yawast 0.6.0.beta4 → 0.6.0.beta5

Sign up to get free protection for your applications and to get access to all the features.
Files changed (27) hide show
  1. checksums.yaml +4 -4
  2. data/.travis.yml +3 -2
  3. data/CHANGELOG.md +1 -0
  4. data/README.md +2 -1
  5. data/lib/resources/common_file.txt +214 -29
  6. data/lib/scanner/core.rb +3 -3
  7. data/lib/scanner/plugins/dns/generic.rb +48 -40
  8. data/lib/scanner/plugins/servers/apache.rb +22 -0
  9. data/lib/scanner/plugins/ssl/ssl.rb +55 -0
  10. data/lib/scanner/plugins/ssl/ssl_labs/analyze.rb +38 -3
  11. data/lib/scanner/plugins/ssl/sweet32.rb +7 -13
  12. data/lib/scanner/ssl.rb +5 -41
  13. data/lib/scanner/ssl_labs.rb +93 -37
  14. data/lib/shared/http.rb +16 -0
  15. data/lib/version.rb +1 -1
  16. data/lib/yawast.rb +2 -2
  17. data/test/data/hsts_disabled_server_header.txt +16 -0
  18. data/test/data/hsts_server_header.txt +17 -0
  19. data/test/data/ssl_labs_analyze_data_file_zetlab_com.json +3851 -0
  20. data/test/data/ssl_labs_analyze_data_parivahan_gov_in.json +1440 -0
  21. data/test/test_scan_apache.rb +50 -0
  22. data/test/test_scan_dns.rb +23 -0
  23. data/test/test_ssl.rb +43 -0
  24. data/test/test_ssl_labs_analyze.rb +29 -0
  25. data/test/test_ssl_sweet32.rb +29 -0
  26. data/test/test_yawast.rb +2 -1
  27. metadata +19 -2
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: 240eb319d357319184c61e26c0011a625af7d8ba
4
- data.tar.gz: b0bcd8e815fc4eaa4d9573a90745d4e55289b542
3
+ metadata.gz: 92439c2e610dc00a65cde05a4bed122f100d81fc
4
+ data.tar.gz: 62a8283127dcd7d69b159beccf215af178156168
5
5
  SHA512:
6
- metadata.gz: 3b78fbe31218ebfac9bd9b72f43f4662d890bd647f5e6797538b4125a7b041494d071205a7b4c822ba00573e065d349181650a034fd5fe31cba070e385c8773a
7
- data.tar.gz: 6ae967a045c69c49f8eeeb71e1601574fde7e2ba8b81823f2d3ce5baedfa09f8efd9cc3564d217ea042cebbc1db9ac552608c90af2e90e4338153ca57d37efd6
6
+ metadata.gz: 89af74f2d41086e71b410a9daed6c2f3fb219e0629f20fa362503c25f5080184fb91620aeaedfa099ad894b500a05d77023ec456a7a323e4640c92a7484ead09
7
+ data.tar.gz: 07f65aa6e69696ee154d88cb6e36c3cf0492e9168b62405b61328186d549a3a8561cd5146f1c85b07f46dd1a7f21d123cf8529327c6a2f325b2bc062d4f0969c
data/.travis.yml CHANGED
@@ -1,7 +1,8 @@
1
1
  language: ruby
2
2
  rvm:
3
- - 2.2.4
4
- - 2.3.1
3
+ - 2.2.8
4
+ - 2.3.5
5
+ - 2.4.2
5
6
  script:
6
7
  - bundle exec rake
7
8
  - bundle exec rake submitcodeclimate
data/CHANGELOG.md CHANGED
@@ -10,6 +10,7 @@
10
10
  * [#118](https://github.com/adamcaudill/yawast/issues/118) - Add check for CVE-2017-12617 - Apache Tomcat PUT RCE
11
11
  * [#120](https://github.com/adamcaudill/yawast/issues/120) - Add Docker support
12
12
  * [#122](https://github.com/adamcaudill/yawast/issues/122) - SSL Labs API v3
13
+ * [#125](https://github.com/adamcaudill/yawast/issues/125) - Add new search paths for Struts Sample Files
13
14
 
14
15
  ## 0.5.2 - 2017-07-13
15
16
 
data/README.md CHANGED
@@ -50,7 +50,7 @@ The following tests are performed:
50
50
  * *(Generic)* Presence of RELEASE-NOTES.txt
51
51
  * *(Generic)* Presence of readme.html
52
52
  * *(Generic)* Missing cookie flags (Secure, HttpOnly, and SameSite)
53
- * *(Generic)* Search for files (14,011) & common directories (21,332)
53
+ * *(Generic)* Search for files (14,169) & common directories (21,332)
54
54
  * *(Apache)* Info Disclosure: Module listing enabled
55
55
  * *(Apache)* Info Disclosure: Server version
56
56
  * *(Apache)* Info Disclosure: OpenSSL module version
@@ -62,6 +62,7 @@ The following tests are performed:
62
62
  * *(Apache Tomcat)* Tomcat Host Manager Weak Password
63
63
  * *(Apache Tomcat)* Tomcat version detection via invalid HTTP verb
64
64
  * *(Apache Tomcat)* Tomcat PUT RCE (CVE-2017-12617)
65
+ * *(Apache Struts)* Sample files which may be vulnerable
65
66
  * *(IIS)* Info Disclosure: Server version
66
67
  * *(ASP.NET)* Info Disclosure: ASP.NET version
67
68
  * *(ASP.NET)* Info Disclosure: ASP.NET MVC version