xssmap 2.8.0__tar.gz → 2.9.0__tar.gz

xssmap-2.9.0/CHANGELOG.md

@@ -0,0 +1,91 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+Releases before 2.8.0 predate this file; their history is in the git log.
+
+## [Unreleased]
+
+## [2.9.0] - 2026-11-13
+
+### Added
+
+- Server-stack fingerprinting. `Server`, `X-Powered-By`, `X-AspNet-Version`,
+  `X-Generator`, `<meta name="generator">` and session cookie names are read
+  from the seed response the crawl already fetched, so the pass sends no extra
+  request. Rows are printed in the console and rendered in the Markdown and
+  HTML reports under "Server stack".
+- Outdated-version detection for components that advertise a version, using a
+  deliberately short policy table: Apache 2.4.49/2.4.50 (CVE-2021-41773,
+  CVE-2021-42013), nginx before 1.20.1 (CVE-2021-23017), PHP branches before
+  8.2 (out of security support) and IIS 6.0-8.5 (shipped only with an
+  end-of-life Windows Server). A flagged version is a lead for the operator,
+  never a finding on its own.
+- 35 tests pinning the new crawl scheduling, the transport cap, the throttle
+  rules and the stack policy table.
+
+### Changed
+
+- Crawl scheduling is continuous instead of level-by-level. `--depth` counts
+  hops from the seed and `--max-pages` is a hard stop, so one slow branch no
+  longer holds back pages that are already queued behind it.
+- `robots.txt` and `sitemap.xml` are fetched concurrently, turning two round
+  trips into one.
+- `Throttle` no longer reads an HTTP 500 as backpressure. An application error
+  is not load, so only 429/503 count, and only after a short streak; a target
+  that answers a fraction of URLs with 500 used to stack seconds of sleep into
+  the crawl and dominate its duration.
+- Binary bodies are read up to a 256 KB cap and marked truncated instead of
+  being buffered whole. A truncated body drops its connection rather than
+  returning a half-drained socket to the pool.
+
+### Fixed
+
+- Crawling a target that 500s part of its URL space is ~24x faster at the same
+  page count: 18.90 s to 0.79 s for 68 requests in the bundled benchmark
+  (identical page sets, deterministic error injection).
+
+## [2.8.1] - 2026-11-13
+
+Packaging release. No scanner behaviour changed.
+
+### Added
+
+- `LICENSE` (MIT).
+- `CHANGELOG.md`.
+- `xssmap/py.typed` so downstream type checkers use the project's inline
+  annotations (PEP 561), shipped inside the wheel as package data.
+
+### Changed
+
+- `pyproject.toml` now declares the license with PEP 639 metadata
+  (`license = "MIT"`, `license-files`) instead of carrying a comment saying no
+  license was stated, so the wheel and sdist advertise the terms and PyPI
+  renders them.
+- Build backend floor raised to `setuptools>=77`, which is the first release
+  that understands `license-files` and an SPDX license expression.
+- Author metadata now names the maintainer instead of repeating the project
+  name.
+
+## [2.8.0] - 2026-11-13
+
+### Added
+
+- DOM state-store and hydration flows. A value written to
+  `localStorage`/`sessionStorage` on one page and rendered as HTML on another,
+  and a server-rendered state blob (`__INITIAL_STATE__`, `__NEXT_DATA__`,
+  `data-*`) that a bundle re-reads after hydration, are now replayed step by
+  step in the browser instead of being left as unprovable static guesses. The
+  new `xssmap/domstate.py` engine drives both, and the bundled lab serves
+  `/dom-state-read` and `/dom-hydrate` endpoints to exercise them.
+- Splash banner in the sqlmap idiom, drawn on every interactive run and
+  suppressed with `--no-color`.
+- 21 tests covering the DOM state-store and hydration engine.
+
+### Fixed
+
+- The remaining DOM-analysis gap: storage-mediated and hydration-mediated
+  source-to-sink flows that the static tracer could see but not confirm are now
+  confirmed in a real browser.

xssmap-2.9.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ian Mattas
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

xssmap-2.9.0/MANIFEST.in

@@ -0,0 +1,4 @@
+# Everything a reader of the sdist needs to audit what changed between releases.
+# LICENSE is already pulled in by PEP 639 `license-files`; README and pyproject
+# are added by setuptools itself.
+include CHANGELOG.md

