Spec' end end describe 'Controllers' do describe '#target' do it 'loads the overrided Target class' do target = scanner.controllers.first.target expect(target).to be_a SubScanner::Target expect(target).to respond_to(:new_method) expect(target.new_method).to eq 'working' expect(target.url).to eql target_url end end describe '#register_config_files' do let(:config_file_path) { '.subscanner/rspec.yml' } it 'register the correct file' do allow(File).to receive(:exist?).and_call_original allow(File).to receive(:exist?).with(config_file_path).and_return(true) option_parser = SubScanner::Scan.new.controllers.option_parser expect(option_parser.config_files.map(&:path)).to eql [config_file_path] end end end describe 'Controller::Base#tmp_directory' do it 'returns the expected value' do expect(scanner.controllers.first.tmp_directory).to eql '/tmp/subscanner' end end describe 'Formatter' do it_behaves_like CMSScanner::Formatter::ClassMethods do subject(:formatter) { formatter_class } end describe '.load' do it 'adds the #custom method for all formatters' do formatter_class.availables.each do |format| expect(formatter_class.load(format).custom).to eql 'It Works!' end end end describe '#views_directories' do it 'returns the expected paths' do expect(scanner.formatter.views_directories).to eql( [ CMSScanner::APP_DIR, SubScanner::APP_DIR, File.join(Dir.home, '.subscanner'), File.join(Dir.pwd, '.subscanner') ].reduce([]) do |a, e| a << File.join(e, 'views') end ) end end end end end CMSScanner-0.14.3/spec/lib/target/000077500000000000000000000000001466634144200165335ustar00rootroot00000000000000CMSScanner-0.14.3/spec/lib/target/hashes_spec.rb000066400000000000000000000047531466634144200213560ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Target do subject(:target) { described_class.new(url) } let(:url) { 'http://e.org' } def md5sum(body) Digest::MD5.hexdigest(body) end describe '#page_hash' do after { expect(described_class.page_hash(page)).to eql @expected } context 'when the page is an url' do let(:page) { 'http://e.org/somepage.php' } it 'returns the MD5 hash of the page' do body = 'Hello World !' stub_request(:get, page).to_return(body: body) @expected = md5sum(body) end end context 'when the page is a Typhoeus::Response' do let(:page) { Typhoeus::Response.new(body: 'Hello Example!') } it 'returns the correct hash' do @expected = md5sum('Hello Example!') end end context 'when there are comments' do let(:page) do body = "yolo\n\n\nworld!" Typhoeus::Response.new(body: body) end it 'removes them' do @expected = md5sum("yolo\n\n\nworld!") end end context 'when there are script tags' do let(:page) do body = "aabbb" Typhoeus::Response.new(body: body) end it 'removes them' do @expected = md5sum('aabbb') end end end describe '#homepage_hash' do it 'returns the MD5 hash of the homepage' do body = 'Hello World' stub_request(:get, target.url).to_return(body: body) expect(target.homepage_hash).to eql md5sum(body) end end describe '#error_404_hash' do it 'returns the md5sum of the 404 page' do stub_request(:any, ERROR_404_URL_PATTERN).to_return(status: 404, body: '404 page !') expect(target.error_404_hash).to eql md5sum('404 page !') end end describe '#homepage_or_404?' do let(:page_url) { target.url('page') } before do expect(target).to receive(:homepage_hash).and_return(md5sum('Home')) expect(target).to receive(:error_404_hash).and_return(md5sum('Custom 404')) stub_request(:get, page_url).to_return(body: body) end context 'when hashes do not match' do let(:body) { 'Page!' } it 'returns false' do expect(target.homepage_or_404?(page_url)).to eql false end end context 'when hashes match' do let(:body) { 'Custom 404' } it 'returns true' do expect(target.homepage_or_404?(page_url)).to eql true end end end end CMSScanner-0.14.3/spec/lib/target/platforms_spec.rb000066400000000000000000000006261466634144200221050ustar00rootroot00000000000000# frozen_string_literal: true [:PHP].each do |platform| describe CMSScanner::Target do subject(:target) do described_class.new(url).extend(described_class::Platform.const_get(platform)) end let(:url) { 'http://e.org' } let(:fixtures) { FIXTURES.join('target', 'platform', platform.to_s.downcase) } it_behaves_like described_class::Platform.const_get(platform) end end CMSScanner-0.14.3/spec/lib/target/scope_spec.rb000066400000000000000000000115471466634144200212130ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Target do subject(:target) { described_class.new(url, opts) } let(:url) { 'http://e.org' } let(:fixtures) { FIXTURES.join('target', 'scope') } let(:opts) { { scope: nil } } describe '#scope' do let(:default_domains) { [PublicSuffix.parse('e.org')] } context 'when none supplied' do its('scope.domains') { should eq default_domains } end context 'when scope provided' do let(:opts) { super().merge(scope: ['*.e.org']) } its('scope.domains') { should eq default_domains << PublicSuffix.parse(opts[:scope].first) } context 'when invalid domains provided' do let(:opts) { super().merge(scope: ['wp-lamp']) } it 'adds them in the invalid_domains attribute' do expect(target.scope.domains).to eq default_domains expect(target.scope.invalid_domains).to eq opts[:scope] end end end end describe '#in_scope?' do context 'when default scope (target domain)' do [nil, '', 'http://out-of-scope.com', '//jquery.com/j.js', 'javascript:alert(3)', 'mailto:p@g.com', Addressable::URI.parse('https://out.cloudfront.net')].each do |url| it "returns false for #{url}" do expect(target.in_scope?(url)).to eql false end end ['https://e.org/file.txt', 'http://e.org/', '//e.org', Addressable::URI.parse('http://e.org')].each do |url| it "returns true for #{url}" do expect(target.in_scope?(url)).to eql true end end end context 'when custom scope' do let(:opts) { { scope: ['*.cdn.com', '192.168.1.12', '*.cloudfront.net'] } } [nil, '', 'http://out-of-scope.com', '//jquery.com/j.js', 'http://192.168.1.2/'].each do |url| it "returns false for #{url}" do expect(target.in_scope?(url)).to eql false end end %w[ https://e.org //aa.cdn.com/f.txt http://s.cdn.com/ https://192.168.1.12/h https://aa.cloudfront.net/ ].each do |url| it "returns true for #{url}" do expect(target.in_scope?