cms_scanner 0.0.31 → 0.0.32

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 262fa29651e85bd873da5de15eddfc52f164b4e1
-  data.tar.gz: a30d0c63d358be3d8b759229093afeb90a104b8b
+  metadata.gz: 5e7b45d83448abe095a219641c27db1ccb6c62d3
+  data.tar.gz: c0a503b8cb376ce46bd620017e33c72d64b2f439
 SHA512:
-  metadata.gz: 39c20221b8fc77ce4cc06275b3b7c651921044698c5994af60792f09f73c2fecc9159a5ab6bb6f25fe41f7b64f84d0d0d7733ebe19dbacd100f51f4526af9b60
-  data.tar.gz: 1f3c35697e6a0b8783c6f91765b4a3266a18825ff4fe1797518981705cac6314877ddd9f6652f4bd62ee8205ba8f53f5d034c74e26d9c7958c7b26505a085fc6
+  metadata.gz: 1c5889f4ba15eac53f58a60037ee7a28e2c99a95ca8b520c880b0feef81d038817e2bcccefe423dabe3506ee93b7bb9d10bfba53bfc7a4a8dafe809a83ee3005
+  data.tar.gz: 0565e658a23e0f67cbb4dff6abfd2cb438277c3cec173c5cdaec40d0a3d1c10e07b05011b0936cb735c31f028c3fd72d8bd25d8146878d1c5a7df6bf62717277

data/app/controllers/core.rb

@@ -25,7 +25,7 @@ module CMSScanner
         fail ProxyAuthRequiredError if target.proxy_auth?
 
         redirection = target.redirection
-        fail HTTPRedirectError, redirection if redirection
+        fail HTTPRedirectError, redirection if redirection && !parsed_options[:ignore_main_redirect]
       end
 
       def run

data/app/controllers/core/cli_options.rb

@@ -7,6 +7,7 @@ module CMSScanner
 
         [
           OptURL.new(['-u', '--url URL'], required: true, default_protocol: 'http'),
+          OptBoolean.new(['--ignore-main-redirect', 'Ignore the main redirect if any and scan the target url']),
           OptBoolean.new(%w(-v --verbose)),
           OptFilePath.new(['-o', '--output FILE', 'Output to FILE'], writable: true, exists: false),
           OptChoice.new(['-f', '--format FORMAT',
@@ -25,6 +26,7 @@ module CMSScanner
       def cli_browser_options
         [
           OptString.new(['--user-agent VALUE', '--ua']),
+          OptString.new(['--vhost VALUE', 'The virtual host (Host header) to use in requests']),
           OptBoolean.new(['--random-user-agent', '--rua',
                           'Use a random user-agent for each scan']),
           OptFilePath.new(['--user-agents-list FILE-PATH',
@@ -57,7 +59,7 @@ module CMSScanner
           OptFilePath.new(['--cookie-jar FILE-PATH', 'File to read and write cookies'],
                           writable: true,
                           exists: false,
-                          default: '/tmp/cms_scanner/cookie_jar.txt')
+                          default: File.join(tmp_directory, 'cookie_jar.txt'))
         ]
       end
 
@@ -69,7 +71,7 @@ module CMSScanner
           OptDirectoryPath.new(['--cache-dir PATH'],
                                readable: true,
                                writable: true,
-                               default: '/tmp/cms_scanner/cache/')
+                               default: File.join(tmp_directory, 'cache'))
         ]
       end
     end

data/app/formatters/cli.rb

@@ -2,26 +2,59 @@ module CMSScanner
   module Formatter
     # CLI Formatter
     class Cli < Base
+      # @return [ String ]
+      def info_icon
+        green('[+]')
+      end
+
+      # @return [ String ]
+      def notice_icon
+        blue('[i]')
+      end
+
+      # @return [ String ]
+      def warning_icon
+        amber('[!]')
+      end
+
+      # @return [ String ]
+      def critical_icon
+        red('[!]')
+      end
+
+      # @param [ String ] text
+      # @return [ String ]
       def bold(text)
         colorize(text, 1)
       end
 
+      # @param [ String ] text
+      # @return [ String ]
       def red(text)
         colorize(text, 31)
       end
 
+      # @param [ String ] text
+      # @return [ String ]
       def green(text)
         colorize(text, 32)
       end
 
+      # @param [ String ] text
+      # @return [ String ]
       def amber(text)
         colorize(text, 33)
       end
 
+      # @param [ String ] text
+      # @return [ String ]
       def blue(text)
         colorize(text, 34)
       end
 
