cms_scanner 0.0.33 → 0.0.34

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 1f93aa617ff534c907d09aed61fc22f2cebb924d
-  data.tar.gz: cbb4ade08697eaec5c6dbdc8c1a73ec950093a85
+  metadata.gz: 452fa0c8c2290b87448608c952c7209f789b9ca2
+  data.tar.gz: 5ea8b78419089ff26a041cd62787b785f816a5cb
 SHA512:
-  metadata.gz: eccfe8a5c8748f6230e8ab5ac0c6d71ffdc1d1ad2e6946436f27407ee9b5878d7eaebcd3c637fe8ee6a7104cfd376cfe8f86cf33d8e69efadebc234b85d1799a
-  data.tar.gz: a407110fcb4b2e2f4460b167a7112c099890a874f0bde0b3ebf5a3b66d19e065525c2bcb7c7f87585624b0274862e96c11981e7ae62839737650542b69a3145b
+  metadata.gz: 16e142c0b57688548e12b6b7e9df53204d40d46ac4dce1c3d27a5bdd7adf8a0af936bb9123dad7d33ca9cb667a3484874797ac339dd5a415a71d89e24721b498
+  data.tar.gz: ca319bb0fcaf4c4f207f8aff69ea31a42119be99d68d473d102f224d2cd435d84808c9e00ffce0928d007b9de9341631a1e46919c292a09e6d39e7868d0de769

data/app/models/headers.rb

@@ -23,8 +23,8 @@ module CMSScanner
     # @return [ Array<String> ] Downcased known headers
     def known_headers
       %w(
-        age accept-ranges cache-control content-type content-length connection date etag expires
-        keep-alive location last-modified link pragma set-cookie strict-transport-security
+        age accept-ranges cache-control content-encoding content-length content-type connection date
+        etag expires keep-alive location last-modified link pragma set-cookie strict-transport-security
         transfer-encoding vary x-cache x-content-security-policy x-content-type-options
         x-frame-options x-language x-permitted-cross-domain-policies x-pingback x-varnish
         x-webkit-csp x-xss-protection

data/cms_scanner.gemspec

@@ -9,10 +9,10 @@ Gem::Specification.new do |s|
   s.version               = CMSScanner::VERSION
   s.platform              = Gem::Platform::RUBY
   s.required_ruby_version = '>= 2.1.0'
-  s.authors               = ['WPScanTeam - Erwan Le Rousseau']
-  s.email                 = ['erwan.lr@gmail.com']
-  s.summary               = 'Experimental CMSScanner'
-  s.description           = 'Experimental CMSScanner'
+  s.authors               = ['WPScanTeam ']
+  s.email                 = ['team@wpscan.org']
+  s.summary               = 'CMS Scanner Framework (experimental)'
+  s.description           = 'Framework to provide an easy way to implement CMS Scanners'
   s.homepage              = 'https://github.com/wpscanteam/CMSScanner'
   s.license               = 'MIT'
 
@@ -31,7 +31,7 @@ Gem::Specification.new do |s|
   s.executables           = s.files.grep(%r{^bin/}) { |f| File.basename(f) }
   s.require_path          = 'lib'
 
-  s.add_dependency 'opt_parse_validator', '~> 0.0.12.1'
+  s.add_dependency 'opt_parse_validator', '~> 0.0.13'
   s.add_dependency 'typhoeus', '~> 0.7'
   s.add_dependency 'nokogiri', '~> 1.6.6'
   s.add_dependency 'addressable', '~> 2.3.8'

data/lib/cms_scanner.rb

@@ -34,25 +34,42 @@ module CMSScanner
   APP_DIR = Pathname.new(__FILE__).dirname.join('..', 'app').expand_path
   NS      = self
 
-  def self.included(base)
-    remove_const(:NS)
-    const_set(:NS, base)
-    super(base)
-  end
-
   # Number of requests performed to display at the end of the scan
   Typhoeus.on_complete do |response|
     self.total_requests += 1 unless response.cached?
   end
 
