Skip to content

Commit b0f5a85

Browse files
tijmetijme
committed
Merge branch 'develop'
2 parents a2dde0b + 3c195d8 commit b0f5a85

File tree

6 files changed

+46
-18
lines changed

6 files changed

+46
-18
lines changed

Diff for: ‎.semver

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
3.0.0
1+
3.0.1

Diff for: ‎README.rst

+20-12
Original file line numberDiff line numberDiff line change
@@ -60,32 +60,40 @@ Usage
6060

6161
``acstis -c -siv -d "https://finnwea.com/"``
6262

63+
**Trust the given certificate**
64+
65+
``acstis -d "https://finnwea.com/some/page/?category=23" -tc "/Users/name/Desktop/cert.pem"``
66+
6367
**All command line options**
6468

6569
.. code:: text
6670
6771
usage: acstis [-h] -d DOMAIN [-c] [-vp] [-av ANGULAR_VERSION] [-pmm] [-sos] [-soh] [-sot] [-siv] [-md MAX_DEPTH] [-mt MAX_THREADS]
6872
6973
required arguments:
70-
-d DOMAIN, --domain DOMAIN the domain to scan (e.g. finnwea.com)
74+
-d DOMAIN, --domain DOMAIN the domain to scan (e.g. finnwea.com)
7175
7276
optional arguments:
73-
-h, --help show this help message and exit
74-
-c, --crawl use the crawler to scan all the entire domain
75-
-vp, --verify-payload use a javascript engine to verify if the payload was executed (otherwise false positives may occur)
76-
-av ANGULAR_VERSION, --angular-version ANGULAR_VERSION manually pass the angular version (e.g. 1.4.2) if the automatic check doesn't work
77-
-pmm, --protocol-must-match (crawler option) only scan pages with the same protocol as the startpoint (e.g. only https)
78-
-sos, --scan-other-subdomains (crawler option) also scan pages that have another subdomain than the startpoint
79-
-soh, --scan-other-hostnames (crawler option) also scan pages that have another hostname than the startpoint
80-
-sot, --scan-other-tlds (crawler option) also scan pages that have another tld than the startpoint
81-
-siv, --stop-if-vulnerable (crawler option) stop scanning if a vulnerability was found
82-
-md MAX_DEPTH, --max-depth MAX_DEPTH (crawler option) the maximum search depth (default is unlimited)
83-
-mt MAX_THREADS, --max-threads MAX_THREADS (crawler option) the maximum amount of simultaneous threads to use (default is 8)
77+
-h, --help show this help message and exit
78+
-c, --crawl use the crawler to scan all the entire domain
79+
-vp, --verify-payload use a javascript engine to verify if the payload was executed (otherwise false positives may occur)
80+
-av ANGULAR_VERSION, --angular-version ANGULAR_VERSION manually pass the angular version (e.g. 1.4.2) if the automatic check doesn't work
81+
-pmm, --protocol-must-match (crawler option) only scan pages with the same protocol as the startpoint (e.g. only https)
82+
-sos, --scan-other-subdomains (crawler option) also scan pages that have another subdomain than the startpoint
83+
-soh, --scan-other-hostnames (crawler option) also scan pages that have another hostname than the startpoint
84+
-sot, --scan-other-tlds (crawler option) also scan pages that have another tld than the startpoint
85+
-siv, --stop-if-vulnerable (crawler option) stop scanning if a vulnerability was found
86+
-md MAX_DEPTH, --max-depth MAX_DEPTH (crawler option) the maximum search depth (default is unlimited)
87+
-mt MAX_THREADS, --max-threads MAX_THREADS (crawler option) the maximum amount of simultaneous threads to use (default is 8)
88+
-iic, --ignore-invalid-certificates (crawler option) ignore invalid ssl certificates
89+
-tc TRUSTED_CERTIFICATES, --trusted-certificates TRUSTED_CERTIFICATES (crawler option) trust this CA_BUNDLE file (.pem) or directory with certificates
8490
8591
**Authentication, Cookies, Headers, Proxies & Scope options**
8692

