sentinel-scanner 2.4.1 → 2.5.0

package/src/commands/ports.ts

@@ -1,175 +0,0 @@
-import fs from "node:fs/promises";
-import path from "node:path";
-import type { ArgumentsCamelCase, CommandModule } from "yargs";
-import { PortsScanner } from "../index.js";
-import { createLogger } from "../utils/index.js";
-
-export type PortScannerCLIOpts = {
-	spiderResults: string;
-	fromPort?: number;
-	toPort?: number;
-	allowList?: Array<number>;
-	concurrency?: number;
-	timeout?: number;
-	output?: string;
-};
-
-const cliLogger = createLogger("CLI");
-
-export const portsCommand: CommandModule = {
-	command: "ports",
-	describe:
-		"Check a website for Open Port vulnerabilities. Check the ports between the specified range for open ports",
-	builder: (yargs) => {
-		return yargs
-			.option("spiderResults", {
-				alias: "s",
-				type: "string",
-				description:
-					"The spider results file to use for scanning. It will use the URLs from the spider results to scan for header vulnerabilities",
-				demandOption: true,
-				coerce: (url) => {
-					if (!path.isAbsolute(url)) {
-						return path.resolve(url);
-					}
-					return url;
-				},
-			})
-			.option("output", {
-				alias: "o",
-				type: "string",
-				description:
-					"The output file to write the results to. Must be a JSON file",
-				default: () => getDefaultFilePath(),
-				coerce: (output) => {
-					const resolvedPath = path.resolve(output);
-					const { ext } = path.parse(resolvedPath);
-
-					if (ext !== ".json") {
-						throw new Error("Output file must be a JSON file");
-					}
-					return resolvedPath;
-				},
-			})
-			.option("concurrency", {
-				alias: "c",
-				type: "number",
-				description: "The number of concurrent requests to make",
-				default: 10,
-				coerce: (concurrency) => {
-					if (concurrency < 1 || concurrency > 20) {
-						throw new Error("Concurrency must be between 1 and 20");
-					}
-					return concurrency;
-				},
-			})
-			.option("timeout", {
-				alias: "t",
-				type: "number",
-				description: "The timeout for each request in milliseconds",
-				default: 5000,
-				coerce: (timeout) => {
-					if (timeout < 0 || timeout > 25000) {
-						throw new Error("Timeout must be between 0 and 25,000 ms");
-					}
-					return timeout;
-				},
-			})
-			.option("fromPort", {
-				alias: "fp",
-				type: "number",
-				description: "The starting port to scan",
-				default: 3,
-				coerce: (fromPort) => {
-					if (fromPort < 1 || fromPort > 65535) {
-						throw new Error("Port must be between 1 and 65,535");
-					}
-				},
-			})
-			.option("toPort", {
-				alias: "tp",
-				type: "number",
-				description: "The ending port to scan",
-				default: 8080,
-				coerce: (toPort) => {
-					if (toPort < 1 || toPort > 65535) {
-						throw new Error("Port must be between 1 and 65,535");
-					}
-				},
-			})
-			.option("allowList", {
-				alias: "al",
-				type: "array",
-				description: "A list of ports to allow",
-				default: [22, 80, 443],
-				coerce: (allowList) => {
-					if (!Array.isArray(allowList)) {
-						throw new Error("Allow list must be an array");
-					}
-					return allowList;
-				},
-			});
-	},
-	handler: async (args) => {
-		try {
-			const argData = args as ArgumentsCamelCase<PortScannerCLIOpts>;
-			const spiderResultsPath = path.resolve(argData.spiderResults);
-
-			// Check if the spider results file exists
-			if (!(await fileExists(spiderResultsPath))) {
-				throw new Error(
-					`Spider results file not found at ${spiderResultsPath}`,
-				);
-			}
-
-			const spiderResults = JSON.parse(
-				await fs.readFile(spiderResultsPath, "utf-8"),
-			);
-
-			cliLogger.info("Starting Port scan on website");
