RubyGems - cms_scanner - Versions diffs - 0.0.2 - Mend

cms_scanner 0.0.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (147) hide show

checksums.yaml +7 -0
data/.gitignore +18 -0
data/.rspec +2 -0
data/.rubocop.yml +6 -0
data/.travis.yml +14 -0
data/Gemfile +6 -0
data/README.md +20 -0
data/Rakefile +9 -0
data/app/app.rb +4 -0
data/app/controllers.rb +2 -0
data/app/controllers/core.rb +46 -0
data/app/controllers/core/cli_options.rb +68 -0
data/app/controllers/interesting_files.rb +12 -0
data/app/finders.rb +1 -0
data/app/finders/interesting_files.rb +21 -0
data/app/finders/interesting_files/fantastico_fileslist.rb +23 -0
data/app/finders/interesting_files/headers.rb +15 -0
data/app/finders/interesting_files/robots_txt.rb +22 -0
data/app/finders/interesting_files/search_replace_db_2.rb +28 -0
data/app/finders/interesting_files/xml_rpc.rb +62 -0
data/app/formatters.rb +3 -0
data/app/formatters/cli.rb +18 -0
data/app/formatters/cli_no_colour.rb +15 -0
data/app/formatters/json.rb +12 -0
data/app/models.rb +5 -0
data/app/models/fantastico_fileslist.rb +20 -0
data/app/models/headers.rb +37 -0
data/app/models/interesting_file.rb +30 -0
data/app/models/robots_txt.rb +20 -0
data/app/models/xml_rpc.rb +35 -0
data/app/views/cli/core/finished.erb +4 -0
data/app/views/cli/core/started.erb +3 -0
data/app/views/cli/interesting_files/findings.erb +19 -0
data/app/views/cli/scan_aborted.erb +4 -0
data/app/views/json/core/finished.erb +3 -0
data/app/views/json/core/started.erb +3 -0
data/app/views/json/interesting_files/findings.erb +1 -0
data/app/views/json/scan_aborted.erb +4 -0
data/cms_scanner.gemspec +37 -0
data/examples/views/cli/wp_custom/test.erb +1 -0
data/examples/views/json/wp_custom/test.erb +1 -0
data/examples/wpscan.rb +29 -0
data/lib/cms_scanner.rb +71 -0
data/lib/cms_scanner/browser.rb +68 -0
data/lib/cms_scanner/browser/actions.rb +48 -0
data/lib/cms_scanner/browser/options.rb +53 -0
data/lib/cms_scanner/cache/file_store.rb +75 -0
data/lib/cms_scanner/cache/typhoeus.rb +21 -0
data/lib/cms_scanner/controller.rb +90 -0
data/lib/cms_scanner/controllers.rb +34 -0
data/lib/cms_scanner/errors/auth_errors.rb +15 -0
data/lib/cms_scanner/finders.rb +5 -0
data/lib/cms_scanner/finders/finder.rb +27 -0
data/lib/cms_scanner/finders/finding.rb +32 -0
data/lib/cms_scanner/finders/findings.rb +25 -0
data/lib/cms_scanner/finders/independent_finder.rb +30 -0
data/lib/cms_scanner/finders/independent_finders.rb +41 -0
data/lib/cms_scanner/formatter.rb +118 -0
data/lib/cms_scanner/formatter/buffer.rb +15 -0
data/lib/cms_scanner/target.rb +33 -0
data/lib/cms_scanner/target/platform.rb +2 -0
data/lib/cms_scanner/target/platform/php.rb +39 -0
data/lib/cms_scanner/target/platform/wordpress.rb +35 -0
data/lib/cms_scanner/target/platform/wordpress/custom_directories.rb +62 -0
data/lib/cms_scanner/target/server.rb +3 -0
data/lib/cms_scanner/target/server/apache.rb +43 -0
data/lib/cms_scanner/target/server/generic.rb +34 -0
data/lib/cms_scanner/target/server/iis.rb +48 -0
data/lib/cms_scanner/version.rb +4 -0
data/lib/cms_scanner/web_site.rb +68 -0
data/lib/helper.rb +24 -0
data/spec/app/controllers/core_spec.rb +152 -0
data/spec/app/controllers/interesting_files_spec.rb +50 -0
data/spec/app/finders/interesting_files/fantastico_fileslist_spec.rb +68 -0
data/spec/app/finders/interesting_files/headers_spec.rb +38 -0
data/spec/app/finders/interesting_files/robots_txt_spec.rb +56 -0
data/spec/app/finders/interesting_files/search_replace_db_2_spec.rb +55 -0
data/spec/app/finders/interesting_files/xml_rpc_spec.rb +138 -0
data/spec/app/finders/interesting_files_spec.rb +13 -0
data/spec/app/formatters/cli_no_colour_spec.rb +17 -0
data/spec/app/formatters/cli_spec.rb +21 -0