{xssmap-2.8.0/xssmap.egg-info → xssmap-2.9.0}/PKG-INFO

@@ -1,8 +1,13 @@
 Metadata-Version: 2.4
 Name: xssmap
-Version: 2.8.0
+Version: 2.9.0
 Summary: Context-aware XSS scanner: crawler, browser verification, mXSS, charset and stored-XSS stages
-Author: xssmap
+Author: Ian Mattas
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/imattas/xssmap
+Project-URL: Repository, https://github.com/imattas/xssmap
+Project-URL: Changelog, https://github.com/imattas/xssmap/blob/main/CHANGELOG.md
+Project-URL: Issues, https://github.com/imattas/xssmap/issues
 Keywords: security,xss,scanner,pentest,sarif
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Information Technology
@@ -11,9 +16,11 @@ Classifier: Programming Language :: Python :: 3 :: Only
 Classifier: Topic :: Security
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
+License-File: LICENSE
 Provides-Extra: dev
 Requires-Dist: ruff>=0.6; extra == "dev"
 Requires-Dist: mypy>=1.10; extra == "dev"
+Dynamic: license-file
 
 # xssmap
 
@@ -51,6 +58,12 @@ actually execute in a real browser.
   friends from body or filename, compares versions against each advisory's affected range
   (so 2.3.2 is not blamed for a 3.4.1 fix) and can merge fresh advisories from osv.dev
   with `--osv`.
+- **Server stack and outdated versions.** Reads what each host says about itself - `Server`,
+  `X-Powered-By`, `X-AspNet-Version`, `X-Generator`, `<meta name="generator">` and session
+  cookie names - from the seed response the crawl already received, so the pass costs no
+  extra request. Versions whose exact build is known-vulnerable or out of support (Apache
+  2.4.49/2.4.50, nginx before 1.20.1, PHP before 8.2, IIS 6.0-8.5) are flagged with the
+  CVE, and every row names the header it came from.
 - **Leads, not silence.** A parameter that reflects but swallows every payload is recorded
   as an unconfirmed lead with the measured filter and how much of the probe survived
   (verbatim, recased, escaped, truncated), in its own report section - never presented as a
@@ -476,6 +489,28 @@ OSV enrichment is verified against the live service, not only against fixtures.
 and Lodash 4.17.4 (9) into the local verdicts, then stopped: the fourth library was never
 queried and stayed unchanged, so the cap is visibly enforced.
 
+### Server stack and outdated versions
+
+The headers a host sends are also an inventory: `Server: nginx/1.18.0` is a version, not
+just a name. The crawler keeps the headers and the `<meta name="generator">` value of the
+first HTML response it already fetched, and the stack pass reads them without a second
+request. Three things make the result usable rather than noisy:
+
+- A row always cites its evidence (`Server`, `X-Powered-By`, `X-AspNet-Version`,
+  `X-Generator`, `meta generator`, or `cookie <name>`), so a claim can be checked against
+  the response that produced it.
+- Versions are compared numerically, so nginx 1.20.10 is newer than 1.20.9 and is not
+  blamed for a fix that shipped in 1.20.1, and the IIS rules match `8.5` without also
+  matching `10.0`.
+- The policy table only holds issues that are public, fixed and cheap to verify: Apache
+  2.4.49/2.4.50 (CVE-2021-41773, CVE-2021-42013), nginx before 1.20.1 (CVE-2021-23017),
+  PHP branches before 8.2 (out of security support) and IIS 6.0-8.5 (shipped only with an
+  end-of-life Windows Server). A CMS such as WordPress is reported with its disclosed
+  version and no end-of-life claim, because that judgement is not the scanner's to make.
+
+A flagged version is a lead: it says the build has a published problem, not that this
+host is exploitable through it. The finding standard for XSS is unchanged.
+
 ### Browser cost
 