+      # @param [ String ] text
+      # @param [ Integer ] color_code
+      # @return [ String ]
       def colorize(text, color_code)
         "\e[#{color_code}m#{text}\e[0m"
       end

data/app/views/cli/core/finished.erb

@@ -1,4 +1,4 @@
-<%= green('[+]') %> Finished: <%= @stop_time.asctime %>
-<%= green('[+]') %> Requests Done: <%= @requests_done %>
-<%= green('[+]') %> Memory used: <%= @used_memory.bytes_to_human %>
-<%= green('[+]') %> Elapsed time: <%= Time.at(@elapsed).utc.strftime('%H:%M:%S') %>
+<%= info_icon %> Finished: <%= @stop_time.asctime %>
+<%= info_icon %> Requests Done: <%= @requests_done %>
+<%= info_icon %> Memory used: <%= @used_memory.bytes_to_human %>
+<%= info_icon %> Elapsed time: <%= Time.at(@elapsed).utc.strftime('%H:%M:%S') %>

data/app/views/cli/core/started.erb

@@ -1,3 +1,3 @@
-<%= green('[+]') %> URL: <%= @url %>
-<%= green('[+]') %> Started: <%= @start_time.asctime %>
+<%= info_icon %> URL: <%= @url %>
+<%= info_icon %> Started: <%= @start_time.asctime %>
 

data/app/views/cli/interesting_findings/findings.erb

@@ -2,7 +2,7 @@
 Interesting Finding(s):
 <% @findings.each do |finding| -%>
 
-<%= green('[+]') %> <%= finding %>
+<%= info_icon %> <%= finding %>
 <%= render('_array', a: finding.interesting_entries, s: 'Interesting Entry', p: 'Interesting Entries') -%>
  | Found By: <%= finding.found_by %>
 <% if finding.confidence > 0 -%>

data/app/views/json/core/banner.erb

@@ -0,0 +1 @@
+<% # Empty file, the banner should be implemented in each scanner %>

data/cms_scanner.gemspec

@@ -33,17 +33,17 @@ Gem::Specification.new do |s|
 
   s.add_dependency 'opt_parse_validator', '~> 0.0.11'
   s.add_dependency 'typhoeus', '~> 0.7'
-  s.add_dependency 'nokogiri', '~> 1.6'
-  s.add_dependency 'addressable', '~> 2.3'
+  s.add_dependency 'nokogiri', '~> 1.6.6'
+  s.add_dependency 'addressable', '~> 2.3.8'
   s.add_dependency 'activesupport', '~> 4.2'
   s.add_dependency 'public_suffix', '~> 1.5'
-  s.add_dependency 'ruby-progressbar', '~> 1.7'
+  s.add_dependency 'ruby-progressbar', '~> 1.7.5'
 
-  s.add_development_dependency 'rake', '~> 10.4'
-  s.add_development_dependency 'rspec', '~> 3.2'
+  s.add_development_dependency 'rake', '~> 10.4.2'
+  s.add_development_dependency 'rspec', '~> 3.3'
   s.add_development_dependency 'rspec-its', '~> 1.2'
   s.add_development_dependency 'bundler', '~> 1.6'
-  s.add_development_dependency 'rubocop', '~> 0.31'
+  s.add_development_dependency 'rubocop', '~> 0.32'
   s.add_development_dependency 'webmock', '~> 1.21'
   s.add_development_dependency 'simplecov', '~> 0.10'
 end

data/lib/cms_scanner.rb

@@ -44,10 +44,12 @@ module CMSScanner
     self.total_requests += 1 unless response.cached?
   end
 
+  # @return [ Integer ]
   def self.total_requests
     @@total_requests ||= 0
   end
 
+  # @param [ Integer ]
   def self.total_requests=(value)
     @@total_requests = value
   end

data/lib/cms_scanner/browser.rb

@@ -57,7 +57,9 @@ module CMSScanner
       end
 
       params[:proxyauth] = "#{proxy_auth[:username]}:#{proxy_auth[:password]}" if proxy_auth
-      params[:userpwd] = "#{http_auth[:username]}:#{http_auth[:password]}" if http_auth
+      params[:userpwd]   = "#{http_auth[:username]}:#{http_auth[:password]}" if http_auth
+
+      params[:headers].merge!('Host' => vhost) if vhost
 