data/spec/app/formatters/json_spec.rb +33 -0
data/spec/app/models/fantastico_fileslist_spec.rb +32 -0
data/spec/app/models/headers_spec.rb +52 -0
data/spec/app/models/interesting_file_spec.rb +51 -0
data/spec/app/models/robots_txt_spec.rb +28 -0
data/spec/app/models/xml_rpc_spec.rb +47 -0
data/spec/cache/.gitignore +4 -0
data/spec/dummy_finders.rb +41 -0
data/spec/fixtures/interesting_files/fantastico_fileslist/fantastico_fileslist.txt +12 -0
data/spec/fixtures/interesting_files/file.txt +4 -0
data/spec/fixtures/interesting_files/headers/interesting.txt +14 -0
data/spec/fixtures/interesting_files/headers/no_interesting.txt +12 -0
data/spec/fixtures/interesting_files/robots_txt/robots.txt +10 -0
data/spec/fixtures/interesting_files/search_replace_db_2/searchreplacedb2.php +188 -0
data/spec/fixtures/interesting_files/xml_rpc/homepage_in_scope_pingback.html +7 -0
data/spec/fixtures/interesting_files/xml_rpc/homepage_out_of_scope_pingback.html +7 -0
data/spec/fixtures/interesting_files/xml_rpc/xmlrpc.php +1 -0
data/spec/fixtures/output.txt +0 -0
data/spec/fixtures/target/platform/php/debug_log/debug.log +2 -0
data/spec/fixtures/target/platform/php/fpd/wp_rss_functions.php +2 -0
data/spec/fixtures/target/platform/wordpress/custom_directories/custom_w_spaces.html +10 -0
data/spec/fixtures/target/platform/wordpress/custom_directories/default.html +14 -0
data/spec/fixtures/target/platform/wordpress/custom_directories/https.html +12 -0
data/spec/fixtures/target/platform/wordpress/detection/default.html +4 -0
data/spec/fixtures/target/platform/wordpress/detection/not_wp.html +8 -0
data/spec/fixtures/target/platform/wordpress/detection/wp_includes.html +3 -0
data/spec/fixtures/target/server/apache/directory_listing/2.2.16.html +15 -0
data/spec/fixtures/target/server/generic/server/apache/basic.txt +5 -0
data/spec/fixtures/target/server/generic/server/iis/basic.txt +6 -0
data/spec/fixtures/target/server/generic/server/not_detected.txt +3 -0
data/spec/fixtures/target/server/iis/directory_listing/no_parent.html +3 -0
data/spec/fixtures/target/server/iis/directory_listing/with_parent.html +3 -0
data/spec/fixtures/views/base/ctrl/local.erb +1 -0
data/spec/fixtures/views/base/ctrl/test.erb +3 -0
data/spec/fixtures/views/base/global.erb +1 -0
data/spec/fixtures/views/base/test.erb +2 -0
data/spec/fixtures/views/based_format/test.erb +1 -0
data/spec/fixtures/views/json/render_me.erb +4 -0
data/spec/lib/browser_spec.rb +141 -0
data/spec/lib/cache/file_store_spec.rb +101 -0
data/spec/lib/cache/typhoeus_spec.rb +30 -0
data/spec/lib/cms_scanner_spec.rb +45 -0
data/spec/lib/controller_spec.rb +23 -0
data/spec/lib/controllers_spec.rb +52 -0
data/spec/lib/finders/findings_spec.rb +49 -0
data/spec/lib/finders/independent_finders_spec.rb +98 -0
data/spec/lib/formatter_spec.rb +136 -0
data/spec/lib/sub_scanner_spec.rb +27 -0
data/spec/lib/target/platforms_spec.rb +13 -0
data/spec/lib/target/servers_spec.rb +13 -0
data/spec/lib/target_spec.rb +50 -0
data/spec/lib/web_site_spec.rb +124 -0
data/spec/shared_examples.rb +11 -0
data/spec/shared_examples/browser_actions.rb +32 -0
data/spec/shared_examples/finding.rb +20 -0
data/spec/shared_examples/formatter_buffer.rb +8 -0
data/spec/shared_examples/formatter_class_methods.rb +26 -0
data/spec/shared_examples/independent_finder.rb +33 -0
data/spec/shared_examples/target/platform/php.rb +58 -0
data/spec/shared_examples/target/platform/wordpress.rb +41 -0
data/spec/shared_examples/target/platform/wordpress/custom_directories.rb +50 -0
data/spec/shared_examples/target/server/apache.rb +33 -0
data/spec/shared_examples/target/server/generic.rb +34 -0
data/spec/shared_examples/target/server/iis.rb +38 -0
data/spec/spec_helper.rb +41 -0
metadata +432 -0

