cms_scanner 0.12.1 → 0.13.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4bd03cf29a3233e11bb14e25cc34876158525f2c6fb5c1ab52319c169e4de474
-  data.tar.gz: b3488745cffc83aea82ea33d6f44c6c52fc5da794d2b2d7d8e0176fe0a9a7a32
+  metadata.gz: 89d37ba77ff1070c9addc53d0ecabaf1252e3cf2bf88a91b3af80f91342adbf3
+  data.tar.gz: 8f3b10edf7482677f61b50725fb8567149fec6d2df40ad47f45a98f8452cd774
 SHA512:
-  metadata.gz: 3029e64fb9f68e040a01a894065b44fb71c15f0e14097fce7534eeeceb09162b4ee836dac56eb6887f2c7bb5fb947e29b59c84b11e82d52494c9de612d59d8d6
-  data.tar.gz: c182f889010dfa7fd9536d560adae2b23cc479dae31dbe20127b51c79e2f30bd88f3c8c77006341ad0a872f3871826eb9a1e04c4314fbab142f7afed2ff68fab
+  metadata.gz: acd1f06bbc57f14b3c82de562f424892e9af6b1eda64e7dcdbc9a8ade93cd87ed5bab4f449cedf0653dab7df3ba9e9f3cdb84e2847da9a68f958cd8d7e0531a1
+  data.tar.gz: 1d0f21bd6935c6fa2e4302db95a70932b7a472ec68dceb42b7cd44ed2a999b893313e924b7b8bd5396eac2ce2739f3d5ef675b2d5a3c408e4bd12666904a99cf

data/app/controllers/core.rb

@@ -43,7 +43,7 @@ module CMSScanner
         when 401
           raise Error::HTTPAuthRequired
         when 403
-          raise Error::AccessForbidden, NS::ParsedCli.random_user_agent
+          raise Error::AccessForbidden, NS::ParsedCli.random_user_agent unless NS::ParsedCli.force
         when 407
           raise Error::ProxyAuthRequired
         end

data/app/controllers/core/cli_options.rb

@@ -10,7 +10,8 @@ module CMSScanner
         [
           OptURL.new(['-u', '--url URL', 'The URL to scan'],
                      required_unless: %i[help hh version],
-                     default_protocol: 'http')
+                     default_protocol: 'http'),
+          OptBoolean.new(['--force', 'Do not check if target returns a 403'])
         ] + mixed_cli_options + [
           OptFilePath.new(['-o', '--output FILE', 'Output to FILE'], writable: true, exists: false),
           OptChoice.new(['-f', '--format FORMAT',

data/app/views/json/scan_aborted.erb

@@ -1,4 +1,5 @@
 "scan_aborted": <%= @reason.to_json %>,
+"target_url": <%= @url.to_json %>,
 <% if @verbose -%>
 "trace": <%= @trace.to_json %>,
 <% end %>

data/lib/cms_scanner/cache/file_store.rb

@@ -59,7 +59,7 @@ module CMSScanner
       #
       # @return [ String ] The expiration file path associated to the key
       def entry_expiration_path(key)
-        entry_path(key) + '.expiration'
+        "#{entry_path(key)}.expiration"
       end
 
       private

data/lib/cms_scanner/errors/http.rb

@@ -44,7 +44,7 @@ module CMSScanner
 
       def to_s
         msg = if random_user_agent_used
-                'Well... --random-user-agent didn\'t work, you\'re on your own now!'
+                'Well... --random-user-agent didn\'t work, use --force to skip this check if needed.'
               else
                 'Please re-try with --random-user-agent'
               end

data/lib/cms_scanner/finders/finder.rb

@@ -57,10 +57,12 @@ module CMSScanner
       # @param [String, Class ] klass
       # @return [ String ]
       def found_by(klass = self.class)
+        labels = %w[aggressive passive]
+
         caller_locations.each do |call|
           label = call.label
 
