@sectester/scan 0.16.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +301 -0
- package/package.json +56 -0
- package/src/DefaultScans.d.ts +20 -0
- package/src/DefaultScans.js +63 -0
- package/src/DefaultScans.js.map +1 -0
- package/src/Scan.d.ts +33 -0
- package/src/Scan.js +133 -0
- package/src/Scan.js.map +1 -0
- package/src/ScanFactory.d.ts +19 -0
- package/src/ScanFactory.js +96 -0
- package/src/ScanFactory.js.map +1 -0
- package/src/ScanSettings.d.ts +47 -0
- package/src/ScanSettings.js +113 -0
- package/src/ScanSettings.js.map +1 -0
- package/src/Scans.d.ts +20 -0
- package/src/Scans.js +5 -0
- package/src/Scans.js.map +1 -0
- package/src/commands/CreateScan.d.ts +17 -0
- package/src/commands/CreateScan.js +15 -0
- package/src/commands/CreateScan.js.map +1 -0
- package/src/commands/DeleteScan.d.ts +4 -0
- package/src/commands/DeleteScan.js +16 -0
- package/src/commands/DeleteScan.js.map +1 -0
- package/src/commands/GetScan.d.ts +5 -0
- package/src/commands/GetScan.js +14 -0
- package/src/commands/GetScan.js.map +1 -0
- package/src/commands/ListIssues.d.ts +5 -0
- package/src/commands/ListIssues.js +14 -0
- package/src/commands/ListIssues.js.map +1 -0
- package/src/commands/StopScan.d.ts +4 -0
- package/src/commands/StopScan.js +15 -0
- package/src/commands/StopScan.js.map +1 -0
- package/src/commands/UploadHar.d.ts +8 -0
- package/src/commands/UploadHar.js +23 -0
- package/src/commands/UploadHar.js.map +1 -0
- package/src/commands/index.d.ts +6 -0
- package/src/commands/index.js +10 -0
- package/src/commands/index.js.map +1 -0
- package/src/exceptions/ScanAborted.d.ts +7 -0
- package/src/exceptions/ScanAborted.js +15 -0
- package/src/exceptions/ScanAborted.js.map +1 -0
- package/src/exceptions/ScanException.d.ts +6 -0
- package/src/exceptions/ScanException.js +11 -0
- package/src/exceptions/ScanException.js.map +1 -0
- package/src/exceptions/ScanExceptionCode.d.ts +4 -0
- package/src/exceptions/ScanExceptionCode.js +9 -0
- package/src/exceptions/ScanExceptionCode.js.map +1 -0
- package/src/exceptions/ScanTimedOut.d.ts +6 -0
- package/src/exceptions/ScanTimedOut.js +15 -0
- package/src/exceptions/ScanTimedOut.js.map +1 -0
- package/src/exceptions/index.d.ts +4 -0
- package/src/exceptions/index.js +8 -0
- package/src/exceptions/index.js.map +1 -0
- package/src/index.d.ts +7 -0
- package/src/index.js +11 -0
- package/src/index.js.map +1 -0
- package/src/models/AttackParamLocation.d.ts +9 -0
- package/src/models/AttackParamLocation.js +14 -0
- package/src/models/AttackParamLocation.js.map +1 -0
- package/src/models/Discovery.d.ts +5 -0
- package/src/models/Discovery.js +10 -0
- package/src/models/Discovery.js.map +1 -0
- package/src/models/HttpMethod.d.ts +18 -0
- package/src/models/HttpMethod.js +24 -0
- package/src/models/HttpMethod.js.map +1 -0
- package/src/models/Issue.d.ts +54 -0
- package/src/models/Issue.js +3 -0
- package/src/models/Issue.js.map +1 -0
- package/src/models/IssueGroup.d.ts +5 -0
- package/src/models/IssueGroup.js +3 -0
- package/src/models/IssueGroup.js.map +1 -0
- package/src/models/Module.d.ts +4 -0
- package/src/models/Module.js +9 -0
- package/src/models/Module.js.map +1 -0
- package/src/models/ScanConfig.d.ts +20 -0
- package/src/models/ScanConfig.js +3 -0
- package/src/models/ScanConfig.js.map +1 -0
- package/src/models/ScanState.d.ts +14 -0
- package/src/models/ScanState.js +3 -0
- package/src/models/ScanState.js.map +1 -0
- package/src/models/ScanStatus.d.ts +11 -0
- package/src/models/ScanStatus.js +16 -0
- package/src/models/ScanStatus.js.map +1 -0
- package/src/models/Severity.d.ts +8 -0
- package/src/models/Severity.js +37 -0
- package/src/models/Severity.js.map +1 -0
- package/src/models/TestType.d.ts +48 -0
- package/src/models/TestType.js +53 -0