 `--browser` reuses one browser and one page per run. The report's `browser_verification`

xssmap-2.8.0/PKG-INFO → xssmap-2.9.0/README.md

@@ -1,20 +1,3 @@
-Metadata-Version: 2.4
-Name: xssmap
-Version: 2.8.0
-Summary: Context-aware XSS scanner: crawler, browser verification, mXSS, charset and stored-XSS stages
-Author: xssmap
-Keywords: security,xss,scanner,pentest,sarif
-Classifier: Environment :: Console
-Classifier: Intended Audience :: Information Technology
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3 :: Only
-Classifier: Topic :: Security
-Requires-Python: >=3.9
-Description-Content-Type: text/markdown
-Provides-Extra: dev
-Requires-Dist: ruff>=0.6; extra == "dev"
-Requires-Dist: mypy>=1.10; extra == "dev"
-
 # xssmap
 
 A context-aware cross-site scripting scanner with a crawler, built in the spirit of
@@ -51,6 +34,12 @@ actually execute in a real browser.
   friends from body or filename, compares versions against each advisory's affected range
   (so 2.3.2 is not blamed for a 3.4.1 fix) and can merge fresh advisories from osv.dev
   with `--osv`.
+- **Server stack and outdated versions.** Reads what each host says about itself - `Server`,
+  `X-Powered-By`, `X-AspNet-Version`, `X-Generator`, `<meta name="generator">` and session
+  cookie names - from the seed response the crawl already received, so the pass costs no
+  extra request. Versions whose exact build is known-vulnerable or out of support (Apache
+  2.4.49/2.4.50, nginx before 1.20.1, PHP before 8.2, IIS 6.0-8.5) are flagged with the
+  CVE, and every row names the header it came from.
 - **Leads, not silence.** A parameter that reflects but swallows every payload is recorded
   as an unconfirmed lead with the measured filter and how much of the probe survived
   (verbatim, recased, escaped, truncated), in its own report section - never presented as a
@@ -476,6 +465,28 @@ OSV enrichment is verified against the live service, not only against fixtures.
 and Lodash 4.17.4 (9) into the local verdicts, then stopped: the fourth library was never
 queried and stayed unchanged, so the cap is visibly enforced.
 
+### Server stack and outdated versions
+
+The headers a host sends are also an inventory: `Server: nginx/1.18.0` is a version, not
+just a name. The crawler keeps the headers and the `<meta name="generator">` value of the
+first HTML response it already fetched, and the stack pass reads them without a second
+request. Three things make the result usable rather than noisy:
+
+- A row always cites its evidence (`Server`, `X-Powered-By`, `X-AspNet-Version`,
+  `X-Generator`, `meta generator`, or `cookie <name>`), so a claim can be checked against
+  the response that produced it.
+- Versions are compared numerically, so nginx 1.20.10 is newer than 1.20.9 and is not
+  blamed for a fix that shipped in 1.20.1, and the IIS rules match `8.5` without also
+  matching `10.0`.
+- The policy table only holds issues that are public, fixed and cheap to verify: Apache
+  2.4.49/2.4.50 (CVE-2021-41773, CVE-2021-42013), nginx before 1.20.1 (CVE-2021-23017),
+  PHP branches before 8.2 (out of security support) and IIS 6.0-8.5 (shipped only with an
+  end-of-life Windows Server). A CMS such as WordPress is reported with its disclosed
+  version and no end-of-life claim, because that judgement is not the scanner's to make.
+
+A flagged version is a lead: it says the build has a published problem, not that this
+host is exploitable through it. The finding standard for XSS is unchanged.
+
 ### Browser cost
 
 `--browser` reuses one browser and one page per run. The report's `browser_verification`

{xssmap-2.8.0 → xssmap-2.9.0}/pyproject.toml

@@ -1,5 +1,7 @@
 [build-system]
-requires = ["setuptools>=68"]
+# 77 is the first setuptools that understands PEP 639 license expressions and
+# `license-files`, which is how the metadata below states the MIT terms.
+requires = ["setuptools>=77"]
 build-backend = "setuptools.build_meta"
 
 [project]
@@ -8,9 +10,9 @@ dynamic = ["version"]
 description = "Context-aware XSS scanner: crawler, browser verification, mXSS, charset and stored-XSS stages"
 readme = "README.md"
 requires-python = ">=3.9"
-# No license field: the tree does not ship a LICENSE file, so the metadata makes
-# no claim about terms the author has not stated.
-authors = [{ name = "xssmap" }]
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "Ian Mattas" }]
 keywords = ["security", "xss", "scanner", "pentest", "sarif"]
 classifiers = [
     "Environment :: Console",
@@ -23,6 +25,12 @@ classifiers = [
 # an assessment host without a package install.
 dependencies = []
 
