pentest-tool-lite 3.10.6 → 3.10.10

package/dist/html/DuplicateId.js

@@ -0,0 +1,35 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const Test_1 = __importDefault(require("../Test"));
+const request_1 = __importDefault(require("../request"));
+const logger_1 = __importDefault(require("../logger"));
+const functions_1 = require("../functions");
+class DuplicateId extends Test_1.default {
+    name = 'Duplicate ID';
+    async test({ url }) {
+        logger_1.default.info('Starting DuplicateId test...');
+        const response = await request_1.default.get(url);
+        const duplicates = await (0, functions_1.getDuplicates)(response);
+        if (duplicates.length > 0) {
+            return {
+                status: 'WARNING',
+                title: 'Duplicate IDs',
+                description: '',
+                results: duplicates.map(duplicate => ({
+                    status: 'WARNING',
+                    title: `<${duplicate.name} id="${duplicate.attribs.id}" ... />`,
+                    description: '',
+                }))
+            };
+        }
+        return {
+            status: 'SUCCESS',
+            title: 'Duplicate IDs',
+            description: ''
+        };
+    }
+}
+exports.default = DuplicateId;

package/dist/html/Generator.js

@@ -0,0 +1,31 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const Test_1 = __importDefault(require("../Test"));
+const request_1 = __importDefault(require("../request"));
+const logger_1 = __importDefault(require("../logger"));
+const functions_1 = require("../functions");
+class Generator extends Test_1.default {
+    name = 'Generator';
+    async test({ url }) {
+        logger_1.default.info('Starting DuplicateId test...');
+        const response = await request_1.default.get(url);
+        const html = await (0, functions_1.parseHtml)(response);
+        const generators = await (0, functions_1.getGenerator)(html);
+        if (generators.length > 0) {
+            return {
+                status: 'WARNING',
+                title: this.name,
+                description: 'Page contains inmformation about its generator!',
+            };
+        }
+        return {
+            status: 'SUCCESS',
+            title: this.name,
+            description: 'Page doesn\t contain any information about its generator.',
+        };
+    }
+}
+exports.default = Generator;

package/dist/html/Image.js

@@ -0,0 +1,79 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const Test_1 = __importDefault(require("../Test"));
+const request_1 = __importDefault(require("../request"));
+const logger_1 = __importDefault(require("../logger"));
+const functions_1 = require("../functions");
+class Image extends Test_1.default {
+    name = 'Image';
+    async test({ url }) {
+        logger_1.default.info('Starting Image test...');
+        const response = await request_1.default.get(url);
+        const html = await (0, functions_1.parseHtml)(response);
+        const images = (0, functions_1.getImages)(html);
+        const subTests = await this.checkImages(images);
+        return {
+            status: this.getStatus(subTests.map(test => test.status)),
+            title: 'Image',
+            description: '',
+            results: subTests,
+        };
+    }
+    async checkImages(images) {
+        const results = [];
+        for (const image of images) {
+            const filename = image.substring(image.lastIndexOf('/') + 1);
+            logger_1.default.verbose(`Checking ${filename}...`);
+            const result = await request_1.default.get(image);
+            const isFileAvailabe = {
+                status: this.isFileAvailable(result) ? 'SUCCESS' : 'ERROR',
+                title: 'Available',
+                description: '',
+            };
+            const isCached = {
+                status: this.isCached(result) ? 'SUCCESS' : 'ERROR',
+                title: 'Cached',
+                description: '',
+            };
+            const hasXContentTypeOptionsHeader = {
+                status: this.hasXContentTypeOptionsHeader(result) ? 'SUCCESS' : 'WARNING',
+                title: 'X-Content-Type-Options',
+                description: '',
+            };
+            results.push({
+                status: this.getStatus([
+                    isFileAvailabe.status,
+                    isCached.status,
+                    hasXContentTypeOptionsHeader.status,
+                ]), // eslint-disable-line  @typescript-eslint/no-explicit-any
+                title: filename,
+                description: '',
+                results: [
+                    isFileAvailabe,
+                    isCached,
+                    hasXContentTypeOptionsHeader,
+                ],
+            });
+        }
+        return results;
+    }
+    /* eslint-disable-next-line  @typescript-eslint/no-explicit-any */
+    isFileAvailable(result) {
+        if (result.response.statusCode === 404 || result.response.statusCode === 500) {
+            return false;
+        }
+        return true;
+    }
+    /* eslint-disable-next-line  @typescript-eslint/no-explicit-any */
+    isCached(result) {
+        return result.response.headers.has('cache-control');
+    }
+    /* eslint-disable-next-line  @typescript-eslint/no-explicit-any */
+    hasXContentTypeOptionsHeader(result) {
+        return result.response.headers.has('x-content-type-options');
+    }
+}
+exports.default = Image;

package/dist/html/JavaScript.js

@@ -0,0 +1,107 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const uglify_js_1 = __importDefault(require("uglify-js"));
+const Test_1 = __importDefault(require("../Test"));
+const request_1 = __importDefault(require("../request"));
+const logger_1 = __importDefault(require("../logger"));
+const functions_1 = require("../functions");
+class JavaScript extends Test_1.default {
+    name = 'JavaScript';
+    async test({ url }) {
+        logger_1.default.info(`Starting ${this.constructor.name} test...`);
+        const response = await request_1.default.get(url);
+        const html = await (0, functions_1.parseHtml)(response);
+        const scripts = (0, functions_1.getScripts)(html);
+        const subTests = await this.check(scripts);
+        return {
+            status: this.getStatus(subTests.map(test => test.status)),
+            title: this.constructor.name,
+            description: '',
+            results: subTests,
+        };
+    }
+    async check(scripts) {
+        const results = [];
+        for (const script of scripts) {
+            const filename = script.substr(script.lastIndexOf('/') + 1);
+            logger_1.default.verbose(`Checking ${filename}...`);
+            const result = await request_1.default.get(script);
+            const isFileAvailabe = {
+                status: this.isFileAvailable(result) ? 'SUCCESS' : 'ERROR',
+                title: 'Available',
+                description: '',
+            };
+            const isCached = {
+                status: this.isCached(result) ? 'SUCCESS' : 'ERROR',
+                title: 'Cached',
+                description: '',
+            };
+            const hasXContentTypeOptionsHeader = {
+                status: this.hasXContentTypeOptionsHeader(result) ? 'SUCCESS' : 'WARNING',
+                title: 'X-Content-Type-Options',
+                description: '',
+            };
+            const isMinified = {
+                status: this.isMinified(result) ? 'SUCCESS' : 'WARNING',
+                title: 'Minified',
+                description: '',
+            };
+            const hasConsoleLogs = {
+                status: this.hasConsoleLogs(result) ? 'SUCCESS' : 'WARNING',
+                title: 'ConsoleLogs',
+                description: '',
+            };
+            results.push({
+                status: this.getStatus([
+                    isFileAvailabe.status,
+                    isCached.status,
+                    hasXContentTypeOptionsHeader.status,
+                    isMinified.status,
+                    hasConsoleLogs.status,
+                ]), // eslint-disable-line  @typescript-eslint/no-explicit-any
+                title: filename,
+                description: '',
+                results: [
+                    isFileAvailabe,
+                    isCached,
+                    hasXContentTypeOptionsHeader,
+                    isMinified,
+                    hasConsoleLogs,
+                ],
+            });
+        }
+        return results;
+    }
+    /* eslint-disable-next-line  @typescript-eslint/no-explicit-any */
+    isFileAvailable(result) {
+        if (result.response.statusCode === 404 || result.response.statusCode === 500) {
+            return false;
+        }
+        return true;
+    }
+    /* eslint-disable-next-line  @typescript-eslint/no-explicit-any */
+    isCached(result) {
+        return result.response.headers.has('cache-control');
+    }
+    /* eslint-disable-next-line  @typescript-eslint/no-explicit-any */
+    hasXContentTypeOptionsHeader(result) {
+        return result.response.headers.has('x-content-type-options');
+    }
+    /* eslint-disable-next-line  @typescript-eslint/no-explicit-any */
+    isMinified(result) {
+        const r = uglify_js_1.default.minify(result.body, { mangle: false, output: { comments: true } });
+        if (Object.prototype.hasOwnProperty.call(r, 'error')) {
+            logger_1.default.error('JavaScript syntax error!');
+            throw r.error;
+        }
+        return result.body.length /* - (result.body.length * 0.05)*/ <= r.code.length;
+    }
+    /* eslint-disable-next-line  @typescript-eslint/no-explicit-any */
+    hasConsoleLogs(result) {
+        return result.body.indexOf('console.log') !== -1 && result.body.indexOf('console.error') !== -1;
+    }
+}
+exports.default = JavaScript;

package/dist/{src/html → html}/__TESTS__/Generator.test.js

@@ -1,44 +1,35 @@
 "use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const Generator_1 = __importDefault(require("../Generator"));
 const request_1 = __importDefault(require("../../request"));
-test('Generator test without generator metatag', () => __awaiter(void 0, void 0, void 0, function* () {
+test('Generator test without generator metatag', async () => {
     const generator = new Generator_1.default();
     /* eslint-disable-next-line  @typescript-eslint/no-explicit-any */
-    const mock = jest.spyOn(request_1.default, 'get').mockImplementation(() => __awaiter(void 0, void 0, void 0, function* () {
+    const mock = jest.spyOn(request_1.default, 'get').mockImplementation(async () => {
         return new Promise((resolve) => {
             resolve({
                 body: '<html><body><meta name="description" content="Generator is not here" /></body></html>'
             });
         });
-    }));
-    const result = yield generator.run({ url: 'https://juffalow.com' });
+    });
+    const result = await generator.run({ url: 'https://juffalow.com' });
     expect(result.status).toEqual('SUCCESS');
     mock.mockRestore();
-}));
-test('Generator test with generator metatag', () => __awaiter(void 0, void 0, void 0, function* () {
+});
+test('Generator test with generator metatag', async () => {
     const generator = new Generator_1.default();
     /* eslint-disable-next-line  @typescript-eslint/no-explicit-any */
-    const mock = jest.spyOn(request_1.default, 'get').mockImplementation(() => __awaiter(void 0, void 0, void 0, function* () {
+    const mock = jest.spyOn(request_1.default, 'get').mockImplementation(async () => {
         return new Promise((resolve) => {
             resolve({
                 body: '<html><body><meta name="description" content="Generator is not here" /><meta name="generator" content="Whatever" /></body></html>'
             });
         });
-    }));
-    const result = yield generator.run({ url: 'https://juffalow.com' });
+    });
+    const result = await generator.run({ url: 'https://juffalow.com' });
     expect(result.status).toEqual('WARNING');
     mock.mockRestore();
-}));
+});

package/dist/html/index.js

@@ -0,0 +1,51 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const Test_1 = __importDefault(require("../Test"));
+const Image_1 = __importDefault(require("./Image"));
+const DuplicateId_1 = __importDefault(require("./DuplicateId"));
+const CSS_1 = __importDefault(require("./CSS"));
+const JavaScript_1 = __importDefault(require("./JavaScript"));
+const Anchor_1 = __importDefault(require("./Anchor"));
+const Generator_1 = __importDefault(require("./Generator"));
+class HTML extends Test_1.default {
+    name = 'HTML';
+    constructor() {
+        super();
+        this.tests = [
+            new JavaScript_1.default(),
+            new CSS_1.default(),
+            new Image_1.default(),
+            new Anchor_1.default(),
+            new DuplicateId_1.default(),
+            new Generator_1.default(),
+        ];
+    }
+    async test(params) {
+        const tests = this.getTests();
+        const results = [];
+        for (const test of tests) {
+            let result = null;
+            try {
+                result = await test.run(params);
+            }
+            catch {
+                result = {
+                    status: 'ERROR',
+                    title: test.name,
+                    description: 'Test failed or cannot be run!',
+                };
+            }
+            results.push(result);
+        }
+        return {
+            status: this.getStatus(results.map(result => result.status)),
+            title: this.name,
+            description: '',
+            results,
+        };
+    }
+}
+exports.default = HTML;