-  # @return [ Integer ]
-  def self.total_requests
-    @@total_requests ||= 0
+  # Module to be able to use these class methods when the CMSScanner
+  # is included in another module
+  module ClassMethods
+    # @return [ Integer ]
+    def total_requests
+      @@total_requests ||= 0
+    end
+
+    # @param [ Integer ]
+    def total_requests=(value)
+      @@total_requests = value
+    end
+
+    # The lowercase name of the scanner
+    # Mainly used in directory paths like the default cookie-jar file and
+    # path to load the cli options from files
+    #
+    # @return [ String ]
+    def app_name
+      to_s.underscore
+    end
   end
 
-  # @param [ Integer ]
-  def self.total_requests=(value)
-    @@total_requests = value
+  extend ClassMethods
+
+  def self.included(base)
+    remove_const(:NS)
+    const_set(:NS, base)
+
+    base.extend(ClassMethods)
+    super(base)
   end
 
   # Scan
@@ -106,13 +123,7 @@ module CMSScanner
     # depending on the findings / errors
     def exit_hook
       at_exit do
-        if run_error
-          exit(NS::ExitCode::CLI_OPTION_ERROR) if run_error.is_a?(OptParseValidator::Error) ||
-                                                  run_error.is_a?(OptionParser::ParseError)
-
-          exit(NS::ExitCode::INTERRUPTED) if run_error.is_a?(Interrupt)
-          exit(NS::ExitCode::ERROR)
-        end
+        exit(run_error_exit_code) if run_error
 
         controller = controllers.first
 
@@ -121,6 +132,16 @@ module CMSScanner
         exit(NS::ExitCode::OK)
       end
     end
+
+    # @return [ Integer ] The exit code related to the run_error
+    def run_error_exit_code
+      return NS::ExitCode::CLI_OPTION_ERROR if run_error.is_a?(OptParseValidator::Error) ||
+                                               run_error.is_a?(OptionParser::ParseError)
+
+      return NS::ExitCode::INTERRUPTED if run_error.is_a?(Interrupt)
+
+      NS::ExitCode::ERROR
+    end
   end
 end
 

data/lib/cms_scanner/browser.rb

@@ -45,7 +45,8 @@ module CMSScanner
     # @return [ Hash ]
     def default_request_params
       params = {
-        ssl_verifypeer: false, ssl_verifyhost: 2, # Disable SSL-Certificate checks
+        # Disable SSL-Certificate checks, see http://curl.haxx.se/libcurl/c/CURLOPT_SSL_VERIFYHOST.html
+        ssl_verifypeer: false, ssl_verifyhost: 0,
         headers: { 'User-Agent' => user_agent },
         accept_encoding: 'gzip, deflate',
         method: :get

data/lib/cms_scanner/controller.rb

@@ -77,7 +77,7 @@ module CMSScanner
 
       # @return [ String ]
       def tmp_directory
-        File.join('/tmp', NS.to_s.underscore)
+        File.join('/tmp', NS.app_name)
       end
 
       protected

data/lib/cms_scanner/controllers.rb

@@ -3,8 +3,20 @@ module CMSScanner
   class Controllers < Array
     attr_reader :option_parser
 
+    # @param [ OptParsevalidator::OptParser ] options_parser
     def initialize(option_parser = OptParseValidator::OptParser.new(nil, 40))
       @option_parser = option_parser
+
+      register_options_files
+    end
+
+    # Adds the potential option file paths to the option_parser
+    def register_options_files
+      [Dir.home, Dir.pwd].each do |dir|
+        option_parser.options_files.supported_extensions.each do |ext|
+          @option_parser.options_files << File.join(dir, ".#{NS.app_name}", "cli_options.#{ext}")
+        end
+      end
     end
 