+[project.urls]
+Homepage = "https://github.com/imattas/xssmap"
+Repository = "https://github.com/imattas/xssmap"
+Changelog = "https://github.com/imattas/xssmap/blob/main/CHANGELOG.md"
+Issues = "https://github.com/imattas/xssmap/issues"
+
 [project.optional-dependencies]
 dev = ["ruff>=0.6", "mypy>=1.10"]
 
@@ -32,6 +40,11 @@ xssmap = "xssmap.cli:main"
 [tool.setuptools]
 packages = ["xssmap"]
 
+# PEP 561 marker: tells type checkers the inline annotations are usable and must
+# travel with the installed package, not just the source tree.
+[tool.setuptools.package-data]
+xssmap = ["py.typed"]
+
 [tool.setuptools.dynamic]
 version = { attr = "xssmap.__version__" }
 

xssmap-2.9.0/tests/test_crawlperf.py

@@ -0,0 +1,230 @@
+"""Crawl scheduling and transport cost.
+
+Three behaviours are pinned here, all of them things that made a crawl slower
+than the work it was doing:
+
+  * the crawl queue is fed continuously, so ``max_depth`` counts hops from the
+    seed and ``max_pages`` is a hard stop;
+  * a 500 from the target is not read as backpressure (only 429/503 are, and
+    only after a short streak);
+  * binary bodies are read up to a cap and their connection is dropped instead
+    of being returned to the pool half-drained.
+"""
+from __future__ import annotations
+
+import os
+import sys
+import threading
+import unittest
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from xssmap.crawler import Crawler, Scope
+from xssmap.net import HTTP, MAX_BINARY_BODY, Throttle
+
+SEED = "http://app.test/"
+
+
+class QuietLog:
+    def info(self, *_a, **_k):
+        pass
+
+    def debug(self, *_a, **_k):
+        pass
+
+    def warn(self, *_a, **_k):
+        pass
+
+    def ok(self, *_a, **_k):
+        pass
+
+    def action(self, *_a, **_k):
+        pass
+
+
+class PageResp:
+    """Enough of :class:`xssmap.net.Response` for the crawler to parse."""
+
+    def __init__(self, url, status=200, text="", content_type="text/html"):
+        self.url = url
+        self.status = status
+        self.text = text
+        self.body = text.encode()
+        self.content_type = content_type
+        self.history: list = []
+
+    @property
+    def is_html(self):
+        return self.content_type.startswith("text/html")
+
+    @property
+    def is_javascript(self):
+        return "javascript" in self.content_type
+
+
+class RouterHTTP:
+    def __init__(self, pages):
+        self.pages = pages
+        self.urls: list[str] = []
+
+    def get(self, url, headers=None, **_kwargs):
+        self.urls.append(url)
+        if url.endswith("/robots.txt") or url.endswith("/sitemap.xml"):
+            return PageResp(url, 404, "not found", "text/plain")
+        text = self.pages.get(url)
+        if text is None:
+            return PageResp(url, 404, "not found", "text/html")
+        ctype = "application/javascript" if url.endswith(".js") else "text/html"
+        return PageResp(url, 200, text, ctype)
+
+
+def crawl(pages, depth, max_pages=50):
+    http = RouterHTTP(pages)
+    crawler = Crawler(http, Scope(SEED), QuietLog(), max_depth=depth,
+                      max_pages=max_pages, crawl_js=True)
+    return crawler.run([SEED]), http
+
+
+class DepthTests(unittest.TestCase):
+    PAGES = {
+        SEED: '<a href="/a">a</a><a href="/b">b</a>',
+        "http://app.test/a": '<a href="/a1">a1</a>',
+        "http://app.test/b": '<a href="/b1">b1</a>',
+        "http://app.test/a1": '<a href="/a2">a2</a>',
+        "http://app.test/b1": "leaf",
+        "http://app.test/a2": "leaf",
+    }
+
+    def test_depth_counts_hops_from_seed(self):
+        _result, http = crawl(self.PAGES, depth=1)
+        fetched = {u for u in http.urls if not u.endswith(("/robots.txt", "/sitemap.xml"))}
+        self.assertEqual(fetched, {SEED, "http://app.test/a", "http://app.test/b"})
+        self.assertNotIn("http://app.test/a1", fetched)
+
+    def test_seed_is_depth_zero(self):
+        result, _http = crawl(self.PAGES, depth=1)
+        self.assertEqual(result.pages[SEED].depth, 0)
+        self.assertEqual(result.pages["http://app.test/a"].depth, 1)
+
+    def test_page_budget_stops_the_crawl(self):
+        _result, http = crawl(self.PAGES, depth=5, max_pages=2)
