yawast 0.6.0.beta4 → 0.6.0.beta5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (27) hide show
  1. checksums.yaml +4 -4
  2. data/.travis.yml +3 -2
  3. data/CHANGELOG.md +1 -0
  4. data/README.md +2 -1
  5. data/lib/resources/common_file.txt +214 -29
  6. data/lib/scanner/core.rb +3 -3
  7. data/lib/scanner/plugins/dns/generic.rb +48 -40
  8. data/lib/scanner/plugins/servers/apache.rb +22 -0
  9. data/lib/scanner/plugins/ssl/ssl.rb +55 -0
  10. data/lib/scanner/plugins/ssl/ssl_labs/analyze.rb +38 -3
  11. data/lib/scanner/plugins/ssl/sweet32.rb +7 -13
  12. data/lib/scanner/ssl.rb +5 -41
  13. data/lib/scanner/ssl_labs.rb +93 -37
  14. data/lib/shared/http.rb +16 -0
  15. data/lib/version.rb +1 -1
  16. data/lib/yawast.rb +2 -2
  17. data/test/data/hsts_disabled_server_header.txt +16 -0
  18. data/test/data/hsts_server_header.txt +17 -0
  19. data/test/data/ssl_labs_analyze_data_file_zetlab_com.json +3851 -0
  20. data/test/data/ssl_labs_analyze_data_parivahan_gov_in.json +1440 -0
  21. data/test/test_scan_apache.rb +50 -0
  22. data/test/test_scan_dns.rb +23 -0
  23. data/test/test_ssl.rb +43 -0
  24. data/test/test_ssl_labs_analyze.rb +29 -0
  25. data/test/test_ssl_sweet32.rb +29 -0
  26. data/test/test_yawast.rb +2 -1
  27. metadata +19 -2
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: 240eb319d357319184c61e26c0011a625af7d8ba
4
- data.tar.gz: b0bcd8e815fc4eaa4d9573a90745d4e55289b542
3
+ metadata.gz: 92439c2e610dc00a65cde05a4bed122f100d81fc
4
+ data.tar.gz: 62a8283127dcd7d69b159beccf215af178156168
5
5
  SHA512:
6
- metadata.gz: 3b78fbe31218ebfac9bd9b72f43f4662d890bd647f5e6797538b4125a7b041494d071205a7b4c822ba00573e065d349181650a034fd5fe31cba070e385c8773a
7
- data.tar.gz: 6ae967a045c69c49f8eeeb71e1601574fde7e2ba8b81823f2d3ce5baedfa09f8efd9cc3564d217ea042cebbc1db9ac552608c90af2e90e4338153ca57d37efd6
6
+ metadata.gz: 89af74f2d41086e71b410a9daed6c2f3fb219e0629f20fa362503c25f5080184fb91620aeaedfa099ad894b500a05d77023ec456a7a323e4640c92a7484ead09
7
+ data.tar.gz: 07f65aa6e69696ee154d88cb6e36c3cf0492e9168b62405b61328186d549a3a8561cd5146f1c85b07f46dd1a7f21d123cf8529327c6a2f325b2bc062d4f0969c
data/.travis.yml CHANGED
@@ -1,7 +1,8 @@
1
1
  language: ruby
2
2
  rvm:
3
- - 2.2.4
4
- - 2.3.1
3
+ - 2.2.8
4
+ - 2.3.5
5
+ - 2.4.2
5
6
  script:
6
7
  - bundle exec rake
7
8
  - bundle exec rake submitcodeclimate
data/CHANGELOG.md CHANGED
@@ -10,6 +10,7 @@
10
10
  * [#118](https://github.com/adamcaudill/yawast/issues/118) - Add check for CVE-2017-12617 - Apache Tomcat PUT RCE
11
11
  * [#120](https://github.com/adamcaudill/yawast/issues/120) - Add Docker support
12
12
  * [#122](https://github.com/adamcaudill/yawast/issues/122) - SSL Labs API v3
13
+ * [#125](https://github.com/adamcaudill/yawast/issues/125) - Add new search paths for Struts Sample Files
13
14
 
14
15
  ## 0.5.2 - 2017-07-13
15
16
 
data/README.md CHANGED
@@ -50,7 +50,7 @@ The following tests are performed:
50
50
  * *(Generic)* Presence of RELEASE-NOTES.txt
51
51
  * *(Generic)* Presence of readme.html
52
52
  * *(Generic)* Missing cookie flags (Secure, HttpOnly, and SameSite)
53
- * *(Generic)* Search for files (14,011) & common directories (21,332)
53
+ * *(Generic)* Search for files (14,169) & common directories (21,332)
54
54
  * *(Apache)* Info Disclosure: Module listing enabled
55
55
  * *(Apache)* Info Disclosure: Server version
56
56
  * *(Apache)* Info Disclosure: OpenSSL module version
@@ -62,6 +62,7 @@ The following tests are performed:
62
62
  * *(Apache Tomcat)* Tomcat Host Manager Weak Password
63
63
  * *(Apache Tomcat)* Tomcat version detection via invalid HTTP verb
64
64
  * *(Apache Tomcat)* Tomcat PUT RCE (CVE-2017-12617)
65
+ * *(Apache Struts)* Sample files which may be vulnerable
65
66
  * *(IIS)* Info Disclosure: Server version
66
67
  * *(ASP.NET)* Info Disclosure: ASP.NET version
67
68
  * *(ASP.NET)* Info Disclosure: ASP.NET MVC version