bbot 2.7.0.6989rc0__py3-none-any.whl → 2.7.0.7002rc0__py3-none-any.whl

bbot/__init__.py

@@ -1,5 +1,5 @@
 # version placeholder (replaced by poetry-dynamic-versioning)
-__version__ = "v2.7.0.6989rc"
+__version__ = "v2.7.0.7002rc"
 
 from .scanner import Scanner, Preset
 

bbot/modules/retirejs.py

@@ -67,16 +67,16 @@ class retirejs(BaseModule):
             "name": "Rename Node.js directory (x64)",
             "command": "mv #{BBOT_TOOLS}/node-v#{BBOT_MODULES_RETIREJS_NODE_VERSION}-linux-x64 #{BBOT_TOOLS}/node",
         },
+        # Set permissions on entire Node.js bin directory
+        {
+            "name": "Set permissions on Node.js bin directory",
+            "file": {"path": "#{BBOT_TOOLS}/node/bin", "mode": "0755", "recurse": "yes"},
+        },
         # Make Node.js binary executable
         {
             "name": "Make Node.js binary executable",
             "file": {"path": "#{BBOT_TOOLS}/node/bin/node", "mode": "0755"},
         },
-        # Make npm executable
-        {
-            "name": "Make npm executable",
-            "file": {"path": "#{BBOT_TOOLS}/node/bin/npm", "mode": "0755"},
-        },
         # Remove existing retirejs directory if it exists
         {
             "name": "Remove existing retirejs directory",
@@ -90,16 +90,11 @@ class retirejs(BaseModule):
         # Install retire.js locally using local Node.js
         {
             "name": "Install retire.js locally",
-            "shell": "cd #{BBOT_TOOLS}/retirejs && #{BBOT_TOOLS}/node/bin/node #{BBOT_TOOLS}/node/lib/node_modules/npm/bin/npm-cli.js install retire@#{BBOT_MODULES_RETIREJS_VERSION} --no-fund --no-audit --silent --no-optional",
+            "shell": "cd #{BBOT_TOOLS}/retirejs && #{BBOT_TOOLS}/node/bin/node #{BBOT_TOOLS}/node/lib/node_modules/npm/bin/npm-cli.js install --prefix . retire@#{BBOT_MODULES_RETIREJS_VERSION} --no-fund --no-audit --silent --no-optional",
             "args": {"creates": "#{BBOT_TOOLS}/retirejs/node_modules/.bin/retire"},
             "timeout": 600,
             "ignore_errors": False,
         },
-        # Fix retire script shebang to use our local node binary
-        {
-            "name": "Fix retire script shebang",
-            "shell": "sed -i '1s|#!/usr/bin/env node|#!#{BBOT_TOOLS}/node/bin/node|' #{BBOT_TOOLS}/retirejs/node_modules/.bin/retire",
-        },
         # Make retire script executable
         {
             "name": "Make retire script executable",
@@ -209,14 +204,13 @@ class retirejs(BaseModule):
     async def execute_retirejs(self, js_file):
         cache_dir = self.helpers.cache_dir / "retire_cache"
         retire_dir = self.scan.helpers.tools_dir / "retirejs"
-
-        # Use the retire CLI script directly with our local node binary
         local_node_dir = self.scan.helpers.tools_dir / "node"
-        retire_cli_script = retire_dir / "node_modules" / "retire" / "lib" / "cli.js"
 
+        # Use the retire binary directly with our local Node.js
+        retire_binary_path = retire_dir / "node_modules" / ".bin" / "retire"
         command = [
             str(local_node_dir / "bin" / "node"),
-            str(retire_cli_script),
+            str(retire_binary_path),
             "--outputformat",
             "json",
             "--cachedir",

bbot/test/test_step_2/module_tests/test_module_excavate.py

@@ -167,6 +167,35 @@ class TestExcavate2(TestExcavate):
         assert not root_page_confusion_2, "Incorrectly detected root-relative URL"
 
