示例#1
0
文件: core.py 项目: GTrunSec/detectem
    def mark_entries(self, entries):
        """ Mark one entry as main entry and the rest as resource entry.

            Main entry is the entry that contain response's body
            of the requested URL.
        """

        for entry in entries:
            self._set_entry_type(entry, RESOURCE_ENTRY)

        # If first entry doesn't have a redirect, set is as main entry
        main_entry = entries[0]
        main_location = self._get_location(main_entry)
        if not main_location:
            self._set_entry_type(main_entry, MAIN_ENTRY)
            return

        # Resolve redirected URL and see if it's in the rest of entries
        main_url = urllib.parse.urljoin(get_url(main_entry), main_location)
        for entry in entries[1:]:
            url = get_url(entry)
            if url == main_url:
                self._set_entry_type(entry, MAIN_ENTRY)
                break
        else:
            # In fail case, set the first entry
            self._set_entry_type(main_entry, MAIN_ENTRY)
示例#2
0
    def get_information(self, entry):
        name_match = re.findall("/wp-content/plugins/([^/]+)/", get_url(entry))
        # There are weird cases with malformed plugins urls
        if not name_match:
            return {}

        name = name_match[0].lower()
        homepage = self.homepage % name

        try:
            vendor = self.plugins[name]
        except KeyError:
            vendor = None

        return {"name": name, "homepage": homepage, "vendor": vendor}
示例#3
0
文件: core.py 项目: GTrunSec/detectem
    def process_har(self):
        """ Detect plugins present in the page. """
        hints = []

        version_plugins = self._plugins.with_version_matchers()
        generic_plugins = self._plugins.with_generic_matchers()

        for entry in self.har:
            for plugin in version_plugins:
                pm = self.apply_plugin_matchers(plugin, entry)
                if not pm:
                    continue

                # Set name if matchers could detect modular name
                if pm.name:
                    name = "{}-{}".format(plugin.name, pm.name)
                else:
                    name = plugin.name

                if pm.version:
                    self._results.add_result(
                        Result(
                            name=name,
                            version=pm.version,
                            homepage=plugin.homepage,
                            from_url=get_url(entry),
                            plugin=plugin.name,
                        )
                    )
                elif pm.presence:
                    # Try to get version through file hashes
                    version = get_version_via_file_hashes(plugin, entry)
                    if version:
                        self._results.add_result(
                            Result(
                                name=name,
                                version=version,
                                homepage=plugin.homepage,
                                from_url=get_url(entry),
                                plugin=plugin.name,
                            )
                        )
                    else:
                        self._results.add_result(
                            Result(
                                name=name,
                                homepage=plugin.homepage,
                                from_url=get_url(entry),
                                type=INDICATOR_TYPE,
                                plugin=plugin.name,
                            )
                        )
                hints += self.get_hints(plugin)

            for plugin in generic_plugins:
                pm = self.apply_plugin_matchers(plugin, entry)
                if not pm:
                    continue

                plugin_data = plugin.get_information(entry)

                # Only add to results if it's a valid result
                if "name" in plugin_data:
                    self._results.add_result(
                        Result(
                            name=plugin_data["name"],
                            homepage=plugin_data["homepage"],
                            from_url=get_url(entry),
                            type=GENERIC_TYPE,
                            plugin=plugin.name,
                        )
                    )

                hints += self.get_hints(plugin)

        for hint in hints:
            self._results.add_result(hint)
示例#4
0
def test_get_url(entry, result):
    assert get_url(entry) == result