(url)).to eql true end end end end describe '#in_scope_uris' do let(:res) { Typhoeus::Response.new(body: File.read(fixtures.join('index.html'))) } context 'when block given' do it 'yield the url' do expect { |b| target.in_scope_uris(res, &b) } .to yield_successive_args( [Addressable::URI.parse('http://e.org/f.txt'), Nokogiri::XML::Element], [Addressable::URI.parse('http://e.org/script/s.js'), Nokogiri::XML::Element], [Addressable::URI.parse('http://e.org/feed'), Nokogiri::XML::Element] ) end end context 'when xpath argument given' do it 'returns the expected array' do xpath = '//link[@rel="alternate" and @type="application/rss+xml"]/@href' expect(target.in_scope_uris(res, xpath)).to eql([Addressable::URI.parse('http://e.org/feed')]) end end context 'when no block given' do after { expect(target.in_scope_uris(res)).to eql @expected } context 'when default scope' do it 'returns the expected array' do @expected = %w[http://e.org/f.txt http://e.org/script/s.js http://e.org/feed].map { |url| Addressable::URI.parse(url) } end end context 'when supplied scope' do let(:opts) { super().merge(scope: ['*.cdn.com', 'wp-lamp']) } it 'returns the expected array' do @expected = %w[http://e.org/f.txt https://a.cdn.com/f2.js http://e.org/script/s.js http://wp-lamp/robots.txt http://e.org/feed].map { |url| Addressable::URI.parse(url) } end end end end describe '#scope_url_pattern' do context 'when no scope given' do its(:scope_url_pattern) { should eql %r{https?:\\?/\\?/(?:e\.org)\\?/?}i } context 'when target is an invalid domain for PublicSuffix' do let(:url) { 'http://wp_lab/' } its(:scope_url_pattern) { should eql %r{https?:\\?/\\?/(?:wp_lab)\\?/?}i } end context 'when a port is present in the target URL' do let(:url) { 'http://wp.lab:82/aa' } its(:scope_url_pattern) { should eql %r{https?:\\?/\\?/(?:wp\.lab(?::\d+)?\\?/aa)\\?/?}i } its(:scope_url_pattern) { should match 'https://wp.lab:82/aa' } end end context 'when scope given' do let(:opts) { super().merge(scope: ['*.cdn.org', 'wp_lamp', '192.168.1.1']) } its(:scope_url_pattern) { should eql %r{https?:\\?/\\?/(?:e\.org|.*\.cdn\.org|192\.168\.1\.1|wp_lamp)\\?/?}i } context 'when target URL has a subdir' do let(:url) { 'https://e.org/blog/test' } its(:scope_url_pattern) do should eql %r{https?:\\?/\\?/(?:e\.org\\?/blog\\?/test|.*\.cdn\.org|192\.168\.1\.1|wp_lamp)\\?/?}i end end end end end CMSScanner-0.14.3/spec/lib/target/servers_spec.rb000066400000000000000000000006361466634144200215700ustar00rootroot00000000000000# frozen_string_literal: true %i[Generic Apache IIS Nginx].each do |server| describe CMSScanner::Target do subject(:target) do described_class.new(url).extend(described_class::Server.const_get(server)) end let(:url) { 'http://e.org' } let(:fixtures) { FIXTURES.join('target', 'server', server.to_s.downcase) } it_behaves_like described_class::Server.const_get(server) end end CMSScanner-0.14.3/spec/lib/target_spec.rb000066400000000000000000000131611466634144200200740ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Target do subject(:target) { described_class.new(url) } let(:url) { 'http://e.org' } let(:fixtures) { FIXTURES.join('target') } describe '#interesting_findings' do before do expect(CMSScanner::Finders::InterestingFindings::Base).to receive(:find).and_return(stubbed) end context 'when no findings' do let(:stubbed) { [] } its(:interesting_findings) { should eq stubbed } end context 'when findings' do let(:stubbed) { ['yolo'] } it 'allows findings to be added with <<' do expect(target.interesting_findings).to eq stubbed target.interesting_findings << 'other-finding' expect(target.interesting_findings).to eq(stubbed << 'other-finding') end end end describe '#vulnerable' do it 'raises an error' do expect { target.vulnerable? }.to raise_error(NotImplementedError) end end describe '#url_pattern' do its(:url_pattern) { should eql %r{https?:\\?/\\?/e\.org\\?/}i } its(:url_pattern) { should match 'https:\/\/e.org\/' } context 'when already https protocol' do let(:url) { 'htTpS://ex.com/' } its(:url_pattern) { should eql %r{https?:\\?/\\?/ex\.com\\?/}i } end end describe '#xpath_pattern_from_page' do # Handled in #comments_from_page & #javascripts_from_page end describe '#comments_from_page' do let(:fixture) { fixtures.join('comments.html') } let(:page) { Typhoeus::Response.new(body: File.read(fixture)) } context 'when the pattern does not match anything' do it 'returns an empty array' do expect(target.comments_from_page(/none/, page)).to eql([]) end end context 'when the pattern matches' do let(:pattern) { /all in one seo pack/i } let(:s1) { 'All in One SEO Pack 2.2.5.1 by Michael Torbert of Semper Fi Web Design' } let(:s2) { '/all in one seo pack' } context 'when no block given' do it 'returns the expected matches' do results = target.comments_from_page(pattern, page) [s1, s2].each_with_index do |s, i| expect(results[i].first).to eql s.match(pattern) expect(results[i].last.to_s).to eql "" end end end # The below doesn't work, dunno why # Would need to find a way to ensure the MatchData and XML::Comment are correct context 'when block given' do it 'yield the MatchData' do expect { |b| target.comments_from_page(pattern, page, &b) } .to yield_successive_args( [MatchData, Nokogiri::XML::Comment], [MatchData, Nokogiri::XML::Comment] ) end end end context 'when invalid byte sequence' do let(:page) { Typhoeus::Response.new(body: "") } it 'does not raise an error' do expect { target.comments_from_page(/none/, page) }.to_not raise_error end end end describe '#javascripts_from_page' do let(:fixture) { fixtures.join('javascripts.html') } let(:page) { Typhoeus::Response.new(body: File.read(fixture)) } context 'when the pattern does not match anything' do it 'returns an empty array' do expect(target.javascripts_from_page(/none/, page)).to eql([]) end end context 'when the pattern matches' do let(:pattern) { /_version =/i } let(:s) { "var _version = '1.2.4';" } context 'when no block given' do it 'returns the expected matches' do results = target.javascripts_from_page(pattern, page) expect(results[0].first).to eql s.match(pattern) expect(results[0].last.text.to_s).to eql s end end # The below doesn't work, dunno why # # Would need to find a way to ensure the MatchData and XML::Element are correct context 'when block given' do it 'yield the MatchData' do expect { |b| target.javascripts_from_page(pattern, page, &b) } .to yield_successive_args( [MatchData, Nokogiri::XML::Element] ) end