cms_scanner 0.0.18 → 0.0.19

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (118) hide show
  1. checksums.yaml +4 -4
  2. data/app/controllers/core.rb +4 -3
  3. data/app/views/cli/core/finished.erb +1 -0
  4. data/app/views/json/core/finished.erb +1 -0
  5. data/cms_scanner.gemspec +13 -3
  6. data/lib/cms_scanner.rb +14 -2
  7. data/lib/cms_scanner/finders/finder.rb +16 -7
  8. data/lib/cms_scanner/finders/finder/enumerator.rb +4 -28
  9. data/lib/cms_scanner/finders/finder/fingerprinter.rb +60 -0
  10. data/lib/cms_scanner/finders/finding.rb +1 -1
  11. data/lib/cms_scanner/target/scope.rb +4 -1
  12. data/lib/cms_scanner/target/server/generic.rb +1 -1
  13. data/lib/cms_scanner/typhoeus/hydra.rb +10 -0
  14. data/lib/cms_scanner/version.rb +1 -1
  15. metadata +5 -203
  16. data/.gitignore +0 -7
  17. data/.rspec +0 -2
  18. data/.rubocop.yml +0 -10
  19. data/.travis.yml +0 -17
  20. data/Gemfile +0 -6
  21. data/Rakefile +0 -9
  22. data/spec/app/controllers/core_spec.rb +0 -167
  23. data/spec/app/controllers/interesting_files_spec.rb +0 -70
  24. data/spec/app/finders/interesting_files/fantastico_fileslist_spec.rb +0 -66
  25. data/spec/app/finders/interesting_files/headers_spec.rb +0 -36
  26. data/spec/app/finders/interesting_files/robots_txt_spec.rb +0 -54
  27. data/spec/app/finders/interesting_files/search_replace_db_2_spec.rb +0 -53
  28. data/spec/app/finders/interesting_files/xml_rpc_spec.rb +0 -136
  29. data/spec/app/finders/interesting_files_spec.rb +0 -12
  30. data/spec/app/formatters/cli_no_colour_spec.rb +0 -14
  31. data/spec/app/formatters/cli_spec.rb +0 -30
  32. data/spec/app/formatters/json_spec.rb +0 -30
  33. data/spec/app/models/fantastico_fileslist_spec.rb +0 -31
  34. data/spec/app/models/headers_spec.rb +0 -51
  35. data/spec/app/models/interesting_file_spec.rb +0 -69
  36. data/spec/app/models/robots_txt_spec.rb +0 -27
  37. data/spec/app/models/version_spec.rb +0 -51
  38. data/spec/app/models/xml_rpc_spec.rb +0 -46
  39. data/spec/app/views_spec.rb +0 -35
  40. data/spec/cache/.gitignore +0 -4
  41. data/spec/dummy_finding.rb +0 -25
  42. data/spec/dummy_independent_finders.rb +0 -26
  43. data/spec/dummy_unique_finders.rb +0 -33
  44. data/spec/fixtures/finders/interesting_files/fantastico_fileslist/fantastico_fileslist.txt +0 -12
  45. data/spec/fixtures/finders/interesting_files/file.txt +0 -4
  46. data/spec/fixtures/finders/interesting_files/headers/interesting.txt +0 -16
  47. data/spec/fixtures/finders/interesting_files/headers/no_interesting.txt +0 -12
  48. data/spec/fixtures/finders/interesting_files/robots_txt/robots.txt +0 -10
  49. data/spec/fixtures/finders/interesting_files/search_replace_db_2/searchreplacedb2.php +0 -188
  50. data/spec/fixtures/finders/interesting_files/xml_rpc/homepage_in_scope_pingback.html +0 -7
  51. data/spec/fixtures/finders/interesting_files/xml_rpc/homepage_out_of_scope_pingback.html +0 -7
  52. data/spec/fixtures/finders/interesting_files/xml_rpc/xmlrpc.php +0 -1
  53. data/spec/fixtures/output.txt +0 -0
  54. data/spec/fixtures/target/comments.html +0 -29
  55. data/spec/fixtures/target/platform/php/debug_log/debug.log +0 -2
  56. data/spec/fixtures/target/platform/php/fpd/wp_rss_functions.php +0 -2
  57. data/spec/fixtures/target/scope/index.html +0 -23
  58. data/spec/fixtures/target/server/apache/directory_listing/2.2.16.html +0 -15