-
-			const scanner = new PortsScanner({
-				spiderResults,
-				fromPort: argData.fromPort ?? 1,
-				toPort: argData.toPort ?? 65535,
-				allowList: argData.allowList ?? [22, 80, 443],
-				concurrency: argData.concurrency ?? 30,
-				timeout: argData.timeout ?? 10000,
-			});
-			const results = await scanner.scan();
-
-			const outputPath = argData.output || getDefaultFilePath();
-			await fs.writeFile(outputPath, JSON.stringify(results, null, 2));
-			cliLogger.info(`Results successfully written to ${outputPath}`);
-		} catch (error) {
-			if (error instanceof Error) {
-				cliLogger.error(`Error: ${error.message}`);
-			}
-			cliLogger.error("Failed to run Port Scan command");
-			process.exit(1);
-		}
-	},
-};
-
-// Utility function to check if a file exists
-const fileExists = async (filePath: string) => {
-	try {
-		await fs.access(filePath);
-		return true;
-	} catch {
-		return false;
-	}
-};
-
-// Utility function to get the default file path
-const getDefaultFilePath = () => {
-	const resolvedDir = path.resolve("sentinel_output");
-
-	// Ensure the directory exists or create it
-	fs.mkdir(resolvedDir, { recursive: true }).catch((err) => {
-		cliLogger.error(`Failed to create directory: ${err.message}`);
-		process.exit(1);
-	});
-
-	return path.resolve(resolvedDir, `portsResults_${Date.now()}.json`);
-};

package/src/commands/sqli.ts

@@ -1,150 +0,0 @@
-import fs from "node:fs/promises";
-import path from "node:path";
-import type { ArgumentsCamelCase, CommandModule } from "yargs";
-import SqliScanner from "../modules/sqli/index.js";
-import { createLogger } from "../utils/index.js";
-
-export type SqliScannerCLIoptions = {
-	spiderResults: string;
-	retries?: number;
-	timeout?: number;
-	concurrency?: number;
-	output?: string;
-};
-
-const cliLogger = createLogger("CLI");
-
-export const sqliCommand: CommandModule = {
-	command: "sqli",
-	describe:
-		"Check a website for SQL Injection vulnerabilities by scanning each page",
-	builder: (yargs) => {
-		return yargs
-			.option("spiderResults", {
-				alias: "s",
-				type: "string",
-				description:
-					"The spider results file to use for scanning. It will use the URLs from the spider results to scan for SQL Injection vulnerabilities",
-				demandOption: true,
-				coerce: (url) => {
-					if (!path.isAbsolute(url)) {
-						return path.resolve(url);
-					}
-					return url;
-				},
-			})
-			.option("output", {
-				alias: "o",
-				type: "string",
-				description:
-					"The output file to write the results to. Must be a JSON file",
-				default: () => getDefaultFilePath(),
-				coerce: (output) => {
-					const resolvedPath = path.resolve(output);
-					const { ext } = path.parse(resolvedPath);
-
-					if (ext !== ".json") {
-						throw new Error("Output file must be a JSON file");
-					}
-					return resolvedPath;
-				},
-			})
-			.option("concurrency", {
-				alias: "c",
-				type: "number",
-				description: "The number of concurrent requests to make",
-				default: 10,
-				coerce: (concurrency) => {
-					if (concurrency < 1 || concurrency > 20) {
-						throw new Error("Concurrency must be between 1 and 20");
-					}
-					return concurrency;
-				},
-			})
-			.option("timeout", {
-				alias: "t",
-				type: "number",
-				description: "The timeout for each request in milliseconds",
-				default: 5000,
-				coerce: (timeout) => {
-					if (timeout < 0 || timeout > 25000) {
-						throw new Error("Timeout must be between 0 and 25,000 ms");
-					}
-					return timeout;
-				},
-			})
-			.option("retries", {
-				alias: "r",
-				type: "number",
-				description: "The number of retries for each request",
-				default: 3,
-				coerce: (retries) => {