end end end describe '#uris_from_page' do let(:page) { Typhoeus::Response.new(body: File.read(fixtures.join('uris_from_page.html'))) } context 'when block given' do it 'yield the url' do expect { |b| target.uris_from_page(page, &b) } .to yield_successive_args( [Addressable::URI.parse('http://e.org/f.txt'), Nokogiri::XML::Element], [Addressable::URI.parse('https://cdn.e.org/f2.js'), Nokogiri::XML::Element], [Addressable::URI.parse('http://e.org/script/s.js'), Nokogiri::XML::Element], [Addressable::URI.parse('http://wp-lamp/feed.xml'), Nokogiri::XML::Element], [Addressable::URI.parse('http://g.com/img.jpg'), Nokogiri::XML::Element], [Addressable::URI.parse('http://g.org/logo.png'), Nokogiri::XML::Element] ) end end context 'when no block given' do it 'returns the expected array' do expect(target.uris_from_page(page)).to eql( %w[ http://e.org/f.txt https://cdn.e.org/f2.js http://e.org/script/s.js http://wp-lamp/feed.xml http://g.com/img.jpg http://g.org/logo.png ].map { |url| Addressable::URI.parse(url) } ) end context 'when xpath argument given' do it 'returns the expected array' do xpath = '//link[@rel="alternate" and @type="application/rss+xml"]/@href' expect(target.uris_from_page(page, xpath)).to eql([Addressable::URI.parse('http://wp-lamp/feed.xml')]) end end end end end CMSScanner-0.14.3/spec/lib/typhoeus/000077500000000000000000000000001466634144200171255ustar00rootroot00000000000000CMSScanner-0.14.3/spec/lib/typhoeus/response_spec.rb000066400000000000000000000012221466634144200223170ustar00rootroot00000000000000# frozen_string_literal: true describe Typhoeus::Response do subject(:response) { Typhoeus::Response.new(opts) } let(:opts) { { body: 'hello world' } } describe 'html' do its(:xml) { should be_a Nokogiri::XML::Document } end describe 'xml' do its(:xml) { should be_a Nokogiri::XML::Document } end describe 'request_size' do its(:request_size) { should eql 0 } end describe 'size' do context 'when no headers' do its(:size) { should eql 11 } end context 'when headers' do let(:opts) { super().merge(response_headers: "key: value\r\n") } its(:size) { should eql 23 } end end end CMSScanner-0.14.3/spec/lib/vulnerability_spec.rb000066400000000000000000000021171466634144200214760ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::Vulnerability do subject(:vuln) { described_class.new(title, references: references, cvss: cvss) } let(:title) { 'Test Vuln' } let(:references) { {} } let(:cvss) { nil } it_behaves_like CMSScanner::References describe '#new' do its(:title) { should eql title } its(:references) { should eql({}) } its(:type) { should eql nil } its(:fixed_in) { should eql nil } its(:introduced_in) { should eql nil } its(:cvss) { should eql nil } context 'when CVSS' do let(:cvss) { { score: '5.4', vector: 'spec', y: 'key should not be added' } } its(:cvss) { should eql({ score: '5.4', vector: 'spec' }) } end end describe '#==' do context 'when the same vuln' do let(:cvss) { { score: '5.4', vector: 'spec' } } it 'returns true' do expect(vuln).to eq vuln.dup end end context 'when not equal' do it 'returns false' do expect(vuln).to_not eq described_class.new('not eq') end end end end CMSScanner-0.14.3/spec/lib/web_site_spec.rb000066400000000000000000000206771466634144200204210ustar00rootroot00000000000000# frozen_string_literal: true describe CMSScanner::WebSite do subject(:web_site) { described_class.new(url, opts) } let(:url) { 'http://e.org' } let(:opts) { {} } describe '#url=' do context 'when the url is incorrect' do after do expect { web_site.url = @url }.to raise_error Addressable::URI::InvalidURIError end it 'raises an error if empty' do @url = '' end it 'raises an error if wrong format' do @url = 'jj' end end context 'when valid' do it 'creates an Addressable object and adds a traling slash' do web_site.url = 'http://site.com' expect(web_site.url).to eq('http://site.com/') expect(web_site.uri).to be_a Addressable::URI end it 'does not modify the original url given' do url = 'http://site.com' web_site.url = url expect(url).to eql('http://site.com') expect(web_site.url).to eq('http://site.com/') end end context 'when non ascii chars' do it 'normalize it' do web_site.url = 'http://пример.испытание/' expect(web_site.url).to eql 'http://xn--e1afmkfd.xn--80akhbyknj4f/' end end end describe '#url' do context 'when no path argument' do its(:url) { should eql 'http://e.org/' } end context 'when a path argument' do it 'appends the path' do expect(web_site.url('file.txt')).to eql "#{url}/file.txt" end it 'encodes the path' do expect(web_site.url('f ile.txt')).to eql "#{url}/f%20ile.txt" expect(web_site.url('s/a%.txt')).to eql "#{url}/s/a%25.txt" expect(web_site.url('#file.txt#')).to eql "#{url}/%23file.txt%23" end context 'when relative path' do let(:url) { 'http://e.org/dir/' } it 'appends it from the host/domain' do expect(web_site.url('/sub/file.txt')).to eql 'http://e.org/sub/file.txt' end end end end describe '#ip' do context 'when target host not known' do let(:url) { 'http://lab.local' } its(:ip) { should eql 'Unknown' } end context 'when target host known' do before { expect(IPSocket).to receive(:getaddress).and_return('127.0.0.1') } its(:ip) { should eql '127.0.0.1' } end end describe '#error_404_res' do before { stub_request(:any, /[a-z\d]{6}\.html/).to_return(stubbed_response) } context 'when no redirect' do let(:stubbed_response) { { status: 200, body: 'hello world!' } } its('error_404_res.body') { should eql 'hello world!' } end # TODO: Uncomment when webmock supports redirects # context 'when redirect' do # let(:redirect) { web_site.url('redirect') } # let(:stubbed_response) { { status: 302, headers: { 'Location' => redirect } } } # before { stub_request(:get, redirect).to_return(status: 200, body: 'redirected!') } # its('error_404_res.body') { should eql 'redirected!' } # end end describe '#error_404_url' do its(:error_404_url) { should match ERROR_404_URL_PATTERN } it 'returns the same url when called more than once' do url1 = web_site.error_404_url url2 = web_site.error_404_url expect(url1).to eql url2 end end describe '#opts' do its(:opts) { should eql({}) } context 'when opts' do let(:opts) { { test: 'mm' } } its(:opts) { should eql opts } end end describe '#online?, #http_auth?, #access_forbidden?, #proxy_auth?' do before { stub_request(:get, web_site.url(path)).to_return(status: status) } [nil, 'file-path.txt'].each do |p| context "when path = #{p}" do let(:path) { p } context 'when response status is a 200' do let(:status) { 200 } it 'is considered fine' do expect(web_site.online?