cms_scanner 0.0.18 → 0.0.19

Sign up to get free protection for your applications and to get access to all the features.
Files changed (118) hide show
  1. checksums.yaml +4 -4
  2. data/app/controllers/core.rb +4 -3
  3. data/app/views/cli/core/finished.erb +1 -0
  4. data/app/views/json/core/finished.erb +1 -0
  5. data/cms_scanner.gemspec +13 -3
  6. data/lib/cms_scanner.rb +14 -2
  7. data/lib/cms_scanner/finders/finder.rb +16 -7
  8. data/lib/cms_scanner/finders/finder/enumerator.rb +4 -28
  9. data/lib/cms_scanner/finders/finder/fingerprinter.rb +60 -0
  10. data/lib/cms_scanner/finders/finding.rb +1 -1
  11. data/lib/cms_scanner/target/scope.rb +4 -1
  12. data/lib/cms_scanner/target/server/generic.rb +1 -1
  13. data/lib/cms_scanner/typhoeus/hydra.rb +10 -0
  14. data/lib/cms_scanner/version.rb +1 -1
  15. metadata +5 -203
  16. data/.gitignore +0 -7
  17. data/.rspec +0 -2
  18. data/.rubocop.yml +0 -10
  19. data/.travis.yml +0 -17
  20. data/Gemfile +0 -6
  21. data/Rakefile +0 -9
  22. data/spec/app/controllers/core_spec.rb +0 -167
  23. data/spec/app/controllers/interesting_files_spec.rb +0 -70
  24. data/spec/app/finders/interesting_files/fantastico_fileslist_spec.rb +0 -66
  25. data/spec/app/finders/interesting_files/headers_spec.rb +0 -36
  26. data/spec/app/finders/interesting_files/robots_txt_spec.rb +0 -54
  27. data/spec/app/finders/interesting_files/search_replace_db_2_spec.rb +0 -53
  28. data/spec/app/finders/interesting_files/xml_rpc_spec.rb +0 -136
  29. data/spec/app/finders/interesting_files_spec.rb +0 -12
  30. data/spec/app/formatters/cli_no_colour_spec.rb +0 -14
  31. data/spec/app/formatters/cli_spec.rb +0 -30
  32. data/spec/app/formatters/json_spec.rb +0 -30
  33. data/spec/app/models/fantastico_fileslist_spec.rb +0 -31
  34. data/spec/app/models/headers_spec.rb +0 -51
  35. data/spec/app/models/interesting_file_spec.rb +0 -69
  36. data/spec/app/models/robots_txt_spec.rb +0 -27
  37. data/spec/app/models/version_spec.rb +0 -51
  38. data/spec/app/models/xml_rpc_spec.rb +0 -46
  39. data/spec/app/views_spec.rb +0 -35
  40. data/spec/cache/.gitignore +0 -4
  41. data/spec/dummy_finding.rb +0 -25
  42. data/spec/dummy_independent_finders.rb +0 -26
  43. data/spec/dummy_unique_finders.rb +0 -33
  44. data/spec/fixtures/finders/interesting_files/fantastico_fileslist/fantastico_fileslist.txt +0 -12
  45. data/spec/fixtures/finders/interesting_files/file.txt +0 -4
  46. data/spec/fixtures/finders/interesting_files/headers/interesting.txt +0 -16
  47. data/spec/fixtures/finders/interesting_files/headers/no_interesting.txt +0 -12
  48. data/spec/fixtures/finders/interesting_files/robots_txt/robots.txt +0 -10
  49. data/spec/fixtures/finders/interesting_files/search_replace_db_2/searchreplacedb2.php +0 -188
  50. data/spec/fixtures/finders/interesting_files/xml_rpc/homepage_in_scope_pingback.html +0 -7
  51. data/spec/fixtures/finders/interesting_files/xml_rpc/homepage_out_of_scope_pingback.html +0 -7
  52. data/spec/fixtures/finders/interesting_files/xml_rpc/xmlrpc.php +0 -1
  53. data/spec/fixtures/output.txt +0 -0
  54. data/spec/fixtures/target/comments.html +0 -29
  55. data/spec/fixtures/target/platform/php/debug_log/debug.log +0 -2
  56. data/spec/fixtures/target/platform/php/fpd/wp_rss_functions.php +0 -2
