bbot 2.7.0.6989rc0__tar.gz → 2.7.0.6995rc0__tar.gz

{bbot-2.7.0.6989rc0 → bbot-2.7.0.6995rc0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: bbot
-Version: 2.7.0.6989rc0
+Version: 2.7.0.6995rc0
 Summary: OSINT automation for hackers.
 License: GPL-3.0
 Keywords: python,cli,automation,osint,threat-intel,intelligence,neo4j,scanner,python-library,hacking,recursion,pentesting,recon,command-line-tool,bugbounty,subdomains,security-tools,subdomain-scanner,osint-framework,attack-surface,subdomain-enumeration,osint-tool

{bbot-2.7.0.6989rc0 → bbot-2.7.0.6995rc0}/bbot/__init__.py

@@ -1,5 +1,5 @@
 # version placeholder (replaced by poetry-dynamic-versioning)
-__version__ = "v2.7.0.6989rc"
+__version__ = "v2.7.0.6995rc"
 
 from .scanner import Scanner, Preset
 

{bbot-2.7.0.6989rc0 → bbot-2.7.0.6995rc0}/bbot/test/test_step_2/module_tests/test_module_excavate.py

@@ -167,6 +167,35 @@ class TestExcavate2(TestExcavate):
         assert not root_page_confusion_2, "Incorrectly detected root-relative URL"
 
 
+class TestExcavateInScopeJavascript(TestExcavate):
+    targets = ["http://127.0.0.1:8888/"]
+    modules_overrides = ["excavate", "httpx", "badsecrets"]
+
+    async def setup_before_prep(self, module_test):
+        module_test.httpserver.expect_request("/").respond_with_data(
+            "<script>window.location.href = 'http://127.0.0.1:8888/script.js';</script>"
+        )
+        module_test.httpserver.expect_request("/script.js").respond_with_data(
+            "var = 'eyJhbGciOiJIUzI1NiJ9.eyJJc3N1ZXIiOiJJc3N1ZXIiLCJVc2VybmFtZSI6IkJhZFNlY3JldHMiLCJleHAiOjE1OTMxMzM0ODMsImlhdCI6MTQ2NjkwMzA4M30.ovqRikAo_0kKJ0GVrAwQlezymxrLGjcEiW_s3UJMMCo';"
+        )
+
+    def check(self, module_test, events):
+        found_js_url_event = False
+        found_badsecrets_vulnerability = False
+        found_excavate_jwt_finding = False
+        for e in events:
+            if e.type == "URL" and e.data == "http://127.0.0.1:8888/script.js":
+                found_js_url_event = True
+            if e.type == "FINDING" and "JWT" in e.data["description"] and str(e.module) == "excavate":
+                found_excavate_jwt_finding = True
+            if e.type == "VULNERABILITY":
+                found_badsecrets_vulnerability = True
+
+        assert found_js_url_event, "Failed to find URL event for script.js"
+        assert found_badsecrets_vulnerability, "Failed to find BADSECRETs event from script.js"
+        assert found_excavate_jwt_finding, "Failed to find JWT finding from script.js"
+
+
 class TestExcavateRedirect(TestExcavate):
     targets = ["http://127.0.0.1:8888/", "http://127.0.0.1:8888/relative/", "http://127.0.0.1:8888/nonhttpredirect/"]
     config_overrides = {"scope": {"report_distance": 1}}

{bbot-2.7.0.6989rc0 → bbot-2.7.0.6995rc0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "bbot"
-version = "v2.7.0.6989rc"
+version = "v2.7.0.6995rc"
 description = "OSINT automation for hackers."
 authors = [
     "TheTechromancer",