cms_scanner 0.0.18 → 0.0.19

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (118) hide show
  1. checksums.yaml +4 -4
  2. data/app/controllers/core.rb +4 -3
  3. data/app/views/cli/core/finished.erb +1 -0
  4. data/app/views/json/core/finished.erb +1 -0
  5. data/cms_scanner.gemspec +13 -3
  6. data/lib/cms_scanner.rb +14 -2
  7. data/lib/cms_scanner/finders/finder.rb +16 -7
  8. data/lib/cms_scanner/finders/finder/enumerator.rb +4 -28
  9. data/lib/cms_scanner/finders/finder/fingerprinter.rb +60 -0
  10. data/lib/cms_scanner/finders/finding.rb +1 -1
  11. data/lib/cms_scanner/target/scope.rb +4 -1
  12. data/lib/cms_scanner/target/server/generic.rb +1 -1
  13. data/lib/cms_scanner/typhoeus/hydra.rb +10 -0
  14. data/lib/cms_scanner/version.rb +1 -1
  15. metadata +5 -203
  16. data/.gitignore +0 -7
  17. data/.rspec +0 -2
  18. data/.rubocop.yml +0 -10
  19. data/.travis.yml +0 -17
  20. data/Gemfile +0 -6
  21. data/Rakefile +0 -9
  22. data/spec/app/controllers/core_spec.rb +0 -167
  23. data/spec/app/controllers/interesting_files_spec.rb +0 -70
  24. data/spec/app/finders/interesting_files/fantastico_fileslist_spec.rb +0 -66
  25. data/spec/app/finders/interesting_files/headers_spec.rb +0 -36
  26. data/spec/app/finders/interesting_files/robots_txt_spec.rb +0 -54
  27. data/spec/app/finders/interesting_files/search_replace_db_2_spec.rb +0 -53
  28. data/spec/app/finders/interesting_files/xml_rpc_spec.rb +0 -136
  29. data/spec/app/finders/interesting_files_spec.rb +0 -12
  30. data/spec/app/formatters/cli_no_colour_spec.rb +0 -14
  31. data/spec/app/formatters/cli_spec.rb +0 -30
  32. data/spec/app/formatters/json_spec.rb +0 -30
  33. data/spec/app/models/fantastico_fileslist_spec.rb +0 -31
  34. data/spec/app/models/headers_spec.rb +0 -51
  35. data/spec/app/models/interesting_file_spec.rb +0 -69
  36. data/spec/app/models/robots_txt_spec.rb +0 -27
  37. data/spec/app/models/version_spec.rb +0 -51
  38. data/spec/app/models/xml_rpc_spec.rb +0 -46
  39. data/spec/app/views_spec.rb +0 -35
  40. data/spec/cache/.gitignore +0 -4
  41. data/spec/dummy_finding.rb +0 -25
  42. data/spec/dummy_independent_finders.rb +0 -26
  43. data/spec/dummy_unique_finders.rb +0 -33
  44. data/spec/fixtures/finders/interesting_files/fantastico_fileslist/fantastico_fileslist.txt +0 -12
  45. data/spec/fixtures/finders/interesting_files/file.txt +0 -4
  46. data/spec/fixtures/finders/interesting_files/headers/interesting.txt +0 -16
  47. data/spec/fixtures/finders/interesting_files/headers/no_interesting.txt +0 -12
  48. data/spec/fixtures/finders/interesting_files/robots_txt/robots.txt +0 -10
  49. data/spec/fixtures/finders/interesting_files/search_replace_db_2/searchreplacedb2.php +0 -188
  50. data/spec/fixtures/finders/interesting_files/xml_rpc/homepage_in_scope_pingback.html +0 -7
  51. data/spec/fixtures/finders/interesting_files/xml_rpc/homepage_out_of_scope_pingback.html +0 -7
  52. data/spec/fixtures/finders/interesting_files/xml_rpc/xmlrpc.php +0 -1
  53. data/spec/fixtures/output.txt +0 -0
  54. data/spec/fixtures/target/comments.html +0 -29
  55. data/spec/fixtures/target/platform/php/debug_log/debug.log +0 -2
  56. data/spec/fixtures/target/platform/php/fpd/wp_rss_functions.php +0 -2
  57. data/spec/fixtures/target/scope/index.html +0 -23
