cms_scanner 0.0.41.10 → 0.0.42.0

data/lib/cms_scanner/finders/unique_finder.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module CMSScanner
   module Finders
     # Unique Finder

data/lib/cms_scanner/finders/unique_finders.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module CMSScanner
   module Finders
     # This class is designed to return a unique result such as a version

data/lib/cms_scanner/formatter.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'cms_scanner/formatter/buffer'
 
 module CMSScanner

data/lib/cms_scanner/formatter/buffer.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module CMSScanner
   module Formatter
     # Module used to output the rendered views into a buffer
@@ -8,7 +10,7 @@ module CMSScanner
       end
 
       def buffer
-        @buffer ||= ''
+        @buffer ||= +''
       end
     end
   end

data/lib/cms_scanner/helper.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # @param [ String ] file The file path
 def redirect_output_to_file(file)
   $stdout.reopen(file, 'w')

data/lib/cms_scanner/numeric.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # Hack of the Numeric class
 class Numeric
   # @return [ String ] A human readable string of the value

data/lib/cms_scanner/progressbar_null_output.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'ruby-progressbar/outputs/null'
 
 module CMSScanner

data/lib/cms_scanner/public_suffix/domain.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module PublicSuffix
   # Monkey Patch to include the match logic
   class Domain

data/lib/cms_scanner/references.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module CMSScanner
   # References related to the issue
   module References

data/lib/cms_scanner/scan.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+module CMSScanner
+  # Scan
+  class Scan
+    attr_reader :run_error
+
+    def initialize
+      controllers << NS::Controller::Core.new
+
+      exit_hook
+
+      yield self if block_given?
+    end
+
+    # @return [ Controllers ]
+    def controllers
+      @controllers ||= NS::Controllers.new
+    end
+
+    def run
+      controllers.run
+    rescue OptParseValidator::NoRequiredOption => e
+      @run_error = e
+
+      formatter.output('@usage', msg: e.message)
+    rescue NoMemoryError, ScriptError, SecurityError, SignalException, StandardError, SystemStackError => e
+      @run_error = e
+
+      formatter.output('@scan_aborted',
+                       reason: e.is_a?(Interrupt) ? 'Canceled by User' : e.message,
+                       trace: e.backtrace,
+                       verbose: controllers.first.parsed_options[:verbose] ||
+                                run_error_exit_code == NS::ExitCode::EXCEPTION)
+    ensure
+      Browser.instance.hydra.abort
+
+      formatter.beautify
+    end
+
+    # Used for convenience
+    # @See Formatter
+    def formatter
+      controllers.first.formatter
+    end
+
+    # @return [ Hash ]
+    def datastore
+      controllers.first.datastore
+    end
+
+    # Hook to be able to have an exit code returned
+    # depending on the findings / errors
+    # :nocov:
+    def exit_hook
+      # Avoid hooking the exit when rspec is running, otherwise it will always return 0
+      # and Travis won't detect failed builds. Couldn't find a better way, even though
+      # some people managed to https://github.com/rspec/rspec-core/pull/410
+      return if defined?(RSpec)
+
+      at_exit do
+        exit(run_error_exit_code) if run_error
+
+        controller = controllers.first
+
+        # The parsed_option[:url] must be checked to avoid raising erros when only -h/-v are given
+        exit(NS::ExitCode::VULNERABLE) if controller.parsed_options[:url] && controller.target.vulnerable?
+        exit(NS::ExitCode::OK)
+      end
+    end
+    # :nocov:
+
+    # @return [ Integer ] The exit code related to the run_error
+    def run_error_exit_code
+      return NS::ExitCode::CLI_OPTION_ERROR if run_error.is_a?(OptParseValidator::Error) ||
+                                               run_error.is_a?(OptionParser::ParseError)
+
+      return NS::ExitCode::INTERRUPTED if run_error.is_a?(Interrupt)
+
+      return NS::ExitCode::ERROR if run_error.is_a?(NS::Error::Standard) ||
+                                    run_error.is_a?(CMSScanner::Error::Standard)
+
+      NS::ExitCode::EXCEPTION
+    end
+  end
+end

data/lib/cms_scanner/target.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'cms_scanner/web_site'
 require 'cms_scanner/target/platform'
 require 'cms_scanner/target/server'

data/lib/cms_scanner/target/hashes.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module CMSScanner
   # Scope system logic
   class Target < WebSite

data/lib/cms_scanner/target/platform.rb

@@ -1 +1,3 @@
+# frozen_string_literal: true
+
 require 'cms_scanner/target/platform/php'

data/lib/cms_scanner/target/platform/php.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module CMSScanner
   class Target < WebSite
     module Platform
@@ -14,9 +16,9 @@ module CMSScanner
         #
         # @return [ Boolean ]
         def log_file?(path, pattern, params = {})
-          # Only the first 700 bytes of the file are retrieved to avoid getting enture log file
+          # Only the first 700 bytes of the file are retrieved to avoid getting entire log file
           # which can be huge (~ 2Go)
-          res = NS::Browser.get(url(path), params.merge(headers: { 'range' => 'bytes=0-700' }))
+          res = head_and_get(path, [200], get: params.merge(headers: { 'Range' => 'bytes=0-700' }))
 
           res.body =~ pattern ? true : false
         end

data/lib/cms_scanner/target/scope.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module CMSScanner
   # Scope system logic
   class Target < WebSite

data/lib/cms_scanner/target/server.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'cms_scanner/target/server/generic'
 require 'cms_scanner/target/server/apache'
 require 'cms_scanner/target/server/iis'

data/lib/cms_scanner/target/server/apache.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module CMSScanner
   class Target < WebSite
     module Server

data/lib/cms_scanner/target/server/generic.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module CMSScanner
   class Target < WebSite
     module Server

