stackscan 2.3.0__tar.gz → 2.5.0__tar.gz

{stackscan-2.3.0 → stackscan-2.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: stackscan
-Version: 2.3.0
+Version: 2.5.0
 Summary: Full web stack, infrastructure, DNS, port, subdomain and CVE analyzer.
 Project-URL: Source, https://github.com/reekeer/stackscan
 Project-URL: Issues, https://github.com/reekeer/stackscan/issues

{stackscan-2.3.0 → stackscan-2.5.0}/src/stackscan/__init__.py

@@ -2,4 +2,4 @@ from .core import StackscanSession
 from .utils import normalize_url
 
 __all__ = ["StackscanSession", "__version__", "normalize_url"]
-__version__ = "2.3.0"
+__version__ = "2.5.0"

{stackscan-2.3.0 → stackscan-2.5.0}/src/stackscan/analyzers/__init__.py

@@ -7,7 +7,7 @@ from stackscan.analyzers.cve import (
     software_from_ports,
 )
 from stackscan.analyzers.exposure import ExposureProbe, analyze_exposure
-from stackscan.analyzers.infra import analyze_infra
+from stackscan.analyzers.infra import analyze_infra, summarize_edge
 from stackscan.analyzers.osdetect import detect_os
 from stackscan.analyzers.security import analyze_security_headers
 from stackscan.analyzers.services import classify_services, port_category
@@ -19,6 +19,7 @@ __all__ = [
     "TechAnalyzer",
     "analyze_exposure",
     "analyze_infra",
+    "summarize_edge",
     "analyze_security_headers",
     "brute_devices",
     "detect_devices",

{stackscan-2.3.0 → stackscan-2.5.0}/src/stackscan/analyzers/cve.py

@@ -281,12 +281,9 @@ _SEVERITY_RANK = {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3}
 
 def _confidence(version: str, rng: dict[str, str], source: str, backported: bool = False) -> int:
     if backported:
-        # Distro backports are a common source of phantom CVEs because the
-        # banner version does not reveal the patchlevel. Keep them below the
-        # default confidence threshold so they only appear when explicitly asked.
         if "start_incl" in rng or "start_excl" in rng:
-            return 45
-        return 25
+            return 35
+        return 20
     comps = len([c for c in re.split("[.\\-_]", version) if c[:1].isdigit()])
     bounded = ("start_incl" in rng or "start_excl" in rng) and (
         "end_incl" in rng or "end_excl" in rng

{stackscan-2.3.0 → stackscan-2.5.0}/src/stackscan/analyzers/generic.py

@@ -4,69 +4,73 @@ import re
 
 from stackscan.types import Software, Technology
 
-SERVER_NAMES: frozenset[str] = frozenset({
-    "nginx",
-    "apache",
-    "httpd",
-    "lighttpd",
-    "litespeed",
-    "caddy",
-    "openresty",
-    "iis",
-    "microsoft-iis",
-    "cherokee",
-    "h2o",
-    "boa",
-    "thttpd",
-    "mini_httpd",
-    "rejetto",
-    "cowboy",
-    "tornado",
-    "gunicorn",
-    "uwsgi",
-    "jetty",
-    "tomcat",
-    "apache tomcat",
-    "websphere",
-    "glassfish",
-    "play",
-    "spray",
-    "kestrel",
-    "cassini",
-    "kangle",
-    "resin",
-    "weblogic",
-    "zope",
-    "aolserver",
-    "yaws",
-})
+SERVER_NAMES: frozenset[str] = frozenset(
+    {
+        "nginx",
+        "apache",
+        "httpd",
+        "lighttpd",
+        "litespeed",
+        "caddy",
+        "openresty",
+        "iis",
+        "microsoft-iis",
+        "cherokee",
+        "h2o",
+        "boa",
+        "thttpd",
+        "mini_httpd",
+        "rejetto",
+        "cowboy",
+        "tornado",
+        "gunicorn",
+        "uwsgi",
+        "jetty",
+        "tomcat",
+        "apache tomcat",
+        "websphere",
+        "glassfish",
+        "play",
+        "spray",
+        "kestrel",
+        "cassini",
+        "kangle",
+        "resin",
+        "weblogic",
+        "zope",
+        "aolserver",
+        "yaws",
+    }
+)
 