(path)).to be true expect(web_site.http_auth?(path)).to be false expect(web_site.access_forbidden?(path)).to be false expect(web_site.proxy_auth?(path)).to be false end end context 'when offline' do let(:status) { 0 } it 'returns false' do expect(web_site.online?(path)).to be false end end context 'when http auth required' do let(:status) { 401 } it 'returns true' do expect(web_site.http_auth?(path)).to be true end end context 'when access is forbidden' do let(:status) { 403 } it 'return true' do expect(web_site.access_forbidden?(path)).to be true end end context 'when proxy auth required' do let(:status) { 407 } it 'returns true' do expect(web_site.proxy_auth?(path)).to be true end end end end end describe '#head_or_get_params' do context 'when not already checked' do before do stub_request(:get, web_site.url) stub_request(:head, web_site.homepage_url).to_return(status: status) end context 'when HEAD dropped/timeout' do let(:status) { 0 } its(:head_or_get_params) { should eql(method: :get, maxfilesize: 1) } end context 'when HEAD not supported' do let(:status) { 405 } its(:head_or_get_params) { should eql(method: :get, maxfilesize: 1) } end context 'when HEAD not implemented' do let(:status) { 501 } its(:head_or_get_params) { should eql(method: :get, maxfilesize: 1) } end context 'when HEAD supported' do let(:status) { 200 } its(:head_or_get_params) { should eql(method: :head) } end end context 'when already set' do it 'returns it' do web_site.instance_variable_set(:@head_or_get_params, method: :head) expect(web_site.head_or_get_params).to eql(method: :head) end end end describe '#head_and_get' do before { expect(web_site).to receive(:head_or_get_params).and_return(method: :head) } let(:path) { 'something' } context 'when no request params given' do before { stub_request(:head, web_site.url(path)).to_return(status: status) } context 'when HEAD response status is not in the codes given' do let(:status) { 404 } after do expect(@res).to be_a(Typhoeus::Response) expect(@res.code).to eql status expect(@res.request.options[:method]).to eql :head expect(@res.body).to be_empty end context 'when codes not provided' do it 'uses the default [200] and returns the HEAD response' do @res = web_site.head_and_get(path) end end context 'when codes provided' do it 'uses them and returns the HEAD response' do @res = web_site.head_and_get(path, [400]) end end end context 'when HEAD response status is in the codes given' do before { stub_request(:get, web_site.url(path)).to_return(status: status, body: 'hello') } after do expect(@res).to be_a(Typhoeus::Response) expect(@res.code).to eql status expect(@res.request.options[:method]).to eql :get expect(@res.body).to eql 'hello' end context 'when codes not provided' do let(:status) { 200 } it 'uses the default [200] and returns the GET response' do @res = web_site.head_and_get(path) end end context 'when codes provided' do let(:status) { 400 } it 'uses them and returns the GET response' do @res = web_site.head_and_get(path, [400]) end end end end context 'when request params given' do let(:status) { 200 } before do stub_request(:head, web_site.url(path)).with(headers: { 'Key' => 'Hello' }) stub_request(:get, web_site.url(path)) .with(query: { k: 'value' }) .and_return(status: 400, body: 'done') end it 'perform the requests with the expected params' do res = web_site.head_and_get(path, [200], head: { headers: { 'Key' => 'Hello' } }, get: { params: { k: 'value' } }) expect(res).to be_a Typhoeus::Response expect(res.code).to eql 400 expect(res.request.options[:method]).to eql :get expect(res.body).to eql 'done' end end end end CMSScanner-0.14.3/spec/output/000077500000000000000000000000001466634144200160375ustar00rootroot00000000000000CMSScanner-0.14.3/spec/output/core/000077500000000000000000000000001466634144200167675ustar00rootroot00000000000000CMSScanner-0.14.3/spec/output/core/finished.cli_no_colour000066400000000000000000000002711466634144200233300ustar00rootroot00000000000000 [+] Finished: Thu Oct 30 12:02:03 2014 [+] Requests Done: 10 [+] Cached Requests: 1 [+] Data Sent: 1000 B [+] Data Received: 1.953 KB [+] Memory used: 100 B [+] Elapsed time: 00:00:02 CMSScanner-0.14.3/spec/output/core/finished.json000066400000000000000000000004201466634144200214470ustar00rootroot00000000000000{ "stop_time": 1414670523, "elapsed": 2, "requests_done": 10, "cached_requests": 1, "data_sent": 1000, "data_sent_humanised": "1000 B", "data_received": 2000, "data_received_humanised": "1.953 KB", "used_memory": 100, "used_memory_humanised": "100 B" }CMSScanner-0.14.3/spec/output/core/help.cli_no_colour000066400000000000000000000000371466634144200224670ustar00rootroot00000000000000Help Message from OptionParser CMSScanner-0.14.3/spec/output/core/help.json000066400000000000000000000000561466634144200206130ustar00rootroot00000000000000{ "help": "Help Message from OptionParser" }CMSScanner-0.14.3/spec/output/core/started.cli_no_colour000066400000000000000000000001121466634144200231770ustar00rootroot00000000000000[+] URL: http://e.org/ [127.0.0.1] [+] Started: Thu Oct 30 12:02:01 2014 CMSScanner-0.14.3/spec/output/core/started.json000066400000000000000000000002251466634144200213270ustar00rootroot00000000000000{ "start_time": 1414670521, "start_memory": 10, "target_url": "http://e.org/", "target_ip": "127.0.0.1", "effective_url": "http://e.org/" }CMSScanner-0.14.3/spec/output/core/started_effective_url.cli_no_colour000066400000000000000000000001571466634144200261120ustar00rootroot00000000000000[+] URL: http://e.org/ [127.0.0.1] [+] Effective URL: http://e.org/home [+] Started: Thu Oct 30 12:02:01 2014 CMSScanner-0.14.3/spec/output/core/started_effective_url.json000066400000000000000000000002311466634144200242260ustar00rootroot00000000000000{ "start_time": 1414670521, "start_memory": 10, "target_url": "http://e.org/", "target_ip": "127.0.0.1", "effective_url": "http://e.org/home" }CMSScanner-0.14.3/spec/output/interesting_findings/000077500000000000000000000000001466634144200222535ustar00rootroot00000000000000CMSScanner-0.14.3/spec/output/interesting_findings/empty.cli_no_colour000066400000000000000000000000011466634144200261500ustar00rootroot00000000000000 