       params
     end

data/lib/cms_scanner/browser/options.rb

@@ -8,12 +8,13 @@ module CMSScanner
       :connect_timeout,
       :http_auth,
       :max_threads,
-      :user_agent,
-      :user_agents_list,
       :proxy,
       :proxy_auth,
       :random_user_agent,
-      :request_timeout
+      :request_timeout,
+      :user_agent,
+      :user_agents_list,
+      :vhost
     ]
 
     attr_accessor(*OPTIONS)
@@ -59,7 +60,7 @@ module CMSScanner
 
     # @return [ String ]
     def default_user_agent
-      "CMSScanner v#{VERSION}"
+      "#{NS} v#{NS::VERSION}"
     end
 
     # @return [ String ] The user agent

data/lib/cms_scanner/controller.rb

@@ -17,6 +17,15 @@ module CMSScanner
         self.class == other.class
       end
 
+      # Reset all the class attibutes
+      # Currently only used in specs
+      def self.reset
+        @@target         = nil
+        @@parsed_options = nil
+        @@datastore      = nil
+        @@formatter      = nil
+      end
+
       # @return [ Target ]
       def target
         @@target ||= NS::Target.new(parsed_options[:url], parsed_options)
@@ -66,6 +75,11 @@ module CMSScanner
         formatter.user_interaction? && !parsed_options[:output]
       end
 
+      # @return [ String ]
+      def tmp_directory
+        File.join('/tmp', NS.to_s.underscore)
+      end
+
       protected
 
       # @param [ String ] tpl

data/lib/cms_scanner/finders/same_type_finder.rb

@@ -7,9 +7,11 @@ module CMSScanner
           include IndependentFinder
 
           # @return [ Array ]
+          # rubocop:disable Lint/NestedMethodDefinition
           def finders
             @finders ||= NS::Finders::SameTypeFinders.new
           end
+          # rubocop:enable all
         end
       end
     end

data/lib/cms_scanner/finders/unique_finder.rb

@@ -7,9 +7,11 @@ module CMSScanner
           include IndependentFinder
 
           # @return [ Array ]
+          # rubocop:disable Lint/NestedMethodDefinition
           def finders
             @finders ||= NS::Finders::UniqueFinders.new
           end
+          # rubocop:enable all
         end
       end
     end

data/lib/cms_scanner/formatter.rb

@@ -128,7 +128,7 @@ module CMSScanner
 
       # @return [ Array<String> ] The directories to look into for views
       def views_directories
-        @views_directories ||= [Pathname.new(APP_DIR).join('views').to_s]
+        @views_directories ||= [APP_DIR, NS::APP_DIR].uniq.reduce([]) { |a, e| a << Pathname.new(e).join('views').to_s }
       end
     end
   end

data/lib/cms_scanner/version.rb

@@ -1,4 +1,4 @@
 # Version
 module CMSScanner
-  VERSION = '0.0.31'
+  VERSION = '0.0.32'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cms_scanner
 version: !ruby/object:Gem::Version
-  version: 0.0.31
+  version: 0.0.32
 platform: ruby
 authors:
 - WPScanTeam - Erwan Le Rousseau
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-06-01 00:00:00.000000000 Z
+date: 2015-06-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: opt_parse_validator
@@ -44,28 +44,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.6'
+        version: 1.6.6
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.6'
+        version: 1.6.6
 - !ruby/object:Gem::Dependency
   name: addressable
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.3'
+        version: 2.3.8
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.3'
+        version: 2.3.8
 - !ruby/object:Gem::Dependency
   name: activesupport
   requirement: !ruby/object:Gem::Requirement
@@ -100,42 +100,42 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.7'
+        version: 1.7.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.7'
+        version: 1.7.5
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.4'
+        version: 10.4.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.4'
+        version: 10.4.2
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.2'
+        version: '3.3'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.2'
+        version: '3.3'
 - !ruby/object:Gem::Dependency
   name: rspec-its
   requirement: !ruby/object:Gem::Requirement
@@ -170,14 +170,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.31'
+        version: '0.32'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.31'
+        version: '0.32'
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement
@@ -246,6 +246,7 @@ files:
 - app/views/cli/interesting_findings/findings.erb
 - app/views/cli/scan_aborted.erb
 - app/views/cli/usage.erb
+- app/views/json/core/banner.erb
 - app/views/json/core/finished.erb
 - app/views/json/core/started.erb
 - app/views/json/interesting_findings/findings.erb
@@ -314,7 +315,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.6
+rubygems_version: 2.4.8
 signing_key: 
 specification_version: 4
 summary: Experimental CMSScanner