cms_scanner 0.8.4 → 0.10.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d2ba75baf0bd8f3ee38106845a617e3b82b15550d2fe389bdd8caa9e01e4ed74
-  data.tar.gz: a61488048c346fdd6f484a34b1a75b38cc8cf996c7053830c0aa9bae2d849dff
+  metadata.gz: ee896090149c3f5dfd501ce88374b708aba187927bdac0c593f3608c801ae0d3
+  data.tar.gz: 24f17ebbab747417216229057783c1545ebbe06ff0a4c6c6e2ff969b67e69f97
 SHA512:
-  metadata.gz: 9786135ac1b578a2fdf8ce4413840c719c6e335238343e6f1b7141877bc4d57702259c8feeaecf91640d5af47e66c2a914486ee7afb836f1bf2ab162283dda18
-  data.tar.gz: 178999de4b3de5da6c01dfad1ba48e79e8757b3401742184e8cc871423907522c0e6cbcda8006635f6370651521e0a21b29c29677d9ceb8bbb39ebad9df86e55
+  metadata.gz: 13f907d61456e051f39e2988755537e6ad6ccdbd473144a5e756cb9f91a680d23539ced35cb9e29925f7d1832e4d84fe8d975871c4d5aa230c863a9e92133eee
+  data.tar.gz: 6fd87965f3fe9385583f5c8fef0ea82fc7b03c8a803e68b6117f410dac554b0c8677d975b894b37cf4c29e87260cb06f2d2e17c75c8e873912060d5707fe2804

data/lib/cms_scanner/finders/finder/breadth_first_dictionary_attack.rb

@@ -103,7 +103,7 @@ module CMSScanner
                     'Request timed out.'
                   elsif response.code.zero?
                     "No response from remote server. WAF/IPS? (#{response.return_message})"
-                  elsif /^50/.match?(response.code.to_s)
+                  elsif response.code.to_s.start_with?('50')
                     'Server error, try reducing the number of threads.'
                   else
                     "Unknown response received Code: #{response.code}\nBody: #{response.body}"

data/lib/cms_scanner/references.rb

@@ -9,7 +9,7 @@ module CMSScanner
     module ClassMethods
       # @return [ Array<Symbol> ]
       def references_keys
-        @references_keys ||= %i[cve exploitdb url metasploit packetstorm securityfocus]
+        @references_keys ||= %i[cve exploitdb url metasploit packetstorm securityfocus youtube]
       end
     end
 
@@ -18,7 +18,13 @@ module CMSScanner
       @references = {}
 
       self.class.references_keys.each do |key|
-        @references[key] = [*refs[key]].map(&:to_s) if refs.key?(key)
+        next unless refs.key?(key)
+
+        @references[key] = if key == :youtube
+                             [*refs[:youtube]].map { |id| youtube_url(id) }
+                           else
+                             [*refs[key]].map(&:to_s)
+                           end
       end
     end
 
@@ -30,7 +36,7 @@ module CMSScanner
     # @return [ Array<String> ] All the references URLs
     def references_urls
       cve_urls + exploitdb_urls + urls + msf_urls +
-        packetstorm_urls + securityfocus_urls
+        packetstorm_urls + securityfocus_urls + youtube_urls
     end
 
     # @return [ Array<String> ] The CVEs
@@ -112,5 +118,15 @@ module CMSScanner
     def securityfocus_url(id)
       "https://www.securityfocus.com/bid/#{id}/"
     end
+
+    # @return [ Array<String> ]
+    def youtube_urls
+      references[:youtube] || []
+    end
+
+    # @return [ String ]
+    def youtube_url(id)
+      "https://www.youtube.com/watch?v=#{id}"
+    end
   end
 end

data/lib/cms_scanner/target/scope.rb

@@ -58,7 +58,7 @@ module CMSScanner
                    [*scope.domains[1..-1]].map(&:to_s) + scope.invalid_domains
                  end
 
