cms_scanner 0.0.19 → 0.0.20

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 0c16a64244ed7befaa7147416fb7f0602dd5e01a
-  data.tar.gz: 0eecb7cd60d586dcce20ceac600b65e48573581b
+  metadata.gz: 5dff32b05d6da49f0ad5697263e3a1e0a3d011a7
+  data.tar.gz: 5373a9c0a91523b45287aa577f07ce53a59fd59e
 SHA512:
-  metadata.gz: 8fae913eb98950ceab827816b37f72ed9ce2d0dcad33677b9e12900b14275f242382155635273ec4e4d26d60e3c4ee507752ff47d0ece9aa0a3f8ea51a09ed70
-  data.tar.gz: bc44ad999e82fdf7744ea738939ee8a7da795681d563f0f494c0e581eaa31998b437be6239ca2e3bd8c9cf6496b2eab26e3ae4396667a9a242dfcfdf44e7adf1
+  metadata.gz: a8c5b0c833ac6514ab85a5a1c5d00a7932eb41c33ad44bfcba544935b84c7405771b06b8ec833d3b211317af4412515db9b075cc88f17a56adcb1a64b2907ed5
+  data.tar.gz: 1a568813897294b4958f5f3f23ce245b64fa5322698a353bf5504bf599f8ef02a90c5a96dcf52b53dce0e3ccd7acc3225a9feae590cbc6f7b1c7bee41c4f6ba4

data/app/controllers.rb

@@ -1,2 +1,2 @@
 require_relative 'controllers/core'
-require_relative 'controllers/interesting_files'
+require_relative 'controllers/interesting_findings'

data/app/controllers/{interesting_files.rb → interesting_findings.rb}

@@ -1,12 +1,12 @@
 module CMSScanner
   module Controller
-    # InterestingFiles Controller
-    class InterestingFiles < Base
+    # InterestingFindings Controller
+    class InterestingFindings < Base
       def cli_options
         [
           OptChoice.new(
-            ['--interesting-files-detection MODE',
-             'Use the supplied mode for the interesting files detection. ' \
+            ['--interesting-findings-detection MODE',
+             'Use the supplied mode for the interesting findings detection. ' \
              'Modes: mixed, passive, aggressive'
             ],
             choices: %w(mixed passive aggressive),
@@ -15,8 +15,8 @@ module CMSScanner
       end
 
       def run
-        mode     = parsed_options[:interesting_files_detection] || parsed_options[:detection_mode]
-        findings = target.interesting_files(mode: mode)
+        mode = parsed_options[:interesting_findings_detection] || parsed_options[:detection_mode]
+        findings = target.interesting_findings(mode: mode)
 
         output('findings', findings: findings) unless findings.empty?
       end

data/app/finders.rb

@@ -1 +1 @@
-require_relative 'finders/interesting_files'
+require_relative 'finders/interesting_findings'

data/app/finders/interesting_findings.rb

@@ -0,0 +1,23 @@
+require_relative 'interesting_findings/headers'
+require_relative 'interesting_findings/robots_txt'
+require_relative 'interesting_findings/fantastico_fileslist'
+require_relative 'interesting_findings/search_replace_db_2'
+require_relative 'interesting_findings/xml_rpc'
+
+module CMSScanner
+  module Finders
+    module InterestingFindings
+      # Interesting Files Finder
+      class Base
+        include IndependentFinder
+
+        # @param [ CMSScanner::Target ] target
+        def initialize(target)
+          %w(Headers RobotsTxt FantasticoFileslist SearchReplaceDB2 XMLRPC).each do |f|
+            finders << NS::Finders::InterestingFindings.const_get(f).new(target)
+          end
+        end
+      end
+    end
+  end
+end

data/app/finders/{interesting_files → interesting_findings}/fantastico_fileslist.rb

@@ -1,6 +1,6 @@
 module CMSScanner
   module Finders
-    module InterestingFiles
+    module InterestingFindings
       # FantasticoFileslist finder
       class FantasticoFileslist < Finder
         # @return [ String ] The url of the fantastico_fileslist.txt file
@@ -8,14 +8,14 @@ module CMSScanner
           target.url('fantastico_fileslist.txt')
         end
 