CMSScanner-0.14.3/spec/output/interesting_findings/empty.json000066400000000000000000000000441466634144200243020ustar00rootroot00000000000000{ "interesting_findings": [ ] }CMSScanner-0.14.3/spec/output/interesting_findings/findings.cli_no_colour000066400000000000000000000007121466634144200266240ustar00rootroot00000000000000Interesting Finding(s): [+] F1_to_s | Found By: Test (Passive) | Confidence: 10% [+] F2 | Interesting Entry: IE1 | Found By: Spec | Confidence: 20% | Confirmed By: Spec2, 10% confidence | Reference: R1 [+] F3 | Interesting Entries: | - IE1 | - IE2 | Found By: Spec | Confidence: 100% | Confirmed By: | - Spec2, 100% confidence | - Spec3, 10% confidence | References: | - R1 | - R2 [+] F4 | Found By: Spec | Confirmed By: Spec2 CMSScanner-0.14.3/spec/output/interesting_findings/findings.json000066400000000000000000000025561466634144200247570ustar00rootroot00000000000000{ "interesting_findings": [ { "url": "F1", "to_s": "F1_to_s", "type": "interesting_finding", "found_by": "Test (Passive)", "confidence": 10, "confirmed_by": { }, "references": { }, "interesting_entries": [ ] }, { "url": "F2", "to_s": "F2", "type": "interesting_finding", "found_by": "Spec", "confidence": 20, "confirmed_by": { "Spec2": { "confidence": 10 } }, "references": { "url": [ "R1" ] }, "interesting_entries": [ "IE1" ] }, { "url": "F3", "to_s": "F3", "type": "interesting_finding", "found_by": "Spec", "confidence": 100, "confirmed_by": { "Spec2": { "confidence": 100 }, "Spec3": { "confidence": 10 } }, "references": { "url": [ "R1", "R2" ] }, "interesting_entries": [ "IE1", "IE2" ] }, { "url": "F4", "to_s": "F4", "type": "interesting_finding", "found_by": "Spec", "confidence": 0, "confirmed_by": { "Spec2": { "confidence": 0 } }, "references": { }, "interesting_entries": [ ] } ] }CMSScanner-0.14.3/spec/shared_examples.rb000066400000000000000000000011331466634144200201660ustar00rootroot00000000000000# frozen_string_literal: true require 'shared_examples/browser_actions' require 'shared_examples/formatter_buffer' require 'shared_examples/formatter_class_methods' require 'shared_examples/finding' require 'shared_examples/independent_finder' require 'shared_examples/target/platform/php' require 'shared_examples/target/server/generic' require 'shared_examples/target/server/apache' require 'shared_examples/target/server/iis' require 'shared_examples/target/server/nginx' require 'shared_examples/views/core' require 'shared_examples/views/interesting_findings' require 'shared_examples/references' CMSScanner-0.14.3/spec/shared_examples/000077500000000000000000000000001466634144200176435ustar00rootroot00000000000000CMSScanner-0.14.3/spec/shared_examples/browser_actions.rb000066400000000000000000000030561466634144200233770ustar00rootroot00000000000000# frozen_string_literal: true shared_examples CMSScanner::Browser::Actions do let(:url) { 'http://example.com/file.txt' } let(:browser) { CMSScanner::Browser } describe '#forge_request' do # Tested from #get etc end describe '#get, #post, #head' do %i[get post head].each do |method| it 'calls the method and returns a Typhoeus::Response' do stub_request(method, url) expect(browser.send(method, url)).to be_a Typhoeus::Response end end end describe '#get_and_follow_location' do let(:redirection) { 'http://redirect.me' } it 'follows the location' do stub_request(:get, url).to_return(status: 301, headers: { location: redirection }) stub_request(:get, redirection).to_return(status: 200, body: 'Got me') response = browser.get_and_follow_location(url) expect(response).to be_a Typhoeus::Response # Line below is not working due to an issue in Typhoeus/Webmock # See https://github.com/typhoeus/typhoeus/issues/279 # expect(response.body).to eq 'Got me' end context 'maxredirs is present in the params' do it 'overrides the default value' do expect(browser).to receive(:get).with(url, hash_including(maxredirs: 10)) browser.get_and_follow_location(url, maxredirs: 10) end end context 'maxredirs is no present in the params' do it 'uses the default value' do expect(browser).to receive(:get).with(url, hash_including(maxredirs: 3)) browser.get_and_follow_location(url) end end end end CMSScanner-0.14.3/spec/shared_examples/finding.rb000066400000000000000000000030051466634144200216040ustar00rootroot00000000000000# frozen_string_literal: true shared_examples CMSScanner::Finders::Finding do it_behaves_like CMSScanner::References do let(:opts) { { references: references } } let(:references) { {} } end %i[confirmed_by interesting_entries].each do |opt| describe "##{opt}" do its(opt) { should eq [] } context 'when supplied in the #new' do let(:opts) { { opt => 'test' } } its(opt) { should eq 'test' } end end end describe '#confidence, #confidence=' do its(:confidence) { should eql 0 } context 'when already set' do before { subject.confidence = 10 } its(:confidence) { should eql 10 } end context 'when another confidence added' do it 'adds it the the actual' do subject.confidence += 30 expect(subject.confidence).to eql 30 end it 'sets it to 100 if >= 100' do subject.confidence += 120 expect(subject.confidence).to eql 100 end end end describe '#parse_finding_options' do xit end describe '#eql?' do before do subject.confidence = 10 subject.found_by = 'test' end context 'when eql' do it 'returns true' do expect(subject).to eql subject end end context 'when not eql' do it 'returns false' do other = subject.dup other.confidence = 20 expect(subject).to_not eql other end end end describe '#<=>' do # Handled in spec/app/models/interesting_findings_spec end end CMSScanner-0.14.3/spec/shared_examples/formatter_buffer.rb000066400000000000000000000002271466634144200235250ustar00rootroot00000000000000# frozen_string_literal: true shared_examples CMSScanner::Formatter::Buffer do describe '#buffer' do its(:buffer) { should be_empty } end end CMSScanner-0.14.3/spec/shared_examples/formatter_class_methods.rb000066400000000000000000000013501466634144200251020ustar00rootroot00000000000000# frozen_string_literal: true shared_examples CMSScanner::Formatter::ClassMethods do describe '#load' do context 'w/o parameter' do it 'loads the default formatter' do expect(subject.load).to be_a