  57. data/spec/fixtures/target/scope/index.html +0 -23
  58. data/spec/fixtures/target/server/apache/directory_listing/2.2.16.html +0 -15
  59. data/spec/fixtures/target/server/generic/server/apache/basic.txt +0 -5
  60. data/spec/fixtures/target/server/generic/server/iis/basic.txt +0 -6
  61. data/spec/fixtures/target/server/generic/server/not_detected.txt +0 -3
  62. data/spec/fixtures/target/server/iis/directory_listing/no_parent.html +0 -3
  63. data/spec/fixtures/target/server/iis/directory_listing/with_parent.html +0 -3
  64. data/spec/fixtures/views/base/ctrl/local.erb +0 -1
  65. data/spec/fixtures/views/base/ctrl/test.erb +0 -3
  66. data/spec/fixtures/views/base/global.erb +0 -1
  67. data/spec/fixtures/views/base/test.erb +0 -2
  68. data/spec/fixtures/views/based_format/test.erb +0 -1
  69. data/spec/fixtures/views/json/render_me.erb +0 -4
  70. data/spec/lib/browser_spec.rb +0 -140
  71. data/spec/lib/cache/file_store_spec.rb +0 -100
  72. data/spec/lib/cache/typhoeus_spec.rb +0 -28
  73. data/spec/lib/cms_scanner_spec.rb +0 -49
  74. data/spec/lib/controller_spec.rb +0 -30
  75. data/spec/lib/controllers_spec.rb +0 -48
  76. data/spec/lib/finders/confidence_spec.rb +0 -39
  77. data/spec/lib/finders/finder/enumerator_spec.rb +0 -89
  78. data/spec/lib/finders/finder/smart_url_checker/findings_spec.rb +0 -39
  79. data/spec/lib/finders/finder/smart_url_checker_spec.rb +0 -50
  80. data/spec/lib/finders/finder_spec.rb +0 -11
  81. data/spec/lib/finders/findings_spec.rb +0 -36
  82. data/spec/lib/finders/independent_finders_spec.rb +0 -134
  83. data/spec/lib/finders/same_type_finder_spec.rb +0 -24
  84. data/spec/lib/finders/same_type_finders_spec.rb +0 -126
  85. data/spec/lib/finders/unique_finder_spec.rb +0 -24
  86. data/spec/lib/finders/unique_finders_spec.rb +0 -222
  87. data/spec/lib/formatter_spec.rb +0 -145
  88. data/spec/lib/public_suffix/domain_spec.rb +0 -49
  89. data/spec/lib/sub_scanner_spec.rb +0 -45
  90. data/spec/lib/target/hashes_spec.rb +0 -90
  91. data/spec/lib/target/platforms_spec.rb +0 -13
  92. data/spec/lib/target/scope_spec.rb +0 -103
  93. data/spec/lib/target/servers_spec.rb +0 -13
  94. data/spec/lib/target_spec.rb +0 -69
  95. data/spec/lib/vulnerability/references_spec.rb +0 -75
  96. data/spec/lib/vulnerability_spec.rb +0 -27
  97. data/spec/lib/web_site_spec.rb +0 -121
  98. data/spec/output/core/finished.cli_no_colour +0 -3
  99. data/spec/output/core/finished.json +0 -5
  100. data/spec/output/core/started.cli_no_colour +0 -3
  101. data/spec/output/core/started.json +0 -5
  102. data/spec/output/interesting_files/empty.cli_no_colour +0 -2
  103. data/spec/output/interesting_files/empty.json +0 -5
  104. data/spec/output/interesting_files/findings.cli_no_colour +0 -30
  105. data/spec/output/interesting_files/findings.json +0 -75
  106. data/spec/shared_examples.rb +0 -11
  107. data/spec/shared_examples/browser_actions.rb +0 -30
  108. data/spec/shared_examples/finding.rb +0 -54
  109. data/spec/shared_examples/formatter_buffer.rb +0 -6
  110. data/spec/shared_examples/formatter_class_methods.rb +0 -26
  111. data/spec/shared_examples/independent_finder.rb +0 -31
  112. data/spec/shared_examples/target/platform/php.rb +0 -56
  113. data/spec/shared_examples/target/server/apache.rb +0 -32
  114. data/spec/shared_examples/target/server/generic.rb +0 -33