  59. data/spec/fixtures/target/server/generic/server/apache/basic.txt +0 -5
  60. data/spec/fixtures/target/server/generic/server/iis/basic.txt +0 -6
  61. data/spec/fixtures/target/server/generic/server/not_detected.txt +0 -3
  62. data/spec/fixtures/target/server/iis/directory_listing/no_parent.html +0 -3
  63. data/spec/fixtures/target/server/iis/directory_listing/with_parent.html +0 -3
  64. data/spec/fixtures/views/base/ctrl/local.erb +0 -1
  65. data/spec/fixtures/views/base/ctrl/test.erb +0 -3
  66. data/spec/fixtures/views/base/global.erb +0 -1
  67. data/spec/fixtures/views/base/test.erb +0 -2
  68. data/spec/fixtures/views/based_format/test.erb +0 -1
  69. data/spec/fixtures/views/json/render_me.erb +0 -4
  70. data/spec/lib/browser_spec.rb +0 -140
  71. data/spec/lib/cache/file_store_spec.rb +0 -100
  72. data/spec/lib/cache/typhoeus_spec.rb +0 -28
  73. data/spec/lib/cms_scanner_spec.rb +0 -49
  74. data/spec/lib/controller_spec.rb +0 -30
  75. data/spec/lib/controllers_spec.rb +0 -48
  76. data/spec/lib/finders/confidence_spec.rb +0 -39
  77. data/spec/lib/finders/finder/enumerator_spec.rb +0 -89
  78. data/spec/lib/finders/finder/smart_url_checker/findings_spec.rb +0 -39
  79. data/spec/lib/finders/finder/smart_url_checker_spec.rb +0 -50
  80. data/spec/lib/finders/finder_spec.rb +0 -11
  81. data/spec/lib/finders/findings_spec.rb +0 -36
  82. data/spec/lib/finders/independent_finders_spec.rb +0 -134
  83. data/spec/lib/finders/same_type_finder_spec.rb +0 -24
  84. data/spec/lib/finders/same_type_finders_spec.rb +0 -126
  85. data/spec/lib/finders/unique_finder_spec.rb +0 -24
  86. data/spec/lib/finders/unique_finders_spec.rb +0 -222
  87. data/spec/lib/formatter_spec.rb +0 -145
  88. data/spec/lib/public_suffix/domain_spec.rb +0 -49
  89. data/spec/lib/sub_scanner_spec.rb +0 -45
  90. data/spec/lib/target/hashes_spec.rb +0 -90
  91. data/spec/lib/target/platforms_spec.rb +0 -13
  92. data/spec/lib/target/scope_spec.rb +0 -103
  93. data/spec/lib/target/servers_spec.rb +0 -13
  94. data/spec/lib/target_spec.rb +0 -69
  95. data/spec/lib/vulnerability/references_spec.rb +0 -75
  96. data/spec/lib/vulnerability_spec.rb +0 -27
  97. data/spec/lib/web_site_spec.rb +0 -121
  98. data/spec/output/core/finished.cli_no_colour +0 -3
  99. data/spec/output/core/finished.json +0 -5
  100. data/spec/output/core/started.cli_no_colour +0 -3
  101. data/spec/output/core/started.json +0 -5
  102. data/spec/output/interesting_files/empty.cli_no_colour +0 -2
  103. data/spec/output/interesting_files/empty.json +0 -5
  104. data/spec/output/interesting_files/findings.cli_no_colour +0 -30
  105. data/spec/output/interesting_files/findings.json +0 -75
  106. data/spec/shared_examples.rb +0 -11
  107. data/spec/shared_examples/browser_actions.rb +0 -30
  108. data/spec/shared_examples/finding.rb +0 -54
  109. data/spec/shared_examples/formatter_buffer.rb +0 -6
  110. data/spec/shared_examples/formatter_class_methods.rb +0 -26
  111. data/spec/shared_examples/independent_finder.rb +0 -31
  112. data/spec/shared_examples/target/platform/php.rb +0 -56
  113. data/spec/shared_examples/target/server/apache.rb +0 -32
  114. data/spec/shared_examples/target/server/generic.rb +0 -33
  115. data/spec/shared_examples/target/server/iis.rb +0 -37
  116. data/spec/shared_examples/views/core.rb +0 -26
  117. data/spec/shared_examples/views/interesting_files.rb +0 -36