-					if (retries < 0 || retries > 10) {
-						throw new Error("Retries must be between 0 and 10");
-					}
-					return retries;
-				},
-			});
-	},
-	handler: async (args) => {
-		try {
-			const argData = args as ArgumentsCamelCase<SqliScannerCLIoptions>;
-			const spiderResultsPath = path.resolve(argData.spiderResults);
-
-			// Check if the spider results file exists
-			if (!(await fileExists(spiderResultsPath))) {
-				throw new Error(
-					`Spider results file not found at ${spiderResultsPath}`,
-				);
-			}
-
-			const spiderResults = JSON.parse(
-				await fs.readFile(spiderResultsPath, "utf-8"),
-			);
-
-			cliLogger.info("Starting SQLI scan on website");
-
-			const scanner = new SqliScanner({
-				spiderResults,
-				concurrency: argData.concurrency,
-				timeout: argData.timeout,
-				retries: argData.retries,
-			});
-
-			const results = await scanner.scan();
-
-			const outputPath = argData.output || getDefaultFilePath();
-			await fs.writeFile(outputPath, JSON.stringify(results, null, 2));
-			cliLogger.info(`Results successfully written to ${outputPath}`);
-		} catch (error) {
-			if (error instanceof Error) {
-				cliLogger.error(`Error: ${error.message}`);
-			}
-			cliLogger.error("Failed to run SQLI command");
-			process.exit(1);
-		}
-	},
-};
-
-// Utility function to check if a file exists
-const fileExists = async (filePath: string) => {
-	try {
-		await fs.access(filePath);
-		return true;
-	} catch {
-		return false;
-	}
-};
-
-// Utility function to get the default file path
-const getDefaultFilePath = () => {
-	const resolvedDir = path.resolve("sentinel_output");
-
-	// Ensure the directory exists or create it
-	fs.mkdir(resolvedDir, { recursive: true }).catch((err) => {
-		cliLogger.error(`Failed to create directory: ${err.message}`);
-		process.exit(1);
-	});
-
-	return path.resolve(resolvedDir, `sqliResult_${Date.now()}.json`);
-};

package/src/commands/xss.ts

@@ -1,149 +0,0 @@
-import fs from "node:fs/promises";
-import path from "node:path";
-import type { ArgumentsCamelCase, CommandModule } from "yargs";
-import { XSSScanner } from "../index.js";
-import { createLogger } from "../utils/index.js";
-
-export type XSSScannerCLIoptions = {
-	spiderResults: string;
-	retries?: number;
-	timeout?: number;
-	concurrency?: number;
-	output?: string;
-};
-
-const cliLogger = createLogger("CLI");
-
-export const xssCommand: CommandModule = {
-	command: "xss",
-	describe: "Check a website for XSS vulnerabilities by scanning each page",
-	builder: (yargs) => {
-		return yargs
-			.option("spiderResults", {
-				alias: "s",
-				type: "string",
-				description:
-					"The spider results file to use for scanning. It will use the URLs from the spider results to scan for XSS vulnerabilities",
-				demandOption: true,
-				coerce: (url) => {
-					if (!path.isAbsolute(url)) {
-						return path.resolve(url);
-					}
-					return url;
-				},
-			})
-			.option("output", {
-				alias: "o",
-				type: "string",
-				description:
-					"The output file to write the results to. Must be a JSON file",
-				default: () => getDefaultFilePath(),
-				coerce: (output) => {
-					const resolvedPath = path.resolve(output);
-					const { ext } = path.parse(resolvedPath);
-
-					if (ext !== ".json") {
-						throw new Error("Output file must be a JSON file");
-					}
-					return resolvedPath;
-				},
-			})
-			.option("concurrency", {
-				alias: "c",
-				type: "number",
-				description: "The number of concurrent requests to make",
-				default: 10,
-				coerce: (concurrency) => {
-					if (concurrency < 1 || concurrency > 20) {
-						throw new Error("Concurrency must be between 1 and 20");
-					}