- package/src/models/TestType.js.map +1 -0
- package/src/models/index.d.ts +11 -0
- package/src/models/index.js +15 -0
- package/src/models/index.js.map +1 -0
- package/src/register.d.ts +1 -0
- package/src/register.js +14 -0
- package/src/register.js.map +1 -0
- package/src/target/Target.d.ts +48 -0
- package/src/target/Target.js +166 -0
- package/src/target/Target.js.map +1 -0
- package/src/target/body-parsers/BinaryBodyParser.d.ts +6 -0
- package/src/target/body-parsers/BinaryBodyParser.js +14 -0
- package/src/target/body-parsers/BinaryBodyParser.js.map +1 -0
- package/src/target/body-parsers/BodyParser.d.ts +12 -0
- package/src/target/body-parsers/BodyParser.js +5 -0
- package/src/target/body-parsers/BodyParser.js.map +1 -0
- package/src/target/body-parsers/FormDataBodyParser.d.ts +9 -0
- package/src/target/body-parsers/FormDataBodyParser.js +63 -0
- package/src/target/body-parsers/FormDataBodyParser.js.map +1 -0
- package/src/target/body-parsers/JsonBodyParser.d.ts +7 -0
- package/src/target/body-parsers/JsonBodyParser.js +24 -0
- package/src/target/body-parsers/JsonBodyParser.js.map +1 -0
- package/src/target/body-parsers/TextBodyParser.d.ts +6 -0
- package/src/target/body-parsers/TextBodyParser.js +15 -0
- package/src/target/body-parsers/TextBodyParser.js.map +1 -0
- package/src/target/body-parsers/UrlEncodedBodyParser.d.ts +7 -0
- package/src/target/body-parsers/UrlEncodedBodyParser.js +25 -0
- package/src/target/body-parsers/UrlEncodedBodyParser.js.map +1 -0
- package/src/target/body-parsers/index.d.ts +2 -0
- package/src/target/body-parsers/index.js +6 -0
- package/src/target/body-parsers/index.js.map +1 -0
- package/src/target/body-parsers/register.d.ts +1 -0
- package/src/target/body-parsers/register.js +26 -0
- package/src/target/body-parsers/register.js.map +1 -0
- package/src/target/index.d.ts +2 -0
- package/src/target/index.js +6 -0
- package/src/target/index.js.map +1 -0
- package/src/utils/entries-to-list.d.ts +7 -0
- package/src/utils/entries-to-list.js +10 -0
- package/src/utils/entries-to-list.js.map +1 -0
- package/src/utils/escape.d.ts +1 -0
- package/src/utils/escape.js +19 -0
- package/src/utils/escape.js.map +1 -0
- package/src/utils/index.d.ts +2 -0
- package/src/utils/index.js +6 -0
- package/src/utils/index.js.map +1 -0
package/src/index.js
ADDED
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
const tslib_1 = require("tslib");
|
|
4
|
+
require("./register");
|
|
5
|
+
(0, tslib_1.__exportStar)(require("./exceptions"), exports);
|
|
6
|
+
(0, tslib_1.__exportStar)(require("./models"), exports);
|
|
7
|
+
(0, tslib_1.__exportStar)(require("./target"), exports);
|
|
8
|
+
(0, tslib_1.__exportStar)(require("./Scan"), exports);
|
|
9
|
+
(0, tslib_1.__exportStar)(require("./ScanFactory"), exports);
|
|
10
|
+
(0, tslib_1.__exportStar)(require("./ScanSettings"), exports);
|
|
11
|
+
//# sourceMappingURL=index.js.map
|
package/src/index.js.map
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../packages/scan/src/index.ts"],"names":[],"mappings":";;;AAAA,sBAAoB;AAEpB,4DAA6B;AAC7B,wDAAyB;AACzB,wDAAyB;AACzB,sDAAuB;AACvB,6DAA8B;AAC9B,8DAA+B"}
|
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.AttackParamLocation = void 0;
|
|
4
|
+
var AttackParamLocation;
|
|
5
|
+
(function (AttackParamLocation) {
|
|
6
|
+
AttackParamLocation["ARTIFICAL_FRAGMENT"] = "artifical-fragment";
|
|
7
|
+
AttackParamLocation["ARTIFICAL_QUERY"] = "artifical-query";
|
|
8
|
+
AttackParamLocation["BODY"] = "body";
|
|
9
|
+
AttackParamLocation["FRAGMENT"] = "fragment";
|
|
10
|
+
AttackParamLocation["HEADER"] = "header";
|
|
11
|
+
AttackParamLocation["PATH"] = "path";
|
|
12
|
+
AttackParamLocation["QUERY"] = "query";
|
|
13
|
+
})(AttackParamLocation = exports.AttackParamLocation || (exports.AttackParamLocation = {}));