-        # @return [ InterestingFile ]
+        # @return [ InterestingFinding ]
         def aggressive(_opts = {})
           res = NS::Browser.get(url)
 
           return unless res && res.code == 200 && res.body.length > 0
           return unless res.headers && res.headers['Content-Type'] =~ /\Atext\/plain/
 
-          NS::FantasticoFileslist.new(url, confidence: 100, found_by: found_by)
+          NS::FantasticoFileslist.new(url, confidence: 70, found_by: found_by)
         end
       end
     end

data/app/finders/{interesting_files → interesting_findings}/headers.rb

@@ -1,9 +1,9 @@
 module CMSScanner
   module Finders
-    module InterestingFiles
+    module InterestingFindings
       # Interesting Headers finder
       class Headers < Finder
-        # @return [ InterestingFile ]
+        # @return [ InterestingFinding ]
         def passive(_opts = {})
           r = NS::Headers.new(target.url, confidence: 100, found_by: found_by)
 

data/app/finders/{interesting_files → interesting_findings}/robots_txt.rb

@@ -1,6 +1,6 @@
 module CMSScanner
   module Finders
-    module InterestingFiles
+    module InterestingFindings
       # Robots.txt finder
       class RobotsTxt < Finder
         # @return [ String ] The url of the robots.txt file
@@ -8,7 +8,7 @@ module CMSScanner
           target.url('robots.txt')
         end
 
-        # @return [ InterestingFile ]
+        # @return [ InterestingFinding ]
         def aggressive(_opts = {})
           res = NS::Browser.get(url)
 

data/app/finders/{interesting_files → interesting_findings}/search_replace_db_2.rb

@@ -1,6 +1,6 @@
 module CMSScanner
   module Finders
-    module InterestingFiles
+    module InterestingFindings
       # SearchReplaceDB2 finder
       class SearchReplaceDB2 < Finder
         # @return [ String ] The url to the searchreplacedb2 PHP file
@@ -8,15 +8,15 @@ module CMSScanner
           target.url('searchreplacedb2.php')
         end
 
-        # @return [ InterestingFile ]
+        # @return [ InterestingFinding ]
         def aggressive(_opts = {})
           res = NS::Browser.get(url)
 
           return unless res && res.code == 200 && res.body =~ /by interconnect/i
 
-          NS::InterestingFile.new(url, confidence: 100,
-                                       found_by: found_by,
-                                       references: references)
+          NS::InterestingFinding.new(url, confidence: 100,
+                                          found_by: found_by,
+                                          references: references)
         end
 
         def references

data/app/finders/{interesting_files → interesting_findings}/xml_rpc.rb

@@ -1,6 +1,6 @@
 module CMSScanner
   module Finders
-    module InterestingFiles
+    module InterestingFindings
       # XML RPC finder
       class XMLRPC < Finder
         # @return [ Array<String> ] The potential urls to the XMl RPC file

data/app/models.rb

@@ -1,4 +1,4 @@
-require_relative 'models/interesting_file'
+require_relative 'models/interesting_finding'
 require_relative 'models/robots_txt'
 require_relative 'models/fantastico_fileslist'
 require_relative 'models/headers'

data/app/models/fantastico_fileslist.rb

@@ -1,6 +1,6 @@
 module CMSScanner
   # FantasticoFileslist
-  class FantasticoFileslist < InterestingFile
+  class FantasticoFileslist < InterestingFinding
     # @return [ Array<String> ] The interesting files/dirs detected
     def interesting_entries
       results = []

data/app/models/headers.rb

@@ -1,6 +1,6 @@
 module CMSScanner
-  # Not really an interesting file, but will use this class for convenience
-  class Headers < InterestingFile
+  # Interesting Headers
+  class Headers < InterestingFinding
     # @return [ Hash ] The headers
     def entries
       res = NS::Browser.get(url)

data/app/models/{interesting_file.rb → interesting_finding.rb}

@@ -1,12 +1,19 @@
 module CMSScanner
-  # Interesting File
-  class InterestingFile
+  # Interesting Finding
+  class InterestingFinding
     include NS::Finders::Finding
 
     attr_reader :url
+    attr_writer :to_s
 
+    # @param [ String ] url
+    # @param [ Hash ] opts
+    #   :to_s (override the to_s method)
+    #   See Finders::Finding for other available options
     def initialize(url, opts = {})
-      @url = url
+      @url  = url
+      @to_s = opts[:to_s]
+
       parse_finding_options(opts)
     end
 
