cms_scanner 0.0.32 → 0.0.33

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 5e7b45d83448abe095a219641c27db1ccb6c62d3
-  data.tar.gz: c0a503b8cb376ce46bd620017e33c72d64b2f439
+  metadata.gz: 1f93aa617ff534c907d09aed61fc22f2cebb924d
+  data.tar.gz: cbb4ade08697eaec5c6dbdc8c1a73ec950093a85
 SHA512:
-  metadata.gz: 1c5889f4ba15eac53f58a60037ee7a28e2c99a95ca8b520c880b0feef81d038817e2bcccefe423dabe3506ee93b7bb9d10bfba53bfc7a4a8dafe809a83ee3005
-  data.tar.gz: 0565e658a23e0f67cbb4dff6abfd2cb438277c3cec173c5cdaec40d0a3d1c10e07b05011b0936cb735c31f028c3fd72d8bd25d8146878d1c5a7df6bf62717277
+  metadata.gz: eccfe8a5c8748f6230e8ab5ac0c6d71ffdc1d1ad2e6946436f27407ee9b5878d7eaebcd3c637fe8ee6a7104cfd376cfe8f86cf33d8e69efadebc234b85d1799a
+  data.tar.gz: a407110fcb4b2e2f4460b167a7112c099890a874f0bde0b3ebf5a3b66d19e065525c2bcb7c7f87585624b0274862e96c11981e7ae62839737650542b69a3145b

data/app/controllers/core/cli_options.rb

@@ -6,18 +6,18 @@ module CMSScanner
         formats = NS::Formatter.availables
 
         [
-          OptURL.new(['-u', '--url URL'], required: true, default_protocol: 'http'),
+          OptURL.new(['-u', '--url URL', 'The URL to scan'], required: true, default_protocol: 'http'),
           OptBoolean.new(['--ignore-main-redirect', 'Ignore the main redirect if any and scan the target url']),
           OptBoolean.new(%w(-v --verbose)),
           OptFilePath.new(['-o', '--output FILE', 'Output to FILE'], writable: true, exists: false),
           OptChoice.new(['-f', '--format FORMAT',
-                         "Available formats: #{formats.join(', ')}"], choices: formats),
-          OptChoice.new(['--detection-mode MODE', 'Modes: mixed (default), passive, aggressive'],
+                         'Output results in the format supplied'], choices: formats),
+          OptChoice.new(['--detection-mode MODE'],
                         choices: %w(mixed passive aggressive),
                         normalize: :to_sym,
                         default: :mixed),
           OptArray.new(['--scope DOMAINS',
-                        'Comma separated (sub-)domains to consider in scope. ' \
+                        'Comma separated (sub-)domains to consider in scope. ',
                         'Wildcard(s) allowed in the trd of valid domains, e.g: *.target.tld'])
         ] + cli_browser_options
       end
@@ -66,7 +66,7 @@ module CMSScanner
       # @return [ Array<OptParseValidator::OptBase> ]
       def cli_browser_cache_options
         [
-          OptInteger.new(['--cache-ttl TIME_TO_LIVE'], default: 600),
+          OptInteger.new(['--cache-ttl TIME_TO_LIVE', 'The cache time to live in seconds'], default: 600),
           OptBoolean.new(['--clear-cache', 'Clear the cache before the scan']),
           OptDirectoryPath.new(['--cache-dir PATH'],
                                readable: true,

data/app/controllers/interesting_findings.rb

@@ -6,9 +6,7 @@ module CMSScanner
         [
           OptChoice.new(
             ['--interesting-findings-detection MODE',
-             'Use the supplied mode for the interesting findings detection. ' \
-             'Modes: mixed, passive, aggressive'
-            ],
+             'Use the supplied mode for the interesting findings detection. '],
             choices: %w(mixed passive aggressive),
             normalize: :to_sym)
         ]

data/cms_scanner.gemspec

@@ -31,7 +31,7 @@ Gem::Specification.new do |s|
   s.executables           = s.files.grep(%r{^bin/}) { |f| File.basename(f) }
   s.require_path          = 'lib'
 
-  s.add_dependency 'opt_parse_validator', '~> 0.0.11'
+  s.add_dependency 'opt_parse_validator', '~> 0.0.12.1'
   s.add_dependency 'typhoeus', '~> 0.7'
   s.add_dependency 'nokogiri', '~> 1.6.6'
   s.add_dependency 'addressable', '~> 2.3.8'

data/lib/cms_scanner.rb

@@ -17,6 +17,7 @@ require 'cms_scanner/typhoeus/hydra'
 require 'cms_scanner/public_suffix/domain'
 # Custom Libs
 require 'cms_scanner/helper'
+require 'cms_scanner/exit_code'
 require 'cms_scanner/errors/http'
 require 'cms_scanner/cache/typhoeus'
 require 'cms_scanner/target'
@@ -56,9 +57,13 @@ module CMSScanner
 
   # Scan
   class Scan
+    attr_reader :run_error
+
     def initialize
       controllers << NS::Controller::Core.new
 
+      exit_hook
+
       yield self if block_given?
     end
 
@@ -70,8 +75,12 @@ module CMSScanner
     def run
       controllers.run
     rescue OptParseValidator::NoRequiredOption => e
+      @run_error = e
+
       formatter.output('@usage', msg: e.message)
     rescue => e
+      @run_error = e
+
       formatter.output('@scan_aborted',
                        reason: e.message,
                        trace: e.backtrace,
@@ -92,6 +101,26 @@ module CMSScanner
     def datastore
       controllers.first.datastore
     end
+
+    # Hook to be able to have an exit code returned
+    # depending on the findings / errors
+    def exit_hook
+      at_exit do
+        if run_error
+          exit(NS::ExitCode::CLI_OPTION_ERROR) if run_error.is_a?(OptParseValidator::Error) ||
+                                                  run_error.is_a?(OptionParser::ParseError)
+
+          exit(NS::ExitCode::INTERRUPTED) if run_error.is_a?(Interrupt)
+          exit(NS::ExitCode::ERROR)
+        end
+
+        controller = controllers.first
+
+        # The parsed_option[:url] must be checked to avoid raising erros when only -h/-v are given
+        exit(NS::ExitCode::VULNERABLE) if controller.parsed_options[:url] && controller.target.vulnerable?
+        exit(NS::ExitCode::OK)
+      end
+    end
   end
 end
 

data/lib/cms_scanner/errors/http.rb

@@ -1,28 +1,37 @@
 module CMSScanner
+  class Error < RuntimeError
+  end
+
   # HTTP Authentication Required Error
-  class HTTPAuthRequiredError < StandardError
+  class HTTPAuthRequiredError < Error
+    # :nocov:
     def to_s
       'HTTP authentication required (or was invalid), please provide it with --http-auth'
     end
+    # :nocov:
   end
 
   # Proxy Authentication Required Error
-  class ProxyAuthRequiredError < StandardError
+  class ProxyAuthRequiredError < Error
+    # :nocov:
     def to_s
       'Proxy authentication required (or was invalid), please provide it with --proxy-auth'
     end
+    # :nocov:
   end
 
   # Access Forbidden Error
-  class AccessForbiddenError < StandardError
+  class AccessForbiddenError < Error
+    # :nocov:
     def to_s
       'The target is responding with a 403, this might be due to a WAF. ' \
       'Please re-try with --random-user-agent'
     end
+    # :nocov:
   end
 
   # HTTP Redirect Error
-  class HTTPRedirectError < StandardError
+  class HTTPRedirectError < Error
     attr_reader :redirect_uri
 