8793
These options are not implemented in the command line interface of ACSTIS. Please download the `extended.py <https://github.com/tijme/angularjs-csti-scanner/blob/master/extended.py>`_ script and extend it with one or more of the following code snippets. You can paste these code snippets in the `main()` method of the `extended.py` script.
8894

95+
**Please note:** if you use the ``extended.py`` file make sure you call ``python extended.py [your arguments]`` instead of ``acstis [your arguments]``.
96+
8997
*Basic Authentication*
9098

9199
.. code:: python

Diff for: ‎acstis/helpers/BrowserHelper.py

+12
Original file line numberDiff line numberDiff line change
@@ -149,24 +149,36 @@ def __proxies_to_service_args(proxies):
149149
Returns:
150150
list: The service args containing proxy details
151151
152+
Note:
153+
The `ignore-ssl-errors` argument is also added because
154+
all SSL checks are handled by Python's requests module.
155+
Python's requests module is also able to allow certain
156+
custom certificates (e.g. if a proxy is used).
157+
152158
"""
153159

154160
service_args = []
155161

156162
parsed = urlparse(list(proxies.values())[0])
157163

164+
# Proxy type
158165
if parsed.scheme.startswith("http"):
159166
service_args.append("--proxy-type=http")
160167
else:
161168
service_args.append("--proxy-type=" + parsed.scheme)
162169

170+
# Proxy
163171
host_and_port = parsed.netloc.split("@")[-1]
164172
service_args.append("--proxy=" + host_and_port)
165173

174+
# Proxy auth
166175
if len(parsed.netloc.split("@")) == 2:
167176
user_pass = parsed.netloc.split("@")[0]
168177
service_args.append("--proxy-auth=" + user_pass)
169178

179+
# Ignore SSL (please see note in this method).
180+
service_args.append("--ignore-ssl-errors=true")
181+
170182
return service_args
171183

172184
@staticmethod

Diff for: ‎acstis_scripts/acstis_cli.py

+6-2
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ def require_arguments():
4040

4141
parser = argparse.ArgumentParser(
4242
prog=PackageHelper.get_alias(),
43-
formatter_class=lambda prog: argparse.HelpFormatter(prog, max_help_position=160, width=160)
43+
formatter_class=lambda prog: argparse.HelpFormatter(prog, max_help_position=180, width=180)
4444
)
4545

4646
optional = parser._action_groups.pop()
@@ -50,14 +50,16 @@ def require_arguments():
5050

5151
optional.add_argument("-c", "--crawl", help="use the crawler to scan all the entire domain", action="store_true")
5252
optional.add_argument("-vp", "--verify-payload", help="use a javascript engine to verify if the payload was executed (otherwise false positives may occur)", action="store_true")
53-
optional.add_argument("-av", "--angular-version", help="manually pass the angular version (e.g. 1.4.2) if the automatic check doesn't work", type=str)
53+
optional.add_argument("-av", "--angular-version", help="manually pass the angular version (e.g. 1.4.2) if the automatic check doesn't work", type=str, default=None)
5454
optional.add_argument("-siv", "--stop-if-vulnerable", help="(crawler option) stop scanning if a vulnerability was found", action="store_true")
5555
optional.add_argument("-pmm", "--protocol-must-match", help="(crawler option) only scan pages with the same protocol as the startpoint (e.g. only https)", action="store_true")
5656
optional.add_argument("-sos", "--scan-other-subdomains", help="(crawler option) also scan pages that have another subdomain than the startpoint", action="store_true")
5757
optional.add_argument("-soh", "--scan-other-hostnames", help="(crawler option) also scan pages that have another hostname than the startpoint", action="store_true")
5858
optional.add_argument("-sot", "--scan-other-tlds", help="(crawler option) also scan pages that have another tld than the startpoint", action="store_true")
5959
optional.add_argument("-md", "--max-depth", help="(crawler option) the maximum search depth (default is unlimited)", type=int)
6060
optional.add_argument("-mt", "--max-threads", help="(crawler option) the maximum amount of simultaneous threads to use (default is 8)", type=int, default=8)
61+
optional.add_argument("-iic", "--ignore-invalid-certificates", help="(crawler option) ignore invalid ssl certificates", action="store_true")
62+
optional.add_argument("-tc", "--trusted-certificates", help="(crawler option) trust this CA_BUNDLE file (.pem) or directory with certificates", type=str, default=None)
6163

