wapiti-scanner · Sep 20, 2024 · Sep 20, 2024 · Sep 20, 2024 · Sep 20, 2024 · Sep 20, 2024
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
@@ -1,10 +1,12 @@
 stages:
   - code_style
   - tests
+  - update
 
 variables:
   PYTHON_10_IMAGE: "docker.io/library/python:3.10-slim-bullseye"
   PYTHON_11_IMAGE: "docker.io/library/python:3.11-slim-bullseye"
+  ACCESS_TOKEN_NAME: "gitlab-ci-token"
 
 check_coding_style:
   stage: code_style
@@ -63,3 +65,38 @@ test-build-docker:
         $CI_PIPELINE_SOURCE == "merge_request_event"
   script:
     - docker build .
+
+update_hash :
+    stage: update
+    tags:
+      - docker-wapiti
+    rules:
+        - if: '$UPDATE_HASH == "true"'
+    image: $IMAGE_UPDATE_HASH
+    before_script:
+        - apt update && apt install -y git curl grep
+    script:
+        - git clone https://$ACCESS_TOKEN_NAME:$ACCESS_TOKEN@$PROJECT_URL/wapiti.git
+        - cd ./wapiti/wapitiCore/data/attacks/
+        - BRANCH_NAME=cms_update_`date +'%Y_%m_%d'`
+        - git switch -c $BRANCH_NAME
+        - curl -Lo "collected_data.db" https://github.com/Cyberwatch/HashThePlanet/releases/download/latest/hashtheplanet.db
+        - python3 update_hash_files.py --db ./collected_data.db --source-file ./src_cms_files/
+        - git add ./*.json
+        - |
+            if git diff --cached --quiet
+            then
+                exit 0
+            else
+                git config --global user.email "$COMMITER_MAIL"
+                git config --global user.name "$COMMITER_NAME"
+                git commit -m "AUTO-COMMIT: Update CMS hash `date +'%Y-%m-%d'`"
+                git push --set-upstream origin $BRANCH_NAME
+                curl -X POST --header "Private-Token: $ACCESS_TOKEN" \
+                "https://$GITLAB_URL/api/v4/projects/$CI_PROJECT_ID/merge_requests" \
+                --data "source_branch=$BRANCH_NAME" \
+                --data "target_branch=master" \
+                --data "title=Update hash files for CMS module" \
+                --data "description=This MR is generated automatically by the CI JOB "update_hash". It allows us to update hash files for CMS module."\
+                --data "remove_source_branch=true"
+            fi
diff --git a/Dockerfile.headless b/Dockerfile.headless
@@ -18,8 +18,8 @@ RUN pip3 install . --break-system-packages
 
 FROM debian:bookworm-slim
 
-ARG firefox_ver=124.0
-ARG geckodriver_ver=0.34.0
+ARG firefox_ver=134.0
+ARG geckodriver_ver=0.35.0
 
 ENV DEBIAN_FRONTEND=noninteractive \
   LANG=en_US.UTF-8 \

diff --git a/Dockerfile.test b/Dockerfile.test
@@ -1,6 +1,6 @@
 FROM ubuntu:22.04
 
-ENV DEBIAN_FRONTEND noninteractive
+ENV DEBIAN_FRONTEND=noninteractive
 
 RUN apt update \
  && apt install ca-certificates python3 python3-pip php8.1-cli php8.1-xml sslscan -y --no-install-recommends \
@@ -15,9 +15,9 @@ RUN python3 -m pip install --upgrade pip
 RUN pip3 install -U setuptools --no-cache-dir
 RUN mkdir /usr/src/app
 
-ENV LANG en_US.UTF-8
-ENV LANGUAGE en_US:en
-ENV LC_ALL en_US.UTF-8
+ENV LANG=en_US.UTF-8
+ENV LANGUAGE=en_US:en
+ENV LC_ALL=en_US.UTF-8
 
 WORKDIR /usr/src/app
 

diff --git a/README.rst b/README.rst
@@ -149,7 +149,7 @@ The aforementioned attacks are tied to the following module names :
 + timesql (SQL injection vulnerabilities detected with time-based methodology)
 + upload (File upload vulnerabilities)
 + wapp (Not an attack module, retrieves web technologies with versions and categories in use on the target)
-+ wp_enum (Enumerate plugins and themes on a Wordpress website)
++ wp_enum Detect WordPress Plugins with version - DEPRECATED (replaced by the module cms)
 + xss (XSS injection module)
 + xxe (XML External Entity attack)
 
@@ -182,13 +182,12 @@ In the prompt, just type the following command to get the basic usage :
 
 You can also take a look at the manpage (wapiti.1 or wapiti.1.html) for more details on each option.
 