 # Product names we never want to emit as a generic technology/software hit.
-_NOISE_NAMES: frozenset[str] = frozenset({
-    "http",
-    "https",
-    "www",
-    "html",
-    "css",
-    "json",
-    "xml",
-    "js",
-    "png",
-    "jpg",
-    "jpeg",
-    "gif",
-    "svg",
-    "ico",
-    "woff",
-    "woff2",
-    "ttf",
-    "eot",
-    "php",
-    "asp",
-    "aspx",
-    "jsp",
-    "cgi",
-})
+_NOISE_NAMES: frozenset[str] = frozenset(
+    {
+        "http",
+        "https",
+        "www",
+        "html",
+        "css",
+        "json",
+        "xml",
+        "js",
+        "png",
+        "jpg",
+        "jpeg",
+        "gif",
+        "svg",
+        "ico",
+        "woff",
+        "woff2",
+        "ttf",
+        "eot",
+        "php",
+        "asp",
+        "aspx",
+        "jsp",
+        "cgi",
+    }
+)
 
 _CORE_COMMIT_RE = re.compile(
     r"([A-Za-z][A-Za-z0-9\s_-]{1,40})\s+Core\s+\(([a-f0-9]{4,})\b\)", re.IGNORECASE
@@ -94,14 +98,59 @@ _SERVER_VERSION_RE = re.compile(
 )
 
 _COMMIT_AFTER_NAME_RE = re.compile(
-    r"\b([A-Za-z][A-Za-z0-9\s_-]{1,40})\s+\(?([a-f0-9]{7,40})\b\)?", re.IGNORECASE
+    r"\b([A-Za-z][A-Za-z0-9._-]{1,40})\s+\(([a-f0-9]{7,40})\)", re.IGNORECASE
+)
+
+_STOPWORDS: frozenset[str] = frozenset(
+    {
+        "and",
+        "or",
+        "the",
+        "a",
+        "an",
+        "with",
+        "for",
+        "to",
+        "of",
+        "in",
+        "on",
+        "our",
+        "your",
+        "my",
+        "this",
+        "that",
+        "is",
+        "are",
+        "was",
+        "were",
+        "by",
+        "from",
+        "using",
+        "use",
+        "plus",
+        "via",
+    }
 )
 
 
+_VERSION_TOKEN_RE = re.compile(r"^v?\d[\w.]*$", re.IGNORECASE)
+
+
 def _normalize_name(name: str) -> str:
     return " ".join(name.split()).strip()
 
 
+def _clean_product_name(name: str) -> str:
+    kept: list[str] = []
+    for word in _normalize_name(name).split():
+        if word.lower() in _STOPWORDS:
+            break
+        kept.append(word)
+    while len(kept) > 1 and _VERSION_TOKEN_RE.match(kept[-1]):
+        kept.pop()
+    return " ".join(kept)
+
+
 def _software_name(name: str) -> str:
     return _normalize_name(name).lower().replace(" ", "")
 
@@ -131,17 +180,11 @@ def is_commit_hash(value: str) -> bool:
 
 
 def extract_generic_tech(body: str) -> list[Technology]:
-    """Return generic service/infrastructure technologies found in the body.
-
-    This is meant to catch products and commit hashes that do not have a
-    dedicated signature in the bundled database, e.g. a 404 page footer that
-    says ``nginx/1.24.0`` or ``CurseForge Core (a26fded)``.
-    """
     hits: list[tuple[str, str, str, str | None]] = []
     seen: set[tuple[str, str | None]] = set()
 
     def remember(name: str, evidence: str, version: str | None) -> None:
-        name = _normalize_name(name)
+        name = _clean_product_name(name)
         if len(name) < 2 or _is_noise(name) or not _is_plausible_name(name):
             return
         key = (name.lower(), version)
@@ -155,13 +198,17 @@ def extract_generic_tech(body: str) -> list[Technology]:
         version = match.group(2)
         remember(name, f"body:{name}/{version}", version)
 
+    powered_starts: set[int] = set()
     for match in _POWERED_BY_VERSION_RE.finditer(body):
         name = _normalize_name(match.group(1))
         version = match.group(2)
+        powered_starts.add(match.start())
         if name and not _is_noise(name):
             remember(name, f"body:powered-by {name} {version}", version)
 
     for match in _POWERED_BY_PLAIN_RE.finditer(body):
+        if match.start() in powered_starts:
+            continue
         name = _normalize_name(match.group(1))
         if name and not _is_noise(name):
             remember(name, f"body:powered-by {name}", None)
@@ -181,14 +228,12 @@ def extract_generic_tech(body: str) -> list[Technology]:
                 return True
         return False
 
-    # Product name directly followed by a short hex commit (no "Core" keyword).
     for match in _COMMIT_AFTER_NAME_RE.finditer(body):
         if _overlaps_core(match.span()):
             continue
         name = _normalize_name(match.group(1))
         commit = match.group(2).lower()
         if name and not _is_noise(name) and is_commit_hash(commit):
-            # Prefer the Core match if we already have one for the same product.
             if (name.lower(), commit) not in seen:
                 remember(name, f"body:{name} ({commit})", commit)
 