-					return concurrency;
-				},
-			})
-			.option("timeout", {
-				alias: "t",
-				type: "number",
-				description: "The timeout for each request in milliseconds",
-				default: 5000,
-				coerce: (timeout) => {
-					if (timeout < 0 || timeout > 25000) {
-						throw new Error("Timeout must be between 0 and 25,000 ms");
-					}
-					return timeout;
-				},
-			})
-			.option("retries", {
-				alias: "r",
-				type: "number",
-				description: "The number of retries for each request",
-				default: 3,
-				coerce: (retries) => {
-					if (retries < 0 || retries > 10) {
-						throw new Error("Retries must be between 0 and 10");
-					}
-					return retries;
-				},
-			});
-	},
-	handler: async (args) => {
-		try {
-			const argData = args as ArgumentsCamelCase<XSSScannerCLIoptions>;
-			const spiderResultsPath = path.resolve(argData.spiderResults);
-
-			// Check if the spider results file exists
-			if (!(await fileExists(spiderResultsPath))) {
-				throw new Error(
-					`Spider results file not found at ${spiderResultsPath}`,
-				);
-			}
-
-			const spiderResults = JSON.parse(
-				await fs.readFile(spiderResultsPath, "utf-8"),
-			);
-
-			cliLogger.info("Starting XSS scan on website");
-
-			const scanner = new XSSScanner({
-				spiderResults,
-				concurrency: argData.concurrency,
-				timeout: argData.timeout,
-				retries: argData.retries,
-			});
-
-			const results = await scanner.scan();
-
-			const outputPath = argData.output || getDefaultFilePath();
-			await fs.writeFile(outputPath, JSON.stringify(results, null, 2));
-			cliLogger.info(`Results successfully written to ${outputPath}`);
-		} catch (error) {
-			if (error instanceof Error) {
-				cliLogger.error(`Error: ${error.message}`);
-			}
-			cliLogger.error("Failed to run XSS command");
-			process.exit(1);
-		}
-	},
-};
-
-// Utility function to check if a file exists
-const fileExists = async (filePath: string) => {
-	try {
-		await fs.access(filePath);
-		return true;
-	} catch {
-		return false;
-	}
-};
-
-// Utility function to get the default file path
-const getDefaultFilePath = () => {
-	const resolvedDir = path.resolve("sentinel_output");
-
-	// Ensure the directory exists or create it
-	fs.mkdir(resolvedDir, { recursive: true }).catch((err) => {
-		cliLogger.error(`Failed to create directory: ${err.message}`);
-		process.exit(1);
-	});
-
-	return path.resolve(resolvedDir, `xssResult_${Date.now()}.json`);
-};

package/src/modules/headers/headers.ts

@@ -1,161 +0,0 @@
-import type { HeadersData } from "./index.js";
-
-const securityChecks: HeadersData[] = [
-	{
-		name: "X-Content-Type-Options",
-		description: "Prevents MIME-type sniffing.",
-		recommendation: "nosniff",
-		check: (value: string) => value === "nosniff",
-	},
-	{
-		name: "X-Frame-Options",
-		description: "Mitigates clickjacking attacks.",
-		recommendation: "DENY or SAMEORIGIN",
-		check: (value: string) =>
-			value === "DENY" ||
-			value === "SAMEORIGIN" ||
-			value?.startsWith("ALLOW-FROM"),
-	},
-	{
-		name: "Strict-Transport-Security",
-		description: "Enforces HTTPS and prevents downgrade attacks.",
-		recommendation: "max-age=31536000; includeSubDomains; preload",
-		check: (value: string) =>
-			value?.includes("max-age=") && value.includes("includeSubDomains"),
-	},
-	{
-		name: "Content-Security-Policy",
-		description:
-			"Prevents cross-site scripting (XSS) and data injection attacks.",
-		recommendation: "script-src 'self'; object-src 'none'",
-		check: (value: string) => !!value,
-	},
-	{
-		name: "Referrer-Policy",
-		description:
-			"Controls how much referrer information is included with requests.",
-		recommendation: "no-referrer or strict-origin",
-		check: (value: string) =>