  115. data/spec/shared_examples/target/server/iis.rb +0 -37
  116. data/spec/shared_examples/views/core.rb +0 -26
  117. data/spec/shared_examples/views/interesting_files.rb +0 -36
  118. data/spec/spec_helper.rb +0 -43
@@ -1,51 +0,0 @@
1
- require 'spec_helper'
2
-
3
- describe CMSScanner::Version do
4
- it_behaves_like CMSScanner::Finders::Finding
5
-
6
- subject(:version) { described_class.new(number, opts) }
7
- let(:opts) { {} }
8
- let(:number) { '1.0' }
9
-
10
- its(:to_s) { should eql '1.0' }
11
-
12
- describe '#number' do
13
- its(:number) { should eql '1.0' }
14
-
15
- context 'when float number supplied' do
16
- let(:number) { 2.0 }
17
-
18
- its(:number) { should eql '2.0' }
19
- its(:to_s) { should eql '2.0' }
20
- end
21
-
22
- context 'when starting with a dot' do
23
- let(:number) { '.2' }
24
-
25
- its(:number) { should eql '0.2' }
26
- end
27
- end
28
-
29
- describe '#<=>, #==, #>, #<' do
30
- it 'returns true' do
31
- expect(version == '1.0').to be true
32
- expect(version == 1.0).to be true
33
- expect(version == described_class.new('1.0')).to be true
34
- expect(version > '0.9').to be true
35
- expect(version < '2').to be true
36
-
37
- expect(described_class.new('0.1') == '.1').to be true
38
- expect(described_class.new('.1') == '0.1').to be true
39
- end
40
-
41
- it 'returns false' do
42
- expect(version == '2.0').to be false
43
- expect(version == described_class.new('2')).to be false
44
- expect(version > '2.0').to be false
45
- expect(version < '1.0').to be false
46
-
47
- expect(version < 'gg').to be false
48
- expect(version == '').to be false
49
- end
50
- end
51
- end
@@ -1,46 +0,0 @@
1
- require 'spec_helper'
2
-
3
- describe CMSScanner::XMLRPC do
4
- subject(:xml_rpc) { described_class.new(url) }
5
- let(:url) { 'http://example.com/xmlrpc' }
6
-
7
- describe '#request_body' do
8
- after { expect(xml_rpc.request_body(method, params)).to eq @expected }
9
-
10
- let(:method) { 'rpc-test' }
11
- let(:params) { [] }
12
-
13
- context 'when no params' do
14
- it 'returns the body w/o the params elements' do
15
- @expected = '<?xml version="1.0"?><methodCall>'
16
- @expected << "<methodName>#{method}</methodName>"
17
- @expected << '</methodCall>'
18
- end
19
- end
20
-
21
- context 'when params' do
22
- let(:params) { %w(p1 p2) }
23
-
24
- it 'returns the correct body' do
25
- @expected = '<?xml version="1.0"?><methodCall>'
26
- @expected << "<methodName>#{method}</methodName><params>"
27
- @expected << '<param><value><string>p1</string></value></param>'
28
- @expected << '<param><value><string>p2</string></value></param>'
29
- @expected << '</params></methodCall>'
30
- end
31
- end
32
- end
33
-
34
- describe '#call' do
35
- let(:method) { 'rpc-test' }
36
-
37
- it 'returns a Typhoeus::Response' do
38
- stub_request(:post, url).with(body: xml_rpc.request_body(method)).to_return(body: 'OK')
39
-
40
- response = xml_rpc.call(method)
41
-
42
- expect(response).to be_a Typhoeus::Response
43
- expect(response.body).to eq 'OK'
44
- end
45
- end
46
- end
@@ -1,35 +0,0 @@
1
- require 'spec_helper'
2
-
3
- describe 'App::Views' do
4
- let(:target_url) { 'http://e.org/' }
5
- let(:fixtures) { File.join(SPECS, 'output') }
6
-
7
- # CliNoColour is used to test the CLI output to avoid the painful colours
8
- # in the expected output.
