cms_scanner 0.0.18 → 0.0.19

Sign up to get free protection for your applications and to get access to all the features.
Files changed (118) hide show
  1. checksums.yaml +4 -4
  2. data/app/controllers/core.rb +4 -3
  3. data/app/views/cli/core/finished.erb +1 -0
  4. data/app/views/json/core/finished.erb +1 -0
  5. data/cms_scanner.gemspec +13 -3
  6. data/lib/cms_scanner.rb +14 -2
  7. data/lib/cms_scanner/finders/finder.rb +16 -7
  8. data/lib/cms_scanner/finders/finder/enumerator.rb +4 -28
  9. data/lib/cms_scanner/finders/finder/fingerprinter.rb +60 -0
  10. data/lib/cms_scanner/finders/finding.rb +1 -1
  11. data/lib/cms_scanner/target/scope.rb +4 -1
  12. data/lib/cms_scanner/target/server/generic.rb +1 -1
  13. data/lib/cms_scanner/typhoeus/hydra.rb +10 -0
  14. data/lib/cms_scanner/version.rb +1 -1
  15. metadata +5 -203
  16. data/.gitignore +0 -7
  17. data/.rspec +0 -2
  18. data/.rubocop.yml +0 -10
  19. data/.travis.yml +0 -17
  20. data/Gemfile +0 -6
  21. data/Rakefile +0 -9
  22. data/spec/app/controllers/core_spec.rb +0 -167
  23. data/spec/app/controllers/interesting_files_spec.rb +0 -70
  24. data/spec/app/finders/interesting_files/fantastico_fileslist_spec.rb +0 -66
  25. data/spec/app/finders/interesting_files/headers_spec.rb +0 -36
  26. data/spec/app/finders/interesting_files/robots_txt_spec.rb +0 -54
  27. data/spec/app/finders/interesting_files/search_replace_db_2_spec.rb +0 -53
  28. data/spec/app/finders/interesting_files/xml_rpc_spec.rb +0 -136
  29. data/spec/app/finders/interesting_files_spec.rb +0 -12
  30. data/spec/app/formatters/cli_no_colour_spec.rb +0 -14
  31. data/spec/app/formatters/cli_spec.rb +0 -30
  32. data/spec/app/formatters/json_spec.rb +0 -30
  33. data/spec/app/models/fantastico_fileslist_spec.rb +0 -31
  34. data/spec/app/models/headers_spec.rb +0 -51
  35. data/spec/app/models/interesting_file_spec.rb +0 -69
  36. data/spec/app/models/robots_txt_spec.rb +0 -27
  37. data/spec/app/models/version_spec.rb +0 -51
  38. data/spec/app/models/xml_rpc_spec.rb +0 -46
  39. data/spec/app/views_spec.rb +0 -35
  40. data/spec/cache/.gitignore +0 -4
  41. data/spec/dummy_finding.rb +0 -25
  42. data/spec/dummy_independent_finders.rb +0 -26
  43. data/spec/dummy_unique_finders.rb +0 -33
  44. data/spec/fixtures/finders/interesting_files/fantastico_fileslist/fantastico_fileslist.txt +0 -12
  45. data/spec/fixtures/finders/interesting_files/file.txt +0 -4
  46. data/spec/fixtures/finders/interesting_files/headers/interesting.txt +0 -16
  47. data/spec/fixtures/finders/interesting_files/headers/no_interesting.txt +0 -12
  48. data/spec/fixtures/finders/interesting_files/robots_txt/robots.txt +0 -10
  49. data/spec/fixtures/finders/interesting_files/search_replace_db_2/searchreplacedb2.php +0 -188
  50. data/spec/fixtures/finders/interesting_files/xml_rpc/homepage_in_scope_pingback.html +0 -7
  51. data/spec/fixtures/finders/interesting_files/xml_rpc/homepage_out_of_scope_pingback.html +0 -7
  52. data/spec/fixtures/finders/interesting_files/xml_rpc/xmlrpc.php +0 -1
  53. data/spec/fixtures/output.txt +0 -0
  54. data/spec/fixtures/target/comments.html +0 -29
  55. data/spec/fixtures/target/platform/php/debug_log/debug.log +0 -2
  56. data/spec/fixtures/target/platform/php/fpd/wp_rss_functions.php +0 -2
  57. data/spec/fixtures/target/scope/index.html +0 -23