 
+class TestExcavateInScopeJavascript(TestExcavate):
+    targets = ["http://127.0.0.1:8888/"]
+    modules_overrides = ["excavate", "httpx", "badsecrets"]
+
+    async def setup_before_prep(self, module_test):
+        module_test.httpserver.expect_request("/").respond_with_data(
+            "<script>window.location.href = 'http://127.0.0.1:8888/script.js';</script>"
+        )
+        module_test.httpserver.expect_request("/script.js").respond_with_data(
+            "var = 'eyJhbGciOiJIUzI1NiJ9.eyJJc3N1ZXIiOiJJc3N1ZXIiLCJVc2VybmFtZSI6IkJhZFNlY3JldHMiLCJleHAiOjE1OTMxMzM0ODMsImlhdCI6MTQ2NjkwMzA4M30.ovqRikAo_0kKJ0GVrAwQlezymxrLGjcEiW_s3UJMMCo';"
+        )
+
+    def check(self, module_test, events):
+        found_js_url_event = False
+        found_badsecrets_vulnerability = False
+        found_excavate_jwt_finding = False
+        for e in events:
+            if e.type == "URL" and e.data == "http://127.0.0.1:8888/script.js":
+                found_js_url_event = True
+            if e.type == "FINDING" and "JWT" in e.data["description"] and str(e.module) == "excavate":
+                found_excavate_jwt_finding = True
+            if e.type == "VULNERABILITY":
+                found_badsecrets_vulnerability = True
+
+        assert found_js_url_event, "Failed to find URL event for script.js"
+        assert found_badsecrets_vulnerability, "Failed to find BADSECRETs event from script.js"
+        assert found_excavate_jwt_finding, "Failed to find JWT finding from script.js"
+
+
 class TestExcavateRedirect(TestExcavate):
     targets = ["http://127.0.0.1:8888/", "http://127.0.0.1:8888/relative/", "http://127.0.0.1:8888/nonhttpredirect/"]
     config_overrides = {"scope": {"report_distance": 1}}

{bbot-2.7.0.6989rc0.dist-info → bbot-2.7.0.7002rc0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: bbot
-Version: 2.7.0.6989rc0
+Version: 2.7.0.7002rc0
 Summary: OSINT automation for hackers.
 License: GPL-3.0
 Keywords: python,cli,automation,osint,threat-intel,intelligence,neo4j,scanner,python-library,hacking,recursion,pentesting,recon,command-line-tool,bugbounty,subdomains,security-tools,subdomain-scanner,osint-framework,attack-surface,subdomain-enumeration,osint-tool