9
- [:JSON, :CliNoColour].each do |formatter|
10
- context "when #{formatter}" do
11
- it_behaves_like 'App::Views::Core'
12
- it_behaves_like 'App::Views::InterestingFiles'
13
-
14
- let(:parsed_options) { { url: target_url, format: formatter.to_s.underscore.dasherize } }
15
-
16
- before do
17
- controller.class.parsed_options = parsed_options
18
- # Resets the formatter to ensure the correct one is loaded
19
- controller.class.class_variable_set(:@@formatter, nil)
20
- end
21
-
22
- after do
23
- view_filename = defined?(expected_view) ? expected_view : view
24
- view_filename = "#{view_filename}.#{formatter.to_s.underscore.downcase}"
25
- controller_dir = controller.class.to_s.demodulize.underscore.downcase
26
- expected_output = File.read(File.join(fixtures, controller_dir, view_filename))
27
-
28
- expect($stdout).to receive(:puts).with(expected_output)
29
-
30
- controller.output(view, @tpl_vars)
31
- controller.formatter.beautify # Mandatory to be able to test formatter such as JSON
32
- end
33
- end
34
- end
35
- end
@@ -1,4 +0,0 @@
1
- # Ignore everything in this directory
2
- *
3
- # Except this file
4
- !.gitignore
@@ -1,25 +0,0 @@
1
- module CMSScanner
2
- # Dummy Finding
3
- class DummyFinding
4
- include Finders::Finding
5
-
6
- attr_reader :r
7
-
8
- def initialize(r, opts = {})
9
- @r = r
10
- parse_finding_options(opts)
11
- end
12
-
13
- def ==(other)
14
- r == other.r
15
- end
16
-
17
- def eql?(other)
18
- r == other.r && confidence == other.confidence && found_by == other.found_by
19
- end
20
-
21
- def to_s
22
- r
23
- end
24
- end
25
- end
@@ -1,26 +0,0 @@
1
- require 'dummy_finding'
2
-
3
- module CMSScanner
4
- module Finders
5
- module Independent
6
- # Dummy Test Finder
7
- class DummyFinder < Finder
8
- def passive(_opts = {})
9
- # the nil is there to ensure such value is ignored
10
- [DummyFinding.new('test', found_by: found_by), nil]
11
- end
12
-
13
- def aggressive(_opts = {})
14
- DummyFinding.new('test', confidence: 100, found_by: 'override')
15
- end
16
- end
17
-
18
- # No aggressive result finder
19
- class NoAggressiveResult < Finder
20
- def passive(_opts = {})
21
- DummyFinding.new('spotted', confidence: 10, found_by: found_by)
22
- end
23
- end
24
- end
25
- end
26
- end
@@ -1,33 +0,0 @@
1
- require 'dummy_finding'
2
-
3
- module CMSScanner
4
- module Finders
5
- module Unique
6
- # Dummy Test Finder
7
- class Dummy < Finder
8
- def passive(_opts = {})
9
- # the nil is there to ensure such value is ignored
10
- [DummyFinding.new('v1', found_by: found_by), nil]
11
- end
12
-
13
- def aggressive(_opts = {})
14
- DummyFinding.new('v1', confidence: 100, found_by: 'override')
15
- end
16
- end
17
-
18
- # No aggressive result
19
- class NoAggressive < Finder
20
- def passive(_opts = {})
21
- DummyFinding.new('v2', confidence: 10, found_by: found_by)
22
- end
23
- end
24
-
25
- # Dummy2
26
- class Dummy2 < Finder
27
- def aggressive(_opts = {})
28
- DummyFinding.new('v1', confidence: 90)
29
- end
30
- end
31
- end
32
- end
33
- end
@@ -1,12 +0,0 @@
1
- includes
2
- misc
3
- modules
4
- .htaccess
5
- CHANGELOG.txt
6
- cron.php
7
- data.sql
8
- admin.txt
9
- robots.txt
10
- update.php
11
- UPGRADE.txt
12
- xmlrpc.php
@@ -1,4 +0,0 @@
1
- This is
2
- a test file
3
-
4
- with some content
@@ -1,16 +0,0 @@
1
- HTTP/1.1 200 OK
2
- Server: nginx/1.1.19
3
- X-Powered-By: ASP.NET
4