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+import Pentest from './Pentest';
+import Test from './Test';
+export default Pentest;
+export { Pentest };
+export { Test };

package/dist/index.js

@@ -0,0 +1,11 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Test = exports.Pentest = void 0;
+const Pentest_1 = __importDefault(require("./Pentest"));
+exports.Pentest = Pentest_1.default;
+const Test_1 = __importDefault(require("./Test"));
+exports.Test = Test_1.default;
+exports.default = Pentest_1.default;

package/dist/{src/logger → logger}/Console.js

@@ -5,9 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const config_1 = __importDefault(require("../config"));
 class Console {
-    constructor() {
-        this.levels = ['ALL', 'DEBUG', 'VERBOSE', 'INFO', 'WARNING', 'ERROR', 'NONE'];
-    }
+    levels = ['ALL', 'DEBUG', 'VERBOSE', 'INFO', 'WARNING', 'ERROR', 'NONE'];
     debug(message, ...args) {
         if (this.levels.indexOf(config_1.default.logger.level) > 1) {
             return;

package/dist/metadata/HTML.js

@@ -0,0 +1,26 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const Test_1 = __importDefault(require("../Test"));
+const request_1 = __importDefault(require("../request"));
+const logger_1 = __importDefault(require("../logger"));
+class HTML extends Test_1.default {
+    name = 'HTML';
+    async test({ url }) {
+        logger_1.default.info(`Starting ${this.constructor.name} test...`);
+        const response = await request_1.default.get(url);
+        const html = response.body;
+        return {
+            status: 'SUCCESS',
+            title: this.constructor.name,
+            description: '',
+            metadata: {
+                html,
+            },
+            results: [],
+        };
+    }
+}
+exports.default = HTML;

package/dist/metadata/Markdown.js

@@ -0,0 +1,28 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_html_markdown_1 = require("node-html-markdown");
+const Test_1 = __importDefault(require("../Test"));
+const request_1 = __importDefault(require("../request"));
+const logger_1 = __importDefault(require("../logger"));
+class Markdown extends Test_1.default {
+    name = 'Markdown';
+    async test({ url }) {
+        logger_1.default.info(`Starting ${this.constructor.name} test...`);
+        const response = await request_1.default.get(url);
+        const html = response.body;
+        const markdown = node_html_markdown_1.NodeHtmlMarkdown.translate(html);
+        return {
+            status: 'SUCCESS',
+            title: this.constructor.name,
+            description: '',
+            metadata: {
+                markdown,
+            },
+            results: [],
+        };
+    }
+}
+exports.default = Markdown;

package/dist/metadata/ResponseTime.js

@@ -0,0 +1,25 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const Test_1 = __importDefault(require("../Test"));
+const request_1 = __importDefault(require("../request"));
+const logger_1 = __importDefault(require("../logger"));
+class ResponseTime extends Test_1.default {
+    name = 'ResponseTime';
+    async test({ url }) {
+        logger_1.default.info(`Starting ${this.constructor.name} test...`);
+        const response = await request_1.default.get(url);
+        return {
+            status: 'SUCCESS',
+            title: this.constructor.name,
+            description: '',
+            metadata: {
+                duration: response.duration,
+            },
+            results: [],
+        };
+    }
+}
+exports.default = ResponseTime;

package/dist/metadata/index.js

@@ -0,0 +1,45 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const Test_1 = __importDefault(require("../Test"));
+const HTML_1 = __importDefault(require("./HTML"));
+const Markdown_1 = __importDefault(require("./Markdown"));
+const ResponseTime_1 = __importDefault(require("./ResponseTime"));
+class Metadata extends Test_1.default {
+    name = 'Metadata';
+    constructor() {
+        super();
+        this.tests = [
+            new HTML_1.default(),
+            new Markdown_1.default(),
+            new ResponseTime_1.default(),
+        ];
+    }
+    async test(params) {
+        const tests = this.getTests();
+        const results = [];
+        for (const test of tests) {
+            let result = null;
+            try {
+                result = await test.run(params);
+            }
+            catch {
+                result = {
+                    status: 'ERROR',
+                    title: test.name,
+                    description: 'Test failed or cannot be run!',
+                };
+            }
+            results.push(result);
+        }
+        return {
+            status: this.getStatus(results.map(result => result.status)),
+            title: this.name,
+            description: '',
+            results,
+        };
+    }
+}
+exports.default = Metadata;