  118. data/spec/spec_helper.rb +0 -43
@@ -1,30 +0,0 @@
1
- require 'spec_helper'
2
-
3
- describe CMSScanner::Controller do
4
- subject(:controller) { described_class::Base.new }
5
-
6
- context 'when parsed_options' do
7
- before { described_class::Base.parsed_options = parsed_options }
8
-
9
- let(:parsed_options) { { url: 'http://example.com/' } }
10
-
11
- its(:parsed_options) { should eq(parsed_options) }
12
- its(:formatter) { should be_a CMSScanner::Formatter::Cli }
13
- its(:user_interaction?) { should be true }
14
- its(:target) { should be_a CMSScanner::Target }
15
- its('target.scope.domains') { should eq [PublicSuffix.parse('example.com')] }
16
-
17
- context 'when output option' do
18
- let(:parsed_options) { super().merge(output: '/tmp/spec.txt') }
19
-
20
- its(:user_interaction?) { should be false }
21
- end
22
-
23
- describe '#render' do
24
- it 'calls the formatter#render' do
25
- expect(controller.formatter).to receive(:render).with('test', { verbose: nil }, 'base')
26
- controller.render('test')
27
- end
28
- end
29
- end
30
- end
@@ -1,48 +0,0 @@
1
- require 'spec_helper'
2
-
3
- module CMSScanner
4
- module Controller
5
- class Spec < Base
6
- end
7
- end
8
- end
9
-
10
- describe CMSScanner::Controllers do
11
- subject(:controllers) { described_class.new }
12
- let(:controller_mod) { CMSScanner::Controller }
13
-
14
- describe '#<<' do
15
- its(:size) { should be 0 }
16
-
17
- context 'when controllers are added' do
18
- before { controllers << controller_mod::Spec.new << controller_mod::Base.new }
19
-
20
- its(:size) { should be 2 }
21
- end
22
-
23
- context 'when a controller is added twice' do
24
- before { 2.times { controllers << controller_mod::Spec.new } }
25
-
26
- its(:size) { should be 1 }
27
- end
28
-
29
- it 'returns self' do
30
- expect(controllers << controller_mod::Spec.new).to be_a described_class
31
- end
32
- end
33
-
34
- describe '#run' do
35
- it 'runs the before_scan, run and after_scan methods of each controller' do
36
- spec = controller_mod::Spec.new
37
- base = controller_mod::Base.new
38
-
39
- controllers << base << spec
40
-
41
- [base, spec].each { |c| expect(c).to receive(:before_scan).ordered }
42
- [base, spec].each { |c| expect(c).to receive(:run).ordered }
43
- [spec, base].each { |c| expect(c).to receive(:after_scan).ordered }
44
-
45
- controllers.run
46
- end
47
- end
48
- end
@@ -1,39 +0,0 @@
1
- require 'spec_helper'
2
-
3
- describe CMSScanner::Finders::Confidence do
4
- subject(:confidence) { described_class.new(number) }
5
-
6
- describe '#new' do
7
- let(:number) { 10 }
8
-
9
- its(:value) { should eq 10 }
10
- end
11
-
12
- describe '#+' do
13
- context 'when the confidence is already at 100' do
14
- let(:number) { 100 }
15
-
16
- it 'returns 100' do
17
- expect(confidence + 50).to eq 100
18
- end
19
- end
20
-
21
- context 'when the confidence is below 100' do
22
- context 'when it reaches 100' do
23
- let(:number) { 90 }
24
-
25
- it 'returns 100' do
26
- expect(confidence + 50 + 80).to eq 100
27
- end
28
- end
29
-
30
- context 'when it satys below 100' do
31
- let(:number) { 50 }
32
-
33
- it 'returns the new value' do
34
- expect(confidence + 50).to eq 66
35
- end
36
- end
37
- end
38
- end
39
- end
@@ -1,89 +0,0 @@
1
- require 'spec_helper'
2
-
3
- describe CMSScanner::Finders::Finder::Enumerator do
4