-          next unless %w[aggressive passive].include? label
+          next unless labels.include? label
 
           title = klass.to_s.demodulize.gsub(/(\d+)[a-z]+/i, '_\0').titleize(keep_id_suffix: true)
 

data/lib/cms_scanner/finders/finder/enumerator.rb

@@ -59,6 +59,8 @@ module CMSScanner
 
           full_res = NS::Browser.get(head_res.effective_url, full_request_params)
 
+          return unless valid_response_codes.include?(full_res.code)
+
           return if target.homepage_or_404?(full_res) ||
                     opts[:exclude_content] && full_res.body&.match(opts[:exclude_content])
 

data/lib/cms_scanner/numeric.rb

@@ -8,6 +8,6 @@ class Numeric
     e     = abs.zero? ? abs : (Math.log(abs) / Math.log(1024)).floor
     s     = format('%<s>.3f', s: (abs.to_f / 1024**e))
 
-    s.sub(/\.?0*$/, ' ' + units[e])
+    s.sub(/\.?0*$/, " #{units[e]}")
   end
 end

data/lib/cms_scanner/references.rb

@@ -86,7 +86,7 @@ module CMSScanner
 
     # @return [ String ] The URL to the metasploit module page
     def msf_url(mod)
-      "https://www.rapid7.com/db/modules/#{mod.sub(%r{^/}, '')}"
+      "https://www.rapid7.com/db/modules/#{mod.sub(%r{^/}, '')}/"
     end
 
     # @return [ Array<String> ] The Packetstormsecurity IDs

data/lib/cms_scanner/scan.rb

@@ -29,11 +29,15 @@ module CMSScanner
     rescue NoMemoryError, ScriptError, SecurityError, SignalException, StandardError, SystemStackError => e
       @run_error = e
 
-      formatter.output('@scan_aborted',
-                       reason: e.is_a?(Interrupt) ? 'Canceled by User' : e.message,
-                       trace: e.backtrace,
-                       verbose: NS::ParsedCli.verbose ||
-                                run_error_exit_code == NS::ExitCode::EXCEPTION)
+      output_params = {
+        reason: e.is_a?(Interrupt) ? 'Canceled by User' : e.message,
+        trace: e.backtrace,
+        verbose: NS::ParsedCli.verbose || run_error_exit_code == NS::ExitCode::EXCEPTION
+      }
+
+      output_params[:url] = controllers.first.target.url if NS::ParsedCli.url
+
+      formatter.output('@scan_aborted', output_params)
     ensure
       formatter.beautify
     end

data/lib/cms_scanner/target.rb

@@ -105,11 +105,11 @@ module CMSScanner
         next unless attr_value && !attr_value.empty?
 
         node_uri = begin
-                     uri.join(attr_value.strip)
-                   rescue StandardError
-                     # Skip potential malformed URLs etc.
-                     next
-                   end
+          uri.join(attr_value.strip)
+        rescue StandardError
+          # Skip potential malformed URLs etc.
+          next
+        end
 
         next unless node_uri.host
 

data/lib/cms_scanner/target/scope.rb

@@ -60,7 +60,7 @@ module CMSScanner
 
       domains.map! { |d| Regexp.escape(d.delete_suffix('/')).gsub('\*', '.*').gsub('/', '\\\\\?/') }
 
-      domains[0].gsub!(Regexp.escape(uri.host), Regexp.escape(uri.host) + '(?::\\d+)?') if uri.port
+      domains[0].gsub!(Regexp.escape(uri.host), "#{Regexp.escape(uri.host)}(?::\\d+)?") if uri.port
 
       @scope_url_pattern = %r{https?:\\?/\\?/(?:#{domains.join('|')})\\?/?}i
     end

data/lib/cms_scanner/target/server/generic.rb

@@ -41,7 +41,7 @@ module CMSScanner
         def directory_listing?(path = nil, params = {})
           res = NS::Browser.get(url(path), params)
 
-          res.code == 200 && res.body.include?('<h1>Index of') ? true : false
+          res.code == 200 && res.body.include?('<h1>Index of')
         end
 