-      domains.map! { |d| Regexp.escape(d.gsub(%r{/$}, '')).gsub('\*', '.*').gsub('/', '\\\\\?/') }
+      domains.map! { |d| Regexp.escape(d.delete_suffix('/')).gsub('\*', '.*').gsub('/', '\\\\\?/') }
 
       domains[0].gsub!(Regexp.escape(uri.host), Regexp.escape(uri.host) + '(?::\\d+)?') if uri.port
 

data/lib/cms_scanner/version.rb

@@ -2,5 +2,5 @@
 
 # Version
 module CMSScanner
-  VERSION = '0.8.4'
+  VERSION = '0.10.1'
 end

data/lib/cms_scanner/vulnerability.rb

@@ -5,22 +5,27 @@ module CMSScanner
   class Vulnerability
     include References
 
-    attr_reader :title, :type, :fixed_in
+    attr_reader :title, :type, :fixed_in, :cvss
 
     # @param [ String ] title
     # @param [ Hash ] references
-    # @option references [ Array<String>, String ] cve
-    # @option references [ Array<String>, String ] secunia
-    # @option references [ Array<String>, String ] osvdb
-    # @option references [ Array<String>, String ] exploitdb
-    # @option references [ Array<String> ] url URL(s) to related advisories etc
-    # @option references [ Array<String>, String ] metasploit The related metasploit module(s)
+    # @option references [ Array<String>, String ] :cve
+    # @option references [ Array<String>, String ] :secunia
+    # @option references [ Array<String>, String ] :osvdb
+    # @option references [ Array<String>, String ] :exploitdb
+    # @option references [ Array<String> ] :url URL(s) to related advisories etc
+    # @option references [ Array<String>, String ] :metasploit The related metasploit module(s)
+    # @option references [ Array<String> ] :youtube
     # @param [ String ] type
     # @param [ String ] fixed_in
-    def initialize(title, references = {}, type = nil, fixed_in = nil)
+    # @param [ HashSymbol ] cvss
+    # @option cvss [ String ] :score
+    # @option cvss [ String ] :vector
+    def initialize(title, references: {}, type: nil, fixed_in: nil, cvss: nil)
       @title    = title
       @type     = type
       @fixed_in = fixed_in
+      @cvss     = { score: cvss[:score], vector: cvss[:vector] } if cvss
 
       self.references = references
     end
@@ -32,7 +37,8 @@ module CMSScanner
       title == other.title &&
         type == other.type &&
         references == other.references &&
-        fixed_in == other.fixed_in
+        fixed_in == other.fixed_in &&
+        cvss == other.cvss
     end
   end
 end

data/lib/cms_scanner/web_site.rb

@@ -57,7 +57,7 @@ module CMSScanner
 
     # @return [ Typhoeus::Response ]
     def error_404_res
-      @error_404_res ||= NS::Browser.get(error_404_url)
+      @error_404_res ||= NS::Browser.get_and_follow_location(error_404_url)
     end
 
     # @return [ String ] The URL of an unlikely existant page

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cms_scanner
 version: !ruby/object:Gem::Version
-  version: 0.8.4
+  version: 0.10.1
 platform: ruby
 authors:
 - WPScanTeam
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-03-02 00:00:00.000000000 Z
+date: 2020-06-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: get_process_mem
@@ -44,14 +44,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.8.1
+        version: 1.9.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.8.1
+        version: 1.9.1
 - !ruby/object:Gem::Dependency
   name: public_suffix
   requirement: !ruby/object:Gem::Requirement
@@ -84,16 +84,22 @@ dependencies:
   name: typhoeus
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 1.3.0
+        version: '1.3'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1.5'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 1.3.0
+        version: '1.3'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1.5'
 - !ruby/object:Gem::Dependency
   name: xmlrpc
   requirement: !ruby/object:Gem::Requirement
@@ -198,28 +204,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.80.0
+        version: 0.85.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.80.0
+        version: 0.85.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.5.0
+        version: 1.6.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.5.0
+        version: 1.6.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -374,7 +380,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.4'
+      version: '2.5'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="