  58. data/spec/fixtures/target/server/apache/directory_listing/2.2.16.html +0 -15
  59. data/spec/fixtures/target/server/generic/server/apache/basic.txt +0 -5
  60. data/spec/fixtures/target/server/generic/server/iis/basic.txt +0 -6
  61. data/spec/fixtures/target/server/generic/server/not_detected.txt +0 -3
  62. data/spec/fixtures/target/server/iis/directory_listing/no_parent.html +0 -3
  63. data/spec/fixtures/target/server/iis/directory_listing/with_parent.html +0 -3
  64. data/spec/fixtures/views/base/ctrl/local.erb +0 -1
  65. data/spec/fixtures/views/base/ctrl/test.erb +0 -3
  66. data/spec/fixtures/views/base/global.erb +0 -1
  67. data/spec/fixtures/views/base/test.erb +0 -2
  68. data/spec/fixtures/views/based_format/test.erb +0 -1
  69. data/spec/fixtures/views/json/render_me.erb +0 -4
  70. data/spec/lib/browser_spec.rb +0 -140
  71. data/spec/lib/cache/file_store_spec.rb +0 -100
  72. data/spec/lib/cache/typhoeus_spec.rb +0 -28
  73. data/spec/lib/cms_scanner_spec.rb +0 -49
  74. data/spec/lib/controller_spec.rb +0 -30
  75. data/spec/lib/controllers_spec.rb +0 -48
  76. data/spec/lib/finders/confidence_spec.rb +0 -39
  77. data/spec/lib/finders/finder/enumerator_spec.rb +0 -89
  78. data/spec/lib/finders/finder/smart_url_checker/findings_spec.rb +0 -39
  79. data/spec/lib/finders/finder/smart_url_checker_spec.rb +0 -50
  80. data/spec/lib/finders/finder_spec.rb +0 -11
  81. data/spec/lib/finders/findings_spec.rb +0 -36
  82. data/spec/lib/finders/independent_finders_spec.rb +0 -134
  83. data/spec/lib/finders/same_type_finder_spec.rb +0 -24
  84. data/spec/lib/finders/same_type_finders_spec.rb +0 -126
  85. data/spec/lib/finders/unique_finder_spec.rb +0 -24
  86. data/spec/lib/finders/unique_finders_spec.rb +0 -222
  87. data/spec/lib/formatter_spec.rb +0 -145
  88. data/spec/lib/public_suffix/domain_spec.rb +0 -49
  89. data/spec/lib/sub_scanner_spec.rb +0 -45
  90. data/spec/lib/target/hashes_spec.rb +0 -90
  91. data/spec/lib/target/platforms_spec.rb +0 -13
  92. data/spec/lib/target/scope_spec.rb +0 -103
  93. data/spec/lib/target/servers_spec.rb +0 -13
  94. data/spec/lib/target_spec.rb +0 -69
  95. data/spec/lib/vulnerability/references_spec.rb +0 -75
  96. data/spec/lib/vulnerability_spec.rb +0 -27
  97. data/spec/lib/web_site_spec.rb +0 -121
  98. data/spec/output/core/finished.cli_no_colour +0 -3
  99. data/spec/output/core/finished.json +0 -5
  100. data/spec/output/core/started.cli_no_colour +0 -3
  101. data/spec/output/core/started.json +0 -5
  102. data/spec/output/interesting_files/empty.cli_no_colour +0 -2
  103. data/spec/output/interesting_files/empty.json +0 -5
  104. data/spec/output/interesting_files/findings.cli_no_colour +0 -30
  105. data/spec/output/interesting_files/findings.json +0 -75
  106. data/spec/shared_examples.rb +0 -11
  107. data/spec/shared_examples/browser_actions.rb +0 -30
  108. data/spec/shared_examples/finding.rb +0 -54
  109. data/spec/shared_examples/formatter_buffer.rb +0 -6
  110. data/spec/shared_examples/formatter_class_methods.rb +0 -26
  111. data/spec/shared_examples/independent_finder.rb +0 -31
  112. data/spec/shared_examples/target/platform/php.rb +0 -56
  113. data/spec/shared_examples/target/server/apache.rb +0 -32
  114. data/spec/shared_examples/target/server/generic.rb +0 -33