@@ -20,12 +27,12 @@ module CMSScanner
     end
 
     def to_s
-      url
+      @to_s || url
     end
 
     def ==(other)
       return false unless self.class == other.class
-      url == other.url
+      to_s == other.to_s
     end
   end
 end

data/app/models/robots_txt.rb

@@ -1,6 +1,6 @@
 module CMSScanner
   # Robots.txt
-  class RobotsTxt < InterestingFile
+  class RobotsTxt < InterestingFinding
     # @todo Better detection, currently everything not empty or / is returned
     #
     # @return [ Array<String> ] The interesting Allow/Disallow rules detected

data/app/models/xml_rpc.rb

@@ -1,6 +1,6 @@
 module CMSScanner
   # XML RPC
-  class XMLRPC < InterestingFile
+  class XMLRPC < InterestingFinding
     # @param [ String ] method
     # @param [ Array ] params
     # @param [ Hash ] request_params

data/app/views/cli/{interesting_files → interesting_findings}/findings.erb

@@ -1,7 +1,8 @@
-Interesting Findings: <%= @findings.size %>
+<% unless @findings.empty? -%>
+Interesting Finding(s):
 <% @findings.each do |finding| -%>
 
-<%= green('[+]') %> <%= finding.url %>
+<%= green('[+]') %> <%= finding %>
 <% if finding.confidence > 0 -%>
  | Confidence: <%= finding.confidence %>%
 <% end -%>
@@ -18,4 +19,5 @@ Interesting Findings: <%= @findings.size %>
 <% end -%>
 <%= render('_array', a: finding.references, s: 'Reference', p: 'References') -%>
 <%= render('_array', a: finding.interesting_entries, s: 'Interesting Entry', p: 'Interesting Entries') -%>
+<% end -%>
 <% end %>

data/app/views/json/{interesting_files → interesting_findings}/findings.erb

@@ -1,4 +1,4 @@
-"interesting_files": [
+"interesting_findings": [
 <% unless @findings.empty? -%>
   {
   <% last_index = @findings.size - 1 %>

data/lib/cms_scanner/browser.rb

@@ -37,9 +37,9 @@ module CMSScanner
     # @return [ Hash ]
     def default_request_params
       params = {
-        ssl_verifypeer: false, # Disable SSL-Certificate checks
-        ssl_verifyhost: 2, # Disable SSL-Certificate checks
-        headers: { 'User-Agent' => user_agent }
+        ssl_verifypeer: false, ssl_verifyhost: 2, # Disable SSL-Certificate checks
+        headers: { 'User-Agent' => user_agent },
+        method: :get
       }
 
       { connecttimeout: :connect_timeout, cache_ttl: :cache_ttl,

data/lib/cms_scanner/finders/finding.rb

@@ -1,5 +1,3 @@
-require 'cms_scanner/finders/confidence'
-
 module CMSScanner
   module Finders
     # Finding
@@ -24,14 +22,14 @@ module CMSScanner
         @interesting_entries ||= []
       end
 
-      # @return [ Confidence ]
+      # @return [ Integer ]
       def confidence
-        @confidence ||= Confidence.new(0)
+        @confidence ||= 0
       end
 
-      # @param [ Integer, Confidence ] value
+      # @param [ Integer ] value
       def confidence=(value)
-        @confidence = value.is_a?(Confidence) ? value : Confidence.new(value)
+        @confidence = value >= 100 ? 100 : value
       end
 