-			[
-				"no-referrer",
-				"strict-origin",
-				"strict-origin-when-cross-origin",
-			].includes(value ?? ""),
-	},
-	{
-		name: "Permissions-Policy",
-		description: "Manages permissions of APIs (e.g., camera, geolocation).",
-		recommendation: "default settings for better privacy",
-		check: (value: string) => !!value,
-	},
-	{
-		name: "Cross-Origin-Embedder-Policy",
-		description:
-			"Prevents a document from loading any cross-origin resources that don't explicitly grant permission.",
-		recommendation: "require-corp",
-		check: (value: string) => value === "require-corp",
-	},
-	{
-		name: "Cross-Origin-Opener-Policy",
-		description:
-			"Prevents other domains from taking control of your context via window.opener.",
-		recommendation: "same-origin",
-		check: (value: string) => value === "same-origin",
-	},
-	{
-		name: "Cross-Origin-Resource-Policy",
-		description: "Prevents your resources from being used by other sites.",
-		recommendation: "same-origin",
-		check: (value: string) => value === "same-origin" || value === "same-site",
-	},
-];
-
-const informationLeakChecks: HeadersData[] = [
-	{
-		name: "Server",
-		description: "Reveals server software information.",
-		recommendation: "Remove or obfuscate this header.",
-		check: (value: string) => !value,
-	},
-	{
-		name: "X-Powered-By",
-		description:
-			"Reveals information about the framework (e.g., Express, PHP).",
-		recommendation: "Remove or set to a generic value.",
-		check: (value: string) => !value,
-	},
-	{
-		name: "X-AspNet-Version",
-		description: "Reveals ASP.NET version.",
-		recommendation: "Remove this header.",
-		check: (value: string) => !value,
-	},
-	{
-		name: "X-AspNetMvc-Version",
-		description: "Reveals ASP.NET MVC version.",
-		recommendation: "Remove this header.",
-		check: (value: string) => !value,
-	},
-	{
-		name: "X-PHP-Version",
-		description: "Reveals PHP version.",
-		recommendation: "Disable or remove this header.",
-		check: (value: string) => !value,
-	},
-	{
-		name: "X-Generator",
-		description: "Reveals information about CMS (e.g., WordPress, Joomla).",
-		recommendation: "Remove this header.",
-		check: (value: string) => !value,
-	},
-	{
-		name: "X-Drupal-Dynamic-Cache",
-		description: "Reveals Drupal cache status.",
-		recommendation: "Remove this header.",
-		check: (value: string) => !value,
-	},
-	{
-		name: "X-Runtime",
-		description: "Reveals the application's runtime environment.",
-		recommendation: "Remove this header.",
-		check: (value: string) => !value,
-	},
-	{
-		name: "X-Backend-Server",
-		description: "Leaks information about backend server infrastructure.",
-		recommendation: "Remove or obfuscate this header.",
-		check: (value: string) => !value,
-	},
-	{
-		name: "Via",
-		description: "Reveals intermediate proxies and gateways.",
-		recommendation: "Remove or obfuscate this header.",
-		check: (value: string) => !value,
-	},
-	{
-		name: "X-Cache",
-		description: "Indicates if a resource was served from cache.",
-		recommendation: "Remove this header.",
-		check: (value: string) => !value,
-	},
-	{
-		name: "X-CF-Powered-By",
-		description: "Reveals that the app is behind Cloudflare.",
-		recommendation: "Remove this header.",
-		check: (value: string) => !value,
-	},
-	{
-		name: "X-Edge-IP",
-		description: "Leaks edge server IP addresses.",
-		recommendation: "Remove or obfuscate this header.",
-		check: (value: string) => !value,
-	},
-	{
-		name: "X-Edge-Location",
-		description: "Reveals the physical location of edge servers.",
-		recommendation: "Remove this header.",
-		check: (value: string) => !value,
-	},
-];
-
-export { securityChecks, informationLeakChecks };