+        fetched = [u for u in http.urls if not u.endswith(("/robots.txt", "/sitemap.xml"))]
+        self.assertEqual(len(fetched), 2)
+
+    def test_boundary_pages_are_fetched_but_not_expanded(self):
+        result, _http = crawl(self.PAGES, depth=2)
+        # The seed is hop 0, so depth 2 reaches /a1 at hop 2 and stops there.
+        self.assertEqual(result.pages["http://app.test/a1"].depth, 2)
+        self.assertNotIn("http://app.test/a2", result.pages)
+
+
+class ThrottleTests(unittest.TestCase):
+    def test_application_error_is_not_backpressure(self):
+        throttle = Throttle(delay=0.0)
+        for _ in range(6):
+            throttle.on_status(500)
+        self.assertEqual(throttle.delay, 0.0)
+
+    def test_single_load_signal_does_not_slow_the_scan(self):
+        throttle = Throttle(delay=0.0)
+        throttle.on_status(503)
+        self.assertEqual(throttle.delay, 0.0)
+
+    def test_repeated_load_signals_slow_then_recover(self):
+        throttle = Throttle(delay=0.0)
+        throttle.on_status(429)
+        throttle.on_status(429)
+        slowed = throttle.delay
+        self.assertGreater(slowed, 0.0)
+        for _ in range(6):
+            throttle.on_status(200)
+        self.assertLess(throttle.delay, slowed)
+        self.assertGreaterEqual(throttle.delay, throttle.base_delay)
+
+    def test_adaptive_delay_is_capped(self):
+        throttle = Throttle(delay=0.0)
+        for _ in range(20):
+            throttle.on_status(503)
+        self.assertLessEqual(throttle.delay, 3.0)
+
+
+class _BodyHandler(BaseHTTPRequestHandler):
+    protocol_version = "HTTP/1.1"
+    disable_nagle_algorithm = True
+
+    def log_message(self, *_a):
+        pass
+
+    def do_GET(self):
+        if self.path == "/big.bin":
+            body = b"\x00" * (MAX_BINARY_BODY + 500_000)
+            ctype = "application/octet-stream"
+        elif self.path == "/small.bin":
+            body = b"\x00" * 2048
+            ctype = "application/octet-stream"
+        else:
+            body = b"<html><body>hello</body></html>"
+            ctype = "text/html"
+        self.send_response(200)
+        self.send_header("Content-Type", ctype)
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+
+class _QuietServer(ThreadingHTTPServer):
+    daemon_threads = True
+
+    def handle_error(self, request, client_address):
+        # A client that abandons a capped binary body leaves the server thread
+        # writing into a closed socket; that is the behaviour under test.
+        pass
+
+
+class BodyCapTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.server = _QuietServer(("127.0.0.1", 0), _BodyHandler)
+        cls.server.daemon_threads = True
+        threading.Thread(target=cls.server.serve_forever, daemon=True).start()
+        cls.base = f"http://127.0.0.1:{cls.server.server_address[1]}"
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.server.shutdown()
+
+    def test_binary_body_is_capped_and_flagged(self):
+        http = HTTP(timeout=10, retries=0, throttle=Throttle())
+        resp = http.get(self.base + "/big.bin")
+        self.assertTrue(resp.truncated)
+        self.assertEqual(len(resp.body), MAX_BINARY_BODY)
+
+    def test_truncated_connection_is_not_pooled(self):
+        http = HTTP(timeout=10, retries=0, throttle=Throttle())
+        http.get(self.base + "/big.bin")
+        self.assertEqual(len(http._pool()), 0)
+
+    def test_full_binary_body_is_pooled(self):
+        # Under the cap nothing is truncated, so the socket stays reusable.
+        http = HTTP(timeout=10, retries=0, throttle=Throttle())
+        resp = http.get(self.base + "/small.bin")
+        self.assertFalse(resp.truncated)
+        pool = http._pool()
+        self.assertEqual(len(pool), 1)
+        for _key, conn, _used in pool:
+            conn.close()
+
+    def test_text_body_is_read_in_full_and_pooled(self):
+        http = HTTP(timeout=10, retries=0, throttle=Throttle())
+        resp = http.get(self.base + "/page.html")
+        self.assertFalse(resp.truncated)
+        self.assertIn(b"hello", resp.body)
+        pool = http._pool()
+        self.assertEqual(len(pool), 1)
+        for _key, conn, _used in pool:
+            conn.close()
+
+
+if __name__ == "__main__":
+    unittest.main()