- # Dummy class to test the module
5
- class DummyFinder < CMSScanner::Finders::Finder
6
- include CMSScanner::Finders::Finder::Enumerator
7
- end
8
-
9
- subject(:finder) { DummyFinder.new(target) }
10
- let(:target) { CMSScanner::Target.new('http://e.org') }
11
-
12
- context 'when #target_urls not implemented' do
13
- it 'raises errors' do
14
- expect { finder.target_urls }.to raise_error NotImplementedError
15
- end
16
- end
17
-
18
- describe '#progress_bar_title' do
19
- it 'returns a space' do
20
- expect(finder.progress_bar_title).to eql ' '
21
- end
22
- end
23
-
24
- its(:browser) { should be_a CMSScanner::Browser }
25
-
26
- its(:request_params) { should eql(cache_ttl: 0) }
27
-
28
- its(:hydra) { should be_a Typhoeus::Hydra }
29
-
30
- describe '#aggressive' do
31
- before do
32
- expect(finder).to receive(:target_urls).and_return(target_urls)
33
- target_urls.each { |url, _| stub_request(:get, url).to_return(status: 200, body: 'rspec') }
34
- end
35
-
36
- let(:target_urls) do
37
- {
38
- target.url('1') => 1,
39
- target.url('2') => 2
40
- }
41
- end
42
-
43
- context 'when no opts' do
44
- let(:opts) { {} }
45
-
46
- context 'when response are the homepage or custom 404' do
47
- before { expect(finder.target).to receive(:homepage_or_404?).twice.and_return(true) }
48
-
49
- it 'does not yield anything' do
50
- expect { |b| finder.enumerate(opts, &b) }.to_not yield_control
51
- end
52
- end
53
-
54
- context 'when not the hompage or 404' do
55
- before { expect(finder.target).to receive(:homepage_or_404?).twice }
56
-
57
- it 'yield the expected items' do
58
- expect { |b| finder.enumerate(opts, &b) }.to yield_successive_args(
59
- [Typhoeus::Response, 1], [Typhoeus::Response, 2]
60
- )
61
- end
62
- end
63
- end
64
-
65
- context 'when opts' do
66
- context 'when :exclude_content' do
67
- before { expect(finder.target).to receive(:homepage_or_404?).twice }
68
-
69
- context 'when it matches' do
70
- let(:opts) { { exclude_content: /spec/i } }
71
-
72
- it 'does not yield anything' do
73
- expect { |b| finder.enumerate(opts, &b) }.to_not yield_control
74
- end
75
- end
76
-
77
- context 'when it does not match' do
78
- let(:opts) { { exclude_content: /not/i } }
79
-
80
- it 'yield the expected items' do
81
- expect { |b| finder.enumerate(opts, &b) }.to yield_successive_args(
82
- [Typhoeus::Response, 1], [Typhoeus::Response, 2]
83
- )
84
- end
85
- end
86
- end
87
- end
88
- end
89
- end
@@ -1,39 +0,0 @@
1
- require 'spec_helper'
2
- require 'dummy_finding'
3
-
4
- describe CMSScanner::Finders::Finder::SmartURLChecker::Findings do
5
- subject(:findings) { described_class.new }
6
- let(:finding) { CMSScanner::DummyFinding }
7
-
8
- describe '#<<' do
9
- after { expect(findings).to eq @expected }
10
-
11
- context 'when no findings already in' do
12
- it 'adds it' do
13
- findings << finding.new('empty-test')
14
- @expected = [finding.new('empty-test')]
15
- end
16
- end
17
-
18
- context 'when findings already in' do
19
- let(:confirmed) { finding.new('confirmed', interesting_entries: entries) }
20
- let(:entries) { %w(e1 e2) }
21
-
22
- before { findings << finding.new('test') << confirmed }
23
-
24
- it 'adds a confirmed result correctly' do
25
- confirmed_dup = confirmed.dup
26
- confirmed_dup.confidence = 100
27
- confirmed_dup.interesting_entries = %w(e2 e3)
28
-
29
- findings << confirmed_dup
30
-
31