  58. data/spec/fixtures/target/server/apache/directory_listing/2.2.16.html +0 -15
  59. data/spec/fixtures/target/server/generic/server/apache/basic.txt +0 -5
  60. data/spec/fixtures/target/server/generic/server/iis/basic.txt +0 -6
  61. data/spec/fixtures/target/server/generic/server/not_detected.txt +0 -3
  62. data/spec/fixtures/target/server/iis/directory_listing/no_parent.html +0 -3
  63. data/spec/fixtures/target/server/iis/directory_listing/with_parent.html +0 -3
  64. data/spec/fixtures/views/base/ctrl/local.erb +0 -1
  65. data/spec/fixtures/views/base/ctrl/test.erb +0 -3
  66. data/spec/fixtures/views/base/global.erb +0 -1
  67. data/spec/fixtures/views/base/test.erb +0 -2
  68. data/spec/fixtures/views/based_format/test.erb +0 -1
  69. data/spec/fixtures/views/json/render_me.erb +0 -4
  70. data/spec/lib/browser_spec.rb +0 -140
  71. data/spec/lib/cache/file_store_spec.rb +0 -100
  72. data/spec/lib/cache/typhoeus_spec.rb +0 -28
  73. data/spec/lib/cms_scanner_spec.rb +0 -49
  74. data/spec/lib/controller_spec.rb +0 -30
  75. data/spec/lib/controllers_spec.rb +0 -48
  76. data/spec/lib/finders/confidence_spec.rb +0 -39
  77. data/spec/lib/finders/finder/enumerator_spec.rb +0 -89
  78. data/spec/lib/finders/finder/smart_url_checker/findings_spec.rb +0 -39
  79. data/spec/lib/finders/finder/smart_url_checker_spec.rb +0 -50
  80. data/spec/lib/finders/finder_spec.rb +0 -11
  81. data/spec/lib/finders/findings_spec.rb +0 -36
  82. data/spec/lib/finders/independent_finders_spec.rb +0 -134
  83. data/spec/lib/finders/same_type_finder_spec.rb +0 -24
  84. data/spec/lib/finders/same_type_finders_spec.rb +0 -126
  85. data/spec/lib/finders/unique_finder_spec.rb +0 -24
  86. data/spec/lib/finders/unique_finders_spec.rb +0 -222
  87. data/spec/lib/formatter_spec.rb +0 -145
  88. data/spec/lib/public_suffix/domain_spec.rb +0 -49
  89. data/spec/lib/sub_scanner_spec.rb +0 -45
  90. data/spec/lib/target/hashes_spec.rb +0 -90
  91. data/spec/lib/target/platforms_spec.rb +0 -13
  92. data/spec/lib/target/scope_spec.rb +0 -103
  93. data/spec/lib/target/servers_spec.rb +0 -13
  94. data/spec/lib/target_spec.rb +0 -69
  95. data/spec/lib/vulnerability/references_spec.rb +0 -75
  96. data/spec/lib/vulnerability_spec.rb +0 -27
  97. data/spec/lib/web_site_spec.rb +0 -121
  98. data/spec/output/core/finished.cli_no_colour +0 -3
  99. data/spec/output/core/finished.json +0 -5
  100. data/spec/output/core/started.cli_no_colour +0 -3
  101. data/spec/output/core/started.json +0 -5
  102. data/spec/output/interesting_files/empty.cli_no_colour +0 -2
  103. data/spec/output/interesting_files/empty.json +0 -5
  104. data/spec/output/interesting_files/findings.cli_no_colour +0 -30
  105. data/spec/output/interesting_files/findings.json +0 -75
  106. data/spec/shared_examples.rb +0 -11
  107. data/spec/shared_examples/browser_actions.rb +0 -30
  108. data/spec/shared_examples/finding.rb +0 -54
  109. data/spec/shared_examples/formatter_buffer.rb +0 -6
  110. data/spec/shared_examples/formatter_class_methods.rb +0 -26
  111. data/spec/shared_examples/independent_finder.rb +0 -31
  112. data/spec/shared_examples/target/platform/php.rb +0 -56
  113. data/spec/shared_examples/target/server/apache.rb +0 -32
  114. data/spec/shared_examples/target/server/generic.rb +0 -33
  115. data/spec/shared_examples/target/server/iis.rb +0 -37
  116. data/spec/shared_examples/views/core.rb +0 -26