data/spec/fixtures/target/server/generic/server/apache/basic.txt ADDED Viewed

@@ -0,0 +1,5 @@
+Date: Sun, 12 Oct 2014 19:44:42 GMT
+Server: Apache/2.2.16 (Debian)
+X-Powered-By: PHP/5.3.3-7+squeeze19
+Vary: Accept-Encoding
+Content-Type: text/html

data/spec/fixtures/target/server/generic/server/iis/basic.txt ADDED Viewed

@@ -0,0 +1,6 @@
+Content-Length: 1027
+Content-Type: text/html; charset=UTF-8
+Server: Microsoft-IIS/7.5
+X-Powered-By: ASP.NET
+X-UA-Compatible: IE=EmulateIE7
+Date: Sun, 12 Oct 2014 20:15:14 GMT

data/spec/fixtures/target/server/generic/server/not_detected.txt ADDED Viewed

@@ -0,0 +1,3 @@
+Date: Sun, 12 Oct 2014 19:44:42 GMT
+Vary: Accept-Encoding
+Content-Type: text/html

data/spec/fixtures/target/server/iis/directory_listing/no_parent.html ADDED Viewed

@@ -0,0 +1,3 @@
+<html><head><title>ex.lo - /dir/</title></head><body><H1>ex.lo - /dir/</H1><hr>
+<pre>10/8/2014 11:00 PM        &lt;dir&gt; <A HREF="/sub-dir/">sub-dir</A>10/10/2014 10:00 PM          168 <A HREF="/web.config">web.config</A><br></pre><hr></body></html>

data/spec/fixtures/target/server/iis/directory_listing/with_parent.html ADDED Viewed

@@ -0,0 +1,3 @@
+<html><head><title>ex.lo - /dir/</title></head><body><H1>ex.lo - /dir/</H1><hr>
+<pre><A HREF="/">[To Parent Directory]</A><br><br> 10/8/2014 11:00 PM        &lt;dir&gt; <A HREF="/sub-dir/">sub-dir</A>10/10/2014 10:00 PM          168 <A HREF="/web.config">web.config</A><br></pre><hr></body></html>

data/spec/fixtures/views/base/ctrl/local.erb ADDED Viewed

	@@ -0,0 +1 @@
1	+ Local View

data/spec/fixtures/views/base/ctrl/test.erb ADDED Viewed

@@ -0,0 +1,3 @@
+Test: <%= @var %>
+<%= render('local') %>
+<%= render('@global') %>

data/spec/fixtures/views/base/global.erb ADDED Viewed

	@@ -0,0 +1 @@
1	+ Global View

data/spec/fixtures/views/base/test.erb ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ It <%= @test %>
2	+ Views Dirs: <%= @views_directories %>

data/spec/fixtures/views/based_format/test.erb ADDED Viewed

	@@ -0,0 +1 @@
1	+ Override the base/test.erb

data/spec/fixtures/views/json/render_me.erb ADDED Viewed

@@ -0,0 +1,4 @@
+"test": <%= @test.to_json %>,
+<% if @var %>
+"var": <%= @var.to_json %>
+<% end %>

data/spec/lib/browser_spec.rb ADDED Viewed

@@ -0,0 +1,141 @@
+require 'spec_helper'
+describe CMSScanner::Browser do
+  it_behaves_like described_class::Actions
+  subject(:browser) { described_class.instance(options) }
+  before            { described_class.reset }
+  let(:options)     { {} }
+  let(:default) do
+    {
+      ssl_verifypeer: false, ssl_verifyhost: 2,
+      headers: { 'User-Agent' => "CMSScanner v#{CMSScanner::VERSION}" }
+    }
+  end
+  describe '#forge_request' do
+    it 'returns a Typhoeus::Request' do
+      expect(browser.forge_request('http://example.com')).to be_a Typhoeus::Request
+    end
+  end
+  describe '#default_request_params' do
+    its(:default_request_params) { should eq default }
+    context 'when some attributes are set' do
+      let(:options)  do
+        {
+          cache_ttl: 200, connect_timeout: 10,
+          http_auth: { username: 'log', password: 'pwd' },
+          cookie_jar: '/tmp/cookie_jar.txt'
+        }
+      end
+      let(:expected) do
+        default.merge(
+          cache_ttl: 200, connecttimeout: 10, userpwd: 'log:pwd',
+          cookiejar: options[:cookie_jar], cookiefile: options[:cookie_jar]
+        )
+      end
+      its(:default_request_params) { should eq expected }
+    end
+  end
+  describe '#request_params' do
+    context 'when no param is given' do
+      its(:request_params) { should eq default }
+    end
+    context 'when params are supplied' do
+      let(:params) { { another_param: true, headers: { 'Accept' => 'None' } } }
+      it 'merges them (headers should be correctly merged)' do
+        expect(browser.request_params(params)).to eq default
+          .merge(params) { |key, oldval, newval| key == :headers ? oldval.merge(newval) : newval }
+      end
+      context 'when browser options' do
+        let(:options) { { proxy: 'http://127.0.0.1:8080' } }
+        it 'returns the correct hash' do
+          expect(browser.request_params(params)).to eq default
+            .merge(options)
+            .merge(params) { |key, oldval, newval| key == :headers ? oldval.merge(newval) : newval }
+        end
+      end
+    end
+  end
+  describe '#load_options' do
+    context 'when no options' do
+      it 'does not load anything' do
+        described_class::OPTIONS.each do |sym|
+          expected = sym == :user_agent ? "CMSScanner v#{CMSScanner::VERSION}" : nil
+          expect(browser.send(sym)).to eq expected
+        end
+      end
+    end
+    context 'when options are supplied' do
+      module CMSScanner
+        # Test accessor
+        class Browser
+          attr_accessor :test
+        end
+      end
+      let(:options) do
+        { cache_ttl: 200, max_threads: 10, test: 'should not be set',
+          user_agent: 'UA', proxy: false }
+      end
+      it 'merges the browser options only' do
+        described_class::OPTIONS.each do |sym|
+          expected = options.key?(sym) ? options[sym] : nil
+          expect(browser.send(sym)).to eq expected
+        end
+        expect(browser.test).to be nil
+      end
+    end
+  end
+  describe '#hydra' do
+    context 'when #max_threads is nil' do
+      its('hydra.max_concurrency') { should eq 1 }
+    end
+    context 'when #max_threads' do
+      let(:options) { { max_threads: 20 } }
+      its('hydra.max_concurrency') { should eq options[:max_threads] }
+    end
+  end
+  describe '#max_threads=' do
+    after do
+      browser.max_threads = @threads
+      expect(browser.max_threads).to eq @expected
+      expect(browser.hydra.max_concurrency).to eq @expected
+    end
+    context 'when <= 0' do
+      it 'sets the @threads to 1' do
+        @threads  = -2
+        @expected = 1
+      end
+    end
+    context 'when > 0' do
+      it 'sets the @threads' do
+        @threads  = 20
+        @expected = @threads
+      end
+    end
+  end
+end