+We also have an official wiki which is more exhaustive : https://github.com/wapiti-scanner/wapiti/wiki
+
 If you have another question, first check the `FAQ <https://github.com/wapiti-scanner/wapiti/blob/master/doc/FAQ.md>`__
 
 If you find a bug, fill an issue : https://github.com/wapiti-scanner/wapiti/issues
 
-The official wiki can be helpful too :  
-https://sourceforge.net/p/wapiti/wiki/browse_pages/
-
 
 How to help the Wapiti project
 ==============================

diff --git a/doc/wapiti.1 b/doc/wapiti.1
@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "WAPITI" "1" "August 2024" "" ""
+.TH "WAPITI" "1" "September 2024" "" ""
 .
 .SH "NAME"
 \fBwapiti\fR \- A web application vulnerability scanner in Python
@@ -98,6 +98,9 @@ PROXY AND AUTHENTICATION OPTIONS:
 \fB\-\-form\-script\fR \fIFILENAME\fR
 .
 .IP "\(bu" 4
+\fB\-\-side\-file\fR \fIFILENAME\fR
+.
+.IP "\(bu" 4
 \fB\-c\fR, \fB\-\-cookie\fR \fICOOKIE_FILE_OR_BROWSER_NAME\fR
 .
 .IP "\(bu" 4
@@ -436,6 +439,9 @@ Send data specified with \fB\-\-form\-data\fR using the given content\-type (def
 Use a custom Python authentication plugin
 .
 .IP "\(bu" 4
+\fB\-\-side\-file\fR \fIFILENAME\fR Use a \.side file generated using Selenium IDE to perform an authenticated scan\.
+.
+.IP "\(bu" 4
 \fB\-c\fR, \fB\-\-cookie\fR \fICOOKIE_FILE_OR_BROWSER_NAME\fR
 .
 .br
@@ -448,6 +454,9 @@ You can also import cookies from your browser by passing "chrome" or "firefox" a
 \fB\-C\fR, \fB\-\-cookie\-value\fR \fICOOKIE_VALUE\fR Set cookies from a valid user cookies\. You can import all the session cookies by copying the value of the cookies sent with headers from a request sent by an authenticated user\. For example: \-\-cookie\-value "PHPSESSIONID=5f4dcc3b5aa765d61d8327deb882cf99;cookie_2=somevalue"
 .
 .IP "\(bu" 4
+\-\-jwt` \fIJWT\fR Set JWT token from a valid user session\. You can import the JWT token value to be sent with every request for an authenticated scan\.
+.
+.IP "\(bu" 4
 \fB\-\-drop\-set\-cookie\fR
 .
 .br

diff --git a/doc/wapiti.1.html b/doc/wapiti.1.html
diff --git a/doc/wapiti.ronn b/doc/wapiti.ronn
@@ -48,8 +48,10 @@ PROXY AND AUTHENTICATION OPTIONS:
   * `--form-url` <URL>
   * `--form-enctype` <ENCTYPE>
   * `--form-script` <FILENAME>
+  * `--side-file` <FILENAME>
   * `-c`, `--cookie` <COOKIE_FILE_OR_BROWSER_NAME>
   * `-C`, `--cookie-value` <COOKIE_VALUE>
+  * `--jwt` <JWT>
   * `--drop-set-cookie`
 
 SESSION OPTIONS:
@@ -199,6 +201,9 @@ OTHER OPTIONS:
   * `--form-script` <FILENAME>  
     Use a custom Python authentication plugin
 
+  * `--side-file` <FILENAME>
+    Use a .side file generated using Selenium IDE to perform an authenticated scan.
+
   * `-c`, `--cookie` <COOKIE_FILE_OR_BROWSER_NAME>  
     Load cookies from a Wapiti JSON cookie file. See wapiti-getcookie(1) for more information.  
     You can also import cookies from your browser by passing "chrome" or "firefox" as value (MS Edge is not supported).
@@ -207,8 +212,12 @@ OTHER OPTIONS:
     Set cookies from a valid user cookies.
     You can import all the session cookies by copying the value of the cookies sent with headers from a request sent by an authenticated user.
     For example: --cookie-value "PHPSESSIONID=5f4dcc3b5aa765d61d8327deb882cf99;cookie_2=somevalue"
-
-  * `--drop-set-cookie`  
+
+  * --jwt` <JWT>
+    Set JWT token from a valid user session.
+    You can import the JWT token value to be sent with every request for an authenticated scan.
+
+  * `--drop-set-cookie`
     Ignore cookies given in HTTP responses. Cookies that have been loaded using `-c` will be kept.
 