|
|
14
|
+
//# sourceMappingURL=AttackParamLocation.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"AttackParamLocation.js","sourceRoot":"","sources":["../../../../../packages/scan/src/models/AttackParamLocation.ts"],"names":[],"mappings":";;;AAAA,IAAY,mBAQX;AARD,WAAY,mBAAmB;IAC7B,gEAAyC,CAAA;IACzC,0DAAmC,CAAA;IACnC,oCAAa,CAAA;IACb,4CAAqB,CAAA;IACrB,wCAAiB,CAAA;IACjB,oCAAa,CAAA;IACb,sCAAe,CAAA;AACjB,CAAC,EARW,mBAAmB,GAAnB,2BAAmB,KAAnB,2BAAmB,QAQ9B"}
|
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.Discovery = void 0;
|
|
4
|
+
var Discovery;
|
|
5
|
+
(function (Discovery) {
|
|
6
|
+
Discovery["CRAWLER"] = "crawler";
|
|
7
|
+
Discovery["ARCHIVE"] = "archive";
|
|
8
|
+
Discovery["OAS"] = "oas";
|
|
9
|
+
})(Discovery = exports.Discovery || (exports.Discovery = {}));
|
|
10
|
+
//# sourceMappingURL=Discovery.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"Discovery.js","sourceRoot":"","sources":["../../../../../packages/scan/src/models/Discovery.ts"],"names":[],"mappings":";;;AAAA,IAAY,SAIX;AAJD,WAAY,SAAS;IACnB,gCAAmB,CAAA;IACnB,gCAAmB,CAAA;IACnB,wBAAW,CAAA;AACb,CAAC,EAJW,SAAS,GAAT,iBAAS,KAAT,iBAAS,QAIpB"}
|
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
export declare enum HttpMethod {
|
|
2
|
+
GET = "GET",
|
|
3
|
+
PUT = "PUT",
|
|
4
|
+
POST = "POST",
|
|
5
|
+
PATCH = "PATCH",
|
|
6
|
+
DELETE = "DELETE",
|
|
7
|
+
COPY = "COPY",
|
|
8
|
+
HEAD = "HEAD",
|
|
9
|
+
OPTIONS = "OPTIONS",
|
|
10
|
+
LINK = "LINK",
|
|
11
|
+
UNLINK = "UNLINK",
|
|
12
|
+
PURGE = "PURGE",
|
|
13
|
+
LOCK = "LOCK",
|
|
14
|
+
UNLOCK = "UNLOCK",
|
|
15
|
+
PROPFIND = "PROPFIND",
|
|
16
|
+
VIEW = "VIEW"
|
|
17
|
+
}
|
|
18
|
+
export declare const isHttpMethod: (value: string) => value is HttpMethod;
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.isHttpMethod = exports.HttpMethod = void 0;
|
|
4
|
+
var HttpMethod;
|
|
5
|
+
(function (HttpMethod) {
|
|
6
|
+
HttpMethod["GET"] = "GET";
|
|
7
|
+
HttpMethod["PUT"] = "PUT";
|
|
8
|
+
HttpMethod["POST"] = "POST";
|
|
9
|
+
HttpMethod["PATCH"] = "PATCH";
|
|
10
|
+
HttpMethod["DELETE"] = "DELETE";
|
|
11
|
+
HttpMethod["COPY"] = "COPY";
|
|
12
|
+
HttpMethod["HEAD"] = "HEAD";
|
|
13
|
+
HttpMethod["OPTIONS"] = "OPTIONS";
|
|
14
|
+
HttpMethod["LINK"] = "LINK";
|
|
15
|
+
HttpMethod["UNLINK"] = "UNLINK";
|
|
16
|
+
HttpMethod["PURGE"] = "PURGE";
|
|
17
|
+
HttpMethod["LOCK"] = "LOCK";
|
|
18
|
+
HttpMethod["UNLOCK"] = "UNLOCK";
|
|
19
|
+
HttpMethod["PROPFIND"] = "PROPFIND";
|
|
20
|
+
HttpMethod["VIEW"] = "VIEW";
|
|
21
|
+
})(HttpMethod = exports.HttpMethod || (exports.HttpMethod = {}));
|
|
22
|
+
const isHttpMethod = (value) => Object.values(HttpMethod).includes(value.toUpperCase());
|
|
23
|
+
exports.isHttpMethod = isHttpMethod;
|
|
24
|
+
//# sourceMappingURL=HttpMethod.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"HttpMethod.js","sourceRoot":"","sources":["../../../../../packages/scan/src/models/HttpMethod.ts"],"names":[],"mappings":";;;AAAA,IAAY,UAgBX;AAhBD,WAAY,UAAU;IACpB,yBAAW,CAAA;IACX,yBAAW,CAAA;IACX,2BAAa,CAAA;IACb,6BAAe,CAAA;IACf,+BAAiB,CAAA;IACjB,2BAAa,CAAA;IACb,2BAAa,CAAA;IACb,iCAAmB,CAAA;IACnB,2BAAa,CAAA;IACb,+BAAiB,CAAA;IACjB,6BAAe,CAAA;IACf,2BAAa,CAAA;IACb,+BAAiB,CAAA;IACjB,mCAAqB,CAAA;IACrB,2BAAa,CAAA;AACf,CAAC,EAhBW,UAAU,GAAV,kBAAU,KAAV,kBAAU,QAgBrB;AAEM,MAAM,YAAY,GAAG,CAAC,KAAa,EAAuB,EAAE,CACjE,MAAM,CAAC,MAAM,CAAS,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;AADrD,QAAA,YAAY,gBACyC"}
|
|
@@ -0,0 +1,54 @@
|
|
|
1
|
+
import { Severity } from './Severity';
|
|
2
|
+
import { HttpMethod } from './HttpMethod';
|
|
3
|
+
export declare type Protocol = 'http' | 'ws';
|
|
4
|
+
export interface Request {
|
|
5
|
+
method: HttpMethod;
|
|
6
|
+
url: string;
|
|
7
|
+
headers?: Record<string, string>;
|
|
8
|
+