  115. data/spec/shared_examples/target/server/iis.rb +0 -37
  116. data/spec/shared_examples/views/core.rb +0 -26
  117. data/spec/shared_examples/views/interesting_files.rb +0 -36
  118. data/spec/spec_helper.rb +0 -43
@@ -1,51 +0,0 @@
1
- require 'spec_helper'
2
-
3
- describe CMSScanner::Version do
4
- it_behaves_like CMSScanner::Finders::Finding
5
-
6
- subject(:version) { described_class.new(number, opts) }
7
- let(:opts) { {} }
8
- let(:number) { '1.0' }
9
-
10
- its(:to_s) { should eql '1.0' }
11
-
12
- describe '#number' do
13
- its(:number) { should eql '1.0' }
14
-
15
- context 'when float number supplied' do
16
- let(:number) { 2.0 }
17
-
18
- its(:number) { should eql '2.0' }
19
- its(:to_s) { should eql '2.0' }
20
- end
21
-
22
- context 'when starting with a dot' do
23
- let(:number) { '.2' }
24
-
25
- its(:number) { should eql '0.2' }
26
- end
27
- end
28
-
29
- describe '#<=>, #==, #>, #<' do
30
- it 'returns true' do
31
- expect(version == '1.0').to be true
32
- expect(version == 1.0).to be true
33
- expect(version == described_class.new('1.0')).to be true
34
- expect(version > '0.9').to be true
35
- expect(version < '2').to be true
36
-
37
- expect(described_class.new('0.1') == '.1').to be true
38
- expect(described_class.new('.1') == '0.1').to be true
39
- end
40
-
41
- it 'returns false' do
42
- expect(version == '2.0').to be false
43
- expect(version == described_class.new('2')).to be false
44
- expect(version > '2.0').to be false
45
- expect(version < '1.0').to be false
46
-
47
- expect(version < 'gg').to be false
48
- expect(version == '').to be false
49
- end
50
- end
51
- end
@@ -1,46 +0,0 @@
1
- require 'spec_helper'
2
-
3
- describe CMSScanner::XMLRPC do
4
- subject(:xml_rpc) { described_class.new(url) }
5
- let(:url) { 'http://example.com/xmlrpc' }
6
-
7
- describe '#request_body' do
8
- after { expect(xml_rpc.request_body(method, params)).to eq @expected }
9
-
10
- let(:method) { 'rpc-test' }
11
- let(:params) { [] }
12
-
13
- context 'when no params' do
14
- it 'returns the body w/o the params elements' do
15
- @expected = '<?xml version="1.0"?><methodCall>'
16
- @expected << "<methodName>#{method}</methodName>"
17
- @expected << '</methodCall>'
18
- end
19
- end
20
-
21
- context 'when params' do
22
- let(:params) { %w(p1 p2) }
23
-
24
- it 'returns the correct body' do
25
- @expected = '<?xml version="1.0"?><methodCall>'
26
- @expected << "<methodName>#{method}</methodName><params>"
27
- @expected << '<param><value><string>p1</string></value></param>'
28
- @expected << '<param><value><string>p2</string></value></param>'
29
- @expected << '</params></methodCall>'
30
- end
31
- end
32
- end
33
-
34
- describe '#call' do
35
- let(:method) { 'rpc-test' }
36
-
37
- it 'returns a Typhoeus::Response' do
38
- stub_request(:post, url).with(body: xml_rpc.request_body(method)).to_return(body: 'OK')
39
-
40
- response = xml_rpc.call(method)
41
-
42
- expect(response).to be_a Typhoeus::Response
43
- expect(response.body).to eq 'OK'
44
- end
45
- end
46
- end
@@ -1,35 +0,0 @@
1
- require 'spec_helper'
2
-
3
- describe 'App::Views' do
4
- let(:target_url) { 'http://e.org/' }
5
- let(:fixtures) { File.join(SPECS, 'output') }
6
-
7
- # CliNoColour is used to test the CLI output to avoid the painful colours
8
- # in the expected output.