  117. data/spec/shared_examples/views/interesting_files.rb +0 -36
  118. data/spec/spec_helper.rb +0 -43
@@ -1,30 +0,0 @@
1
- require 'spec_helper'
2
-
3
- describe CMSScanner::Controller do
4
- subject(:controller) { described_class::Base.new }
5
-
6
- context 'when parsed_options' do
7
- before { described_class::Base.parsed_options = parsed_options }
8
-
9
- let(:parsed_options) { { url: 'http://example.com/' } }
10
-
11
- its(:parsed_options) { should eq(parsed_options) }
12
- its(:formatter) { should be_a CMSScanner::Formatter::Cli }
13
- its(:user_interaction?) { should be true }
14
- its(:target) { should be_a CMSScanner::Target }
15
- its('target.scope.domains') { should eq [PublicSuffix.parse('example.com')] }
16
-
17
- context 'when output option' do
18
- let(:parsed_options) { super().merge(output: '/tmp/spec.txt') }
19
-
20
- its(:user_interaction?) { should be false }
21
- end
22
-
23
- describe '#render' do
24
- it 'calls the formatter#render' do
25
- expect(controller.formatter).to receive(:render).with('test', { verbose: nil }, 'base')
26
- controller.render('test')
27
- end
28
- end
29
- end
30
- end
@@ -1,48 +0,0 @@
1
- require 'spec_helper'
2
-
3
- module CMSScanner
4
- module Controller
5
- class Spec < Base
6
- end
7
- end
8
- end
9
-
10
- describe CMSScanner::Controllers do
11
- subject(:controllers) { described_class.new }
12
- let(:controller_mod) { CMSScanner::Controller }
13
-
14
- describe '#<<' do
15
- its(:size) { should be 0 }
16
-
17
- context 'when controllers are added' do
18
- before { controllers << controller_mod::Spec.new << controller_mod::Base.new }
19
-
20
- its(:size) { should be 2 }
21
- end
22
-
23
- context 'when a controller is added twice' do
24
- before { 2.times { controllers << controller_mod::Spec.new } }
25
-
26
- its(:size) { should be 1 }
27
- end
28
-
29
- it 'returns self' do
30
- expect(controllers << controller_mod::Spec.new).to be_a described_class
31
- end
32
- end
33
-
34
- describe '#run' do
35
- it 'runs the before_scan, run and after_scan methods of each controller' do
36
- spec = controller_mod::Spec.new
37
- base = controller_mod::Base.new
38
-
39
- controllers << base << spec
40
-
41
- [base, spec].each { |c| expect(c).to receive(:before_scan).ordered }
42
- [base, spec].each { |c| expect(c).to receive(:run).ordered }
43
- [spec, base].each { |c| expect(c).to receive(:after_scan).ordered }
44
-
45
- controllers.run
46
- end
47
- end
48
- end
@@ -1,39 +0,0 @@
1
- require 'spec_helper'
2
-
3
- describe CMSScanner::Finders::Confidence do
4
- subject(:confidence) { described_class.new(number) }
5
-
6
- describe '#new' do
7
- let(:number) { 10 }
8
-
9
- its(:value) { should eq 10 }
10
- end
11
-
12
- describe '#+' do
13
- context 'when the confidence is already at 100' do
14
- let(:number) { 100 }
15
-
16
- it 'returns 100' do
17
- expect(confidence + 50).to eq 100
18
- end
19
- end
20
-
21
- context 'when the confidence is below 100' do
22
- context 'when it reaches 100' do
23
- let(:number) { 90 }
24
-
25
- it 'returns 100' do
26
- expect(confidence + 50 + 80).to eq 100
27
- end
28
- end
29
-
30
- context 'when it satys below 100' do
31
- let(:number) { 50 }
32
-
33
- it 'returns the new value' do
34
- expect(confidence + 50).to eq 66
35
- end
36
- end
37
- end
38
- end
39
- end
@@ -1,89 +0,0 @@
1
- require 'spec_helper'
2
-
3
- describe CMSScanner::Finders::Finder::Enumerator do