6264
parser._action_groups.append(optional)
6365
return parser.parse_args()
@@ -134,6 +136,8 @@ def main():
134136
options.scope.tld_must_match = not args.scan_other_tlds
135137
options.scope.max_depth = args.max_depth if args.crawl else 0
136138
options.performance.max_threads = args.max_threads
139+
options.misc.verify_ssl_certificates = not args.ignore_invalid_certificates
140+
options.misc.trusted_certificates = args.trusted_certificates
137141

138142
driver = Driver(args, options)
139143
driver.start()

Diff for: ‎extended.py

+6-2
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,8 @@ def main():
4646
options.scope.tld_must_match = not args.scan_other_tlds
4747
options.scope.max_depth = args.max_depth if args.crawl else 0
4848
options.performance.max_threads = args.max_threads
49+
options.misc.verify_ssl_certificates = not args.ignore_invalid_certificates
50+
options.misc.trusted_certificates = args.trusted_certificates
4951

5052
""" ########################################################## """
5153
""" """
@@ -69,7 +71,7 @@ def require_arguments():
6971

7072
parser = argparse.ArgumentParser(
7173
prog=PackageHelper.get_alias(),
72-
formatter_class=lambda prog: argparse.HelpFormatter(prog, max_help_position=160, width=160)
74+
formatter_class=lambda prog: argparse.HelpFormatter(prog, max_help_position=180, width=180)
7375
)
7476

7577
optional = parser._action_groups.pop()
@@ -79,14 +81,16 @@ def require_arguments():
7981

8082
optional.add_argument("-c", "--crawl", help="use the crawler to scan all the entire domain", action="store_true")
8183
optional.add_argument("-vp", "--verify-payload", help="use a javascript engine to verify if the payload was executed (otherwise false positives may occur)", action="store_true")
82-
optional.add_argument("-av", "--angular-version", help="manually pass the angular version (e.g. 1.4.2) if the automatic check doesn't work", type=str)
84+
optional.add_argument("-av", "--angular-version", help="manually pass the angular version (e.g. 1.4.2) if the automatic check doesn't work", type=str, default=None)
8385
optional.add_argument("-siv", "--stop-if-vulnerable", help="(crawler option) stop scanning if a vulnerability was found", action="store_true")
8486
optional.add_argument("-pmm", "--protocol-must-match", help="(crawler option) only scan pages with the same protocol as the startpoint (e.g. only https)", action="store_true")
8587
optional.add_argument("-sos", "--scan-other-subdomains", help="(crawler option) also scan pages that have another subdomain than the startpoint", action="store_true")
8688
optional.add_argument("-soh", "--scan-other-hostnames", help="(crawler option) also scan pages that have another hostname than the startpoint", action="store_true")
8789
optional.add_argument("-sot", "--scan-other-tlds", help="(crawler option) also scan pages that have another tld than the startpoint", action="store_true")
8890
optional.add_argument("-md", "--max-depth", help="(crawler option) the maximum search depth (default is unlimited)", type=int)
8991
optional.add_argument("-mt", "--max-threads", help="(crawler option) the maximum amount of simultaneous threads to use (default is 8)", type=int, default=8)
92+
optional.add_argument("-iic", "--ignore-invalid-certificates", help="(crawler option) ignore invalid ssl certificates", action="store_true")
93+
optional.add_argument("-tc", "--trusted-certificates", help="(crawler option) trust this CA_BUNDLE file (.pem) or directory with certificates", type=str, default=None)
9094

9195
parser._action_groups.append(optional)
9296
return parser.parse_args()

Diff for: ‎requirements.txt

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
colorlog==2.10.0
2-
nyawc==1.7.5
2+
nyawc==1.7.8
33
requests==2.18.1
44
requests_toolbelt==0.8.0
55
selenium==3.4.3

0 commit comments

Comments
 (0)