     # @param [ String ] url
@@ -31,7 +40,8 @@ module CMSScanner
     end
 
     def to_s
-      "The URL supplied redirects to #{redirect_uri}"
+      "The URL supplied redirects to #{redirect_uri}. Use the --ignore-main-redirect "\
+      'option to ignore the redirection and scan the target.'
     end
   end
 end

data/lib/cms_scanner/exit_code.rb

@@ -0,0 +1,20 @@
+module CMSScanner
+  # Exit Code Values
+  module ExitCode
+    # No error, scan finished w/o any vulnerabilies found
+    OK               = 0
+
+    # All exceptions raised by OptParseValidator and OptionParser
+    CLI_OPTION_ERROR = 1
+
+    # Interrupt received
+    INTERRUPTED      = 2
+
+    # Exceptions
+    ERROR            = 3
+
+    # The target has at least one vulnerability.
+    # Currently, the interesting findings do not count as vulnerable things
+    VULNERABLE       = 4
+  end
+end

data/lib/cms_scanner/public_suffix/domain.rb

@@ -6,28 +6,35 @@ module PublicSuffix
       name == other.name
     end
 
-    # TODO: better code for this method
-    # rubocop:disable all
+    # @return [ Boolean ]
+    #
     def match(pattern)
       pattern = PublicSuffix.parse(pattern) unless pattern.is_a?(PublicSuffix::Domain)
 
       return name == pattern.name unless pattern.trd
       return false unless tld == pattern.tld && sld == pattern.sld
 
+      matching_pattern?(pattern)
+    end
+
+    protected
+
+    # @rturn [ Boolean ]
+    def matching_pattern?(pattern)
       pattern_trds = pattern.trd.split('.')
       domain_trds  = trd.split('.')
 
       case pattern_trds.first
       when '*'
-        pattern_trds[1..pattern_trds.size] == domain_trds[1..domain_trds.size]
+        pattern_trds[1..-1] == domain_trds[1..-1]
       when '**'
-        pa = pattern_trds[1..pattern_trds.size]
+        pa = pattern_trds[1..-1]
+        pa_size = pa.size
 
-        domain_trds[domain_trds.size - pa.size, pa.size] == pa
+        domain_trds[domain_trds.size - pa_size, pa_size] == pa
       else
         name == pattern.name
       end
     end
-    # rubocop:enable all
   end
 end

data/lib/cms_scanner/target.rb

@@ -26,6 +26,15 @@ module CMSScanner
       @interesting_findings ||= NS::Finders::InterestingFindings::Base.find(self, opts)
     end
 
+    # Weteher or not vulnerabilities have been found.
+    # Used to set the exit code of the script
+    # and it should be overriden in the implementation
+    #
+    # @return [ Boolean ]
+    def vulnerable?
+      false
+    end
+
     # @param [ Regexp ] pattern
     # @param [ Typhoeus::Response, String ] page
     #
@@ -63,13 +72,14 @@ module CMSScanner
 
           next unless attr_value && !attr_value.empty?
 
-          tag_uri = uri.join(attr_value.strip) rescue next
+          tag_uri        = uri.join(attr_value.strip) rescue next
+          tag_uri_string = tag_uri.to_s
 
           next unless tag_uri.host
 
-          yield tag_uri.to_s, tag if block_given? && !found.include?(tag_uri.to_s)
+          yield tag_uri_string, tag if block_given? && !found.include?(tag_uri_string)
 
-          found << tag_uri.to_s
+          found << tag_uri_string
         end
       end
 

data/lib/cms_scanner/version.rb

@@ -1,4 +1,4 @@
 # Version
 module CMSScanner
-  VERSION = '0.0.32'
+  VERSION = '0.0.33'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cms_scanner
 version: !ruby/object:Gem::Version
-  version: 0.0.32
+  version: 0.0.33
 platform: ruby
 authors:
 - WPScanTeam - Erwan Le Rousseau
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-06-30 00:00:00.000000000 Z
+date: 2015-07-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: opt_parse_validator
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.0.11
+        version: 0.0.12.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.0.11
+        version: 0.0.12.1
 - !ruby/object:Gem::Dependency
   name: typhoeus
   requirement: !ruby/object:Gem::Requirement
@@ -261,6 +261,7 @@ files:
 - lib/cms_scanner/controller.rb
 - lib/cms_scanner/controllers.rb
 - lib/cms_scanner/errors/http.rb
+- lib/cms_scanner/exit_code.rb
 - lib/cms_scanner/finders.rb
 - lib/cms_scanner/finders/finder.rb
 - lib/cms_scanner/finders/finder/enumerator.rb