data/lib/cms_scanner/target/server/iis.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module CMSScanner
   class Target < WebSite
     module Server

data/lib/cms_scanner/target/server/nginx.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module CMSScanner
   class Target < WebSite
     module Server

data/lib/cms_scanner/typhoeus/hydra.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Typhoeus
   # Ensure a clean abort of hydra
   # See https://github.com/typhoeus/typhoeus/issues/439

data/lib/cms_scanner/typhoeus/response.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Typhoeus
   # Custom Response class
   class Response

data/lib/cms_scanner/version.rb

@@ -1,4 +1,6 @@
+# frozen_string_literal: true
+
 # Version
 module CMSScanner
-  VERSION = '0.0.41.10'.freeze
+  VERSION = '0.0.42.0'
 end

data/lib/cms_scanner/vulnerability.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module CMSScanner
   # Generic Vulnerability
   class Vulnerability

data/lib/cms_scanner/web_site.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module CMSScanner
   # WebSite Implementation
   class WebSite
@@ -6,13 +8,14 @@ module CMSScanner
     # @param [ String ] site_url
     # @param [ Hash ] opts
     def initialize(site_url, opts = {})
-      self.url = site_url.dup
+      self.url = +site_url
       @opts    = opts
     end
 
     def url=(site_url)
       # Add a trailing slash to the site url
-      site_url << '/' if site_url[-1, 1] != '/'
+      # Making also sure the site_url is unfrozen
+      +site_url << '/' if site_url[-1, 1] != '/'
 
       # Use the validator to ensure the site_url has a correct format
       OptParseValidator::OptURL.new([]).validate(site_url)
@@ -98,5 +101,34 @@ module CMSScanner
       res.effective_url == url ? nil : res.effective_url
     end
     # :nocov:
+
+    # @return [ Hash ] The Typhoeus params to use to perform head requests
+    def head_or_get_params
+      @head_or_get_params ||= if NS::Browser.head(homepage_url).code == 405
+                                { method: :get, maxfilesize: 1 }
+                              else
+                                { method: :head }
+                              end
+    end
+
+    # Perform a HEAD request to the path provided, then if its response code
+    # is in the array of codes given, a GET is done and the response returned. Otherwise the
+    # HEAD response is returned.
+    #
+    # @param [ String ] path
+    # @param [ Array<String> ] codes
+    # @param [ Hash ] params The requests params
+    # @option params [ Hash ] :head Request params for the HEAD
+    # @option params [ hash ] :get Request params for the GET
+    #
+    # @return [ Typhoeus::Response ]
+    def head_and_get(path, codes = [200], params = {})
+      url_to_get  = url(path)
+      head_params = (params[:head] || {}).merge(head_or_get_params)
+
+      head_res = NS::Browser.forge_request(url_to_get, head_params).run
+
+      codes.include?(head_res.code) ? NS::Browser.get(url_to_get, params[:get] || {}) : head_res
+    end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cms_scanner
 version: !ruby/object:Gem::Version
-  version: 0.0.41.10
+  version: 0.0.42.0
 platform: ruby
 authors:
 - WPScanTeam
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-03-19 00:00:00.000000000 Z
+date: 2019-03-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri
@@ -230,23 +230,19 @@ files:
 - LICENSE
 - README.md
 - app/app.rb
-- app/controllers.rb
 - app/controllers/core.rb
 - app/controllers/core/cli_options.rb
 - app/controllers/interesting_findings.rb
-- app/finders.rb
 - app/finders/interesting_findings.rb
 - app/finders/interesting_findings/fantastico_fileslist.rb
 - app/finders/interesting_findings/headers.rb
 - app/finders/interesting_findings/robots_txt.rb
 - app/finders/interesting_findings/search_replace_db_2.rb
 - app/finders/interesting_findings/xml_rpc.rb
-- app/formatters.rb
 - app/formatters/cli.rb
 - app/formatters/cli_no_color.rb
 - app/formatters/cli_no_colour.rb
 - app/formatters/json.rb
-- app/models.rb
 - app/models/fantastico_fileslist.rb
 - app/models/headers.rb
 - app/models/interesting_finding.rb
@@ -279,6 +275,7 @@ files:
 - lib/cms_scanner/cache/typhoeus.rb
 - lib/cms_scanner/controller.rb
 - lib/cms_scanner/controllers.rb
+- lib/cms_scanner/errors.rb
 - lib/cms_scanner/errors/http.rb
 - lib/cms_scanner/errors/scan.rb
 - lib/cms_scanner/exit_code.rb
@@ -305,6 +302,7 @@ files:
 - lib/cms_scanner/progressbar_null_output.rb
 - lib/cms_scanner/public_suffix/domain.rb
 - lib/cms_scanner/references.rb
+- lib/cms_scanner/scan.rb
 - lib/cms_scanner/target.rb
 - lib/cms_scanner/target/hashes.rb
 - lib/cms_scanner/target/platform.rb

data/app/controllers.rb

@@ -1,2 +0,0 @@
-require_relative 'controllers/core'
-require_relative 'controllers/interesting_findings'

data/app/finders.rb

@@ -1 +0,0 @@
-require_relative 'finders/interesting_findings'

data/app/formatters.rb

@@ -1,4 +0,0 @@
-require_relative 'formatters/cli'
-require_relative 'formatters/cli_no_colour'
-require_relative 'formatters/cli_no_color'
-require_relative 'formatters/json'

data/app/models.rb

@@ -1,7 +0,0 @@
-require_relative 'models/interesting_finding'
-require_relative 'models/robots_txt'
-require_relative 'models/fantastico_fileslist'
-require_relative 'models/headers'
-require_relative 'models/xml_rpc'
-require_relative 'models/version'
-require_relative 'models/user'