@@ -205,12 +250,11 @@ def extract_generic_tech(body: str) -> list[Technology]:
 
 
 def extract_generic_software(body: str, location: str = "") -> list[Software]:
-    """Return Software records for generic product/version/commit patterns."""
     out: list[Software] = []
     seen: set[tuple[str, str | None]] = set()
 
     def add(name: str, version: str | None, evidence: str) -> None:
-        name = _normalize_name(name)
+        name = _clean_product_name(name)
         if len(name) < 2 or not _is_plausible_name(name):
             return
         sname = _software_name(name)
@@ -234,13 +278,17 @@ def extract_generic_software(body: str, location: str = "") -> list[Software]:
         version = match.group(2)
         add(name, version, f"body:{name}/{version}")
 
+    powered_starts: set[int] = set()
     for match in _POWERED_BY_VERSION_RE.finditer(body):
         name = _normalize_name(match.group(1))
         version = match.group(2)
+        powered_starts.add(match.start())
         if name:
             add(name, version, f"body:powered-by {name} {version}")
 
     for match in _POWERED_BY_PLAIN_RE.finditer(body):
+        if match.start() in powered_starts:
+            continue
         name = _normalize_name(match.group(1))
         if name:
             add(name, None, f"body:powered-by {name}")

{stackscan-2.3.0 → stackscan-2.5.0}/src/stackscan/analyzers/infra.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+from collections.abc import Iterable
+
 from stackscan.types import Headers, InfraInfo
 
 _Signature = tuple[str, str, str | None]
@@ -92,6 +94,61 @@ def _proxy_notes(headers: Headers, host: str) -> list[str]:
     return notes
 
 
+_ROLE_LABEL: dict[str, str] = {"cdn": "CDN", "waf": "WAF", "proxy": "reverse proxy"}
+_ROLE_ORDER: tuple[str, ...] = ("cdn", "waf", "proxy")
+_ORG_SUFFIXES: tuple[str, ...] = (
+    ", inc.",
+    ", inc",
+    " inc.",
+    " inc",
+    " llc",
+    " ltd",
+    " ltd.",
+    " gmbh",
+    " corporation",
+    " technologies",
+)
+
+
+def _canonical_provider(org: str) -> str:
+    name = org.strip()
+    low = name.lower()
+    for suffix in _ORG_SUFFIXES:
+        if low.endswith(suffix):
+            name = name[: -len(suffix)].strip()
+            low = name.lower()
+    return name
+
+
+def summarize_edge(infra: InfraInfo, cdn_orgs: Iterable[str] = (), *, sep: str = " → ") -> str:
+    roles: dict[str, list[str]] = {}
+    order: list[str] = []
+    role_names = {"cdn": infra.cdn, "waf": infra.waf, "proxy": infra.proxy}
+    for role in _ROLE_ORDER:
+        for name in role_names[role]:
+            if name not in roles:
+                roles[name] = []
+                order.append(name)
+            if role not in roles[name]:
+                roles[name].append(role)
+    for org in cdn_orgs:
+        name = _canonical_provider(org)
+        if not name:
+            continue
+        if any(name.lower() in known.lower() or known.lower() in name.lower() for known in roles):
+            continue
+        roles[name] = ["cdn"]
+        order.append(name)
+    if not order:
+        return ""
+    order.sort(key=lambda n: 0 if ({"waf", "proxy"} & set(roles[n])) else 1)
+    parts: list[str] = []
+    for name in order:
+        labels = ", ".join(_ROLE_LABEL[r] for r in _ROLE_ORDER if r in roles[name])
+        parts.append(f"{name} ({labels})" if labels else name)
+    return sep.join(parts)
+
+
 def analyze_infra(headers: Headers, cookies: tuple[str, ...], host: str) -> InfraInfo:
     cdn = _collect(headers, CDN_SIGNATURES)
     waf = _collect(headers, WAF_SIGNATURES)

{stackscan-2.3.0 → stackscan-2.5.0}/src/stackscan/analyzers/osdetect.py

@@ -106,7 +106,9 @@ def detect_os(report: ScanReport) -> list[OsFinding]:
         for os, src in pairs:
             by_source.setdefault(src, []).append(os)
         dominant_source = max(by_source, key=lambda s: len(by_source[s]))
-        if dominant_source == "port-banner" or dominant_source.startswith(("header:", "meta:", "script")):
+        if dominant_source == "port-banner" or dominant_source.startswith(
+            ("header:", "meta:", "script")
+        ):
             category = "banner"
         elif dominant_source.startswith("port "):
             category = "network"