9
- [:JSON, :CliNoColour].each do |formatter|
10
- context "when #{formatter}" do
11
- it_behaves_like 'App::Views::Core'
12
- it_behaves_like 'App::Views::InterestingFiles'
13
-
14
- let(:parsed_options) { { url: target_url, format: formatter.to_s.underscore.dasherize } }
15
-
16
- before do
17
- controller.class.parsed_options = parsed_options
18
- # Resets the formatter to ensure the correct one is loaded
19
- controller.class.class_variable_set(:@@formatter, nil)
20
- end
21
-
22
- after do
23
- view_filename = defined?(expected_view) ? expected_view : view
24
- view_filename = "#{view_filename}.#{formatter.to_s.underscore.downcase}"
25
- controller_dir = controller.class.to_s.demodulize.underscore.downcase
26
- expected_output = File.read(File.join(fixtures, controller_dir, view_filename))
27
-
28
- expect($stdout).to receive(:puts).with(expected_output)
29
-
30
- controller.output(view, @tpl_vars)
31
- controller.formatter.beautify # Mandatory to be able to test formatter such as JSON
32
- end
33
- end
34
- end
35
- end
@@ -1,4 +0,0 @@
1
- # Ignore everything in this directory
2
- *
3
- # Except this file
4
- !.gitignore
@@ -1,25 +0,0 @@
1
- module CMSScanner
2
- # Dummy Finding
3
- class DummyFinding
4
- include Finders::Finding
5
-
6
- attr_reader :r
7
-
8
- def initialize(r, opts = {})
9
- @r = r
10
- parse_finding_options(opts)
11
- end
12
-
13
- def ==(other)
14
- r == other.r
15
- end
16
-
17
- def eql?(other)
18
- r == other.r && confidence == other.confidence && found_by == other.found_by
19
- end
20
-
21
- def to_s
22
- r
23
- end
24
- end
25
- end
@@ -1,26 +0,0 @@
1
- require 'dummy_finding'
2
-
3
- module CMSScanner
4
- module Finders
5
- module Independent
6
- # Dummy Test Finder
7
- class DummyFinder < Finder
8
- def passive(_opts = {})
9
- # the nil is there to ensure such value is ignored
10
- [DummyFinding.new('test', found_by: found_by), nil]
11
- end
12
-
13
- def aggressive(_opts = {})
14
- DummyFinding.new('test', confidence: 100, found_by: 'override')
15
- end
16
- end
17
-
18
- # No aggressive result finder
19
- class NoAggressiveResult < Finder
20
- def passive(_opts = {})
21
- DummyFinding.new('spotted', confidence: 10, found_by: found_by)
22
- end
23
- end
24
- end
25
- end
26
- end
@@ -1,33 +0,0 @@
1
- require 'dummy_finding'
2
-
3
- module CMSScanner
4
- module Finders
5
- module Unique
6
- # Dummy Test Finder
7
- class Dummy < Finder
8
- def passive(_opts = {})
9
- # the nil is there to ensure such value is ignored
10
- [DummyFinding.new('v1', found_by: found_by), nil]
11
- end
12
-
13
- def aggressive(_opts = {})
14
- DummyFinding.new('v1', confidence: 100, found_by: 'override')
15
- end
16
- end
17
-
18
- # No aggressive result
19
- class NoAggressive < Finder
20
- def passive(_opts = {})
21
- DummyFinding.new('v2', confidence: 10, found_by: found_by)
22
- end
23
- end
24
-
25
- # Dummy2
26
- class Dummy2 < Finder
27
- def aggressive(_opts = {})
28
- DummyFinding.new('v1', confidence: 90)
29
- end
30
- end
31
- end
32
- end
33
- end
@@ -1,12 +0,0 @@
1
- includes
2
- misc
3
- modules
4
- .htaccess
5
- CHANGELOG.txt
6
- cron.php
7
- data.sql
8
- admin.txt
9
- robots.txt
10
- update.php
11
- UPGRADE.txt
12
- xmlrpc.php
@@ -1,4 +0,0 @@
1
- This is
2
- a test file
3
-
4
- with some content
@@ -1,16 +0,0 @@
1
- HTTP/1.1 200 OK
2
- Server: nginx/1.1.19
3
- X-Powered-By: ASP.NET
