pentest-tool-lite 3.10.6 → 3.10.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (205) hide show
  1. package/dist/Pentest.js +46 -0
  2. package/dist/{src/Test.js → Test.js} +11 -24
  3. package/dist/commands/Sitemap.js +79 -0
  4. package/dist/dns/A.js +49 -0
  5. package/dist/dns/DMARC.js +59 -0
  6. package/dist/dns/NS.js +36 -0
  7. package/dist/dns/RegistrationDate.js +39 -0
  8. package/dist/dns/index.js +47 -0
  9. package/dist/functions/parseSitemap.js +12 -0
  10. package/dist/html/Anchor.js +56 -0
  11. package/dist/html/CSS.js +92 -0
  12. package/dist/html/DuplicateId.js +35 -0
  13. package/dist/html/Generator.js +31 -0
  14. package/dist/html/Image.js +79 -0
  15. package/dist/html/JavaScript.js +107 -0
  16. package/dist/{src/html → html}/__TESTS__/Generator.test.js +10 -19
  17. package/dist/html/index.js +51 -0
  18. package/dist/{src/index → index} +21 -20
  19. package/dist/{src/logger → logger}/Console.js +1 -3
  20. package/dist/metadata/HTML.js +26 -0
  21. package/dist/metadata/Markdown.js +28 -0
  22. package/dist/metadata/ResponseTime.js +25 -0
  23. package/dist/metadata/index.js +45 -0
  24. package/dist/request/NodeFetch.js +58 -0
  25. package/dist/{src/request → request}/cache/UnlimitedCache.js +2 -0
  26. package/dist/security/ContentEncoding.js +44 -0
  27. package/dist/security/ContentSecurityPolicy.js +32 -0
  28. package/dist/security/Cookies.js +44 -0
  29. package/dist/security/FingerPrint.js +37 -0
  30. package/dist/security/GoogleWebRisk.js +44 -0
  31. package/dist/security/HSTS.js +48 -0
  32. package/dist/security/HTTPS.js +78 -0
  33. package/dist/security/HTTPVersion.js +50 -0
  34. package/dist/security/PermissionsPolicy.js +53 -0
  35. package/dist/security/Redirect.js +37 -0
  36. package/dist/security/ReferrerPolicy.js +32 -0
  37. package/dist/security/RobotsTXT.js +28 -0
  38. package/dist/security/SSL.js +36 -0
  39. package/dist/security/XFrameOptions.js +32 -0
  40. package/dist/security/XXSSProtection.js +32 -0
  41. package/dist/{src/security → security}/__TESTS__/ContentSecurityPolicy.test.js +10 -19
  42. package/dist/{src/security → security}/__TESTS__/FingerPrint.test.js +10 -19
  43. package/dist/{src/security → security}/__TESTS__/HSTS.test.js +15 -24
  44. package/dist/{src/security → security}/__TESTS__/HTTPS.test.js +15 -24
  45. package/dist/{src/security → security}/__TESTS__/XFrameOptions.test.js +10 -19
  46. package/dist/{src/security → security}/__TESTS__/XXSSProtection.test.js +10 -19
  47. package/dist/{src/security → security}/index.js +20 -31
  48. package/dist/seo/Heading.js +51 -0
  49. package/dist/seo/Robots.js +21 -0
  50. package/dist/seo/Sitemap.js +32 -0
  51. package/dist/seo/Title.js +44 -0
  52. package/dist/seo/index.js +47 -0
  53. package/dist/wordpress/DefaultFiles.js +50 -0
  54. package/dist/wordpress/Generator.js +58 -0
  55. package/dist/wordpress/index.js +43 -0
  56. package/package.json +10 -2
  57. package/dist/package.json +0 -61
  58. package/dist/src/Pentest.js +0 -57
  59. package/dist/src/commands/Sitemap.js +0 -96
  60. package/dist/src/dns/A.js +0 -65
  61. package/dist/src/dns/DMARC.js +0 -73
  62. package/dist/src/dns/NS.js +0 -52
  63. package/dist/src/dns/RegistrationDate.js +0 -55
  64. package/dist/src/dns/index.js +0 -58
  65. package/dist/src/functions/parseSitemap.js +0 -23
  66. package/dist/src/html/Anchor.js +0 -72
  67. package/dist/src/html/CSS.js +0 -108
  68. package/dist/src/html/DuplicateId.js +0 -49
  69. package/dist/src/html/Generator.js +0 -45
  70. package/dist/src/html/Image.js +0 -95
  71. package/dist/src/html/JavaScript.js +0 -123
  72. package/dist/src/html/index.js +0 -62
  73. package/dist/src/metadata/HTML.js +0 -40
  74. package/dist/src/metadata/Markdown.js +0 -42
  75. package/dist/src/metadata/ResponseTime.js +0 -39
  76. package/dist/src/metadata/index.js +0 -56
  77. package/dist/src/request/NodeFetch.js +0 -68
  78. package/dist/src/security/ContentEncoding.js +0 -58
  79. package/dist/src/security/ContentSecurityPolicy.js +0 -46
  80. package/dist/src/security/Cookies.js +0 -58
  81. package/dist/src/security/FingerPrint.js +0 -51
  82. package/dist/src/security/GoogleWebRisk.js +0 -58
  83. package/dist/src/security/HSTS.js +0 -62
  84. package/dist/src/security/HTTPS.js +0 -92
  85. package/dist/src/security/HTTPVersion.js +0 -64
  86. package/dist/src/security/PermissionsPolicy.js +0 -67
  87. package/dist/src/security/Redirect.js +0 -51
  88. package/dist/src/security/ReferrerPolicy.js +0 -46
  89. package/dist/src/security/RobotsTXT.js +0 -42
  90. package/dist/src/security/SSL.js +0 -50
  91. package/dist/src/security/XFrameOptions.js +0 -46
  92. package/dist/src/security/XXSSProtection.js +0 -46
  93. package/dist/src/seo/Heading.js +0 -65
  94. package/dist/src/seo/Robots.js +0 -35
  95. package/dist/src/seo/Sitemap.js +0 -46
  96. package/dist/src/seo/Title.js +0 -58
  97. package/dist/src/seo/index.js +0 -58
  98. package/dist/src/wordpress/DefaultFiles.js +0 -66
  99. package/dist/src/wordpress/Generator.js +0 -76
  100. package/dist/src/wordpress/index.js +0 -54
  101. /package/dist/{src/Pentest.d.ts → Pentest.d.ts} +0 -0
  102. /package/dist/{src/Test.d.ts → Test.d.ts} +0 -0
  103. /package/dist/{src/commands → commands}/Sitemap.d.ts +0 -0
  104. /package/dist/{src/config.d.ts → config.d.ts} +0 -0
  105. /package/dist/{src/config.js → config.js} +0 -0
  106. /package/dist/{src/dns → dns}/A.d.ts +0 -0
  107. /package/dist/{src/dns → dns}/DMARC.d.ts +0 -0
  108. /package/dist/{src/dns → dns}/NS.d.ts +0 -0
  109. /package/dist/{src/dns → dns}/RegistrationDate.d.ts +0 -0
  110. /package/dist/{src/dns → dns}/index.d.ts +0 -0
  111. /package/dist/{src/functions → functions}/findEvery.d.ts +0 -0
  112. /package/dist/{src/functions → functions}/findEvery.js +0 -0
  113. /package/dist/{src/functions → functions}/getAnchors.d.ts +0 -0
  114. /package/dist/{src/functions → functions}/getAnchors.js +0 -0
  115. /package/dist/{src/functions → functions}/getDomain.d.ts +0 -0
  116. /package/dist/{src/functions → functions}/getDomain.js +0 -0
  117. /package/dist/{src/functions → functions}/getDuplicates.d.ts +0 -0
  118. /package/dist/{src/functions → functions}/getDuplicates.js +0 -0
  119. /package/dist/{src/functions → functions}/getGenerator.d.ts +0 -0
  120. /package/dist/{src/functions → functions}/getGenerator.js +0 -0
  121. /package/dist/{src/functions → functions}/getHeading.d.ts +0 -0
  122. /package/dist/{src/functions → functions}/getHeading.js +0 -0
  123. /package/dist/{src/functions → functions}/getImages.d.ts +0 -0
  124. /package/dist/{src/functions → functions}/getImages.js +0 -0
  125. /package/dist/{src/functions → functions}/getObject.d.ts +0 -0
  126. /package/dist/{src/functions → functions}/getObject.js +0 -0
  127. /package/dist/{src/functions → functions}/getScripts.d.ts +0 -0
  128. /package/dist/{src/functions → functions}/getScripts.js +0 -0
  129. /package/dist/{src/functions → functions}/getStylesheets.d.ts +0 -0
  130. /package/dist/{src/functions → functions}/getStylesheets.js +0 -0
  131. /package/dist/{src/functions → functions}/getTitle.d.ts +0 -0
  132. /package/dist/{src/functions → functions}/getTitle.js +0 -0
  133. /package/dist/{src/functions → functions}/index.d.ts +0 -0
  134. /package/dist/{src/functions → functions}/index.js +0 -0
  135. /package/dist/{src/functions → functions}/parseHtml.d.ts +0 -0
  136. /package/dist/{src/functions → functions}/parseHtml.js +0 -0
  137. /package/dist/{src/functions → functions}/parseSitemap.d.ts +0 -0
  138. /package/dist/{src/functions → functions}/parseXml.d.ts +0 -0
  139. /package/dist/{src/functions → functions}/parseXml.js +0 -0
  140. /package/dist/{src/html → html}/Anchor.d.ts +0 -0
  141. /package/dist/{src/html → html}/CSS.d.ts +0 -0
  142. /package/dist/{src/html → html}/DuplicateId.d.ts +0 -0
  143. /package/dist/{src/html → html}/Generator.d.ts +0 -0
  144. /package/dist/{src/html → html}/Image.d.ts +0 -0
  145. /package/dist/{src/html → html}/JavaScript.d.ts +0 -0
  146. /package/dist/{src/html → html}/__TESTS__/Generator.test.d.ts +0 -0
  147. /package/dist/{src/html → html}/index.d.ts +0 -0
  148. /package/dist/{src/index.d.ts → index.d.ts} +0 -0
  149. /package/dist/{src/logger → logger}/Console.d.ts +0 -0
  150. /package/dist/{src/logger → logger}/Logger.d.ts +0 -0
  151. /package/dist/{src/logger → logger}/Logger.js +0 -0
  152. /package/dist/{src/logger → logger}/index.d.ts +0 -0
  153. /package/dist/{src/logger → logger}/index.js +0 -0
  154. /package/dist/{src/metadata → metadata}/HTML.d.ts +0 -0
  155. /package/dist/{src/metadata → metadata}/Markdown.d.ts +0 -0
  156. /package/dist/{src/metadata → metadata}/ResponseTime.d.ts +0 -0
  157. /package/dist/{src/metadata → metadata}/index.d.ts +0 -0
  158. /package/dist/{src/report → report}/CommandLine.d.ts +0 -0
  159. /package/dist/{src/report → report}/CommandLine.js +0 -0
  160. /package/dist/{src/report → report}/Json.d.ts +0 -0
  161. /package/dist/{src/report → report}/Json.js +0 -0
  162. /package/dist/{src/report → report}/Report.d.ts +0 -0
  163. /package/dist/{src/report → report}/Report.js +0 -0
  164. /package/dist/{src/report → report}/Symbols.d.ts +0 -0
  165. /package/dist/{src/report → report}/Symbols.js +0 -0
  166. /package/dist/{src/report → report}/index.d.ts +0 -0
  167. /package/dist/{src/report → report}/index.js +0 -0
  168. /package/dist/{src/request → request}/NodeFetch.d.ts +0 -0
  169. /package/dist/{src/request → request}/Request.d.ts +0 -0
  170. /package/dist/{src/request → request}/Request.js +0 -0
  171. /package/dist/{src/request → request}/cache/BlackHoleCache.d.ts +0 -0
  172. /package/dist/{src/request → request}/cache/BlackHoleCache.js +0 -0
  173. /package/dist/{src/request → request}/cache/UnlimitedCache.d.ts +0 -0
  174. /package/dist/{src/request → request}/index.d.ts +0 -0
  175. /package/dist/{src/request → request}/index.js +0 -0
  176. /package/dist/{src/security → security}/ContentEncoding.d.ts +0 -0
  177. /package/dist/{src/security → security}/ContentSecurityPolicy.d.ts +0 -0
  178. /package/dist/{src/security → security}/Cookies.d.ts +0 -0
  179. /package/dist/{src/security → security}/FingerPrint.d.ts +0 -0
  180. /package/dist/{src/security → security}/GoogleWebRisk.d.ts +0 -0
  181. /package/dist/{src/security → security}/HSTS.d.ts +0 -0
  182. /package/dist/{src/security → security}/HTTPS.d.ts +0 -0
  183. /package/dist/{src/security → security}/HTTPVersion.d.ts +0 -0
  184. /package/dist/{src/security → security}/PermissionsPolicy.d.ts +0 -0
  185. /package/dist/{src/security → security}/Redirect.d.ts +0 -0
  186. /package/dist/{src/security → security}/ReferrerPolicy.d.ts +0 -0
  187. /package/dist/{src/security → security}/RobotsTXT.d.ts +0 -0
  188. /package/dist/{src/security → security}/SSL.d.ts +0 -0
  189. /package/dist/{src/security → security}/XFrameOptions.d.ts +0 -0
  190. /package/dist/{src/security → security}/XXSSProtection.d.ts +0 -0
  191. /package/dist/{src/security → security}/__TESTS__/ContentSecurityPolicy.test.d.ts +0 -0
  192. /package/dist/{src/security → security}/__TESTS__/FingerPrint.test.d.ts +0 -0
  193. /package/dist/{src/security → security}/__TESTS__/HSTS.test.d.ts +0 -0
  194. /package/dist/{src/security → security}/__TESTS__/HTTPS.test.d.ts +0 -0
  195. /package/dist/{src/security → security}/__TESTS__/XFrameOptions.test.d.ts +0 -0
  196. /package/dist/{src/security → security}/__TESTS__/XXSSProtection.test.d.ts +0 -0
  197. /package/dist/{src/security → security}/index.d.ts +0 -0
  198. /package/dist/{src/seo → seo}/Heading.d.ts +0 -0
  199. /package/dist/{src/seo → seo}/Robots.d.ts +0 -0
  200. /package/dist/{src/seo → seo}/Sitemap.d.ts +0 -0
  201. /package/dist/{src/seo → seo}/Title.d.ts +0 -0
  202. /package/dist/{src/seo → seo}/index.d.ts +0 -0
  203. /package/dist/{src/wordpress → wordpress}/DefaultFiles.d.ts +0 -0
  204. /package/dist/{src/wordpress → wordpress}/Generator.d.ts +0 -0
  205. /package/dist/{src/wordpress → wordpress}/index.d.ts +0 -0
@@ -1,39 +0,0 @@
1
- "use strict";
2
- var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
3
- function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
4
- return new (P || (P = Promise))(function (resolve, reject) {
5
- function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
6
- function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
7
- function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
8
- step((generator = generator.apply(thisArg, _arguments || [])).next());
9
- });
10
- };
11
- var __importDefault = (this && this.__importDefault) || function (mod) {
12
- return (mod && mod.__esModule) ? mod : { "default": mod };
13
- };
14
- Object.defineProperty(exports, "__esModule", { value: true });
15
- const Test_1 = __importDefault(require("../Test"));
16
- const request_1 = __importDefault(require("../request"));
17
- const logger_1 = __importDefault(require("../logger"));
18
- class ResponseTime extends Test_1.default {
19
- constructor() {
20
- super(...arguments);
21
- this.name = 'ResponseTime';
22
- }
23
- test(_a) {
24
- return __awaiter(this, arguments, void 0, function* ({ url }) {
25
- logger_1.default.info(`Starting ${this.constructor.name} test...`);
26
- const response = yield request_1.default.get(url);
27
- return {
28
- status: 'SUCCESS',
29
- title: this.constructor.name,
30
- description: '',
31
- metadata: {
32
- duration: response.duration,
33
- },
34
- results: [],
35
- };
36
- });
37
- }
38
- }
39
- exports.default = ResponseTime;
@@ -1,56 +0,0 @@
1
- "use strict";
2
- var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
3
- function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
4
- return new (P || (P = Promise))(function (resolve, reject) {
5
- function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
6
- function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
7
- function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
8
- step((generator = generator.apply(thisArg, _arguments || [])).next());
9
- });
10
- };
11
- var __importDefault = (this && this.__importDefault) || function (mod) {
12
- return (mod && mod.__esModule) ? mod : { "default": mod };
13
- };
14
- Object.defineProperty(exports, "__esModule", { value: true });
15
- const Test_1 = __importDefault(require("../Test"));
16
- const HTML_1 = __importDefault(require("./HTML"));
17
- const Markdown_1 = __importDefault(require("./Markdown"));
18
- const ResponseTime_1 = __importDefault(require("./ResponseTime"));
19
- class Metadata extends Test_1.default {
20
- constructor() {
21
- super();
22
- this.name = 'Metadata';
23
- this.tests = [
24
- new HTML_1.default(),
25
- new Markdown_1.default(),
26
- new ResponseTime_1.default(),
27
- ];
28
- }
29
- test(params) {
30
- return __awaiter(this, void 0, void 0, function* () {
31
- const tests = this.getTests();
32
- const results = [];
33
- for (const test of tests) {
34
- let result = null;
35
- try {
36
- result = yield test.run(params);
37
- }
38
- catch (_a) {
39
- result = {
40
- status: 'ERROR',
41
- title: test.name,
42
- description: 'Test failed or cannot be run!',
43
- };
44
- }
45
- results.push(result);
46
- }
47
- return {
48
- status: this.getStatus(results.map(result => result.status)),
49
- title: this.name,
50
- description: '',
51
- results,
52
- };
53
- });
54
- }
55
- }
56
- exports.default = Metadata;
@@ -1,68 +0,0 @@
1
- "use strict";
2
- var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
3
- function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
4
- return new (P || (P = Promise))(function (resolve, reject) {
5
- function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
6
- function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
7
- function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
8
- step((generator = generator.apply(thisArg, _arguments || [])).next());
9
- });
10
- };
11
- var __importDefault = (this && this.__importDefault) || function (mod) {
12
- return (mod && mod.__esModule) ? mod : { "default": mod };
13
- };
14
- Object.defineProperty(exports, "__esModule", { value: true });
15
- const config_1 = __importDefault(require("../config"));
16
- const getHeaders = (headers) => {
17
- const keyValues = {};
18
- headers.forEach((value, header) => {
19
- if (value.length === 1 && header !== 'set-cookie') {
20
- keyValues[header] = value[0];
21
- }
22
- else {
23
- keyValues[header] = value;
24
- }
25
- });
26
- return keyValues;
27
- };
28
- class NodeFetch {
29
- constructor(cache) {
30
- this.cache = cache;
31
- }
32
- get(url, options) {
33
- return __awaiter(this, void 0, void 0, function* () {
34
- if (this.cache.has(url)) {
35
- return this.cache.get(url);
36
- }
37
- const defaultOptions = config_1.default.request.options;
38
- const startTime = Date.now();
39
- const response = yield fetch(url, Object.assign(Object.assign({}, defaultOptions), options));
40
- const endTime = Date.now();
41
- const body = yield response.text();
42
- const statusCode = response.status;
43
- const statusText = response.statusText;
44
- const headers = getHeaders(response.headers);
45
- this.cache.add(url, {
46
- response,
47
- statusCode,
48
- statusText,
49
- headers,
50
- body,
51
- url,
52
- finalUrl: response.url,
53
- duration: (endTime - startTime) / 1000,
54
- });
55
- return {
56
- response,
57
- statusCode,
58
- statusText,
59
- headers,
60
- body,
61
- url,
62
- finalUrl: response.url,
63
- duration: (endTime - startTime) / 1000,
64
- };
65
- });
66
- }
67
- }
68
- exports.default = NodeFetch;
@@ -1,58 +0,0 @@
1
- "use strict";
2
- var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
3
- function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
4
- return new (P || (P = Promise))(function (resolve, reject) {
5
- function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
6
- function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
7
- function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
8
- step((generator = generator.apply(thisArg, _arguments || [])).next());
9
- });
10
- };
11
- var __importDefault = (this && this.__importDefault) || function (mod) {
12
- return (mod && mod.__esModule) ? mod : { "default": mod };
13
- };
14
- Object.defineProperty(exports, "__esModule", { value: true });
15
- const Test_1 = __importDefault(require("../Test"));
16
- const request_1 = __importDefault(require("../request"));
17
- const logger_1 = __importDefault(require("../logger"));
18
- /**
19
- *
20
- * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/content-encoding
21
- */
22
- class ContentEncoding extends Test_1.default {
23
- constructor() {
24
- super(...arguments);
25
- this.name = 'Content-Encoding';
26
- }
27
- test(_a) {
28
- return __awaiter(this, arguments, void 0, function* ({ url }) {
29
- logger_1.default.info('Starting content-encoding test...');
30
- const response = yield request_1.default.get(url);
31
- if (!Object.prototype.hasOwnProperty.call(response.headers, 'content-encoding')) {
32
- return {
33
- status: 'ERROR',
34
- title: 'Content-Encoding',
35
- description: 'Response headers does not contain content-encoding header!',
36
- };
37
- }
38
- const attributesList = response.headers['content-encoding'];
39
- const attributes = attributesList.replace(' ', '').split(',');
40
- const ce1 = attributes.indexOf('gzip') > -1;
41
- const ce2 = attributes.indexOf('deflate') > -1;
42
- const ce3 = attributes.indexOf('br') > -1;
43
- if (ce1 || ce2 || ce3) {
44
- return {
45
- status: 'SUCCESS',
46
- title: 'Content-Encoding',
47
- description: `The value of content-encoding header is ${attributesList}.`,
48
- };
49
- }
50
- return {
51
- status: 'ERROR',
52
- title: 'Content-Encoding',
53
- description: `The value of content-encoding header is ${attributesList}.`,
54
- };
55
- });
56
- }
57
- }
58
- exports.default = ContentEncoding;
@@ -1,46 +0,0 @@
1
- "use strict";
2
- var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
3
- function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
4
- return new (P || (P = Promise))(function (resolve, reject) {
5
- function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
6
- function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
7
- function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
8
- step((generator = generator.apply(thisArg, _arguments || [])).next());
9
- });
10
- };
11
- var __importDefault = (this && this.__importDefault) || function (mod) {
12
- return (mod && mod.__esModule) ? mod : { "default": mod };
13
- };
14
- Object.defineProperty(exports, "__esModule", { value: true });
15
- const Test_1 = __importDefault(require("../Test"));
16
- const request_1 = __importDefault(require("../request"));
17
- const logger_1 = __importDefault(require("../logger"));
18
- /**
19
- *
20
- * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
21
- */
22
- class ContentSecurityPolicy extends Test_1.default {
23
- constructor() {
24
- super(...arguments);
25
- this.name = 'Content-Security-Policy';
26
- }
27
- test(_a) {
28
- return __awaiter(this, arguments, void 0, function* ({ url }) {
29
- logger_1.default.info('Starting ContentSecurityPolicy test...');
30
- const response = yield request_1.default.get(url);
31
- if (!Object.prototype.hasOwnProperty.call(response.headers, 'content-security-policy')) {
32
- return {
33
- status: 'ERROR',
34
- title: 'Content-Security-Policy',
35
- description: 'Response headers does not contain content-security-policy header!',
36
- };
37
- }
38
- return {
39
- status: 'SUCCESS',
40
- title: 'Content-Security-Policy',
41
- description: `The value of content-security-policy header is ${response.headers['content-security-policy']}.`,
42
- };
43
- });
44
- }
45
- }
46
- exports.default = ContentSecurityPolicy;
@@ -1,58 +0,0 @@
1
- "use strict";
2
- var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
3
- function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
4
- return new (P || (P = Promise))(function (resolve, reject) {
5
- function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
6
- function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
7
- function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
8
- step((generator = generator.apply(thisArg, _arguments || [])).next());
9
- });
10
- };
11
- var __importDefault = (this && this.__importDefault) || function (mod) {
12
- return (mod && mod.__esModule) ? mod : { "default": mod };
13
- };
14
- Object.defineProperty(exports, "__esModule", { value: true });
15
- const Test_1 = __importDefault(require("../Test"));
16
- const request_1 = __importDefault(require("../request"));
17
- const logger_1 = __importDefault(require("../logger"));
18
- class Cookies extends Test_1.default {
19
- constructor() {
20
- super(...arguments);
21
- this.name = 'Cookies';
22
- }
23