package/dist/request/NodeFetch.js

@@ -0,0 +1,58 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const config_1 = __importDefault(require("../config"));
+const getHeaders = (headers) => {
+    const keyValues = {};
+    headers.forEach((value, header) => {
+        if (value.length === 1 && header !== 'set-cookie') {
+            keyValues[header] = value[0];
+        }
+        else {
+            keyValues[header] = value;
+        }
+    });
+    return keyValues;
+};
+class NodeFetch {
+    cache;
+    constructor(cache) {
+        this.cache = cache;
+    }
+    async get(url, options) {
+        if (this.cache.has(url)) {
+            return this.cache.get(url);
+        }
+        const defaultOptions = config_1.default.request.options;
+        const startTime = Date.now();
+        const response = await fetch(url, { ...defaultOptions, ...options });
+        const endTime = Date.now();
+        const body = await response.text();
+        const statusCode = response.status;
+        const statusText = response.statusText;
+        const headers = getHeaders(response.headers);
+        this.cache.add(url, {
+            response,
+            statusCode,
+            statusText,
+            headers,
+            body,
+            url,
+            finalUrl: response.url,
+            duration: (endTime - startTime) / 1000,
+        });
+        return {
+            response,
+            statusCode,
+            statusText,
+            headers,
+            body,
+            url,
+            finalUrl: response.url,
+            duration: (endTime - startTime) / 1000,
+        };
+    }
+}
+exports.default = NodeFetch;

package/dist/{src/request → request}/cache/UnlimitedCache.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 class UnlimitedCache {
+    /* eslint-disable-next-line  @typescript-eslint/no-explicit-any */
+    requests;
     constructor() {
         this.requests = {};
     }

package/dist/security/ContentEncoding.js

@@ -0,0 +1,44 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const Test_1 = __importDefault(require("../Test"));
+const request_1 = __importDefault(require("../request"));
+const logger_1 = __importDefault(require("../logger"));
+/**
+ *
+ * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/content-encoding
+ */
+class ContentEncoding extends Test_1.default {
+    name = 'Content-Encoding';
+    async test({ url }) {
+        logger_1.default.info('Starting content-encoding test...');
+        const response = await request_1.default.get(url);
+        if (!Object.prototype.hasOwnProperty.call(response.headers, 'content-encoding')) {
+            return {
+                status: 'ERROR',
+                title: 'Content-Encoding',
+                description: 'Response headers does not contain content-encoding header!',
+            };
+        }
+        const attributesList = response.headers['content-encoding'];
+        const attributes = attributesList.replace(' ', '').split(',');
+        const ce1 = attributes.indexOf('gzip') > -1;
+        const ce2 = attributes.indexOf('deflate') > -1;
+        const ce3 = attributes.indexOf('br') > -1;
+        if (ce1 || ce2 || ce3) {
+            return {
+                status: 'SUCCESS',
+                title: 'Content-Encoding',
+                description: `The value of content-encoding header is ${attributesList}.`,
+            };
+        }
+        return {
+            status: 'ERROR',
+            title: 'Content-Encoding',
+            description: `The value of content-encoding header is ${attributesList}.`,
+        };
+    }
+}
+exports.default = ContentEncoding;

package/dist/security/ContentSecurityPolicy.js

@@ -0,0 +1,32 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const Test_1 = __importDefault(require("../Test"));
+const request_1 = __importDefault(require("../request"));
+const logger_1 = __importDefault(require("../logger"));
+/**
+ *
+ * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
+ */
+class ContentSecurityPolicy extends Test_1.default {
+    name = 'Content-Security-Policy';
+    async test({ url }) {
+        logger_1.default.info('Starting ContentSecurityPolicy test...');
+        const response = await request_1.default.get(url);
+        if (!Object.prototype.hasOwnProperty.call(response.headers, 'content-security-policy')) {
+            return {
+                status: 'ERROR',
+                title: 'Content-Security-Policy',
+                description: 'Response headers does not contain content-security-policy header!',
+            };
+        }
+        return {
+            status: 'SUCCESS',
+            title: 'Content-Security-Policy',
+            description: `The value of content-security-policy header is ${response.headers['content-security-policy']}.`,
+        };
+    }
+}
+exports.default = ContentSecurityPolicy;