       # @param [ Hash ] opts

data/lib/cms_scanner/target.rb

@@ -22,8 +22,8 @@ module CMSScanner
     # @param [ Hash ] opts
     #
     # @return [ Findings ]
-    def interesting_files(opts = {})
-      @interesting_files ||= NS::Finders::InterestingFiles::Base.find(self, opts)
+    def interesting_findings(opts = {})
+      @interesting_findings ||= NS::Finders::InterestingFindings::Base.find(self, opts)
     end
 
     # @param [ Regexp ] pattern

data/lib/cms_scanner/target/platform/php.rb

@@ -5,15 +5,35 @@ module CMSScanner
       module PHP
         DEBUG_LOG_PATTERN = /\[[^\]]+\] PHP (?:Warning|Error|Notice):/
         FPD_PATTERN       = /Fatal error:.+? in (.+?) on/
+        ERROR_LOG_PATTERN = /PHP Fatal error/i
 
         # @param [ String ] path
+        # @param [ Regexp ] pattern
         # @param [ Hash ] params The request params
         #
-        # @return [ Boolean ] true if  url(path) is a debug log, false otherwise
-        def debug_log?(path = nil, params = {})
+        # @return [ Boolean ]
+        def log_file?(path, pattern, params = {})
+          # Only the first 700 bytes of the file are retrieved to avoid getting enture log file
+          # which can be huge (~ 2Go)
           res = NS::Browser.get(url(path), params.merge(headers: { 'range' => 'bytes=0-700' }))
 
-          res.body =~ DEBUG_LOG_PATTERN ? true : false
+          res.body =~ pattern ? true : false
+        end
+
+        # @param [ String ] path
+        # @param [ Hash ] params The request params
+        #
+        # @return [ Boolean ] true if  url(path) is a debug log, false otherwise
+        def debug_log?(path, params = {})
+          log_file?(path, DEBUG_LOG_PATTERN, params)
+        end
+
+        # @param [ String ] path
+        # @param [ Hash ] params The request params
+        #
+        # @return [ Boolean ] Wether or not url(path) is an error log file
+        def error_log?(path, params = {})
+          log_file?(path, ERROR_LOG_PATTERN, params)
         end
 
         # @param [ String ] path

data/lib/cms_scanner/version.rb

@@ -1,4 +1,4 @@
 # Version
 module CMSScanner
-  VERSION = '0.0.19'
+  VERSION = '0.0.20'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cms_scanner
 version: !ruby/object:Gem::Version
-  version: 0.0.19
+  version: 0.0.20
 platform: ruby
 authors:
 - WPScanTeam - Erwan Le Rousseau
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-03-06 00:00:00.000000000 Z
+date: 2015-03-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: opt_parse_validator
@@ -219,14 +219,14 @@ files:
 - app/controllers.rb
 - app/controllers/core.rb
 - app/controllers/core/cli_options.rb
-- app/controllers/interesting_files.rb
+- app/controllers/interesting_findings.rb
 - app/finders.rb
-- app/finders/interesting_files.rb
-- app/finders/interesting_files/fantastico_fileslist.rb
-- app/finders/interesting_files/headers.rb
-- app/finders/interesting_files/robots_txt.rb
-- app/finders/interesting_files/search_replace_db_2.rb
-- app/finders/interesting_files/xml_rpc.rb
+- app/finders/interesting_findings.rb
+- app/finders/interesting_findings/fantastico_fileslist.rb
+- app/finders/interesting_findings/headers.rb
+- app/finders/interesting_findings/robots_txt.rb
+- app/finders/interesting_findings/search_replace_db_2.rb
+- app/finders/interesting_findings/xml_rpc.rb
 - app/formatters.rb
 - app/formatters/cli.rb
 - app/formatters/cli_no_colour.rb
@@ -234,19 +234,19 @@ files:
 - app/models.rb
 - app/models/fantastico_fileslist.rb
 - app/models/headers.rb
-- app/models/interesting_file.rb
+- app/models/interesting_finding.rb
 - app/models/robots_txt.rb
 - app/models/version.rb
 - app/models/xml_rpc.rb
 - app/views/cli/core/banner.erb
 - app/views/cli/core/finished.erb
 - app/views/cli/core/started.erb
-- app/views/cli/interesting_files/_array.erb
-- app/views/cli/interesting_files/findings.erb
+- app/views/cli/interesting_findings/_array.erb
+- app/views/cli/interesting_findings/findings.erb
 - app/views/cli/scan_aborted.erb
 - app/views/json/core/finished.erb
 - app/views/json/core/started.erb
-- app/views/json/interesting_files/findings.erb
+- app/views/json/interesting_findings/findings.erb
 - app/views/json/scan_aborted.erb
 - cms_scanner.gemspec
 - lib/cms_scanner.rb
@@ -259,7 +259,6 @@ files:
 - lib/cms_scanner/controllers.rb
 - lib/cms_scanner/errors/auth_errors.rb
 - lib/cms_scanner/finders.rb
-- lib/cms_scanner/finders/confidence.rb
 - lib/cms_scanner/finders/finder.rb
 - lib/cms_scanner/finders/finder/enumerator.rb
 - lib/cms_scanner/finders/finder/fingerprinter.rb
@@ -312,7 +311,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5
+rubygems_version: 2.4.6
 signing_key: 
 specification_version: 4
 summary: Experimental CMSScanner