 ## SESSIONS

diff --git a/pyproject.toml b/pyproject.toml
@@ -31,27 +31,26 @@ classifiers = [
         "Topic :: Software Development :: Testing"
 ]
 dependencies = [
-        "aiocache==0.12.2",
-        "aiohttp==3.9.4",
-        "aiosqlite==0.20.0",
+        "aiocache==0.12.3",
+        "aiohttp==3.11.13",
+        "aiosqlite==0.21.0",
         "arsenic==21.8",
-        "beautifulsoup4==4.12.3",
-        "browser-cookie3==0.19.1",
-        "dnspython==2.6.1",
+        "beautifulsoup4==4.13.3",
+        "browser-cookie3==0.20.1",
+        "dnspython==2.7.0",
         "h11==0.14.0",
-        "httpcore==1.0.4",
-        "httpx[brotli, socks]==0.27.0",
+        "httpcore==1.0.7",
+        "httpx[brotli, socks]==0.28.1",
         "httpx-ntlm==1.4.0",
-        "humanize==4.9.0",
-        "loguru==0.7.2",
-        "mako==1.3.2",
-        "markupsafe==2.1.5",
-        "mitmproxy==10.2.3",
-        "pyasn1==0.5.1",
-        "six==1.16.0",
-        "sqlalchemy==2.0.28",
+        "humanize==4.12.1",
+        "loguru==0.7.3",
+        "mako==1.3.9",
+        "markupsafe==3.0.2",
+        "mitmproxy==11.0.2",
+        "pyasn1==0.6.1",
+        "sqlalchemy==2.0.38",
         "tld==0.13",
-        "typing-extensions==4.10.0",
+        "typing-extensions==4.11.0",
         "yaswfp==0.9.3",
         "prance[osv]>=23.6.21.0"
 ]
@@ -66,11 +65,11 @@ wapiti-getcookie = "wapitiCore.main.getcookie:getcookie_asyncio_wrapper"
 
 [project.optional-dependencies]
 test = [
-        "humanize==4.9.0",
-        "pytest==8.0.2",
-        "pytest-cov==4.1.0",
-        "pytest-asyncio==0.23.5",
-        "respx==0.20.2",
+        "humanize==4.12.1",
+        "pytest==8.3.4",
+        "pytest-cov==6.0.0",
+        "pytest-asyncio==0.25.3",
+        "respx==0.22.0",
 ]
 
 [tool.setuptools.packages]

diff --git a/tests/attack/test_mod_backup.py b/tests/attack/test_mod_backup.py
@@ -1,4 +1,3 @@
-from asyncio import Event
 from unittest.mock import AsyncMock
 
 import httpx
@@ -35,7 +34,7 @@ async def test_whole_stuff():
     async with AsyncCrawler.with_configuration(crawler_configuration) as crawler:
         options = {"timeout": 10, "level": 2}
 
-        module = ModuleBackup(crawler, persister, options, Event(), crawler_configuration)
+        module = ModuleBackup(crawler, persister, options, crawler_configuration)
         module.do_get = True
         await module.attack(request, response)
 
@@ -66,6 +65,6 @@ async def test_false_positive():
     async with AsyncCrawler.with_configuration(crawler_configuration) as crawler:
         options = {"timeout": 10, "level": 2}
 
-        module = ModuleBackup(crawler, persister, options, Event(), crawler_configuration)
+        module = ModuleBackup(crawler, persister, options, crawler_configuration)
         module.do_get = True
         assert not await module.must_attack(request, response)
diff --git a/tests/attack/test_mod_buster.py b/tests/attack/test_mod_buster.py
@@ -1,6 +1,6 @@
 from unittest import mock
 from unittest.mock import AsyncMock
-from asyncio import Event, sleep
+from asyncio import sleep
 
 import httpx
 import respx
@@ -41,7 +41,7 @@ async def test_whole_stuff():
             "wordlist.txt": "nawak\nadmin\nconfig.inc\nauthconfig.php",
         }
         with mock.patch("builtins.open", get_mock_open(files)):
-            module = ModuleBuster(crawler, persister, options, Event(), crawler_configuration)
+            module = ModuleBuster(crawler, persister, options, crawler_configuration)
             module.DATA_DIR = ""
             module.PATHS_FILE = "wordlist.txt"
             module.do_get = True