4
- # Dummy class to test the module
5
- class DummyFinder < CMSScanner::Finders::Finder
6
- include CMSScanner::Finders::Finder::Enumerator
7
- end
8
-
9
- subject(:finder) { DummyFinder.new(target) }
10
- let(:target) { CMSScanner::Target.new('http://e.org') }
11
-
12
- context 'when #target_urls not implemented' do
13
- it 'raises errors' do
14
- expect { finder.target_urls }.to raise_error NotImplementedError
15
- end
16
- end
17
-
18
- describe '#progress_bar_title' do
19
- it 'returns a space' do
20
- expect(finder.progress_bar_title).to eql ' '
21
- end
22
- end
23
-
24
- its(:browser) { should be_a CMSScanner::Browser }
25
-
26
- its(:request_params) { should eql(cache_ttl: 0) }
27
-
28
- its(:hydra) { should be_a Typhoeus::Hydra }
29
-
30
- describe '#aggressive' do
31
- before do
32
- expect(finder).to receive(:target_urls).and_return(target_urls)
33
- target_urls.each { |url, _| stub_request(:get, url).to_return(status: 200, body: 'rspec') }
34
- end
35
-
36
- let(:target_urls) do
37
- {
38
- target.url('1') => 1,
39
- target.url('2') => 2
40
- }
41
- end
42
-
43
- context 'when no opts' do
44
- let(:opts) { {} }
45
-
46
- context 'when response are the homepage or custom 404' do
47
- before { expect(finder.target).to receive(:homepage_or_404?).twice.and_return(true) }
48
-
49
- it 'does not yield anything' do
50
- expect { |b| finder.enumerate(opts, &b) }.to_not yield_control
51
- end
52
- end
53
-
54
- context 'when not the hompage or 404' do
55
- before { expect(finder.target).to receive(:homepage_or_404?).twice }
56
-
57
- it 'yield the expected items' do
58
- expect { |b| finder.enumerate(opts, &b) }.to yield_successive_args(
59
- [Typhoeus::Response, 1], [Typhoeus::Response, 2]
60
- )
61
- end
62
- end
63
- end
64
-
65
- context 'when opts' do
66
- context 'when :exclude_content' do
67
- before { expect(finder.target).to receive(:homepage_or_404?).twice }
68
-
69
- context 'when it matches' do
70
- let(:opts) { { exclude_content: /spec/i } }
71
-
72
- it 'does not yield anything' do
73
- expect { |b| finder.enumerate(opts, &b) }.to_not yield_control
74
- end
75
- end
76
-
77
- context 'when it does not match' do
78
- let(:opts) { { exclude_content: /not/i } }
79
-
80
- it 'yield the expected items' do
81
- expect { |b| finder.enumerate(opts, &b) }.to yield_successive_args(
82
- [Typhoeus::Response, 1], [Typhoeus::Response, 2]
83
- )
84
- end
85
- end
86
- end
87
- end
88
- end
89
- end
@@ -1,39 +0,0 @@
1
- require 'spec_helper'
2
- require 'dummy_finding'
3
-
4
- describe CMSScanner::Finders::Finder::SmartURLChecker::Findings do
5
- subject(:findings) { described_class.new }
6
- let(:finding) { CMSScanner::DummyFinding }
7
-
8
- describe '#<<' do
9
- after { expect(findings).to eq @expected }
10
-
11
- context 'when no findings already in' do
12
- it 'adds it' do
13
- findings << finding.new('empty-test')
14
- @expected = [finding.new('empty-test')]
15
- end
16
- end
17
-
18
- context 'when findings already in' do
19
- let(:confirmed) { finding.new('confirmed', interesting_entries: entries) }
20
- let(:entries) { %w(e1 e2) }
21
-
22
- before { findings << finding.new('test') << confirmed }
23
-
24
- it 'adds a confirmed result correctly' do
25
- confirmed_dup = confirmed.dup
26
- confirmed_dup.confidence = 100
27
- confirmed_dup.interesting_entries = %w(e2 e3)
28
-
29
- findings << confirmed_dup