{stackscan-2.3.0 → stackscan-2.5.0}/src/stackscan/analyzers/tech.py

@@ -40,17 +40,51 @@ def _script_srcs(html: str) -> list[str]:
 _CLASS_ATTR_RE = re.compile(r'\bclass\s*=\s*"([^"]*)"|\bclass\s*=\s*\'([^\']*)\'', re.I)
 
 
-_CSS_UTILITY_EXACT: frozenset[str] = frozenset({
-    "container", "flex", "grid", "block", "inline", "inline-block", "hidden",
-    "table", "table-cell", "table-row", "flow-root", "contents",
-    "float-left", "float-right", "float-none", "clear-left", "clear-right",
-    "clear-both", "clear-none", "isolate", "isolation-auto",
-    "object-contain", "object-cover", "object-fill", "object-none", "object-scale-down",
-    "overflow-auto", "overflow-hidden", "overflow-visible", "overflow-scroll",
-    "overscroll-auto", "overscroll-contain", "overscroll-none",
-    "visible", "invisible", "collapse",
-    "static", "fixed", "absolute", "relative", "sticky",
-})
+_CSS_UTILITY_EXACT: frozenset[str] = frozenset(
+    {
+        "container",
+        "flex",
+        "grid",
+        "block",
+        "inline",
+        "inline-block",
+        "hidden",
+        "table",
+        "table-cell",
+        "table-row",
+        "flow-root",
+        "contents",
+        "float-left",
+        "float-right",
+        "float-none",
+        "clear-left",
+        "clear-right",
+        "clear-both",
+        "clear-none",
+        "isolate",
+        "isolation-auto",
+        "object-contain",
+        "object-cover",
+        "object-fill",
+        "object-none",
+        "object-scale-down",
+        "overflow-auto",
+        "overflow-hidden",
+        "overflow-visible",
+        "overflow-scroll",
+        "overscroll-auto",
+        "overscroll-contain",
+        "overscroll-none",
+        "visible",
+        "invisible",
+        "collapse",
+        "static",
+        "fixed",
+        "absolute",
+        "relative",
+        "sticky",
+    }
+)
 # Tailwind-style utilities: px-4, w-full, bg-red-500, my-auto, backdrop-blur, etc.
 _CSS_UTILITY_RE = re.compile(
     r"^[a-z]+(-[a-z]+)?-(\d+|auto|full|screen|px|sm|md|lg|xl|2xl|3xl|4xl|5xl|6xl|7xl|8xl|9xl|none|hidden|visible|inherit|current|transparent|black|white|blur|opacity|saturate|sepia|grayscale|contrast|brightness|invert|drop-shadow|hue-rotate|shadow|sm|md|lg|xl)$",
@@ -118,7 +152,9 @@ def _confidence(evidence: list[str]) -> int:
 
 
 _VERSION_RE = re.compile(r"(\d+\.\d+(?:\.\d+)?(?:[-+.]?[a-zA-Z0-9]+)?)")
-_CORE_COMMIT_RE = re.compile(r"([A-Za-z][A-Za-z0-9\s-]*?)\s+Core\s+\(([a-f0-9]{4,})\)", re.IGNORECASE)
+_CORE_COMMIT_RE = re.compile(
+    r"([A-Za-z][A-Za-z0-9\s-]*?)\s+Core\s+\(([a-f0-9]{4,})\)", re.IGNORECASE
+)
 
 
 def _version_key(version: str) -> tuple[int, int, int, int]:
@@ -274,9 +310,7 @@ class TechAnalyzer:
             self._add(acc, matcher.match(result.body), "body")
             self._add(acc, matcher.match(result.url), "url")
             for token in _framework_tokens(result.body):
-                self._add(
-                    acc, matcher.match_search({"framework": token}), f"framework:{token}"
-                )
+                self._add(acc, matcher.match_search({"framework": token}), f"framework:{token}")
         self._curated(acc, result)
         by_name: dict[str, _Hit] = {}
         for hit in acc.values():
@@ -336,4 +370,9 @@ class TechAnalyzer:
                 add(name, "service", f"body:{name} Core ({commit})", version=commit)
 
         for tech in extract_generic_tech(result.body):
-            add(tech.name, tech.categories[0] if tech.categories else "service", tech.evidence[0], tech.version)
+            add(
+                tech.name,
+                tech.categories[0] if tech.categories else "service",
+                tech.evidence[0],
+                tech.version,
+            )