subject::Cli end end it 'loads the correct formatter' do expect(subject.load('cli_no_colour')).to be_a subject::CliNoColour end it 'adds the custom_views' do formatter = subject.load(nil, %w[/path/views1 /path2/views]) expect(formatter.views_directories).to include('/path/views1', '/path2/views') end end describe '#availables' do it 'returns the right list' do expect(subject.availables).to match_array(%w[json cli-no-colour cli-no-color cli]) end end end CMSScanner-0.14.3/spec/shared_examples/independent_finder.rb000066400000000000000000000014661466634144200240230ustar00rootroot00000000000000# frozen_string_literal: true shared_examples CMSScanner::Finders::IndependentFinder do describe '::find' do it 'creates a new object and call finders#find' do created = described_class.new(target) expect(described_class).to receive(:new).and_return(created) expect(created).to receive(:find) described_class.find(target) end end describe '#find' do it 'calls finders#run' do expect(subject.finders).to receive(:run).with({}) subject.find end end describe '#finders' do its(:finders) { should be_a expected_finders_class } it 'returns the correct finders' do finders = subject.finders expect(finders.size).to eq expected_finders.size expect(finders.map { |f| f.class.to_s.demodulize }).to eq expected_finders end end end CMSScanner-0.14.3/spec/shared_examples/references.rb000066400000000000000000000120511466634144200223100ustar00rootroot00000000000000# frozen_string_literal: true shared_examples CMSScanner::References do describe '#references_keys' do it 'returns the expected array of symbols' do expect(subject.class.references_keys) .to eql %i[cve exploitdb url metasploit packetstorm securityfocus youtube] end end describe 'references' do context 'when no references' do %i[cves exploitdb_ids urls msf_modules packetstorm_ids securityfocus_ids youtube_urls].each do |attribute| its(attribute) { should eql([]) } end %i[cve_urls exploitdb_urls msf_urls packetstorm_urls securityfocus_urls youtube_urls].each do |attribute| its(attribute) { should eql([]) } end its(:references_urls) { should eql([]) } end context 'when an unknown reference key is provided' do let(:references) { { cve: 1, unknown: 12 } } its(:references) { should eql(cve: %w[1]) } end context 'when references provided as string/integer' do let(:references) do { cve: '11', secunia: '12', # Secunia and OSVDB have been left here to make sure they don't raise errors osvdb: '13', exploitdb: '14', url: 'single-url', metasploit: '/exploit/yolo', packetstorm: 15, securityfocus: 16, youtube: 'xAAAA' } end its(:cves) { should eql %w[11] } its(:cve_urls) { should eql %w[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-11] } its(:exploitdb_ids) { should eql %w[14] } its(:exploitdb_urls) { should eql %w[https://www.exploit-db.com/exploits/14/] } its(:urls) { should eql %w[single-url] } its(:msf_modules) { should eql %w[/exploit/yolo] } its(:msf_urls) { should eql %w[https://www.rapid7.com/db/modules/exploit/yolo/] } its(:packetstorm_ids) { should eq %w[15] } its(:packetstorm_urls) { should eql %w[https://packetstormsecurity.com/files/15/] } its(:securityfocus_ids) { should eq %w[16] } its(:securityfocus_urls) { should eql %w[https://www.securityfocus.com/bid/16/] } its(:youtube_urls) { should eql %w[https://www.youtube.com/watch?v=xAAAA] } its(:references_urls) do should eql [ 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-11', 'https://www.exploit-db.com/exploits/14/', 'single-url', 'https://www.rapid7.com/db/modules/exploit/yolo/', 'https://packetstormsecurity.com/files/15/', 'https://www.securityfocus.com/bid/16/', 'https://www.youtube.com/watch?v=xAAAA' ] end end context 'when references provided as array' do let(:references) do { cve: [10, 11], secunia: [20, 21], # Secunia and OSVDB have been left here to make sure they don't raise errors osvdb: [30, 31], exploitdb: [40, 41], url: %w[single-url another-url], metasploit: %w[/exploit/yolo exploit/aa], packetstorm: [50, 51], securityfocus: [60, 61], youtube: %w[xBBBB] } end its(:cves) { should eql %w[10 11] } its(:cve_urls) do should eql %w[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-10 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-11] end its(:exploitdb_ids) { should eql %w[40 41] } its(:exploitdb_urls) do should eql %w[https://www.exploit-db.com/exploits/40/ https://www.exploit-db.com/exploits/41/] end its(:urls) { should eql %w[single-url another-url] } its(:msf_modules) { should eql %w[/exploit/yolo exploit/aa] } its(:msf_urls) do should eql %w[https://www.rapid7.com/db/modules/exploit/yolo/ https://www.rapid7.com/db/modules/exploit/aa/] end its(:packetstorm_ids) { should eq %w[50 51] } its(:packetstorm_urls) do should eql %w[https://packetstormsecurity.com/files/50/ https://packetstormsecurity.com/files/51/] end its(:securityfocus_ids) { should eq %w[60 61] } its(:securityfocus_urls) do should eql %w[https://www.securityfocus.com/bid/60/ https://www.securityfocus.com/bid/61/] end its(:youtube_urls) { should eql %w[https://www.youtube.com/watch?v=xBBBB] } its(:references_urls) do should eql [ 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-10', 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-11', 'https://www.exploit-db.com/exploits/40/', 'https://www.exploit-db.com/exploits/41/', 'single-url', 'another-url', 'https://www.rapid7.com/db/modules/exploit/yolo/', 'https://www.rapid7.com/db/modules/exploit/aa/', 'https://packetstormsecurity.com/files/50/', 'https://packetstormsecurity.com/files/51/', 'https://www.securityfocus.com/bid/60/', 'https://www.securityfocus.com/bid/61/', 'https://www.youtube.com/watch?v=xBBBB' ] end end end end CMSScanner-0.14.3/spec/shared_examples/target/000077500000000000000000000000001466634144200211315ustar00rootroot00000000000000CMSScanner-0.14.3/spec/shared_examples/target/platform/000077500000000000000000000000001466634144200227555ustar00rootroot00000000000000CMSScanner-0.14.3/spec/shared_examples/target/platform/php.rb000066400000000000000000000060111466634144200240670ustar00rootroot00000000000000# frozen_string_literal: true shared_examples CMSScanner::Target::Platform::PHP do before do if /\.log\z/i.match?