- X-Powered-By: PHP
5
- Date: Thu
6
- Content-Type: text/plain; charset=utf-8
7
- Connection: keep-alive
8
- X-Content-Type-Options: nosniff
9
- Cache-Control: s-maxage=3600, must-revalidate, max-age=0
10
- X-Article-Id: 12
11
- X-Language: en
12
- Last-Modified: Tue, 26 Nov 2013 17:39:43 GMT
13
- Vary: X-Subdomain,X-Use-HHVM
14
- X-Varnish: 11545
15
- Age: 206
16
- Set-Cookie: GeoIP=; Path=/; Domain=.test.lo
@@ -1,12 +0,0 @@
1
- HTTP/1.1 200 OK
2
- Date: Thu
3
- Content-Type: text/plain; charset=utf-8
4
- Connection: keep-alive
5
- X-Content-Type-Options: nosniff
6
- Cache-Control: s-maxage=3600, must-revalidate, max-age=0
7
- X-Language: en
8
- Last-Modified: Tue, 26 Nov 2013 17:39:43 GMT
9
- Vary: X-Subdomain,X-Use-HHVM
10
- X-Varnish: 15154
11
- Age: 206
12
- Set-Cookie: GeoIP=; Path=/; Domain=.test.lo
@@ -1,10 +0,0 @@
1
- # advertising-related bots:
2
- User-agent: Mediapartners-Google*
3
- Disallow: /
4
-
5
- # Wikipedia work bots:
6
- User-agent: IsraBot
7
- Disallow:
8
-
9
- Disallow: /admin
10
- Allow: /public/home
@@ -1,188 +0,0 @@
1
- <!DOCTYPE html>
2
- <html xmlns="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/terms/" dir="ltr" lang="en-US">
3
- <head profile="http://gmpg.org/xfn/11">
4
- <title>Search and replace DB.</title>
5
- <style type="text/css">
6
- body {
7
- background-color: #E5E5E5;
8
- color: #353231;
9
- font: 14px/18px "Gill Sans MT","Gill Sans",Calibri,sans-serif;
10
- }
11
-
12
- p {
13
- line-height: 18px;
14
- margin: 18px 0;
15
- max-width: 520px;
16
- }
17
-
18
- p.byline {
19
- margin: 0 0 18px 0;
20
- padding-bottom: 9px;
21
- border-bottom: 1px dashed #999999;
22
- max-width: 100%;
23
- }
24
-
25
- h1,h2,h3 {
26
- font-weight: normal;
27
- line-height: 36px;
28
- font-size: 24px;
29
- margin: 9px 0;
30
- text-shadow: 1px 1px 0 rgba(255, 255, 255, 0.8);
31
- }
32
-
33
- h2 {
34
- font-weight: normal;
35
- line-height: 24px;
36
- font-size: 21px;
37
- margin: 9px 0;
38
- text-shadow: 1px 1px 0 rgba(255, 255, 255, 0.8);
39
- }
40
-
41
- h3 {
42
- font-weight: normal;
43
- line-height: 18px;
44
- margin: 9px 0;
45
- text-shadow: 1px 1px 0 rgba(255, 255, 255, 0.8);
46
- }
47
-
48
- a {
49
- -moz-transition: color 0.2s linear 0s;
50
- color: #DE1301;
51
- text-decoration: none;
52
- font-weight: normal;
53
- }
54
-
55
- a:visited {
56
- -moz-transition: color 0.2s linear 0s;
57
- color: #AE1301;
58
- }
59
-
60
- a:hover, a:visited:hover {
61
- -moz-transition: color 0.2s linear 0s;
62
- color: #FE1301;
63
- text-decoration: underline;
64
- }
65
-
66
- #container {
67
- display:block;
68
- width: 768px;
69
- padding: 10px;
70
- margin: 0px auto;
71
- border:solid 10px 0px 0px 0px #ccc;
72
- border-top: 18px solid #DE1301;
73
- background-color: #F5F5F5;
74
- }
75
-
76
- fieldset {
77
- border: 0 none;
78
- }
79
-
80
- .error {
81
- border: solid 1px #c00;
82
- padding: 5px;
83
- background-color: #FFEBE8;
84
- text-align: center;
85
- margin-bottom: 10px;
86
- }
87
-
88
- label {
89
- display:block;
90
- line-height: 18px;
91
- cursor: pointer;
92
- }
93
-
94
- select.multi,
95
- input.text {
96
- margin-bottom: 1em;
97
- display:block;
98
- width: 90%;
99
- }
100
-
101
- select.multi {
102
- height: 144px;
103
- }
104
-
105
-
106
- input.button {
107
- }
108
-
109
- div.help {
110
- border-top: 1px dashed #999999;
111
- margin-top: 9px;
112
- }
113
-
114
- </style>
115