data/spec/lib/cache/file_store_spec.rb ADDED Viewed

@@ -0,0 +1,101 @@
+require 'spec_helper'
+describe CMSScanner::Cache::FileStore do
+  let(:cache_dir) { File.join(CACHE, 'cache_file_store') }
+  subject(:cache) { described_class.new(cache_dir) }
+  before { FileUtils.rm_r(cache_dir, secure: true) if Dir.exist?(cache_dir) }
+  after  { cache.clean }
+  describe '#new, #storage_path, #serializer' do
+    its(:serializer)   { should be Marshal }
+    its(:storage_path) { should eq cache_dir }
+  end
+  describe '#clean' do
+    it 'removes all files from the cache dir' do
+      # let's create some files into the directory first
+      (0..5).each do |i|
+        File.new(File.join(cache.storage_path, "file_#{i}.txt"), File::CREAT)
+      end
+      expect(count_files_in_dir(cache.storage_path, 'file_*.txt')).to eq 6
+      cache.clean
+      expect(count_files_in_dir(cache.storage_path)).to eq 0
+    end
+  end
+  describe '#read_entry?' do
+    let(:key) { 'key1' }
+    after do
+      File.write(cache.entry_expiration_path(key), @expiration) if @expiration
+      expect(cache.read_entry(key)).to eq @expected
+    end
+    context 'when the entry does not exists' do
+      it 'returns nil' do
+        @expected = nil
+      end
+    end
+    context 'when the file is empty (marshal data too short error)' do
+      it 'returns nil' do
+        File.new(cache.entry_path(key), File::CREAT)
+        @expiration = Time.now.to_i + 200
+        @expected   = nil
+      end
+    end
+    context 'when the entry has expired' do
+      it 'returns nil' do
+        @expiration = Time.now.to_i - 200
+        @expected   = nil
+      end
+    end
+    context 'when the entry has not expired' do
+      it 'returns the entry' do
+        File.write(cache.entry_path(key), cache.serializer.dump('testing data'))
+        @expiration = Time.now.to_i + 600
+        @expected   = 'testing data'
+      end
+    end
+  end
+  describe '#write_entry' do
+    after do
+      cache.write_entry(@key, @data, @ttl)
+      expect(cache.read_entry(@key)).to eq @expected
+    end
+    it 'should get the correct entry (string)' do
+      @ttl      = 10
+      @key      = 'some_key'
+      @data     = 'Hello World !'
+      @expected = @data
+    end
+    context 'when cache_ttl <= 0' do
+      it 'does not write the entry' do
+        @ttl      = 0
+        @key      = 'another_key'
+        @data     = 'Another Hello World !'
+        @expected = nil
+      end
+    end
+    context 'when cache_ttl is nil' do
+      it 'does not write the entry' do
+        @ttl      = nil
+        @key      = 'test'
+        @data     = 'test'
+        @expected = nil
+      end
+    end
+  end
+end