body?: string;
|
|
9
|
+
protocol?: Protocol;
|
|
10
|
+
}
|
|
11
|
+
export interface Response {
|
|
12
|
+
headers?: Record<string, string>;
|
|
13
|
+
body?: string;
|
|
14
|
+
status?: number;
|
|
15
|
+
protocol?: Protocol;
|
|
16
|
+
}
|
|
17
|
+
export declare type Frame = 'outgoing' | 'incoming';
|
|
18
|
+
export interface WebsocketFrame {
|
|
19
|
+
type: Frame;
|
|
20
|
+
status?: number;
|
|
21
|
+
data?: string;
|
|
22
|
+
timestamp?: number;
|
|
23
|
+
}
|
|
24
|
+
export interface Screenshot {
|
|
25
|
+
url: string;
|
|
26
|
+
title: string;
|
|
27
|
+
}
|
|
28
|
+
export interface Comment {
|
|
29
|
+
headline: string;
|
|
30
|
+
links?: string[];
|
|
31
|
+
text?: string;
|
|
32
|
+
}
|
|
33
|
+
export interface Issue {
|
|
34
|
+
id: string;
|
|
35
|
+
order: number;
|
|
36
|
+
details: string;
|
|
37
|
+
name: string;
|
|
38
|
+
severity: Severity;
|
|
39
|
+
protocol: Protocol;
|
|
40
|
+
remedy: string;
|
|
41
|
+
time: Date;
|
|
42
|
+
originalRequest: Request;
|
|
43
|
+
request: Request;
|
|
44
|
+
link: string;
|
|
45
|
+
exposure?: string;
|
|
46
|
+
resources?: string[];
|
|
47
|
+
comments?: Comment[];
|
|
48
|
+
screenshots?: Screenshot[];
|
|
49
|
+
cvss?: string;
|
|
50
|
+
cwe?: string;
|
|
51
|
+
frames?: WebsocketFrame[];
|
|
52
|
+
originalFrames?: WebsocketFrame[];
|
|
53
|
+
response?: Response;
|
|
54
|
+
}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"Issue.js","sourceRoot":"","sources":["../../../../../packages/scan/src/models/Issue.ts"],"names":[],"mappings":""}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"IssueGroup.js","sourceRoot":"","sources":["../../../../../packages/scan/src/models/IssueGroup.ts"],"names":[],"mappings":""}
|
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.Module = void 0;
|
|
4
|
+
var Module;
|
|
5
|
+
(function (Module) {
|
|
6
|
+
Module["DAST"] = "dast";
|
|
7
|
+
Module["FUZZER"] = "fuzzer";
|
|
8
|
+
})(Module = exports.Module || (exports.Module = {}));
|
|
9
|
+
//# sourceMappingURL=Module.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"Module.js","sourceRoot":"","sources":["../../../../../packages/scan/src/models/Module.ts"],"names":[],"mappings":";;;AAAA,IAAY,MAGX;AAHD,WAAY,MAAM;IAChB,uBAAa,CAAA;IACb,2BAAiB,CAAA;AACnB,CAAC,EAHW,MAAM,GAAN,cAAM,KAAN,cAAM,QAGjB"}
|
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
import { Module } from './Module';
|
|
2
|
+
import { TestType } from './TestType';
|
|
3
|
+
import { Discovery } from './Discovery';
|
|
4
|
+
import { AttackParamLocation } from './AttackParamLocation';
|
|
5
|
+
export interface ScanConfig {
|
|
6
|
+
name: string;
|
|
7
|
+
module?: Module;
|
|
8
|
+
tests?: TestType[];
|
|
9
|
+
discoveryTypes?: Discovery[];
|
|
10
|
+
poolSize?: number;
|
|
11
|
+
attackParamLocations?: AttackParamLocation[];
|
|
12
|
+
fileId?: string;
|
|
13
|
+
hostsFilter?: string[];
|
|
14
|
+
repeaters?: string[];
|
|
15
|
+
smart?: boolean;
|
|
16
|
+
skipStaticParams?: boolean;
|
|
17
|
+
projectId?: string;
|
|
18
|
+
slowEpTimeout?: number;
|
|
19
|
+
targetTimeout?: number;
|
|
20
|
+
}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"ScanConfig.js","sourceRoot":"","sources":["../../../../../packages/scan/src/models/ScanConfig.ts"],"names":[],"mappings":""}
|
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
import { IssueGroup } from './IssueGroup';
|
|
2
|
+
import { ScanStatus } from './ScanStatus';
|
|
3
|
+
export interface ScanState {
|
|
4
|
+
status: ScanStatus;
|
|
5
|
+
issuesBySeverity?: IssueGroup[];
|
|
6
|
+
entryPoints?: number;
|
|
7
|
+
totalParams?: number;
|
|
8
|
+
discovering?: boolean;
|
|
9
|
+
requests?: number;
|
|
10
|
+
elapsed?: number;
|
|
11
|
+
startTime?: Date;
|
|
12
|
+
endTime?: Date;
|
|
13
|
+
createdAt?: Date;
|
|
14
|
+