xssmap-2.9.0/tests/test_tech.py

@@ -0,0 +1,150 @@
+"""Server-stack fingerprinting: header parsing, version rules and report shape."""
+import unittest
+
+from xssmap import tech
+
+
+def names(techs):
+    return [t.name for t in techs]
+
+
+def by_name(techs, name):
+    return next(t for t in techs if t.name == name)
+
+
+class HeaderParsingTests(unittest.TestCase):
+    def test_nginx_version_is_read_from_server(self):
+        found = tech.detect([("Server", "nginx/1.24.0")])
+        self.assertEqual(names(found), ["nginx"])
+        self.assertEqual(found[0].version, "1.24.0")
+        self.assertEqual(found[0].source, "Server")
+
+    def test_header_lookup_is_case_insensitive(self):
+        found = tech.detect([("server", "Apache/2.4.51 (Debian)")])
+        self.assertEqual(found[0].name, "Apache httpd")
+        self.assertEqual(found[0].version, "2.4.51")
+
+    def test_products_without_a_version_are_still_named(self):
+        found = tech.detect([("Server", "cloudflare")])
+        self.assertEqual(found[0].name, "Cloudflare")
+        self.assertEqual(found[0].version, "")
+
+    def test_several_products_in_one_header(self):
+        found = tech.detect([("Server", "nginx/1.18.0 (Ubuntu) OpenSSL/1.1.1f")])
+        self.assertEqual(names(found), ["nginx"])
+
+    def test_powered_by_and_aspnet_version(self):
+        found = tech.detect([("X-Powered-By", "PHP/8.1.2"),
+                             ("X-AspNet-Version", "4.0.30319")])
+        self.assertEqual(set(names(found)), {"PHP", "ASP.NET"})
+        self.assertEqual(by_name(found, "ASP.NET").version, "4.0.30319")
+
+    def test_meta_generator_identifies_the_cms(self):
+        found = tech.detect([], generator="WordPress 6.2")
+        self.assertEqual(found[0].name, "WordPress")
+        self.assertEqual(found[0].version, "6.2")
+        self.assertEqual(found[0].source, "meta generator")
+
+    def test_cookie_names_identify_the_runtime(self):
+        found = tech.detect([("Set-Cookie", "PHPSESSID=abc123; path=/; HttpOnly")])
+        self.assertEqual(found[0].name, "PHP")
+        self.assertEqual(found[0].version, "")
+        self.assertTrue(found[0].source.startswith("cookie "))
+
+    def test_cookie_does_not_repeat_a_versioned_product(self):
+        found = tech.detect([("X-Powered-By", "PHP/7.4.33"),
+                             ("Set-Cookie", "PHPSESSID=abc; path=/")])
+        self.assertEqual(names(found), ["PHP"])
+        self.assertEqual(found[0].version, "7.4.33")
+
+    def test_duplicate_evidence_is_collapsed(self):
+        found = tech.detect([("Server", "nginx/1.24.0"), ("Server", "nginx/1.24.0")])
+        self.assertEqual(len(found), 1)
+
+    def test_empty_headers_yield_nothing(self):
+        self.assertEqual(tech.detect([]), [])
+        self.assertEqual(tech.detect([], generator=""), [])
+
+
+class VersionRuleTests(unittest.TestCase):
+    def test_apache_2449_is_flagged_critical(self):
+        row = tech.detect([("Server", "Apache/2.4.49")])[0]
+        self.assertEqual(row.status, "vulnerable")
+        self.assertEqual(row.severity, "critical")
+        self.assertIn("CVE-2021-41773", row.cves)
+
+    def test_apache_2450_is_flagged_with_its_own_cve(self):
+        row = tech.detect([("Server", "Apache/2.4.50")])[0]