4
- X-Powered-By: PHP
5
- Date: Thu
6
- Content-Type: text/plain; charset=utf-8
7
- Connection: keep-alive
8
- X-Content-Type-Options: nosniff
9
- Cache-Control: s-maxage=3600, must-revalidate, max-age=0
10
- X-Article-Id: 12
11
- X-Language: en
12
- Last-Modified: Tue, 26 Nov 2013 17:39:43 GMT
13
- Vary: X-Subdomain,X-Use-HHVM
14
- X-Varnish: 11545
15
- Age: 206
16
- Set-Cookie: GeoIP=; Path=/; Domain=.test.lo
@@ -1,12 +0,0 @@
1
- HTTP/1.1 200 OK
2
- Date: Thu
3
- Content-Type: text/plain; charset=utf-8
4
- Connection: keep-alive
5
- X-Content-Type-Options: nosniff
6
- Cache-Control: s-maxage=3600, must-revalidate, max-age=0
7
- X-Language: en
8
- Last-Modified: Tue, 26 Nov 2013 17:39:43 GMT
9
- Vary: X-Subdomain,X-Use-HHVM
10
- X-Varnish: 15154
11
- Age: 206
12
- Set-Cookie: GeoIP=; Path=/; Domain=.test.lo
@@ -1,10 +0,0 @@
1
- # advertising-related bots:
2
- User-agent: Mediapartners-Google*
3
- Disallow: /
4
-
5
- # Wikipedia work bots:
6
- User-agent: IsraBot
7
- Disallow:
8
-
9
- Disallow: /admin
10
- Allow: /public/home
@@ -1,188 +0,0 @@
1
- <!DOCTYPE html>
2
- <html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/terms/" dir="ltr" lang="en-US">
3
- <head profile="http://gmpg.org/xfn/11">
4
- <title>Search and replace DB.</title>
5
- <style type="text/css">
6
- body {
7
- background-color: #E5E5E5;
8
- color: #353231;
9
- font: 14px/18px "Gill Sans MT","Gill Sans",Calibri,sans-serif;
10
- }
11
-
12
- p {
13
- line-height: 18px;
14
- margin: 18px 0;
15
- max-width: 520px;
16
- }
17
-
18
- p.byline {
19
- margin: 0 0 18px 0;
20
- padding-bottom: 9px;
21
- border-bottom: 1px dashed #999999;
22
- max-width: 100%;
23
- }
24
-
25
- h1,h2,h3 {
26
- font-weight: normal;
27
- line-height: 36px;
28
- font-size: 24px;
29
- margin: 9px 0;
30
- text-shadow: 1px 1px 0 rgba(255, 255, 255, 0.8);
31
- }
32
-
33
- h2 {
34
- font-weight: normal;
35
- line-height: 24px;
36
- font-size: 21px;
37
- margin: 9px 0;
38
- text-shadow: 1px 1px 0 rgba(255, 255, 255, 0.8);
39
- }
40
-
41
- h3 {
42
- font-weight: normal;
43
- line-height: 18px;
44
- margin: 9px 0;
45
- text-shadow: 1px 1px 0 rgba(255, 255, 255, 0.8);
46
- }
47
-
48
- a {
49
- -moz-transition: color 0.2s linear 0s;
50
- color: #DE1301;
51
- text-decoration: none;
52
- font-weight: normal;
53
- }
54
-
55
- a:visited {
56
- -moz-transition: color 0.2s linear 0s;
57
- color: #AE1301;
58
- }
59
-
60
- a:hover, a:visited:hover {
61
- -moz-transition: color 0.2s linear 0s;
62
- color: #FE1301;
63
- text-decoration: underline;
64
- }
65
-
66
- #container {
67
- display:block;
68
- width: 768px;
69
- padding: 10px;
70
- margin: 0px auto;
71
- border:solid 10px 0px 0px 0px #ccc;
72
- border-top: 18px solid #DE1301;
73
- background-color: #F5F5F5;
74
- }
75
-
76
- fieldset {
77
- border: 0 none;
78
- }
79
-
80
- .error {
81
- border: solid 1px #c00;
82
- padding: 5px;
83
- background-color: #FFEBE8;
84
- text-align: center;
85
- margin-bottom: 10px;
86
- }
87
-
88
- label {
89
- display:block;
90
- line-height: 18px;
91
- cursor: pointer;
92
- }
93
-
94
- select.multi,
95
- input.text {
96
- margin-bottom: 1em;
97
- display:block;
98
- width: 90%;
99
- }
100
-
101
- select.multi {
102
- height: 144px;
103
- }
104
-
105
-
106
- input.button {
107
- }
108
-
109
- div.help {
110
- border-top: 1px dashed #999999;
111
- margin-top: 9px;
112
- }
113
-
114
- </style>
115
- </head>
