bbot 2.7.0.6989rc0__tar.gz → 2.7.0.7002rc0__tar.gz

{bbot-2.7.0.6989rc0 → bbot-2.7.0.7002rc0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: bbot
-Version: 2.7.0.6989rc0
+Version: 2.7.0.7002rc0
 Summary: OSINT automation for hackers.
 License: GPL-3.0
 Keywords: python,cli,automation,osint,threat-intel,intelligence,neo4j,scanner,python-library,hacking,recursion,pentesting,recon,command-line-tool,bugbounty,subdomains,security-tools,subdomain-scanner,osint-framework,attack-surface,subdomain-enumeration,osint-tool

{bbot-2.7.0.6989rc0 → bbot-2.7.0.7002rc0}/bbot/__init__.py

@@ -1,5 +1,5 @@
 # version placeholder (replaced by poetry-dynamic-versioning)
-__version__ = "v2.7.0.6989rc"
+__version__ = "v2.7.0.7002rc"
 
 from .scanner import Scanner, Preset
 

{bbot-2.7.0.6989rc0 → bbot-2.7.0.7002rc0}/bbot/modules/retirejs.py

@@ -67,16 +67,16 @@ class retirejs(BaseModule):
             "name": "Rename Node.js directory (x64)",
             "command": "mv #{BBOT_TOOLS}/node-v#{BBOT_MODULES_RETIREJS_NODE_VERSION}-linux-x64 #{BBOT_TOOLS}/node",
         },
+        # Set permissions on entire Node.js bin directory
+        {
+            "name": "Set permissions on Node.js bin directory",
+            "file": {"path": "#{BBOT_TOOLS}/node/bin", "mode": "0755", "recurse": "yes"},
+        },
         # Make Node.js binary executable
         {
             "name": "Make Node.js binary executable",
             "file": {"path": "#{BBOT_TOOLS}/node/bin/node", "mode": "0755"},
         },
-        # Make npm executable
-        {
-            "name": "Make npm executable",
-            "file": {"path": "#{BBOT_TOOLS}/node/bin/npm", "mode": "0755"},
-        },
         # Remove existing retirejs directory if it exists
         {
             "name": "Remove existing retirejs directory",
@@ -90,16 +90,11 @@ class retirejs(BaseModule):
         # Install retire.js locally using local Node.js
         {
             "name": "Install retire.js locally",
-            "shell": "cd #{BBOT_TOOLS}/retirejs && #{BBOT_TOOLS}/node/bin/node #{BBOT_TOOLS}/node/lib/node_modules/npm/bin/npm-cli.js install retire@#{BBOT_MODULES_RETIREJS_VERSION} --no-fund --no-audit --silent --no-optional",
+            "shell": "cd #{BBOT_TOOLS}/retirejs && #{BBOT_TOOLS}/node/bin/node #{BBOT_TOOLS}/node/lib/node_modules/npm/bin/npm-cli.js install --prefix . retire@#{BBOT_MODULES_RETIREJS_VERSION} --no-fund --no-audit --silent --no-optional",
             "args": {"creates": "#{BBOT_TOOLS}/retirejs/node_modules/.bin/retire"},
             "timeout": 600,
             "ignore_errors": False,
         },
-        # Fix retire script shebang to use our local node binary
-        {
-            "name": "Fix retire script shebang",
-            "shell": "sed -i '1s|#!/usr/bin/env node|#!#{BBOT_TOOLS}/node/bin/node|' #{BBOT_TOOLS}/retirejs/node_modules/.bin/retire",
-        },
         # Make retire script executable
         {
             "name": "Make retire script executable",
@@ -209,14 +204,13 @@ class retirejs(BaseModule):
     async def execute_retirejs(self, js_file):
         cache_dir = self.helpers.cache_dir / "retire_cache"
         retire_dir = self.scan.helpers.tools_dir / "retirejs"
-
-        # Use the retire CLI script directly with our local node binary
         local_node_dir = self.scan.helpers.tools_dir / "node"
-        retire_cli_script = retire_dir / "node_modules" / "retire" / "lib" / "cli.js"
 
+        # Use the retire binary directly with our local Node.js
+        retire_binary_path = retire_dir / "node_modules" / ".bin" / "retire"
         command = [
             str(local_node_dir / "bin" / "node"),
-            str(retire_cli_script),
+            str(retire_binary_path),
             "--outputformat",
             "json",
             "--cachedir",

{bbot-2.7.0.6989rc0 → bbot-2.7.0.7002rc0}/bbot/test/test_step_2/module_tests/test_module_excavate.py

@@ -167,6 +167,35 @@ class TestExcavate2(TestExcavate):
         assert not root_page_confusion_2, "Incorrectly detected root-relative URL"
 
 
+class TestExcavateInScopeJavascript(TestExcavate):
+    targets = ["http://127.0.0.1:8888/"]
+    modules_overrides = ["excavate", "httpx", "badsecrets"]
+
+    async def setup_before_prep(self, module_test):
+        module_test.httpserver.expect_request("/").respond_with_data(
+            "<script>window.location.href = 'http://127.0.0.1:8888/script.js';</script>"
+        )
+        module_test.httpserver.expect_request("/script.js").respond_with_data(
+            "var = 'eyJhbGciOiJIUzI1NiJ9.eyJJc3N1ZXIiOiJJc3N1ZXIiLCJVc2VybmFtZSI6IkJhZFNlY3JldHMiLCJleHAiOjE1OTMxMzM0ODMsImlhdCI6MTQ2NjkwMzA4M30.ovqRikAo_0kKJ0GVrAwQlezymxrLGjcEiW_s3UJMMCo';"
+        )
+
+    def check(self, module_test, events):
+        found_js_url_event = False
+        found_badsecrets_vulnerability = False
+        found_excavate_jwt_finding = False
+        for e in events:
+            if e.type == "URL" and e.data == "http://127.0.0.1:8888/script.js":
+                found_js_url_event = True
+            if e.type == "FINDING" and "JWT" in e.data["description"] and str(e.module) == "excavate":
+                found_excavate_jwt_finding = True
+            if e.type == "VULNERABILITY":
+                found_badsecrets_vulnerability = True
+
+        assert found_js_url_event, "Failed to find URL event for script.js"
+        assert found_badsecrets_vulnerability, "Failed to find BADSECRETs event from script.js"
+        assert found_excavate_jwt_finding, "Failed to find JWT finding from script.js"
+
+
 class TestExcavateRedirect(TestExcavate):
     targets = ["http://127.0.0.1:8888/", "http://127.0.0.1:8888/relative/", "http://127.0.0.1:8888/nonhttpredirect/"]
     config_overrides = {"scope": {"report_distance": 1}}

{bbot-2.7.0.6989rc0 → bbot-2.7.0.7002rc0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "bbot"
-version = "v2.7.0.6989rc"
+version = "v2.7.0.7002rc"
 description = "OSINT automation for hackers."
 authors = [
     "TheTechromancer",