     # @param [ Controller::Base ] controller

data/lib/cms_scanner/finders/independent_finders.rb

@@ -19,15 +19,15 @@ module CMSScanner
 
         each do |finder|
           methods.each do |symbol|
-            [*finder.send(symbol, opts.merge(found: findings))].compact.each do |found|
-              findings << found
-            end
+            run_finder(finder, symbol, opts)
           end
         end
 
-        findings
+        filter_findings
       end
 
+      protected
+
       # @param [ Symbol ] mode :mixed, :passive or :aggressive
       # @return [ Array<Symbol> ] The symbols to call for the mode
       def symbols_from_mode(mode)
@@ -36,6 +36,23 @@ module CMSScanner
         return symbols if mode.nil? || mode == :mixed
         symbols.include?(mode) ? [*mode] : []
       end
+
+      # @param [ CMSScanner::Finders::Finder ] finder
+      # @param [ Symbol ] symbol See return values of #symbols_from_mode
+      # @param [ Hash ] opts
+      def run_finder(finder, symbol, opts)
+        [*finder.send(symbol, opts.merge(found: findings))].compact.each do |found|
+          findings << found
+        end
+      end
+
+      # Allow child classes to filter the findings, such as return the best one
+      # or remove the low confidence ones.
+      #
+      # @return [ Findings ]
+      def filter_findings
+        findings
+      end
     end
   end
 end

data/lib/cms_scanner/finders/same_type_finders.rb

@@ -13,15 +13,13 @@ module CMSScanner
       def run(opts = {})
         symbols_from_mode(opts[:mode]).each do |symbol|
           each do |finder|
-            [*finder.send(symbol, opts.merge(found: findings))].compact.each do |found|
-              findings << found
-            end
+            run_finder(finder, symbol, opts)
           end
         end
 
         findings.sort! if opts[:sort]
 
-        findings
+        filter_findings
       end
     end
   end

data/lib/cms_scanner/finders/unique_finders.rb

@@ -19,9 +19,7 @@ module CMSScanner
 
         symbols_from_mode(opts[:mode]).each do |symbol|
           each do |finder|
-            [*finder.send(symbol, opts.merge(found: findings))].compact.each do |found|
-              findings << found
-            end
+            run_finder(finder, symbol, opts)
 
             next if opts[:confidence_threshold] <= 0
 
@@ -29,13 +27,13 @@ module CMSScanner
           end
         end
 
-        best_finding(findings)
+        filter_findings
       end
 
-      # @param [ Array<Object> ] findings
-      #
+      protected
+
       # @return [ Object, false ] The best finding or false if none
-      def best_finding(findings)
+      def filter_findings
         # results are sorted by confidence ASC
         findings.sort_by!(&:confidence)
 

data/lib/cms_scanner/version.rb

@@ -1,4 +1,4 @@
 # Version
 module CMSScanner
-  VERSION = '0.0.33'
+  VERSION = '0.0.34'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cms_scanner
 version: !ruby/object:Gem::Version
-  version: 0.0.33
+  version: 0.0.34
 platform: ruby
 authors:
-- WPScanTeam - Erwan Le Rousseau
+- 'WPScanTeam '
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-07-06 00:00:00.000000000 Z
+date: 2015-07-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: opt_parse_validator
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.0.12.1
+        version: 0.0.13
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.0.12.1
+        version: 0.0.13
 - !ruby/object:Gem::Dependency
   name: typhoeus
   requirement: !ruby/object:Gem::Requirement
@@ -206,9 +206,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.10'
-description: Experimental CMSScanner
+description: Framework to provide an easy way to implement CMS Scanners
 email:
-- erwan.lr@gmail.com
+- team@wpscan.org
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -319,6 +319,6 @@ rubyforge_project:
 rubygems_version: 2.4.8
 signing_key: 
 specification_version: 4
-summary: Experimental CMSScanner
+summary: CMS Scanner Framework (experimental)
 test_files: []
 has_rdoc: