pentest-tool-lite 3.6.4 → 3.8.0

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "pentest-tool-lite",
     "description": "Check your website ( or any other website ) for common vulnerabilities.",
-    "version": "3.6.4",
+    "version": "3.8.0",
     "homepage": "https://pentest-tool-lite.com",
     "license": "MIT",
     "author": {
@@ -13,6 +13,7 @@
         "pentest-tool-lite": "./src/index"
     },
     "dependencies": {
+        "@google-cloud/web-risk": "^4.0.1",
         "commander": "^6.0.0",
         "csso": "^5.0.5",
         "domhandler": "^4.2.2",
@@ -37,7 +38,7 @@
     },
     "devDependencies": {
         "@types/jest": "^27.0.2",
-        "@types/node": "^13.13.0",
+        "@types/node": "^18.18.4",
         "@types/node-fetch": "^2.5.7",
         "@types/uglify-js": "^3.0.4",
         "@types/xml2js": "^0.4.5",

package/src/Pentest.d.ts

@@ -2,6 +2,7 @@ import { Result } from './Test';
 interface PentestResult {
     security: Result;
     html: Result;
+    seo: Result;
     wordpress: Result;
 }
 declare class Pentest {

package/src/Pentest.js

@@ -14,19 +14,23 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const security_1 = __importDefault(require("./security"));
 const html_1 = __importDefault(require("./html"));
+const seo_1 = __importDefault(require("./seo"));
 const wordpress_1 = __importDefault(require("./wordpress"));
 class Pentest {
     run(url) {
         return __awaiter(this, void 0, void 0, function* () {
             const security = new security_1.default();
             const html = new html_1.default();
+            const seo = new seo_1.default();
             const wordPress = new wordpress_1.default();
             const securityResult = yield security.run({ url });
             const htmlResult = yield html.run({ url });
+            const seoResult = yield seo.run({ url });
             const wordPressResult = yield wordPress.run({ url });
             return {
                 security: securityResult,
                 html: htmlResult,
+                seo: seoResult,
                 wordpress: wordPressResult,
             };
         });

package/src/Test.d.ts

@@ -1,8 +1,8 @@
-export declare type TestParameters = {
+export type TestParameters = {
     url: string;
 };
-export declare type Status = 'FATAL' | 'ERROR' | 'WARNING' | 'SUCCESS';
-export declare type Result = {
+export type Status = 'FATAL' | 'ERROR' | 'WARNING' | 'SUCCESS';
+export type Result = {
     status: Status;
     title: string;
     description: string;

package/src/functions/getHeading.d.ts

@@ -0,0 +1,2 @@
+declare const getHeading: (result: any) => string | string[];
+export default getHeading;

package/src/functions/getHeading.js

@@ -0,0 +1,14 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const getObject_1 = __importDefault(require("./getObject"));
+const getHeading = (result) => {
+    const titles = (0, getObject_1.default)(result.html, 'name', 'h1')
+        .map((title) => {
+        return title.children[0].data;
+    });
+    return titles.length > 1 ? titles : titles.shift();
+};
+exports.default = getHeading;

package/src/functions/getTitle.d.ts

@@ -0,0 +1,2 @@
+declare const getTitle: (result: any) => string | string[];
+export default getTitle;

package/src/functions/getTitle.js

@@ -0,0 +1,14 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const getObject_1 = __importDefault(require("./getObject"));
+const getTitle = (result) => {
+    const titles = (0, getObject_1.default)(result.html, 'name', 'title')
+        .map((title) => {
+        return title.children[0].data;
+    });
+    return titles.length > 1 ? titles : titles.shift();
+};
+exports.default = getTitle;

package/src/functions/index.d.ts

@@ -9,3 +9,5 @@ export { default as getGenerator } from './getGenerator';
 export { default as parseHtml } from './parseHtml';
 export { default as parseSitemap } from './parseSitemap';
 export { default as parseXml } from './parseXml';
+export { default as getTitle } from './getTitle';
+export { default as getHeading } from './getHeading';

package/src/functions/index.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseXml = exports.parseSitemap = exports.parseHtml = exports.getGenerator = exports.getObject = exports.getStylesheets = exports.getScripts = exports.getImages = exports.getDuplicates = exports.getAnchors = exports.findEvery = void 0;
+exports.getHeading = exports.getTitle = exports.parseXml = exports.parseSitemap = exports.parseHtml = exports.getGenerator = exports.getObject = exports.getStylesheets = exports.getScripts = exports.getImages = exports.getDuplicates = exports.getAnchors = exports.findEvery = void 0;
 var findEvery_1 = require("./findEvery");
 Object.defineProperty(exports, "findEvery", { enumerable: true, get: function () { return __importDefault(findEvery_1).default; } });
 var getAnchors_1 = require("./getAnchors");
@@ -26,3 +26,7 @@ var parseSitemap_1 = require("./parseSitemap");
 Object.defineProperty(exports, "parseSitemap", { enumerable: true, get: function () { return __importDefault(parseSitemap_1).default; } });
 var parseXml_1 = require("./parseXml");
 Object.defineProperty(exports, "parseXml", { enumerable: true, get: function () { return __importDefault(parseXml_1).default; } });
+var getTitle_1 = require("./getTitle");
+Object.defineProperty(exports, "getTitle", { enumerable: true, get: function () { return __importDefault(getTitle_1).default; } });
+var getHeading_1 = require("./getHeading");
+Object.defineProperty(exports, "getHeading", { enumerable: true, get: function () { return __importDefault(getHeading_1).default; } });

package/src/functions/parseXml.js

@@ -7,6 +7,9 @@ const xml2js_1 = __importDefault(require("xml2js"));
 function default_1(result) {
     return new Promise((resolve, reject) => {
         xml2js_1.default.parseString(result.body, (err, r) => {
+            if (err) {
+                reject(err);
+            }
             resolve(r);
         });
     });

package/src/index

@@ -70,7 +70,7 @@ program
     const pentest = new Pentest_1.default();
     const results = yield pentest.run(url);
     const report = report_1.default.get(config_1.default.report.format);
-    report.write([results.security, results.html, results.wordpress]);
+    report.write([results.security, results.html, results.seo, results.wordpress]);
 }));
 program
     .command('sitemap <URL>')

package/src/request/Request.d.ts

@@ -1,9 +1,9 @@
-export declare type Options = {
+export type Options = {
     redirect?: 'follow' | 'manual' | 'error';
     timeout?: number;
     agent?: string;
 };
-export declare type Response = {
+export type Response = {
     url: string;
     body: string;
     statusCode: number;

package/src/security/GoogleWebRisk.d.ts

@@ -0,0 +1,12 @@
+import Test, { TestParameters, Result } from '../Test';
+/**
+ *
+ * @see https://cloud.google.com/web-risk
+ * @see https://safebrowsing.google.com
+ * @see https://transparencyreport.google.com/safe-browsing/search
+ */
+declare class GoogleWebRisk extends Test {
+    name: string;
+    test({ url }: TestParameters): Promise<Result>;
+}
+export default GoogleWebRisk;

package/src/security/GoogleWebRisk.js

@@ -0,0 +1,58 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const web_risk_1 = require("@google-cloud/web-risk");
+const Test_1 = __importDefault(require("../Test"));
+const logger_1 = __importDefault(require("../logger"));
+/**
+ *
+ * @see https://cloud.google.com/web-risk
+ * @see https://safebrowsing.google.com
+ * @see https://transparencyreport.google.com/safe-browsing/search
+ */
+class GoogleWebRisk extends Test_1.default {
+    constructor() {
+        super(...arguments);
+        this.name = 'GoogleWebRisk';
+    }
+    test({ url }) {
+        return __awaiter(this, void 0, void 0, function* () {
+            logger_1.default.info('Starting Google Web Risk test...');
+            const client = new web_risk_1.WebRiskServiceClient();
+            const request = {
+                uri: url,
+                threatTypes: [
+                    web_risk_1.protos.google.cloud.webrisk.v1.ThreatType.MALWARE,
+                    web_risk_1.protos.google.cloud.webrisk.v1.ThreatType.SOCIAL_ENGINEERING,
+                    web_risk_1.protos.google.cloud.webrisk.v1.ThreatType.UNWANTED_SOFTWARE,
+                ],
+            };
+            const response = yield client.searchUris(request);
+            const { threat } = response[0];
+            if (threat !== null) {
+                return {
+                    status: 'ERROR',
+                    title: this.name,
+                    description: `This url contains ${threat.threatTypes.join(', ').toLowerCase()}!`,
+                };
+            }
+            return {
+                status: 'SUCCESS',
+                title: this.name,
+                description: 'This URL is safe.',
+            };
+        });
+    }
+}
+exports.default = GoogleWebRisk;

package/src/security/index.js

@@ -26,6 +26,7 @@ const ReferrerPolicy_1 = __importDefault(require("./ReferrerPolicy"));
 const RobotsTXT_1 = __importDefault(require("./RobotsTXT"));
 const PermissionsPolicy_1 = __importDefault(require("./PermissionsPolicy"));
 const SSL_1 = __importDefault(require("./SSL"));
+const GoogleWebRisk_1 = __importDefault(require("./GoogleWebRisk"));
 class Security extends Test_1.default {
     constructor() {
         super();
@@ -44,6 +45,7 @@ class Security extends Test_1.default {
             new ContentEncoding_1.default(),
             new RobotsTXT_1.default(),
             new SSL_1.default(),
+            new GoogleWebRisk_1.default(),
         ];
     }
     test(params) {

package/src/seo/Heading.d.ts

@@ -0,0 +1,7 @@
+import Test, { TestParameters, Result } from '../Test';
+declare class Heading extends Test {
+    name: string;
+    test({ url }: TestParameters): Promise<Result>;
+    private checkHeading;
+}
+export default Heading;

package/src/seo/Heading.js

@@ -0,0 +1,58 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const Test_1 = __importDefault(require("../Test"));
+const request_1 = __importDefault(require("../request"));
+const logger_1 = __importDefault(require("../logger"));
+const functions_1 = require("../functions");
+class Heading extends Test_1.default {
+    constructor() {
+        super(...arguments);
+        this.name = 'Heading';
+    }
+    test({ url }) {
+        return __awaiter(this, void 0, void 0, function* () {
+            logger_1.default.info(`Starting ${this.constructor.name} test...`);
+            const response = yield request_1.default.get(url);
+            const html = yield (0, functions_1.parseHtml)(response);
+            const heading = (0, functions_1.getHeading)(html);
+            const subTests = this.checkHeading(heading);
+            return {
+                status: this.getStatus(subTests.map(test => test.status)),
+                title: this.constructor.name,
+                description: '',
+                results: subTests,
+            };
+        });
+    }
+    checkHeading(title) {
+        const results = [];
+        results.push({
+            status: typeof title !== undefined && title.length > 0 ? 'SUCCESS' : 'WARNING',
+            title: 'H1 tag',
+        });
+        results.push({
+            status: Array.isArray(title) ? 'ERROR' : 'SUCCESS',
+            title: 'Duplicate H1 tag',
+            description: `HTML should contain just one title tag.`,
+        });
+        results.push({
+            status: title.length <= 60 ? 'SUCCESS' : 'WARNING',
+            title: 'Title length',
+            description: `Title length should be under 60 characters and it is ${title.length}.`,
+        });
+        return results;
+    }
+}
+exports.default = Heading;

package/src/seo/Robots.d.ts

@@ -0,0 +1,6 @@
+import Test, { TestParameters, Result } from '../Test';
+declare class Robots extends Test {
+    name: string;
+    test({ url }: TestParameters): Promise<Result>;
+}
+export default Robots;

package/src/seo/Robots.js

@@ -0,0 +1,35 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const Test_1 = __importDefault(require("../Test"));
+const request_1 = __importDefault(require("../request"));
+const logger_1 = __importDefault(require("../logger"));
+class Robots extends Test_1.default {
+    constructor() {
+        super(...arguments);
+        this.name = 'Robots';
+    }
+    test({ url }) {
+        return __awaiter(this, void 0, void 0, function* () {
+            logger_1.default.info(`Starting ${this.constructor.name} test...`);
+            const response = yield request_1.default.get(`${url}/robots.txt`);
+            return {
+                status: Math.floor(response.statusCode / 100) === 2 ? 'SUCCESS' : 'WARNING',
+                title: 'Robots.txt',
+                description: '',
+            };
+        });
+    }
+}
+exports.default = Robots;

package/src/seo/Sitemap.d.ts

@@ -0,0 +1,6 @@
+import Test, { TestParameters, Result } from '../Test';
+declare class Sitemap extends Test {
+    name: string;
+    test({ url }: TestParameters): Promise<Result>;
+}
+export default Sitemap;

package/src/seo/Sitemap.js

@@ -0,0 +1,46 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const Test_1 = __importDefault(require("../Test"));
+const request_1 = __importDefault(require("../request"));
+const logger_1 = __importDefault(require("../logger"));
+const functions_1 = require("../functions");
+class Sitemap extends Test_1.default {
+    constructor() {
+        super(...arguments);
+        this.name = 'Sitemap';
+    }
+    test({ url }) {
+        return __awaiter(this, void 0, void 0, function* () {
+            logger_1.default.info(`Starting ${this.constructor.name} test...`);
+            const robotsResponse = yield request_1.default.get(`${url}/robots.txt`);
+            let sitemapUrl = `${url}/sitemap.xml`;
+            if (Math.floor(robotsResponse.statusCode / 100) === 2) {
+                const lines = robotsResponse.body.split(/\r?\n/);
+                const sitemap = lines.find(line => line.startsWith('Sitemap'));
+                if (typeof sitemap !== 'undefined') {
+                    sitemapUrl = sitemap.split(' ')[1];
+                }
+            }
+            const response = yield request_1.default.get(sitemapUrl);
+            const xml = yield (0, functions_1.parseXml)(response);
+            return {
+                status: 'sitemapindex' in xml || 'urlset' in xml ? 'SUCCESS' : 'WARNING',
+                title: this.constructor.name,
+                description: '',
+            };
+        });
+    }
+}
+exports.default = Sitemap;

package/src/seo/Title.d.ts

@@ -0,0 +1,7 @@
+import Test, { TestParameters, Result } from '../Test';
+declare class Title extends Test {
+    name: string;
+    test({ url }: TestParameters): Promise<Result>;
+    private checkTitle;
+}
+export default Title;

package/src/seo/Title.js

@@ -0,0 +1,58 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const Test_1 = __importDefault(require("../Test"));
+const request_1 = __importDefault(require("../request"));
+const logger_1 = __importDefault(require("../logger"));
+const functions_1 = require("../functions");
+class Title extends Test_1.default {
+    constructor() {
+        super(...arguments);
+        this.name = 'Title';
+    }
+    test({ url }) {
+        return __awaiter(this, void 0, void 0, function* () {
+            logger_1.default.info(`Starting ${this.constructor.name} test...`);
+            const response = yield request_1.default.get(url);
+            const html = yield (0, functions_1.parseHtml)(response);
+            const title = (0, functions_1.getTitle)(html);
+            const subTests = this.checkTitle(title);
+            return {
+                status: this.getStatus(subTests.map(test => test.status)),
+                title: this.constructor.name,
+                description: '',
+                results: subTests,
+            };
+        });
+    }
+    checkTitle(title) {
+        const results = [];
+        results.push({
+            status: typeof title !== undefined && title.length > 0 ? 'SUCCESS' : 'WARNING',
+            title: 'Title tag',
+        });
+        results.push({
+            status: Array.isArray(title) ? 'ERROR' : 'SUCCESS',
+            title: 'Duplicate title tag',
+            description: `HTML should contain just one title tag.`,
+        });
+        results.push({
+            status: title.length <= 60 ? 'SUCCESS' : 'WARNING',
+            title: 'Title length',
+            description: `Title length should be under 60 characters and it is ${title.length}.`,
+        });
+        return results;
+    }
+}
+exports.default = Title;

package/src/seo/index.d.ts

@@ -0,0 +1,6 @@
+import Test, { TestParameters, Result } from '../Test';
+export default class SEO extends Test {
+    name: string;
+    constructor();
+    test(params: TestParameters): Promise<Result>;
+}

package/src/seo/index.js

@@ -0,0 +1,58 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const Test_1 = __importDefault(require("../Test"));
+const Title_1 = __importDefault(require("./Title"));
+const Heading_1 = __importDefault(require("./Heading"));
+const Sitemap_1 = __importDefault(require("./Sitemap"));
+const Robots_1 = __importDefault(require("./Robots"));
+class SEO extends Test_1.default {
+    constructor() {
+        super();
+        this.name = 'SEO';
+        this.tests = [
+            new Title_1.default(),
+            new Heading_1.default(),
+            new Sitemap_1.default(),
+            new Robots_1.default(),
+        ];
+    }
+    test(params) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const tests = this.getTests();
+            const results = [];
+            for (const test of tests) {
+                let result = null;
+                try {
+                    result = yield test.run(params);
+                }
+                catch (error) {
+                    result = {
+                        status: 'ERROR',
+                        title: test.name,
+                        description: 'Test failed or cannot be run!',
+                    };
+                }
+                results.push(result);
+            }
+            return {
+                status: this.getStatus(results.map(result => result.status)),
+                title: this.name,
+                description: '',
+                results,
+            };
+        });
+    }
+}
+exports.default = SEO;