30
-
31
- confirmed.confirmed_by = confirmed_dup
32
-
33
- @expected = [] << finding.new('test') << confirmed
34
-
35
- expect(findings[1].interesting_entries).to eql(%w(e1 e2 e3))
36
- end
37
- end
38
- end
39
- end
@@ -1,50 +0,0 @@
1
- require 'spec_helper'
2
-
3
- describe CMSScanner::Finders::Finder::SmartURLChecker do
4
- # Dummy class to test the module
5
- class DummyFinder < CMSScanner::Finders::Finder
6
- include CMSScanner::Finders::Finder::SmartURLChecker
7
- end
8
-
9
- subject(:finder) { DummyFinder.new(target) }
10
- let(:target) { CMSScanner::Target.new('http://e.org') }
11
-
12
- before { stub_request(:get, target.url) }
13
-
14
- context 'when methods are not implemented' do
15
- it 'raises errors' do
16
- expect { finder.process_urls([]) }.to raise_error NotImplementedError
17
- expect { finder.passive }.to raise_error NotImplementedError
18
- expect { finder.aggressive_urls }.to raise_error NotImplementedError
19
- end
20
- end
21
-
22
- describe '#aggressive' do
23
- before { expect(finder).to receive(:aggressive_urls).and_return(%w(u1 u2 u3)) }
24
-
25
- after do
26
- expect(finder).to receive(:process_urls).with(@expected_urls, mode: mode)
27
- finder.aggressive(mode: mode)
28
- end
29
-
30
- context 'when :mode = :mixed' do
31
- before { expect(finder).to receive(:passive_urls).and_return(%w(u2)) }
32
-
33
- let(:mode) { :mixed }
34
-
35
- it 'calls #process_urls with the correct argument' do
36
- @expected_urls = %w(u1 u3)
37
- end
38
- end
39
-
40
- [:passive, :aggressive].each do |m|
41
- context "when :mode = #{m}" do
42
- let(:mode) { m }
43
-
44
- it 'calls #process_urls with the correct argument' do
45
- @expected_urls = %w(u1 u2 u3)
46
- end
47
- end
48
- end
49
- end
50
- end
@@ -1,11 +0,0 @@
1
- require 'spec_helper'
2
-
3
- describe CMSScanner::Finders::Finder do
4
- subject(:finder) { described_class.new('target') }
5
-
6
- describe '#progress_bar' do
7
- it 'returns a ProgressBar::Base' do
8
- expect(finder.progress_bar(12)).to be_a ProgressBar::Base
9
- end
10
- end
11
- end
@@ -1,36 +0,0 @@
1
- require 'spec_helper'
2
- require 'dummy_finding'
3
-
4
- describe CMSScanner::Finders::Findings do
5
- subject(:findings) { described_class.new }
6
- let(:finding) { CMSScanner::DummyFinding }
7
-
8
- describe '#<<' do
9
- after { expect(findings).to eq @expected }
10
-
11
- context 'when no findings already in' do
12
- it 'adds it' do
13
- findings << finding.new('empty-test')
14
- @expected = [finding.new('empty-test')]
15
- end
16
- end
17
-
18
- context 'when findings already in' do
19
- let(:confirmed) { finding.new('confirmed') }
20
-
21
- before { findings << finding.new('test') << confirmed }
22
-
23
- it 'adds a confirmed result correctly' do
24
- confirmed_dup = confirmed.dup
25
- confirmed_dup.confidence = 100
26
-
27
- findings << finding.new('test2')
28
- findings << confirmed_dup
29
-
30
- confirmed.confirmed_by = confirmed_dup
31
-
32
- @expected = [] << finding.new('test') << confirmed << finding.new('test2')
33
- end
34
- end
35
- end
36
- end
@@ -1,134 +0,0 @@
1
- require 'spec_helper'
2
- require 'dummy_independent_finders'
3
-
4
- describe CMSScanner::Finders::IndependentFinders do
5
- subject(:finders) { described_class.new }
6
-
7
- describe '#run' do
8
- let(:target) { 'target' }
9
- let(:finding) { CMSScanner::DummyFinding }
10
- let(:expected_aggressive) { finding.new('test', found_by: 'override', confidence: 100) }