116
- <body>
117
- <div id="container">
118
-
119
- <h1>Safe Search Replace</h1>
120
- <p class="byline">by interconnect/<strong>it</strong></p>
121
- <h2>Database details</h2>
122
- <form action="searchreplacedb2.php?step=3" method="post">
123
- <fieldset>
124
- <p>
125
- <label for="host">Server Name:</label>
126
- <input class="text" type="text" name="host" id="host" value="localhost" />
127
- </p>
128
-
129
- <p>
130
- <label for="data">Database Name:</label>
131
- <input class="text" type="text" name="data" id="data" value="" />
132
- </p>
133
-
134
- <p>
135
- <label for="user">Username:</label>
136
- <input class="text" type="text" name="user" id="user" value="" />
137
- </p>
138
-
139
- <p>
140
- <label for="pass">Password:</label>
141
- <input class="text" type="password" name="pass" id="pass" value="" />
142
- </p>
143
-
144
- <p>
145
- <label for="pass">Charset:</label>
146
- <input class="text" type="text" name="char" id="char" value="" />
147
- </p>
148
- <input type="submit" class="button" value="Submit DB details" /> </fieldset>
149
- </form> <div class="help">
150
- <h4><a href="http://interconnectit.com/">interconnect/it</a> <a href="http://interconnectit.com/124/search-and-replace-for-wordpress-databases/">Safe Search and Replace on Database with Serialized Data v2.0.0</a></h4>
151
- <p>This developer/sysadmin tool helps solve the problem of doing a search and replace on a
152
- WordPress site when doing a migration to a domain name with a different length.</p>
153
-
154
- <p><style="color:red">WARNING!</strong> Take a backup first, and carefully test the results of this code.
155
- If you don't, and you vape your data then you only have yourself to blame.
156
- Seriously. And if you're English is bad and you don't fully understand the
157
- instructions then STOP. Right there. Yes. Before you do any damage.
158
-
159
- <h2>Don't Forget to Remove Me!</h3>
160
-
161
- <p style="color:red">Delete this utility from your
162
- server after use. It represents a major security threat to your database if
163
- maliciously used.</p>
164
-
165
- <h2>Use Of This Script Is Entirely At Your Own Risk</h2>
166
-
167
- <p> We accept no liability from the use of this tool.</p>
168
-
169
- <p>If you're not comfortable with this kind of stuff, get an expert, like us, to do
170
- this work for you. You do this ENTIRELY AT YOUR OWN RISK! We accept no responsibility
171
- if you mess up your data. There is NO UNDO here!</p>
172
-
173
- <p>The easiest way to use it is to copy your site's files and DB to the new location.
174
- You then, if required, fix up your .htaccess and wp-config.php appropriately. Once
175
- done, run this script, select your tables (in most cases all of them) and then
176
- enter the search replace strings. You can press back in your browser to do
177
- this several times, as may be required in some cases.</p>
178
-
179
- <p>Of course, you can use the script in many other ways - for example, finding
180
- all references to a company name and changing it when a rebrand comes along. Or
181
- perhaps you changed your name. Whatever you want to search and replace the code will help.</p>
182
-
183
- <p><a href="http://interconnectit.com/124/search-and-replace-for-wordpress-databases/">Got feedback on this script? Come tell us!</a>
184
-
185
- </div>
186
- </div>
187
- </body>
188
- </html>