}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"ScanState.js","sourceRoot":"","sources":["../../../../../packages/scan/src/models/ScanState.ts"],"names":[],"mappings":""}
|
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.ScanStatus = void 0;
|
|
4
|
+
var ScanStatus;
|
|
5
|
+
(function (ScanStatus) {
|
|
6
|
+
ScanStatus["FAILED"] = "failed";
|
|
7
|
+
ScanStatus["DISRUPTED"] = "disrupted";
|
|
8
|
+
ScanStatus["RUNNING"] = "running";
|
|
9
|
+
ScanStatus["STOPPED"] = "stopped";
|
|
10
|
+
ScanStatus["QUEUED"] = "queued";
|
|
11
|
+
ScanStatus["SCHEDULED"] = "scheduled";
|
|
12
|
+
ScanStatus["PENDING"] = "pending";
|
|
13
|
+
ScanStatus["DONE"] = "done";
|
|
14
|
+
ScanStatus["PAUSED"] = "paused";
|
|
15
|
+
})(ScanStatus = exports.ScanStatus || (exports.ScanStatus = {}));
|
|
16
|
+
//# sourceMappingURL=ScanStatus.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"ScanStatus.js","sourceRoot":"","sources":["../../../../../packages/scan/src/models/ScanStatus.ts"],"names":[],"mappings":";;;AAAA,IAAY,UAUX;AAVD,WAAY,UAAU;IACpB,+BAAiB,CAAA;IACjB,qCAAuB,CAAA;IACvB,iCAAmB,CAAA;IACnB,iCAAmB,CAAA;IACnB,+BAAiB,CAAA;IACjB,qCAAuB,CAAA;IACvB,iCAAmB,CAAA;IACnB,2BAAa,CAAA;IACb,+BAAiB,CAAA;AACnB,CAAC,EAVW,UAAU,GAAV,kBAAU,KAAV,kBAAU,QAUrB"}
|
|
@@ -0,0 +1,8 @@
|
|
|
1
|
+
export declare enum Severity {
|
|
2
|
+
MEDIUM = "Medium",
|
|
3
|
+
HIGH = "High",
|
|
4
|
+
LOW = "Low"
|
|
5
|
+
}
|
|
6
|
+
export declare const severityRanges: Map<Severity, Severity[]>;
|
|
7
|
+
export declare function severityToNumber(s: Severity): number;
|
|
8
|
+
export declare function severityComparator(s1: Severity, s2: Severity): number;
|
|
@@ -0,0 +1,37 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.severityComparator = exports.severityToNumber = exports.severityRanges = exports.Severity = void 0;
|
|
4
|
+
var Severity;
|
|
5
|
+
(function (Severity) {
|
|
6
|
+
Severity["MEDIUM"] = "Medium";
|
|
7
|
+
Severity["HIGH"] = "High";
|
|
8
|
+
Severity["LOW"] = "Low";
|
|
9
|
+
})(Severity = exports.Severity || (exports.Severity = {}));
|
|
10
|
+
exports.severityRanges = new Map(Object.values(Severity).map(severity => {
|
|
11
|
+
switch (severity) {
|
|
12
|
+
case Severity.MEDIUM:
|
|
13
|
+
return [severity, [Severity.MEDIUM, Severity.HIGH]];
|
|
14
|
+
case Severity.HIGH:
|
|
15
|
+
return [severity, [Severity.HIGH]];
|
|
16
|
+
case Severity.LOW:
|
|
17
|
+
return [severity, Object.values(Severity)];
|
|
18
|
+
}
|
|
19
|
+
}));
|
|
20
|
+
function severityToNumber(s) {
|
|
21
|
+
switch (s) {
|
|
22
|
+
case Severity.LOW:
|
|
23
|
+
return 1;
|
|
24
|
+
case Severity.MEDIUM:
|
|
25
|
+
return 2;
|
|
26
|
+
case Severity.HIGH:
|
|
27
|
+
return 3;
|
|
28
|
+
default:
|
|
29
|
+
throw new Error('Unknown severity value');
|
|
30
|
+
}
|
|
31
|
+
}
|
|
32
|
+
exports.severityToNumber = severityToNumber;
|
|
33
|
+
function severityComparator(s1, s2) {
|
|
34
|
+
return severityToNumber(s2) - severityToNumber(s1);
|
|
35
|
+
}
|
|
36
|
+
exports.severityComparator = severityComparator;
|
|
37
|
+
//# sourceMappingURL=Severity.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"Severity.js","sourceRoot":"","sources":["../../../../../packages/scan/src/models/Severity.ts"],"names":[],"mappings":";;;AAAA,IAAY,QAIX;AAJD,WAAY,QAAQ;IAClB,6BAAiB,CAAA;IACjB,yBAAa,CAAA;IACb,uBAAW,CAAA;AACb,CAAC,EAJW,QAAQ,GAAR,gBAAQ,KAAR,gBAAQ,QAInB;AAEY,QAAA,cAAc,GAAG,IAAI,GAAG,CACnC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;IACrC,QAAQ,QAAQ,EAAE;QAChB,KAAK,QAAQ,CAAC,MAAM;YAClB,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,KAAK,QAAQ,CAAC,IAAI;YAChB,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,KAAK,QAAQ,CAAC,GAAG;YACf,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;KAC9C;AACH,CAAC,CAAC,CACH,CAAC;AAEF,SAAgB,gBAAgB,CAAC,CAAW;IAC1C,QAAQ,CAAC,EAAE;QACT,KAAK,QAAQ,CAAC,GAAG;YACf,OAAO,CAAC,CAAC;QACX,KAAK,QAAQ,CAAC,MAAM;YAClB,OAAO,CAAC,CAAC;QACX,KAAK,QAAQ,CAAC,IAAI;YAChB,OAAO,CAAC,CAAC;QACX;YACE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;KAC7C;AACH,CAAC;AAXD,4CAWC;AAED,SAAgB,kBAAkB,CAAC,EAAY,EAAE,EAAY;IAC3D,OAAO,gBAAgB,CAAC,EAAE,CAAC,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;AACrD,CAAC;AAFD,gDAEC"}