11
- let(:expected_passive) do
12
- [
13
- finding.new('test', found_by: 'Dummy Finder (Passive Detection)'),
14
- finding.new('spotted', found_by: 'No Aggressive Result (Passive Detection)', confidence: 10)
15
- ]
16
- end
17
-
18
- before do
19
- finders <<
20
- CMSScanner::Finders::Independent::DummyFinder.new(target) <<
21
- CMSScanner::Finders::Independent::NoAggressiveResult.new(target)
22
- end
23
-
24
- describe 'method calls order' do
25
- after { finders.run(mode: mode) }
26
-
27
- [:passive, :aggressive].each do |current_mode|
28
- context "when #{current_mode} mode" do
29
- let(:mode) { current_mode }
30
-
31
- it "calls the #{current_mode} method on each finder" do
32
- finders.each do |f|
33
- expect(f).to receive(current_mode).with(hash_including(found: [])).ordered
34
- end
35
- end
36
- end
37
- end
38
-
39
- context 'when :mixed mode' do
40
- let(:mode) { :mixed }
41
-
42
- it 'calls :passive then :aggressive on each finder' do
43
- finders.each do |finder|
44
- [:passive, :aggressive].each do |method|
45
- expect(finder).to receive(method).with(hash_including(found: [])).ordered
46
- end
47
- end
48
- end
49
- end
50
- end
51
-
52
- describe 'returned results' do
53
- before do
54
- @found = finders.run(mode: mode)
55
-
56
- expect(@found).to be_a(CMSScanner::Finders::Findings)
57
-
58
- @found.each { |f| expect(f).to be_a finding }
59
- end
60
-
61
- context 'when :passive mode' do
62
- let(:mode) { :passive }
63
-
64
- it 'returns 2 results' do
65
- expect(@found.size).to eq 2
66
- expect(@found.first).to eql expected_passive.first
67
- expect(@found.last).to eql expected_passive.last
68
- end
69
- end
70
-
71
- context 'when :aggressive mode' do
72
- let(:mode) { :aggressive }
73
-
74
- it 'returns 1 result' do
75
- expect(@found.size).to eq 1
76
- expect(@found.first).to eql expected_aggressive
77
- end
78
- end
79
-
80
- context 'when :mixed mode' do
81
- let(:mode) { :mixed }
82
-
83
- it 'returns 2 results' do
84
- # As the first passive is confirmed by the expected_aggressive, the confidence
85
- # increases and should be 100% due to the expected_aggressive.confidence
86
- first_passive = expected_passive.first.dup
87
- first_passive.confidence = 100
88
-
89
- expect(@found.size).to eq 2
90
- expect(@found.first).to eql first_passive
91
- expect(@found.first.confirmed_by).to eql [expected_aggressive]
92
- expect(@found.last).to eql expected_passive.last
93
- end
94
- end
95
-
96
- context 'when multiple results returned' do
97
- xit
98
- end
99
- end
100
- end
101
-
102
- describe '#symbols_from_mode' do
103
- after { expect(finders.symbols_from_mode(@mode)).to eq @expected }
104
-
105
- context 'when :mixed' do
106
- it 'returns [:passive, :aggressive]' do
107
- @mode = :mixed
108
- @expected = [:passive, :aggressive]
109
- end
110
- end
111
-
112
- context 'when :passive or :aggresssive' do
113
- [:passive, :aggressive].each do |symbol|
114
- it 'returns it in an array' do
115
- @mode = symbol
116
- @expected = [*symbol]
117
- end
118
- end
119
- end
120
-
121
- context 'otherwise' do
122
- it 'returns []' do
123
- @mode = :unallowed
124
- @expected = []
125
- end
126
- end
127
- end
128
-
129
- describe '#findings' do
130
- it 'returns a Findings object' do
131
- expect(finders.findings).to be_a CMSScanner::Finders::Findings
132
- end
133
- end
134
- end