(path) expect(target).to receive(:head_or_get_params).and_return(method: :head) stub_request(:head, target.url(path)).and_return(status: head_status) if head_status == 200 stub_request(:get, target.url(path)) .with(headers: { 'Range' => 'bytes=0-700' }) .to_return(body: body) end else stub_request(:get, target.url(path)).to_return(body: body) end end describe '#debug_log?' do let(:path) { 'd.log' } context 'when the HEAD status is a 404' do let(:head_status) { 404 } it 'returns false' do expect(target.debug_log?(path)).to be false end end context 'when the HEAD status is a 200' do let(:head_status) { 200 } context 'when the body matches' do %w[debug.log db_error.log].each do |file| context "when #{file} body" do let(:body) { File.read(fixtures.join('debug_log', file)) } it 'returns true' do expect(target.debug_log?(path)).to be true end end end end context 'when the body does not match' do let(:body) { '' } it 'returns false' do expect(target.debug_log?(path)).to be false end end end end describe '#error_log?' do let(:path) { 'error.log' } context 'when the HEAD status is a 404' do let(:head_status) { 404 } it 'returns false' do expect(target.error_log?(path)).to be false end end context 'when the HEAD status is a 200' do let(:head_status) { 200 } context 'when the body matches' do %w[error.log].each do |file| context "when #{file} body" do let(:body) { File.read(fixtures.join('error_log', file)) } it 'returns true' do expect(target.error_log?(path)).to be true end end end end context 'when the body does not match' do let(:body) { '' } it 'returns false' do expect(target.error_log?(path)).to be false end end end end describe '#full_path_disclosure?, #full_path_disclosure_entries' do let(:path) { 'p.php' } context 'when the body matches a FPD' do { 'wp_rss_functions.php' => %w[/short-path/rss-f.php] }.each do |file, expected| context "when #{file} body" do let(:body) { File.read(fixtures.join('fpd', file)) } it 'returns the expected array' do expect(target.full_path_disclosure_entries(path)).to eql expected expect(target.full_path_disclosure?(path)).to be true end end end end context 'when no FPD' do let(:body) { '' } it 'returns an empty array' do expect(target.full_path_disclosure_entries(path)).to eq [] expect(target.full_path_disclosure?(path)).to be false end end end end CMSScanner-0.14.3/spec/shared_examples/target/server/000077500000000000000000000000001466634144200224375ustar00rootroot00000000000000CMSScanner-0.14.3/spec/shared_examples/target/server/apache.rb000066400000000000000000000024711466634144200242110ustar00rootroot00000000000000# frozen_string_literal: true shared_examples CMSScanner::Target::Server::Apache do describe '#server' do its(:server) { should eq :Apache } end describe '#directory_listing?, #directory_listing_entries' do before { stub_request(:get, target.url(path)).to_return(body: body, status: status) } let(:path) { 'somedir' } context 'when not a 200' do let(:status) { 404 } let(:body) { '' } it 'returns false and an empty array' do expect(target.directory_listing?(path)).to be false expect(target.directory_listing_entries(path)).to eql [] end end context 'when 200' do let(:status) { 200 } let(:body) { File.read(fixtures.join('directory_listing', '2.2.16.html')) } it 'returns true and the expected array' do expect(target.directory_listing?(path)).to be true expect(target.directory_listing_entries(path)).to eq %w[backup.php database-empty.php] end end context 'when no files nor folders' do let(:status) { 200 } let(:body) { File.read(fixtures.join('directory_listing', 'empty.html')) } it 'returns true and the an empty array' do expect(target.directory_listing?(path)).to be true expect(target.directory_listing_entries(path)).to eql [] end end end end CMSScanner-0.14.3/spec/shared_examples/target/server/generic.rb000066400000000000000000000023161466634144200244020ustar00rootroot00000000000000# frozen_string_literal: true shared_examples CMSScanner::Target::Server::Generic do describe '#server' do before { stub_request(:head, target.url).to_return(headers: parse_headers_file(fixture)) } context 'when apache headers' do %w[basic.txt].each do |file| context "when #{file} headers" do let(:fixture) { fixtures.join('server', 'apache', file) } its(:server) { should eq :Apache } end end end context 'when iis headers' do %w[basic.txt].each do |file| context "when #{file} headers" do let(:fixture) { fixtures.join('server', 'iis', file) } its(:server) { should eq :IIS } end end end context 'when nginx headers' do %w[basic.txt].each do |file| context "when #{file} headers" do let(:fixture) { fixtures.join('server', 'nginx', file) } its(:server) { should eq :Nginx } end end end context 'not detected' do let(:fixture) { fixtures.join('server', 'not_detected.txt') } its(:server) { should be nil } end end describe '#directory_listing?' do # Handled in shared_examples/target/server/apache & nginx end end CMSScanner-0.14.3/spec/shared_examples/target/server/iis.rb000066400000000000000000000021131466634144200235450ustar00rootroot00000000000000# frozen_string_literal: true shared_examples CMSScanner::Target::Server::IIS do describe '#server' do its(:server) { should eq :IIS } end describe '#directory_listing?, #directory_listing_entries' do before { stub_request(:get, target.url(path)).to_return(body: body, status: status) } let(:path) { 'dir' } context 'when not a 200' do let(:status) { 404 } let(:body) { '' } it 'returns false and an empty array' do expect(target.directory_listing?(path)).to be false expect(target.directory_listing_entries(path)).to eql [] end end context 'when 200' do let(:status) { 200 } %w[with_parent.html no_parent.html].each do |file| context "when #{file} body" do let(:body) { File.read(fixtures.join('directory_listing', file)) } it 'returns true and the expected array' do expect(target.directory_listing?(path)).to be true expect(target.directory_listing_entries(path)).to eq %w[sub-dir web.config] end end end end end end CMSScanner-0.14.3/spec/shared_examples/target/server/nginx.rb000066400000000000000000000024521466634144200241120ustar00rootroot00000000000000# frozen_string_literal: true shared_examples CMSScanner::Target::Server::Nginx do describe '#server' do its(:server) { should eq :Nginx } end describe '#directory_listing?, #directory_listing_entries' do before { stub_request(:get, target.url(path)).to_return(body: body, status: status) } let(:path) { 'somedir' } context 'when not a 200' do let(:status) { 404 } let(:body) { '' } it 'returns false and an empty array' do expect(target.directory_listing?