data/spec/lib/cache/typhoeus_spec.rb ADDED Viewed

@@ -0,0 +1,30 @@
+require 'spec_helper'
+describe CMSScanner::Cache::Typhoeus do
+  subject(:cache) { described_class.new(cache_dir) }
+  let(:cache_dir) { File.join(CACHE, 'typhoeus_cache') }
+  let(:url)       { 'http://example.com' }
+  let(:request)   { Typhoeus::Request.new(url, cache_ttl: 20) }
+  let(:key)       { request.hash.to_s }
+  describe '#get' do
+    it 'calls #read_entry' do
+      expect(cache).to receive(:read_entry).with(key)
+      cache.get(request)
+    end
+  end
+  describe '#set' do
+    let(:response) { Typhoeus::Response.new }
+    it 'calls #write_entry' do
+      expect(cache).to receive(:write_entry).with(key, response, request.cache_ttl)
+      cache.set(request, response)
+    end
+  end
+end

data/spec/lib/cms_scanner_spec.rb ADDED Viewed

@@ -0,0 +1,45 @@
+require 'spec_helper'
+module CMSScanner
+  module Controller
+    # Failure class for testing
+    class SpecFailure < Base
+      def before_scan
+        fail 'error spotted'
+      end
+    end
+  end
+end
+describe CMSScanner::Scan do
+  subject(:scanner) { described_class.new }
+  let(:controller)  { CMSScanner::Controller }
+  describe '#new, #controllers' do
+    its(:controllers) { should eq([controller::Core.new]) }
+  end
+  describe '#run' do
+    it 'runs the controlllers and calls the formatter#beautify' do
+      expect(scanner.controllers).to receive(:run)
+      expect(scanner.formatter).to receive(:beautify)
+      scanner.run
+    end
+    context 'when an error is raised during the #run' do
+      it 'aborts the scan with the associated output' do
+        scanner.controllers[0] = controller::SpecFailure.new
+        expect(scanner.formatter).to receive(:output)
+          .with('@scan_aborted', hash_including(:reason, :trace, :verbose))
+        scanner.run
+      end
+    end
+  end
+  describe '#datastore' do
+    its(:datastore) { should eq({}) }
+  end
+end

data/spec/lib/controller_spec.rb ADDED Viewed

@@ -0,0 +1,23 @@
+require 'spec_helper'
+describe CMSScanner::Controller do
+  subject(:controller) { described_class::Base.new }
+  context 'when parsed_options' do
+    before               { described_class::Base.parsed_options = parsed_options }
+    let(:parsed_options) { { url: 'http://example.com/' } }
+    its(:parsed_options) { should eq(parsed_options) }
+    its(:formatter)      { should be_a CMSScanner::Formatter::Cli }
+    its(:target)         { should be_a CMSScanner::Target }
+    describe '#render' do
+      it 'calls the formatter#render' do
+        expect(controller.formatter).to receive(:render).with('test', { verbose: nil }, 'base')
+        controller.render('test')
+      end
+    end
+  end
+end

data/spec/lib/controllers_spec.rb ADDED Viewed

@@ -0,0 +1,52 @@
+require 'spec_helper'
+module CMSScanner
+  module Controller
+    class Spec < Base
+    end
+  end
+end
+describe CMSScanner::Controllers do
+  subject(:controllers)  { described_class.new }
+  let(:controller_mod) { CMSScanner::Controller }
+  describe '#<<' do
+    its(:size) { should be 0 }
+    context 'when controllers are added' do
+      before { controllers << controller_mod::Spec.new << controller_mod::Base.new }
+      its(:size) { should be 2 }
+    end
+    context 'when a controller is added twice' do
+      before { 2.times { controllers << controller_mod::Spec.new } }
+      its(:size) { should be 1 }
+    end
+    it 'returns self' do
+      expect(controllers << controller_mod::Spec.new).to be_a described_class
+    end
+  end
+  describe '#run' do
+    it 'runs the before_scan, run and after_scan methods of each controller' do
+      spec = controller_mod::Spec.new
+      base = controller_mod::Base.new
+      controllers << spec << base
+      # TODO: Any way to test the orders ? (after_scan should reverse the order)
+      [base, spec].each do |c|
+        expect(c).to receive(:before_scan)
+        expect(c).to receive(:run)
+        expect(c).to receive(:after_scan)
+      end
+      controllers.run
+    end
+  end
+end