{bbot-2.7.0.6989rc0.dist-info → bbot-2.7.0.7002rc0.dist-info}/RECORD

@@ -1,4 +1,4 @@
-bbot/__init__.py,sha256=KqGrJ3EqVq7g_ze809iQbwFcd5RlmZeXtHWN9bjQaVY,163
+bbot/__init__.py,sha256=nZBigwfdyXf7yqicWEvudUnyyst9EsHHiKAZo_DNg1A,163
 bbot/cli.py,sha256=1QJbANVw9Q3GFM92H2QRV2ds5756ulm08CDZwzwPpeI,11888
 bbot/core/__init__.py,sha256=l255GJE_DvUnWvrRb0J5lG-iMztJ8zVvoweDOfegGtI,46
 bbot/core/config/__init__.py,sha256=zYNw2Me6tsEr8hOOkLb4BQ97GB7Kis2k--G81S8vofU,342
@@ -187,7 +187,7 @@ bbot/modules/reflected_parameters.py,sha256=RjS-4C-XC9U-jC9J7AYNqwn6I-O2y3LvTRhB
 bbot/modules/report/affiliates.py,sha256=vvus8LylqOfP-lfGid0z4FS6MwOpNuRTcSJ9aSnybp4,1713
 bbot/modules/report/asn.py,sha256=D0jQkcZe_gEbmSokgSisYw6QolVJI9l71ksSMlOVTfo,9687
 bbot/modules/report/base.py,sha256=hOtZF41snTSlHZmzZndmOjfmtdKPy2-tfFBAxxbHcao,105
-bbot/modules/retirejs.py,sha256=m56ESnaMg_xcsNgSCyPmMYFX3iXowh1B7IUxnr7nvpA,10423
+bbot/modules/retirejs.py,sha256=9RjTHtBfWY0GmD_DPILjYyylGqGUN-DERaGgLfaObSs,10210
 bbot/modules/robots.py,sha256=LGG6ixsxrlaCk-mi4Lp6kB2RB1v-25NhTAQxdQEtH8s,2172
 bbot/modules/securitytrails.py,sha256=5Jk_HTQP8FRq6A30sN19FU79uLJt7aiOsI2dxNkLDcM,1148
 bbot/modules/securitytxt.py,sha256=nwaTOnRAl2NWcEc3i_I9agB56QjqK8dHqiKRHPPkCPE,4558
@@ -348,7 +348,7 @@ bbot/test/test_step_2/module_tests/test_module_dockerhub.py,sha256=9T8CFcFP32MOp
 bbot/test/test_step_2/module_tests/test_module_dotnetnuke.py,sha256=Q7M3hrbEwOuORZXPS-pIGFTRzB2-g4cEvGtsEcTp7t8,8049
 bbot/test/test_step_2/module_tests/test_module_emailformat.py,sha256=cKxBPnEQ4AiRKV_-hSYEE6756ypst3hi6MN0L5RTukY,461
 bbot/test/test_step_2/module_tests/test_module_emails.py,sha256=bZjtO8N3GG2_g6SUEYprAFLcsi7SlwNPJJ0nODfrWYU,944
-bbot/test/test_step_2/module_tests/test_module_excavate.py,sha256=ywg-J2yl6LynHKIxEWmxBvV1RNFOZC2uCu1pGSbaoFo,61586
+bbot/test/test_step_2/module_tests/test_module_excavate.py,sha256=AUh9fegqoxZjZHISWryuJgK3HJqKEUhFsRtMTROFfa4,63067
 bbot/test/test_step_2/module_tests/test_module_extractous.py,sha256=6wuZ978y5YIPYdR7av6otrY_5jUlzzuJDZ-DsBNOoLA,18197
 bbot/test/test_step_2/module_tests/test_module_ffuf.py,sha256=z8ihAM1WYss7QGXIjbi67cekg8iOemDjaM8YR9_qSEs,4100
 bbot/test/test_step_2/module_tests/test_module_ffuf_shortnames.py,sha256=0-a9J-gq8bUtmxl_-QPVidwZ9KkCvgvoG30Ot3a8lqM,8406
@@ -455,8 +455,8 @@ bbot/wordlists/raft-small-extensions-lowercase_CLEANED.txt,sha256=ZSIVebs7ptMvHx
 bbot/wordlists/top_open_ports_nmap.txt,sha256=LmdFYkfapSxn1pVuQC2LkOIY2hMLgG-Xts7DVtYzweM,42727
 bbot/wordlists/valid_url_schemes.txt,sha256=0B_VAr9Dv7aYhwi6JSBDU-3M76vNtzN0qEC_RNLo7HE,3310
 bbot/wordlists/wordninja_dns.txt.gz,sha256=DYHvvfW0TvzrVwyprqODAk4tGOxv5ezNmCPSdPuDUnQ,570241
-bbot-2.7.0.6989rc0.dist-info/LICENSE,sha256=GzeCzK17hhQQDNow0_r0L8OfLpeTKQjFQwBQU7ZUymg,32473
-bbot-2.7.0.6989rc0.dist-info/METADATA,sha256=NO1Ezqw8WggKJwkDLTHpsQ3W5ZLHjZSFywDAl6XT9Vg,18308
-bbot-2.7.0.6989rc0.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
-bbot-2.7.0.6989rc0.dist-info/entry_points.txt,sha256=cWjvcU_lLrzzJgjcjF7yeGuRA_eDS8pQ-kmPUAyOBfo,38
-bbot-2.7.0.6989rc0.dist-info/RECORD,,
+bbot-2.7.0.7002rc0.dist-info/LICENSE,sha256=GzeCzK17hhQQDNow0_r0L8OfLpeTKQjFQwBQU7ZUymg,32473
+bbot-2.7.0.7002rc0.dist-info/METADATA,sha256=GoJDZxCaWD9bvePyFrOTUQOOvYepdPoViowhPj_LM0o,18308
+bbot-2.7.0.7002rc0.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
+bbot-2.7.0.7002rc0.dist-info/entry_points.txt,sha256=cWjvcU_lLrzzJgjcjF7yeGuRA_eDS8pQ-kmPUAyOBfo,38
+bbot-2.7.0.7002rc0.dist-info/RECORD,,