data/app/finders/interesting_files.rb

@@ -1,23 +0,0 @@
-require_relative 'interesting_files/headers'
-require_relative 'interesting_files/robots_txt'
-require_relative 'interesting_files/fantastico_fileslist'
-require_relative 'interesting_files/search_replace_db_2'
-require_relative 'interesting_files/xml_rpc'
-
-module CMSScanner
-  module Finders
-    module InterestingFiles
-      # Interesting Files Finder
-      class Base
-        include IndependentFinder
-
-        # @param [ CMSScanner::Target ] target
-        def initialize(target)
-          %w(Headers RobotsTxt FantasticoFileslist SearchReplaceDB2 XMLRPC).each do |f|
-            finders << NS.const_get("Finders::InterestingFiles::#{f}").new(target)
-          end
-        end
-      end
-    end
-  end
-end

data/lib/cms_scanner/finders/confidence.rb

@@ -1,81 +0,0 @@
-module CMSScanner
-  module Finders
-    # Confidence
-    class Confidence < Numeric
-      attr_reader :value
-
-      def initialize(value)
-        @value = value
-      end
-
-      # @param [ Integer, Confidence ] other
-      #
-      # TODO: rework the formula which is weak when the value to add is < the current confidence
-      # e.g: 90 + 50 + 30 => 82
-      #
-      # @return [ Confidence ] A new Confidence
-      def +(other)
-        return Confidence.new(100) if @value == 100
-
-        to_add    = other_value(other)
-        new_value = (@value + to_add) / 1.5
-        new_value = 100 if new_value > 100 || to_add == 100
-
-        Confidence.new(new_value.floor)
-      end
-
-      #
-      ## Convenient Methods
-      #
-      #:nocov:
-      def to_s
-        @value.to_s
-      end
-
-      def to_json
-        @value.to_json
-      end
-
-      # @param [ Integer, Confidence ] other
-      def other_value(other)
-        other.is_a?(Confidence) ? other.value : other
-      end
-
-      # @param [ Integer, Confidence ] other
-      def ==(other)
-        @value == other_value(other)
-      end
-
-      # @param [ Integer, Confidence ] other
-      def eql?(other)
-        @value.eql?(other_value(other))
-      end
-
-      # @param [ Integer, Confidence ] other
-      def <(other)
-        @value < other_value(other)
-      end
-
-      # @param [ Integer, Confidence ] other
-      def <=(other)
-        @value <= other_value(other)
-      end
-
-      # @param [ Integer, Confidence ] other
-      def >(other)
-        @value > other_value(other)
-      end
-
-      # @param [ Integer, Confidence ] other
-      def >=(other)
-        @value >= other_value(other)
-      end
-
-      # @param [ Integer, Confidence ] other
-      def <=>(other)
-        @value <=> other_value(other)
-      end
-      #:nocov:
-    end
-  end
-end