- test(_a) {
24
- return __awaiter(this, arguments, void 0, function* ({ url }) {
25
- logger_1.default.info('Starting Cookies test...');
26
- const response = yield request_1.default.get(url);
27
- let subChecks = [];
28
- if (Object.prototype.hasOwnProperty.call(response.headers, 'set-cookie')) {
29
- const cookies = response.headers['set-cookie'];
30
- subChecks = this.checkCookies(cookies);
31
- }
32
- return {
33
- status: subChecks.some(check => check.status === 'WARNING') ? 'WARNING' : 'SUCCESS',
34
- title: 'Cookies',
35
- description: '',
36
- results: subChecks,
37
- };
38
- });
39
- }
40
- checkCookies(cookies) {
41
- const regx = new RegExp('.*(secure; HttpOnly)$', 'i');
42
- return cookies.map((cookie) => {
43
- if (!regx.test(cookie)) {
44
- return {
45
- status: 'WARNING',
46
- title: cookie.substr(0, cookie.indexOf('=')),
47
- description: '',
48
- };
49
- }
50
- return {
51
- status: 'SUCCESS',
52
- title: cookie.substr(0, cookie.indexOf('=')),
53
- description: '',
54
- };
55
- });
56
- }
57
- }
58
- exports.default = Cookies;
@@ -1,51 +0,0 @@
1
- "use strict";
2
- var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
3
- function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
4
- return new (P || (P = Promise))(function (resolve, reject) {
5
- function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
6
- function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
7
- function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
8
- step((generator = generator.apply(thisArg, _arguments || [])).next());
9
- });
10
- };
11
- var __importDefault = (this && this.__importDefault) || function (mod) {
12
- return (mod && mod.__esModule) ? mod : { "default": mod };
13
- };
14
- Object.defineProperty(exports, "__esModule", { value: true });
15
- const Test_1 = __importDefault(require("../Test"));
16
- const request_1 = __importDefault(require("../request"));
17
- const logger_1 = __importDefault(require("../logger"));
18
- /**
19
- *
20
- * @see https://www.owasp.org/index.php/Fingerprint_Web_Server_(OTG-INFO-002)
21
- * @see https://www.owasp.org/index.php/Fingerprint_Web_Application_Framework_(OTG-INFO-008)
22
- */
23
- class FingerPrint extends Test_1.default {
24
- constructor() {
25
- super(...arguments);
26
- this.name = 'FingerPrint';
27
- this.knownHeaders = ['x-powered-by', 'x-generator', 'server'];
28
- }
29
- test(_a) {
30
- return __awaiter(this, arguments, void 0, function* ({ url }) {
31
- logger_1.default.info('Starting FingerPrint test...');
32
- const response = yield request_1.default.get(url);
33
- if (this.hasFingerPrintHeader(response.headers)) {
34
- return {
35
- status: 'ERROR',
36
- title: 'FingerPrint',
37
- description: 'Response headers includes at least one of finger print headers!',
38
- };
39
- }
40
- return {
41
- status: 'SUCCESS',
42
- title: 'FingerPrint',
43
- description: `Response headers don't inlcude any of finger print headers.`,
44
- };
45
- });
46
- }
47
- hasFingerPrintHeader(headers) {
48
- return Object.keys(headers).filter((header) => this.knownHeaders.includes(header)).length > 0;
49
- }
50
- }
51
- exports.default = FingerPrint;
@@ -1,58 +0,0 @@
1
- "use strict";
2
- var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
3
- function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
4
- return new (P || (P = Promise))(function (resolve, reject) {
5
- function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
6
- function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
7
- function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
8
- step((generator = generator.apply(thisArg, _arguments || [])).next());
9
- });
10
- };
11
- var __importDefault = (this && this.__importDefault) || function (mod) {
12
- return (mod && mod.__esModule) ? mod : { "default": mod };
13
- };
14
- Object.defineProperty(exports, "__esModule", { value: true });
15
- const web_risk_1 = require("@google-cloud/web-risk");
16
- const Test_1 = __importDefault(require("../Test"));
17
- const logger_1 = __importDefault(require("../logger"));
18
- /**
19
- *
20
- * @see https://cloud.google.com/web-risk
21
- * @see https://safebrowsing.google.com
22
- * @see https://transparencyreport.google.com/safe-browsing/search
23
- */
24
- class GoogleWebRisk extends Test_1.default {
25
- constructor() {
26
- super(...arguments);
27
- this.name = 'GoogleWebRisk';
28
- }
29
- test(_a) {
30
- return __awaiter(this, arguments, void 0, function* ({ url }) {
31
- logger_1.default.info('Starting Google Web Risk test...');
32
- const client = new web_risk_1.WebRiskServiceClient();