|
|
@@ -0,0 +1,48 @@
|
|
|
1
|
+
export declare enum TestType {
|
|
2
|
+
ANGULAR_CSTI = "angular_csti",
|
|
3
|
+
BACKUP_LOCATIONS = "backup_locations",
|
|
4
|
+
BROKEN_SAML_AUTH = "broken_saml_auth",
|
|
5
|
+
BRUTE_FORCE_LOGIN = "brute_force_login",
|
|
6
|
+
BUSINESS_CONSTRAINT_BYPASS = "business_constraint_bypass",
|
|
7
|
+
COMMON_FILES = "common_files",
|
|
8
|
+
COOKIE_SECURITY = "cookie_security",
|
|
9
|
+
CSRF = "csrf",
|
|
10
|
+
DATE_MANIPULATION = "date_manipulation",
|
|
11
|
+
DEFAULT_LOGIN_LOCATION = "default_login_location",
|
|
12
|
+
DIRECTORY_LISTING = "directory_listing",
|
|
13
|
+
DOM_XSS = "dom_xss",
|
|
14
|
+
EMAIL_INJECTION = "email_injection",
|
|
15
|
+
EXPOSED_COUCH_DB_APIS = "exposed_couch_db_apis",
|
|
16
|
+
FILE_UPLOAD = "file_upload",
|
|
17
|
+
FULL_PATH_DISCLOSURE = "full_path_disclosure",
|
|
18
|
+
HEADER_SECURITY = "header_security",
|
|
19
|
+
HRS = "hrs",
|
|
20
|
+
HTML_INJECTION = "html_injection",
|
|
21
|
+
HTTP_METHOD_FUZZING = "http_method_fuzzing",
|
|
22
|
+
HTTP_RESPONSE_SPLITTING = "http_response_splitting",
|
|
23
|
+
ID_ENUMERATION = "id_enumeration",
|
|
24
|
+
IMPROPER_ASSET_MANAGEMENT = "improper_asset_management",
|
|
25
|
+
INSECURE_TLS_CONFIGURATION = "insecure_tls_configuration",
|
|
26
|
+
JWT = "jwt",
|
|
27
|
+
LDAPI = "ldapi",
|
|
28
|
+
LFI = "lfi",
|
|
29
|
+
MASS_ASSIGNMENT = "mass_assignment",
|
|
30
|
+
NOSQL = "nosql",
|
|
31
|
+
OPEN_BUCKETS = "open_buckets",
|
|
32
|
+
OPEN_DATABASE = "open_database",
|
|
33
|
+
OSI = "osi",
|
|
34
|
+
PROTO_POLLUTION = "proto_pollution",
|
|
35
|
+
RETIRE_JS = "retire_js",
|
|
36
|
+
RFI = "rfi",
|
|
37
|
+
SECRET_TOKENS = "secret_tokens",
|
|
38
|
+
SERVER_SIDE_JS_INJECTION = "server_side_js_injection",
|
|
39
|
+
SQLI = "sqli",
|
|
40
|
+
SSRF = "ssrf",
|
|
41
|
+
SSTI = "ssti",
|
|
42
|
+
UNVALIDATED_REDIRECT = "unvalidated_redirect",
|
|
43
|
+
VERSION_CONTROL_SYSTEMS = "version_control_systems",
|
|
44
|
+
WORDPRESS = "wordpress",
|
|
45
|
+
XPATHI = "xpathi",
|
|
46
|
+
XSS = "xss",
|
|
47
|
+
XXE = "xxe"
|
|
48
|
+
}
|
|
@@ -0,0 +1,53 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.TestType = void 0;
|
|
4
|
+
var TestType;
|
|
5
|
+
(function (TestType) {
|
|
6
|
+
TestType["ANGULAR_CSTI"] = "angular_csti";
|
|
7
|
+
TestType["BACKUP_LOCATIONS"] = "backup_locations";
|
|
8
|
+
TestType["BROKEN_SAML_AUTH"] = "broken_saml_auth";
|
|
9
|
+
TestType["BRUTE_FORCE_LOGIN"] = "brute_force_login";
|
|
10
|
+
TestType["BUSINESS_CONSTRAINT_BYPASS"] = "business_constraint_bypass";
|
|
11
|
+
TestType["COMMON_FILES"] = "common_files";
|
|
12
|
+
TestType["COOKIE_SECURITY"] = "cookie_security";
|
|
13
|
+
TestType["CSRF"] = "csrf";
|
|
14
|
+
TestType["DATE_MANIPULATION"] = "date_manipulation";
|
|
15
|
+
TestType["DEFAULT_LOGIN_LOCATION"] = "default_login_location";
|
|
16
|
+
TestType["DIRECTORY_LISTING"] = "directory_listing";
|
|
17
|
+
TestType["DOM_XSS"] = "dom_xss";
|
|
18
|
+
TestType["EMAIL_INJECTION"] = "email_injection";
|
|
19
|
+
TestType["EXPOSED_COUCH_DB_APIS"] = "exposed_couch_db_apis";
|
|
20
|
+
TestType["FILE_UPLOAD"] = "file_upload";
|
|
21
|
+
TestType["FULL_PATH_DISCLOSURE"] = "full_path_disclosure";
|
|
22
|
+
TestType["HEADER_SECURITY"] = "header_security";
|
|
23
|
+
TestType["HRS"] = "hrs";
|
|
24
|
+
TestType["HTML_INJECTION"] = "html_injection";
|
|
25
|
+