+        self.assertIn("CVE-2021-42013", row.cves)
+
+    def test_patched_apache_is_not_flagged(self):
+        row = tech.detect([("Server", "Apache/2.4.51")])[0]
+        self.assertEqual(row.status, "detected")
+        self.assertEqual(row.cves, [])
+
+    def test_old_nginx_matches_the_resolver_cve(self):
+        row = tech.detect([("Server", "nginx/1.18.0")])[0]
+        self.assertEqual(row.status, "vulnerable")
+        self.assertEqual(row.severity, "high")
+        self.assertIn("CVE-2021-23017", row.cves)
+
+    def test_nginx_1201_is_the_fix_and_is_clean(self):
+        row = tech.detect([("Server", "nginx/1.20.1")])[0]
+        self.assertEqual(row.status, "detected")
+
+    def test_version_compare_is_numeric_not_lexicographic(self):
+        # 1.20.10 > 1.20.9 > 1.20.1, so none of these are "older than 1.20.1".
+        for version in ("1.20.9", "1.20.10", "1.21.0"):
+            row = tech.detect([("Server", f"nginx/{version}")])[0]
+            self.assertEqual(row.status, "detected", version)
+
+    def test_php_below_82_is_out_of_support_without_a_cve_claim(self):
+        row = tech.detect([("X-Powered-By", "PHP/7.4.33")])[0]
+        self.assertEqual(row.status, "outdated")
+        self.assertEqual(row.cves, [])
+        self.assertTrue(row.detail)
+
+    def test_supported_php_is_clean(self):
+        row = tech.detect([("X-Powered-By", "PHP/8.3.1")])[0]
+        self.assertEqual(row.status, "detected")
+
+    def test_iis_10_is_not_flagged(self):
+        row = tech.detect([("Server", "Microsoft-IIS/10.0")])[0]
+        self.assertEqual(row.status, "detected")
+
+    def test_iis_85_is_flagged_but_prefix_does_not_swallow_10(self):
+        self.assertEqual(tech.detect([("Server", "Microsoft-IIS/8.5")])[0].status,
+                         "outdated")
+        self.assertEqual(tech.detect([("Server", "Microsoft-IIS/10.0")])[0].status,
+                         "detected")
+
+    def test_cms_versions_are_reported_without_eol_claims(self):
+        row = tech.detect([], generator="Drupal 9")[0]
+        self.assertEqual(row.status, "detected")
+        self.assertEqual(row.cves, [])
+
+
+class ReportShapeTests(unittest.TestCase):
+    def test_rows_carry_every_report_field(self):
+        rows = tech.rows(tech.detect([("Server", "Apache/2.4.49")]))
+        self.assertEqual(set(rows[0]), {"name", "version", "source", "status",
+                                        "severity", "cves", "detail"})
+        self.assertIsInstance(rows[0]["cves"], list)
+
+    def test_summary_counts_by_status(self):
+        found = (tech.detect([("Server", "Apache/2.4.49")])
+                 + tech.detect([("X-Powered-By", "PHP/7.4")])
+                 + tech.detect([("Server", "Microsoft-IIS/10.0")]))
+        self.assertEqual(tech.summary(found)["vulnerable"], 1)
+        self.assertEqual(tech.summary(found)["outdated"], 1)
+        self.assertEqual(tech.summary(found)["detected"], 1)
+
+    def test_line_names_the_version_and_evidence(self):
+        row = tech.detect([("Server", "nginx/1.18.0")])[0]
+        self.assertIn("nginx 1.18.0", row.line())
+        self.assertIn("Server", row.line())
+        self.assertIn("1.20.1", row.line())
+
+
+if __name__ == "__main__":
+    unittest.main()