         # @param [ String ] path

data/lib/cms_scanner/version.rb

@@ -2,5 +2,5 @@
 
 # Version
 module CMSScanner
-  VERSION = '0.12.1'
+  VERSION = '0.13.3'
 end

data/lib/cms_scanner/vulnerability.rb

@@ -5,7 +5,7 @@ module CMSScanner
   class Vulnerability
     include References
 
-    attr_reader :title, :type, :fixed_in, :cvss
+    attr_reader :title, :type, :fixed_in, :introduced_in, :cvss
 
     # @param [ String ] title
     # @param [ Hash ] references
@@ -18,14 +18,16 @@ module CMSScanner
     # @option references [ Array<String> ] :youtube
     # @param [ String ] type
     # @param [ String ] fixed_in
+    # @param [ String ] introduced_in
     # @param [ HashSymbol ] cvss
     # @option cvss [ String ] :score
     # @option cvss [ String ] :vector
-    def initialize(title, references: {}, type: nil, fixed_in: nil, cvss: nil)
-      @title    = title
-      @type     = type
-      @fixed_in = fixed_in
-      @cvss     = { score: cvss[:score], vector: cvss[:vector] } if cvss
+    def initialize(title, references: {}, type: nil, fixed_in: nil, introduced_in: nil, cvss: nil)
+      @title         = title
+      @type          = type
+      @fixed_in      = fixed_in
+      @introduced_in = introduced_in
+      @cvss          = { score: cvss[:score], vector: cvss[:vector] } if cvss
 
       self.references = references
     end

data/lib/cms_scanner/web_site.rb

@@ -62,7 +62,7 @@ module CMSScanner
 
     # @return [ String ] The URL of an unlikely existant page
     def error_404_url
-      @error_404_url ||= uri.join(Digest::MD5.hexdigest(rand(999_999).to_s)[0..6] + '.html').to_s
+      @error_404_url ||= uri.join("#{Digest::MD5.hexdigest(rand(999_999).to_s)[0..6]}.html").to_s
     end
 
     # Checks if the remote website is up.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cms_scanner
 version: !ruby/object:Gem::Version
-  version: 0.12.1
+  version: 0.13.3
 platform: ruby
 authors:
 - WPScanTeam
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-07-25 00:00:00.000000000 Z
+date: 2021-03-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: get_process_mem
@@ -30,28 +30,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.10.8
+        version: 1.11.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.10.8
+        version: 1.11.0
 - !ruby/object:Gem::Dependency
   name: opt_parse_validator
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: 1.9.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: 1.9.4
 - !ruby/object:Gem::Dependency
   name: public_suffix
   requirement: !ruby/object:Gem::Requirement
@@ -70,16 +70,22 @@ dependencies:
   name: ruby-progressbar
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 1.10.0
+        version: '1.10'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1.12'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 1.10.0
+        version: '1.10'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1.12'
 - !ruby/object:Gem::Dependency
   name: typhoeus
   requirement: !ruby/object:Gem::Requirement
@@ -176,14 +182,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.9.0
+        version: 3.10.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.9.0
+        version: 3.10.0
 - !ruby/object:Gem::Dependency
   name: rspec-its
   requirement: !ruby/object:Gem::Requirement
@@ -204,42 +210,42 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.88.0
+        version: 1.11.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.88.0
+        version: 1.11.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.7.0
+        version: 1.10.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.7.0
+        version: 1.10.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.18.2
+        version: 0.21.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.18.2
+        version: 0.21.0
 - !ruby/object:Gem::Dependency
   name: simplecov-lcov
   requirement: !ruby/object:Gem::Requirement
@@ -260,17 +266,17 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.8.0
+        version: 3.12.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.8.0
+        version: 3.12.0
 description: Framework to provide an easy way to implement CMS Scanners
 email:
-- team@wpscan.org
+- contact@wpscan.com
 executables: []
 extensions: []
 extra_rdoc_files: []