TestType["HTTP_METHOD_FUZZING"] = "http_method_fuzzing";
|
|
26
|
+
TestType["HTTP_RESPONSE_SPLITTING"] = "http_response_splitting";
|
|
27
|
+
TestType["ID_ENUMERATION"] = "id_enumeration";
|
|
28
|
+
TestType["IMPROPER_ASSET_MANAGEMENT"] = "improper_asset_management";
|
|
29
|
+
TestType["INSECURE_TLS_CONFIGURATION"] = "insecure_tls_configuration";
|
|
30
|
+
TestType["JWT"] = "jwt";
|
|
31
|
+
TestType["LDAPI"] = "ldapi";
|
|
32
|
+
TestType["LFI"] = "lfi";
|
|
33
|
+
TestType["MASS_ASSIGNMENT"] = "mass_assignment";
|
|
34
|
+
TestType["NOSQL"] = "nosql";
|
|
35
|
+
TestType["OPEN_BUCKETS"] = "open_buckets";
|
|
36
|
+
TestType["OPEN_DATABASE"] = "open_database";
|
|
37
|
+
TestType["OSI"] = "osi";
|
|
38
|
+
TestType["PROTO_POLLUTION"] = "proto_pollution";
|
|
39
|
+
TestType["RETIRE_JS"] = "retire_js";
|
|
40
|
+
TestType["RFI"] = "rfi";
|
|
41
|
+
TestType["SECRET_TOKENS"] = "secret_tokens";
|
|
42
|
+
TestType["SERVER_SIDE_JS_INJECTION"] = "server_side_js_injection";
|
|
43
|
+
TestType["SQLI"] = "sqli";
|
|
44
|
+
TestType["SSRF"] = "ssrf";
|
|
45
|
+
TestType["SSTI"] = "ssti";
|
|
46
|
+
TestType["UNVALIDATED_REDIRECT"] = "unvalidated_redirect";
|
|
47
|
+
TestType["VERSION_CONTROL_SYSTEMS"] = "version_control_systems";
|
|
48
|
+
TestType["WORDPRESS"] = "wordpress";
|
|
49
|
+
TestType["XPATHI"] = "xpathi";
|
|
50
|
+
TestType["XSS"] = "xss";
|
|
51
|
+
TestType["XXE"] = "xxe";
|
|
52
|
+
})(TestType = exports.TestType || (exports.TestType = {}));
|
|
53
|
+
//# sourceMappingURL=TestType.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"TestType.js","sourceRoot":"","sources":["../../../../../packages/scan/src/models/TestType.ts"],"names":[],"mappings":";;;AAAA,IAAY,QA+CX;AA/CD,WAAY,QAAQ;IAClB,yCAA6B,CAAA;IAC7B,iDAAqC,CAAA;IACrC,iDAAqC,CAAA;IACrC,mDAAuC,CAAA;IACvC,qEAAyD,CAAA;IACzD,yCAA6B,CAAA;IAC7B,+CAAmC,CAAA;IACnC,yBAAa,CAAA;IACb,mDAAuC,CAAA;IACvC,6DAAiD,CAAA;IACjD,mDAAuC,CAAA;IACvC,+BAAmB,CAAA;IACnB,+CAAmC,CAAA;IACnC,2DAA+C,CAAA;IAC/C,uCAA2B,CAAA;IAC3B,yDAA6C,CAAA;IAC7C,+CAAmC,CAAA;IACnC,uBAAW,CAAA;IACX,6CAAiC,CAAA;IACjC,uDAA2C,CAAA;IAC3C,+DAAmD,CAAA;IACnD,6CAAiC,CAAA;IACjC,mEAAuD,CAAA;IACvD,qEAAyD,CAAA;IACzD,uBAAW,CAAA;IACX,2BAAe,CAAA;IACf,uBAAW,CAAA;IACX,+CAAmC,CAAA;IACnC,2BAAe,CAAA;IACf,yCAA6B,CAAA;IAC7B,2CAA+B,CAAA;IAC/B,uBAAW,CAAA;IACX,+CAAmC,CAAA;IACnC,mCAAuB,CAAA;IACvB,uBAAW,CAAA;IACX,2CAA+B,CAAA;IAC/B,iEAAqD,CAAA;IACrD,yBAAa,CAAA;IACb,yBAAa,CAAA;IACb,yBAAa,CAAA;IACb,yDAA6C,CAAA;IAC7C,+DAAmD,CAAA;IACnD,mCAAuB,CAAA;IACvB,6BAAiB,CAAA;IACjB,uBAAW,CAAA;IACX,uBAAW,CAAA;AACb,CAAC,EA/CW,QAAQ,GAAR,gBAAQ,KAAR,gBAAQ,QA+CnB"}
|
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
export * from './AttackParamLocation';
|
|
2
|
+
export * from './Discovery';
|
|
3
|
+
export * from './Severity';
|
|
4
|
+
export * from './Module';
|
|
5
|
+
export * from './ScanStatus';
|
|
6
|
+
export * from './TestType';
|
|
7
|
+
export * from './Issue';
|
|
8
|
+
export * from './IssueGroup';
|
|
9
|
+
export * from './ScanState';
|
|
10
|
+
export * from './ScanConfig';
|
|
11
|
+
export * from './HttpMethod';
|
|
@@ -0,0 +1,15 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
const tslib_1 = require("tslib");
|
|
4
|
+
(0, tslib_1.__exportStar)(require("./AttackParamLocation"), exports);
|
|
5
|
+
(0, tslib_1.__exportStar)(require("./Discovery"), exports);
|
|
6
|
+
(0, tslib_1.__exportStar)(require("./Severity"), exports);
|
|
7
|
+
(0, tslib_1.__exportStar)(require("./Module"), exports);
|
|
8
|
+
(0, tslib_1.__exportStar)(require("./ScanStatus"), exports);
|
|
9
|
+
(0, tslib_1.__exportStar)(require("./TestType"), exports);
|
|
10
|
+
(0, tslib_1.__exportStar)(require("./Issue"), exports);
|
|
11
|
+
(0, tslib_1.__exportStar)(require("./IssueGroup"), exports);
|
|
12
|
+
(0, tslib_1.__exportStar)(require("./ScanState"), exports);