- confirmed.confirmed_by = confirmed_dup
32
-
33
- @expected = [] << finding.new('test') << confirmed
34
-
35
- expect(findings[1].interesting_entries).to eql(%w(e1 e2 e3))
36
- end
37
- end
38
- end
39
- end
@@ -1,50 +0,0 @@
1
- require 'spec_helper'
2
-
3
- describe CMSScanner::Finders::Finder::SmartURLChecker do
4
- # Dummy class to test the module
5
- class DummyFinder < CMSScanner::Finders::Finder
6
- include CMSScanner::Finders::Finder::SmartURLChecker
7
- end
8
-
9
- subject(:finder) { DummyFinder.new(target) }
10
- let(:target) { CMSScanner::Target.new('http://e.org') }
11
-
12
- before { stub_request(:get, target.url) }
13
-
14
- context 'when methods are not implemented' do
15
- it 'raises errors' do
16
- expect { finder.process_urls([]) }.to raise_error NotImplementedError
17
- expect { finder.passive }.to raise_error NotImplementedError
18
- expect { finder.aggressive_urls }.to raise_error NotImplementedError
19
- end
20
- end
21
-
22
- describe '#aggressive' do
23
- before { expect(finder).to receive(:aggressive_urls).and_return(%w(u1 u2 u3)) }
24
-
25
- after do
26
- expect(finder).to receive(:process_urls).with(@expected_urls, mode: mode)
27
- finder.aggressive(mode: mode)
28
- end
29
-
30
- context 'when :mode = :mixed' do
31
- before { expect(finder).to receive(:passive_urls).and_return(%w(u2)) }
32
-
33
- let(:mode) { :mixed }
34
-
35
- it 'calls #process_urls with the correct argument' do
36
- @expected_urls = %w(u1 u3)
37
- end
38
- end
39
-
40
- [:passive, :aggressive].each do |m|
41
- context "when :mode = #{m}" do
42
- let(:mode) { m }
43
-
44
- it 'calls #process_urls with the correct argument' do
45
- @expected_urls = %w(u1 u2 u3)
46
- end
47
- end
48
- end
49
- end
50
- end
@@ -1,11 +0,0 @@
1
- require 'spec_helper'
2
-
3
- describe CMSScanner::Finders::Finder do
4
- subject(:finder) { described_class.new('target') }
5
-
6
- describe '#progress_bar' do
7
- it 'returns a ProgressBar::Base' do
8
- expect(finder.progress_bar(12)).to be_a ProgressBar::Base
9
- end
10
- end
11
- end
@@ -1,36 +0,0 @@
1
- require 'spec_helper'
2
- require 'dummy_finding'
3
-
4
- describe CMSScanner::Finders::Findings do
5
- subject(:findings) { described_class.new }
6
- let(:finding) { CMSScanner::DummyFinding }
7
-
8
- describe '#<<' do
9
- after { expect(findings).to eq @expected }
10
-
11
- context 'when no findings already in' do
12
- it 'adds it' do
13
- findings << finding.new('empty-test')
14
- @expected = [finding.new('empty-test')]
15
- end
16
- end
17
-
18
- context 'when findings already in' do
19
- let(:confirmed) { finding.new('confirmed') }
20
-
21
- before { findings << finding.new('test') << confirmed }
22
-
23
- it 'adds a confirmed result correctly' do
24
- confirmed_dup = confirmed.dup
25
- confirmed_dup.confidence = 100
26
-
27
- findings << finding.new('test2')
28
- findings << confirmed_dup
29
-
30
- confirmed.confirmed_by = confirmed_dup
31
-
32
- @expected = [] << finding.new('test') << confirmed << finding.new('test2')
33
- end
34
- end
35
- end
36
- end
@@ -1,134 +0,0 @@
1
- require 'spec_helper'
2
- require 'dummy_independent_finders'
3
-
4
- describe CMSScanner::Finders::IndependentFinders do
5
- subject(:finders) { described_class.new }
6
-
7
- describe '#run' do
8
- let(:target) { 'target' }
9
- let(:finding) { CMSScanner::DummyFinding }
10
- let(:expected_aggressive) { finding.new('test', found_by: 'override', confidence: 100) }