- </head>
116
- <body>
117
- <div id="container">
118
-
119
- <h1>Safe Search Replace</h1>
120
- <p class="byline">by interconnect/<strong>it</strong></p>
121
- <h2>Database details</h2>
122
- <form action="searchreplacedb2.php?step=3" method="post">
123
- <fieldset>
124
- <p>
125
- <label for="host">Server Name:</label>
126
- <input class="text" type="text" name="host" id="host" value="localhost" />
127
- </p>
128
-
129
- <p>
130
- <label for="data">Database Name:</label>
131
- <input class="text" type="text" name="data" id="data" value="" />
132
- </p>
133
-
134
- <p>
135
- <label for="user">Username:</label>
136
- <input class="text" type="text" name="user" id="user" value="" />
137
- </p>
138
-
139
- <p>
140
- <label for="pass">Password:</label>
141
- <input class="text" type="password" name="pass" id="pass" value="" />
142
- </p>
143
-
144
- <p>
145
- <label for="pass">Charset:</label>
146
- <input class="text" type="text" name="char" id="char" value="" />
147
- </p>
148
- <input type="submit" class="button" value="Submit DB details" /> </fieldset>
149
- </form> <div class="help">
150
- <h4><a href="http://interconnectit.com/">interconnect/it</a> <a href="http://interconnectit.com/124/search-and-replace-for-wordpress-databases/">Safe Search and Replace on Database with Serialized Data v2.0.0</a></h4>
151
- <p>This developer/sysadmin tool helps solve the problem of doing a search and replace on a
152
- WordPress site when doing a migration to a domain name with a different length.</p>
153
-
154
- <p><style="color:red">WARNING!</strong> Take a backup first, and carefully test the results of this code.
155
- If you don't, and you vape your data then you only have yourself to blame.
156
- Seriously. And if you're English is bad and you don't fully understand the
157
- instructions then STOP. Right there. Yes. Before you do any damage.
158
-
159
- <h2>Don't Forget to Remove Me!</h3>
160
-
161
- <p style="color:red">Delete this utility from your
162
- server after use. It represents a major security threat to your database if
163
- maliciously used.</p>
164
-
165
- <h2>Use Of This Script Is Entirely At Your Own Risk</h2>
166
-
167
- <p> We accept no liability from the use of this tool.</p>
168
-
169
- <p>If you're not comfortable with this kind of stuff, get an expert, like us, to do
170
- this work for you. You do this ENTIRELY AT YOUR OWN RISK! We accept no responsibility
171
- if you mess up your data. There is NO UNDO here!</p>
172
-
173
- <p>The easiest way to use it is to copy your site's files and DB to the new location.
174
- You then, if required, fix up your .htaccess and wp-config.php appropriately. Once
175
- done, run this script, select your tables (in most cases all of them) and then
176
- enter the search replace strings. You can press back in your browser to do
177
- this several times, as may be required in some cases.</p>
178
-
179
- <p>Of course, you can use the script in many other ways - for example, finding
180
- all references to a company name and changing it when a rebrand comes along. Or
181
- perhaps you changed your name. Whatever you want to search and replace the code will help.</p>
182
-
183
- <p><a href="http://interconnectit.com/124/search-and-replace-for-wordpress-databases/">Got feedback on this script? Come tell us!</a>
184
-
185
- </div>
186
- </div>
187
- </body>
188
- </html>