(path)).to be false expect(target.directory_listing_entries(path)).to eql [] end end context 'when 200' do let(:status) { 200 } let(:body) { File.read(fixtures.join('directory_listing', 'fanart.html')) } it 'returns true and the expected array' do expect(target.directory_listing?(path)).to be true expect(target.directory_listing_entries(path)).to eql %w[1931/ 720/ down] end end context 'when no files nor folders' do let(:status) { 200 } let(:body) { File.read(fixtures.join('directory_listing', 'empty.html')) } it 'returns true and the an empty array' do expect(target.directory_listing?(path)).to be true expect(target.directory_listing_entries(path)).to eql [] end end end end CMSScanner-0.14.3/spec/shared_examples/views/000077500000000000000000000000001466634144200210005ustar00rootroot00000000000000CMSScanner-0.14.3/spec/shared_examples/views/core.rb000066400000000000000000000033311466634144200222550ustar00rootroot00000000000000# frozen_string_literal: true shared_examples 'App::Views::Core' do let(:controller) { CMSScanner::Controller::Core.new } let(:start) { Time.at(1_414_670_521).in_time_zone('Europe/London') } let(:tpl_vars) { { url: target_url, ip: '127.0.0.1', start_time: start } } describe 'version' do let(:view) { 'version' } it 'outputs the expected string' do @tpl_vars = {} @expected_output = if parsed_options[:format] == 'json' JSON.pretty_generate('version' => CMSScanner::VERSION) else "Version: #{CMSScanner::VERSION}\n" end end end describe 'help' do let(:view) { 'help' } it 'outputs the expected string' do @tpl_vars = { help: 'Help Message from OptionParser' } end end describe 'started' do let(:view) { 'started' } context 'when the target url and the effective_url are the same' do it 'outputs the expected string' do @tpl_vars = tpl_vars.merge(start_memory: 10, effective_url: target_url) end end context 'when target url != effective_url' do let(:expected_view) { 'started_effective_url' } it 'outputs the expected string' do @tpl_vars = tpl_vars.merge(start_memory: 10, effective_url: "#{target_url}home") end end end describe 'finished' do let(:view) { 'finished' } it 'outputs the expected string' do @tpl_vars = tpl_vars.merge( stop_time: Time.at(1_414_670_523).in_time_zone('Europe/London'), used_memory: 100, elapsed: 2, requests_done: 10, cached_requests: 1, data_sent: 1000, data_received: 2000 ) end end end CMSScanner-0.14.3/spec/shared_examples/views/interesting_findings.rb000066400000000000000000000027021466634144200255420ustar00rootroot00000000000000# frozen_string_literal: true shared_examples 'App::Views::InterestingFindings' do let(:controller) { CMSScanner::Controller::InterestingFindings.new } let(:tpl_vars) { { url: target_url } } let(:interesting_file) { CMSScanner::Model::InterestingFinding } describe 'findings' do let(:view) { 'findings' } let(:opts) { { confidence: 10, found_by: 'Spec' } } context 'when empty results' do let(:expected_view) { 'empty' } it 'outputs the expected string' do @tpl_vars = tpl_vars.merge(findings: []) end end it 'outputs the expected string' do findings = CMSScanner::Finders::Findings.new findings << interesting_file.new('F1', opts.merge(to_s: 'F1_to_s', found_by: 'Test (Passive)')) << interesting_file.new('F2', opts.merge(references: { url: 'R1' }, interesting_entries: %w[IE1])) << interesting_file.new('F2', opts.merge(found_by: 'Spec2')) << interesting_file.new('F3', opts.merge(references: { url: %w[R1 R2] }, interesting_entries: %w[IE1 IE2])) << interesting_file.new('F3', opts.merge(found_by: 'Spec2', confidence: 100)) << interesting_file.new('F3', opts.merge(found_by: 'Spec3')) << interesting_file.new('F4', opts.merge(confidence: 0)) << interesting_file.new('F4', opts.merge(confidence: 0, found_by: 'Spec2')) @tpl_vars = tpl_vars.merge(findings: findings) end end end CMSScanner-0.14.3/spec/spec_helper.rb000066400000000000000000000054031466634144200173170ustar00rootroot00000000000000# frozen_string_literal: true $LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib')) require 'simplecov' # More config is defined in ./.simplecov require 'rspec/its' require 'webmock/rspec' require 'active_support' require 'active_support/time' # See http://betterspecs.org/ RSpec.configure do |config| config.expect_with :rspec do |c| c.syntax = :expect end end def count_files_in_dir(absolute_dir_path, files_pattern = '*') Dir.glob(File.join(absolute_dir_path, files_pattern)).count end # Parse a file containing raw headers and return the associated Hash # @return [ Hash ] def parse_headers_file(filepath) Typhoeus::Response::Header.new(File.read(filepath)) end require 'cms_scanner' require 'shared_examples' def rspec_parsed_options(args) controllers = CMSScanner::Controllers.new << CMSScanner::Controller::Core.new << CMSScanner::Controller::InterestingFindings.new controllers.option_parser.results(args.split) end # TODO: remove when https://github.com/bblimke/webmock/issues/552 fixed # rubocop:disable all module WebMock module HttpLibAdapters class TyphoeusAdapter < HttpLibAdapter def self.effective_url(effective_uri) effective_uri.port = nil if effective_uri.scheme == 'http' && effective_uri.port == 80 effective_uri.port = nil if effective_uri.scheme == 'https' && effective_uri.port == 443 effective_uri.to_s end def self.generate_typhoeus_response(request_signature, webmock_response) response = if webmock_response.should_timeout ::Typhoeus::Response.new( code: 0, status_message: '', body: '', headers: {}, return_code: :operation_timedout ) else ::Typhoeus::Response.new( code: webmock_response.status[0], status_message: webmock_response.status[1], body: webmock_response.body, headers: webmock_response.headers, effective_url: effective_url(request_signature.uri) ) end response.mock = :webmock response end end end end # rubocop:enabled all SPECS = Pathname.new(__FILE__).dirname CACHE = SPECS.join('cache') FIXTURES = SPECS.join('fixtures') FIXTURES_VIEWS = FIXTURES.join('views') FIXTURES_FINDERS = FIXTURES.join('finders') FIXTURES_MODELS = FIXTURES.join('models') FIXTURES_CONTROLLERS = FIXTURES.join('controllers') APP_VIEWS = File.join(CMSScanner::APP_DIR, 'views') ERROR_404_URL_PATTERN = %r{/[a-z\d]{7}\.html$}