33
- const request = {
34
- uri: url,
35
- threatTypes: [
36
- web_risk_1.protos.google.cloud.webrisk.v1.ThreatType.MALWARE,
37
- web_risk_1.protos.google.cloud.webrisk.v1.ThreatType.SOCIAL_ENGINEERING,
38
- web_risk_1.protos.google.cloud.webrisk.v1.ThreatType.UNWANTED_SOFTWARE,
39
- ],
40
- };
41
- const response = yield client.searchUris(request);
42
- const { threat } = response[0];
43
- if (threat !== null) {
44
- return {
45
- status: 'ERROR',
46
- title: this.name,
47
- description: `This url contains ${threat.threatTypes.join(', ').toLowerCase()}!`,
48
- };
49
- }
50
- return {
51
- status: 'SUCCESS',
52
- title: this.name,
53
- description: 'This URL is safe.',
54
- };
55
- });
56
- }
57
- }
58
- exports.default = GoogleWebRisk;
@@ -1,62 +0,0 @@
1
- "use strict";
2
- var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
3
- function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
4
- return new (P || (P = Promise))(function (resolve, reject) {
5
- function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
6
- function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
7
- function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
8
- step((generator = generator.apply(thisArg, _arguments || [])).next());
9
- });
10
- };
11
- var __importDefault = (this && this.__importDefault) || function (mod) {
12
- return (mod && mod.__esModule) ? mod : { "default": mod };
13
- };
14
- Object.defineProperty(exports, "__esModule", { value: true });
15
- const Test_1 = __importDefault(require("../Test"));
16
- const request_1 = __importDefault(require("../request"));
17
- const logger_1 = __importDefault(require("../logger"));
18
- /**
19
- * HTTP Strict Transport Security
20
- *
21
- * Recommended value is at least one year (31536000).
22
- *
23
- * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
24
- * @see https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
25
- */
26
- class HSTS extends Test_1.default {
27
- constructor() {
28
- super(...arguments);
29
- this.name = 'HSTS';
30
- this.minValue = 31536000;
31
- }
32
- test(_a) {
33
- return __awaiter(this, arguments, void 0, function* ({ url }) {
34
- logger_1.default.info('Starting HSTS test...');
35
- const response = yield request_1.default.get(url);
36
- if (!Object.prototype.hasOwnProperty.call(response.headers, 'strict-transport-security')) {
37
- return {
38
- status: 'ERROR',
39
- title: 'HSTS',
40
- description: 'The strict-transport-security header is not present!',
41
- };
42
- }
43
- const attributes = response.headers['strict-transport-security'].replace(' ', '').split(';');
44
- const maxAge = attributes.filter((attribute) => {
45
- return attribute.startsWith('max-age');
46
- }).shift().replace('max-age=', '');
47
- if (parseInt(maxAge, 10) < this.minValue) {
48
- return {
49
- status: 'ERROR',
50
- title: 'HSTS',
51
- description: `The value of strict-transport-security header is ${maxAge}. Minimum value is ${this.minValue}!`,
52
- };
53
- }
54
- return {
55
- status: 'SUCCESS',
56
- title: 'HSTS',
57
- description: `The value of strict-transport-security header is ${maxAge}.`,
58
- };
59
- });
60
- }
61
- }
62
- exports.default = HSTS;
@@ -1,92 +0,0 @@
1
- "use strict";
2
- var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
3
- function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
4
- return new (P || (P = Promise))(function (resolve, reject) {
5
- function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
6
- function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
7
- function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
8
- step((generator = generator.apply(thisArg, _arguments || [])).next());
9
- });
10
- };
11
- var __importDefault = (this && this.__importDefault) || function (mod) {
12
- return (mod && mod.__esModule) ? mod : { "default": mod };
13
- };
14
- Object.defineProperty(exports, "__esModule", { value: true });
15
- const Test_1 = __importDefault(require("../Test"));
16
- const request_1 = __importDefault(require("../request"));
17
- const logger_1 = __importDefault(require("../logger"));
18
- /**
19
- * Hypertext Transfer Protocol Secure
20
- *
21
- * The script first transform the url to be unsecure
22
- * and then make the request. The answer has to be
23
- * redirect to secure version.
24
- *
25
- * Some sites requires www (or requires version without wwww)
26
- * and if the request is not as desired, it first redirects
27
- * to desired version (without https) and then again redirects
28
- * to version with https. This is also wrong.