11
- let(:expected_passive) do
12
- [
13
- finding.new('test', found_by: 'Dummy Finder (Passive Detection)'),
14
- finding.new('spotted', found_by: 'No Aggressive Result (Passive Detection)', confidence: 10)
15
- ]
16
- end
17
-
18
- before do
19
- finders <<
20
- CMSScanner::Finders::Independent::DummyFinder.new(target) <<
21
- CMSScanner::Finders::Independent::NoAggressiveResult.new(target)
22
- end
23
-
24
- describe 'method calls order' do
25
- after { finders.run(mode: mode) }
26
-
27
- [:passive, :aggressive].each do |current_mode|
28
- context "when #{current_mode} mode" do
29
- let(:mode) { current_mode }
30
-
31
- it "calls the #{current_mode} method on each finder" do
32
- finders.each do |f|
33
- expect(f).to receive(current_mode).with(hash_including(found: [])).ordered
34
- end
35
- end
36
- end
37
- end
38
-
39
- context 'when :mixed mode' do
40
- let(:mode) { :mixed }
41
-
42
- it 'calls :passive then :aggressive on each finder' do
43
- finders.each do |finder|
44
- [:passive, :aggressive].each do |method|
45
- expect(finder).to receive(method).with(hash_including(found: [])).ordered
46
- end
47
- end
48
- end
49
- end
50
- end
51
-
52
- describe 'returned results' do
53
- before do
54
- @found = finders.run(mode: mode)
55
-
56
- expect(@found).to be_a(CMSScanner::Finders::Findings)
57
-
58
- @found.each { |f| expect(f).to be_a finding }
59
- end
60
-
61
- context 'when :passive mode' do
62
- let(:mode) { :passive }
63
-
64
- it 'returns 2 results' do
65
- expect(@found.size).to eq 2
66
- expect(@found.first).to eql expected_passive.first
67
- expect(@found.last).to eql expected_passive.last
68
- end
69
- end
70
-
71
- context 'when :aggressive mode' do
72
- let(:mode) { :aggressive }
73
-
74
- it 'returns 1 result' do
75
- expect(@found.size).to eq 1
76
- expect(@found.first).to eql expected_aggressive
77
- end
78
- end
79
-
80
- context 'when :mixed mode' do
81
- let(:mode) { :mixed }
82
-
83
- it 'returns 2 results' do
84
- # As the first passive is confirmed by the expected_aggressive, the confidence
85
- # increases and should be 100% due to the expected_aggressive.confidence
86
- first_passive = expected_passive.first.dup
87
- first_passive.confidence = 100
88
-
89
- expect(@found.size).to eq 2
90
- expect(@found.first).to eql first_passive
91
- expect(@found.first.confirmed_by).to eql [expected_aggressive]
92
- expect(@found.last).to eql expected_passive.last
93
- end
94
- end
95
-
96
- context 'when multiple results returned' do
97
- xit
98
- end
99
- end
100
- end
101
-
102
- describe '#symbols_from_mode' do
103
- after { expect(finders.symbols_from_mode(@mode)).to eq @expected }
104
-
105
- context 'when :mixed' do
106
- it 'returns [:passive, :aggressive]' do
107
- @mode = :mixed
108
- @expected = [:passive, :aggressive]
109
- end
110
- end
111
-
112
- context 'when :passive or :aggresssive' do
113
- [:passive, :aggressive].each do |symbol|
114
- it 'returns it in an array' do
115
- @mode = symbol
116
- @expected = [*symbol]
117
- end
118
- end
119
- end
120
-
121
- context 'otherwise' do
122
- it 'returns []' do
123
- @mode = :unallowed
124
- @expected = []
125
- end
126
- end
127
- end
128
-
129
- describe '#findings' do
130
- it 'returns a Findings object' do
131
- expect(finders.findings).to be_a CMSScanner::Finders::Findings
132
- end
133
- end
134
- end