|
|
13
|
+
(0, tslib_1.__exportStar)(require("./ScanConfig"), exports);
|
|
14
|
+
(0, tslib_1.__exportStar)(require("./HttpMethod"), exports);
|
|
15
|
+
//# sourceMappingURL=index.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/scan/src/models/index.ts"],"names":[],"mappings":";;;AAAA,qEAAsC;AACtC,2DAA4B;AAC5B,0DAA2B;AAC3B,wDAAyB;AACzB,4DAA6B;AAC7B,0DAA2B;AAC3B,uDAAwB;AACxB,4DAA6B;AAC7B,2DAA4B;AAC5B,4DAA6B;AAC7B,4DAA6B"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
export {};
|
package/src/register.js
ADDED
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
const Scans_1 = require("./Scans");
|
|
4
|
+
const DefaultScans_1 = require("./DefaultScans");
|
|
5
|
+
const ScanFactory_1 = require("./ScanFactory");
|
|
6
|
+
const tsyringe_1 = require("tsyringe");
|
|
7
|
+
const core_1 = require("@sectester/core");
|
|
8
|
+
tsyringe_1.container.register(Scans_1.Scans, { useClass: DefaultScans_1.DefaultScans });
|
|
9
|
+
tsyringe_1.container.register(ScanFactory_1.ScanFactory, {
|
|
10
|
+
useFactory(childContainer) {
|
|
11
|
+
return new ScanFactory_1.ScanFactory(childContainer.resolve(core_1.Configuration));
|
|
12
|
+
}
|
|
13
|
+
});
|
|
14
|
+
//# sourceMappingURL=register.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../../packages/scan/src/register.ts"],"names":[],"mappings":";;AAAA,mCAAgC;AAChC,iDAA8C;AAC9C,+CAA4C;AAC5C,uCAA0D;AAC1D,0CAAgD;AAEhD,oBAAS,CAAC,QAAQ,CAAC,aAAK,EAAE,EAAE,QAAQ,EAAE,2BAAY,EAAE,CAAC,CAAC;AAEtD,oBAAS,CAAC,QAAQ,CAAC,yBAAW,EAAE;IAC9B,UAAU,CAAC,cAAmC;QAC5C,OAAO,IAAI,yBAAW,CAAC,cAAc,CAAC,OAAO,CAAC,oBAAa,CAAC,CAAC,CAAC;IAChE,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -0,0 +1,48 @@
|
|
|
1
|
+
/// <reference types="node" />
|
|
2
|
+
import { HttpMethod } from '../models';
|
|
3
|
+
import { Header, PostData, QueryString, Request } from '@har-sdk/core';
|
|
4
|
+
export interface TargetOptions {
|
|
5
|
+
url: string;
|
|
6
|
+
query?: URLSearchParams | Record<string, string | string[]> | string;
|
|
7
|
+
body?: unknown;
|
|
8
|
+
method?: HttpMethod | string;
|
|
9
|
+
headers?: Record<string, string | string[]>;
|
|
10
|
+
serializeQuery?(params: URLSearchParams | Record<string, string | string[]>): string;
|
|
11
|
+
}
|
|
12
|
+
export declare class Target implements TargetOptions {
|
|
13
|
+
private _serializeQuery;
|
|
14
|
+
get serializeQuery(): (params: URLSearchParams | Record<string, string | string[]>) => string;
|
|
15
|
+
private _parsedURL;
|
|
16
|
+
get parsedURL(): URL;
|
|
17
|
+
private _url?;
|
|
18
|
+
get url(): string;
|
|
19
|
+
private set url(value);
|
|
20
|
+
private _method;
|
|
21
|
+
get method(): HttpMethod;
|
|
22
|
+
set method(value: HttpMethod);
|
|
23
|
+
private _queryString?;
|
|
24
|
+
get queryString(): string;
|
|
25
|
+
private _queryParameters?;
|
|
26
|
+
get queryParameters(): QueryString[];
|
|
27
|
+
private _query?;
|
|
28
|
+
get query(): URLSearchParams | Record<string, string | string[]> | string;
|
|
29
|
+
private set query(value);
|
|
30
|
+
private _headerValues;
|
|
31
|
+
private _headerParameters?;
|
|
32
|
+
get headerParameters(): Header[];
|
|
33
|
+
private _headers?;
|
|
34
|
+
get headers(): Record<string, string | string[]>;
|
|
35
|
+
private set headers(value);
|
|
36
|
+
private _postData;
|
|
37
|
+
get postData(): PostData | undefined;
|
|
38
|
+
private _body?;
|
|
39
|
+
get body(): unknown;
|
|
40
|
+
private set body(value);
|
|
41
|
+
get contentType(): string | undefined;
|
|
42
|
+
get httpVersion(): string;
|
|
43
|
+
constructor({ url, body, query, headers, serializeQuery, method }: TargetOptions);
|
|
44
|
+
toHarRequest(): Request;
|
|
45
|
+
private setContentTypeIfUnset;
|
|
46
|
+
private getHeaderValue;
|
|
47
|
+
private computeHeaderValue;
|
|
48
|
+
}
|