29
- *
30
- * @see https://en.wikipedia.org/wiki/HTTPS
31
- */
32
- class HTTPS extends Test_1.default {
33
- constructor() {
34
- super(...arguments);
35
- this.name = 'HTTPS';
36
- }
37
- test(_a) {
38
- return __awaiter(this, arguments, void 0, function* ({ url }) {
39
- logger_1.default.info('Starting HTTPS test...');
40
- const unsecureUrl = this.toHttp(url);
41
- logger_1.default.debug('Unsecure URL', unsecureUrl);
42
- const response = yield request_1.default.get(unsecureUrl, { redirect: 'manual' });
43
- logger_1.default.debug('Response', { statusCode: response.statusCode, headers: response.headers });
44
- if (!this.isRedirect(response)) {
45
- return {
46
- status: 'ERROR',
47
- title: 'HTTPS',
48
- metadata: {
49
- statusCode: response.statusCode,
50
- unsecureUrl,
51
- finalUrl: response.finalUrl,
52
- },
53
- description: `Request to not secure url returned ${response.statusCode}!`,
54
- };
55
- }
56
- if (!this.isRedirectSecure(response)) {
57
- return {
58
- status: 'ERROR',
59
- title: 'HTTPS',
60
- metadata: {
61
- statusCode: response.statusCode,
62
- unsecureUrl,
63
- finalUrl: response.finalUrl,
64
- },
65
- description: `Request to not secure url returned non-secure redirect url ${response.headers.location}!`,
66
- };
67
- }
68
- return {
69
- status: 'SUCCESS',
70
- title: 'HTTPS',
71
- metadata: {
72
- statusCode: response.statusCode,
73
- unsecureUrl,
74
- finalUrl: response.finalUrl,
75
- },
76
- description: `Request to not secure url responded with status code ${response.statusCode} and redirect url ${response.headers.location}.`,
77
- };
78
- });
79
- }
80
- /* eslint-disable-next-line @typescript-eslint/no-explicit-any */
81
- isRedirect(response) {
82
- return Math.floor(response.statusCode / 100) === 3 && 'location' in response.headers;
83
- }
84
- /* eslint-disable-next-line @typescript-eslint/no-explicit-any */
85
- isRedirectSecure(response) {
86
- return response.headers.location.startsWith('https');
87
- }
88
- toHttp(url) {
89
- return url.replace('https://', 'http://');
90
- }
91
- }
92
- exports.default = HTTPS;
@@ -1,64 +0,0 @@
1
- "use strict";
2
- var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
3
- function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
4
- return new (P || (P = Promise))(function (resolve, reject) {
5
- function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
6
- function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
7
- function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
8
- step((generator = generator.apply(thisArg, _arguments || [])).next());
9
- });
10
- };
11
- var __importDefault = (this && this.__importDefault) || function (mod) {
12
- return (mod && mod.__esModule) ? mod : { "default": mod };
13
- };
14
- Object.defineProperty(exports, "__esModule", { value: true });
15
- const Test_1 = __importDefault(require("../Test"));
16
- const request_1 = __importDefault(require("../request"));
17
- const logger_1 = __importDefault(require("../logger"));
18
- /**
19
- *
20
- * @see https://en.wikipedia.org/wiki/HTTP/2
21
- * @see https://en.wikipedia.org/wiki/HTTP/3
22
- */
23
- class HTTPVersion extends Test_1.default {
24
- constructor() {
25
- super(...arguments);
26
- this.name = 'HTTP Version';
27
- }
28
- test(_a) {
29
- return __awaiter(this, arguments, void 0, function* ({ url }) {
30
- logger_1.default.info('Starting HTTPVersion test...');
31
- const response = yield request_1.default.get(url);
32
- if (Object.prototype.hasOwnProperty.call(response.headers, 'upgrade')) {
33
- const attributes = response.headers['upgrade'].replace(' ', '').split(',');
34
- const h2 = attributes.indexOf('h2') > -1;
35
- if (h2) {
36
- return {
37
- status: 'WARNING',
38
- title: 'HTTP/2',
39
- description: 'The current HTTP version is 2. Can be upgraded to 3.',
40
- };
41
- }
42
- }
43
- if (Object.prototype.hasOwnProperty.call(response.headers, 'alt-svc')) {
44
- const attributes = response.headers['alt-svc'].replace(' ', '').split(',');
45
- const h3 = attributes.find(a => a.includes('h3'));
46
- if (typeof h3 !== 'undefined') {
47
- if (h3) {
48
- return {
49
- status: 'SUCCESS',
50
- title: 'HTTP/3',
51
- description: 'The value of HTTP/3 header is present.',
52
- };
53
- }
54
- }
55
- }
56
- return {
57
- status: 'ERROR',
58
- title: 'HTTP/1',
59
- description: 'The current HTTP version is 1. Should be upgraded at least to 2!',
60
- };
61
- });
62
- }
63
- }
64
- exports.default = HTTPVersion;