diff --git a/.github/auto_assign.yml b/.github/auto_assign.yml new file mode 100644 index 0000000..fe4b20a --- /dev/null +++ b/.github/auto_assign.yml @@ -0,0 +1,14 @@ +# Set to true to add reviewers to pull requests +addReviewers: true + +# A list of reviewers to be added to pull requests (GitHub user name) +reviewers: + - edoardottt + +# A list of keywords to be skipped the process that add reviewers if pull requests include it +skipKeywords: + - wip + +# A number of reviewers added to the pull request +# Set 0 to add all the reviewers (default: 0) +numberOfReviewers: 0 diff --git a/.gitignore b/.gitignore index a4156f5..94300f1 100644 --- a/.gitignore +++ b/.gitignore @@ -2,6 +2,7 @@ cariddi output-cariddi/ .cariddi_cache/ +*.snap # Binaries for programs and plugins *.exe diff --git a/README.md b/README.md index 87dd13a..b6ec701 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ go-report-card - + workflows @@ -47,7 +47,7 @@
- Share on Twitter! + Share on Twitter!

@@ -63,11 +63,20 @@ Preview :bar_chart: ---------- -[![asciicast](https://asciinema.org/a/415989.svg)](https://asciinema.org/a/415989) + + +

+ +

Installation 📡 ---------- +### Using Snap +```bash +sudo snap install cariddi +``` + ### Using Go ```bash go install -v github.com/edoardottt/cariddi/cmd/cariddi@latest diff --git a/go.mod b/go.mod index 16f47c7..373ee40 100644 --- a/go.mod +++ b/go.mod @@ -1,29 +1,29 @@ module github.com/edoardottt/cariddi -go 1.17 +go 1.18 require ( - github.com/fatih/color v1.14.1 + github.com/fatih/color v1.15.0 github.com/gocolly/colly v1.2.0 ) require ( - github.com/PuerkitoBio/goquery v1.8.0 // indirect + github.com/PuerkitoBio/goquery v1.8.1 // indirect github.com/andybalholm/cascadia v1.3.1 // indirect - github.com/antchfx/htmlquery v1.2.5 // indirect - github.com/antchfx/xmlquery v1.3.13 // indirect - github.com/antchfx/xpath v1.2.1 // indirect + github.com/antchfx/htmlquery v1.3.0 // indirect + github.com/antchfx/xmlquery v1.3.15 // indirect + github.com/antchfx/xpath v1.2.4 // indirect github.com/gobwas/glob v0.2.3 // indirect github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect - github.com/golang/protobuf v1.5.2 // indirect + github.com/golang/protobuf v1.5.3 // indirect github.com/kennygrant/sanitize v1.2.4 // indirect github.com/mattn/go-colorable v0.1.13 // indirect github.com/mattn/go-isatty v0.0.17 // indirect - github.com/saintfish/chardet v0.0.0-20120816061221-3af4cd4741ca // indirect + github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d // indirect github.com/temoto/robotstxt v1.1.2 // indirect - golang.org/x/net v0.4.0 // indirect - golang.org/x/sys v0.3.0 // indirect - golang.org/x/text v0.5.0 // indirect + golang.org/x/net v0.8.0 // indirect + golang.org/x/sys v0.6.0 // indirect + golang.org/x/text v0.8.0 // indirect google.golang.org/appengine v1.6.7 // indirect - google.golang.org/protobuf v1.28.1 // indirect + google.golang.org/protobuf v1.30.0 // indirect ) diff --git a/go.sum b/go.sum index acb71b0..3a6b9a3 100644 --- a/go.sum +++ b/go.sum @@ -1,17 +1,26 @@ github.com/PuerkitoBio/goquery v1.8.0 h1:PJTF7AmFCFKk1N6V6jmKfrNH9tV5pNE6lZMkG0gta/U= github.com/PuerkitoBio/goquery v1.8.0/go.mod h1:ypIiRMtY7COPGk+I/YbZLbxsxn9g5ejnI2HSMtkjZvI= +github.com/PuerkitoBio/goquery v1.8.1 h1:uQxhNlArOIdbrH1tr0UXwdVFgDcZDrZVdcpygAcwmWM= +github.com/PuerkitoBio/goquery v1.8.1/go.mod h1:Q8ICL1kNUJ2sXGoAhPGUdYDJvgQgHzJsnnd3H7Ho5jQ= github.com/andybalholm/cascadia v1.3.1 h1:nhxRkql1kdYCc8Snf7D5/D3spOX+dBgjA6u8x004T2c= github.com/andybalholm/cascadia v1.3.1/go.mod h1:R4bJ1UQfqADjvDa4P6HZHLh/3OxWWEqc0Sk8XGwHqvA= github.com/antchfx/htmlquery v1.2.5 h1:1lXnx46/1wtv1E/kzmH8vrfMuUKYgkdDBA9pIdMJnk4= github.com/antchfx/htmlquery v1.2.5/go.mod h1:2MCVBzYVafPBmKbrmwB9F5xdd+IEgRY61ci2oOsOQVw= +github.com/antchfx/htmlquery v1.3.0 h1:5I5yNFOVI+egyia5F2s/5Do2nFWxJz41Tr3DyfKD25E= +github.com/antchfx/htmlquery v1.3.0/go.mod h1:zKPDVTMhfOmcwxheXUsx4rKJy8KEY/PU6eXr/2SebQ8= github.com/antchfx/xmlquery v1.3.13 h1:wqhTv2BN5MzYg9rnPVtZb3IWP8kW6WV/ebAY0FCTI7Y= github.com/antchfx/xmlquery v1.3.13/go.mod h1:3w2RvQvTz+DaT5fSgsELkSJcdNgkmg6vuXDEuhdwsPQ= +github.com/antchfx/xmlquery v1.3.15 h1:aJConNMi1sMha5G8YJoAIF5P+H+qG1L73bSItWHo8Tw= +github.com/antchfx/xmlquery v1.3.15/go.mod h1:zMDv5tIGjOxY/JCNNinnle7V/EwthZ5IT8eeCGJKRWA= github.com/antchfx/xpath v1.2.1 h1:qhp4EW6aCOVr5XIkT+l6LJ9ck/JsUH/yyauNgTQkBF8= github.com/antchfx/xpath v1.2.1/go.mod h1:i54GszH55fYfBmoZXapTHN8T8tkcHfRgLyVwwqzXNcs= +github.com/antchfx/xpath v1.2.3/go.mod h1:i54GszH55fYfBmoZXapTHN8T8tkcHfRgLyVwwqzXNcs= +github.com/antchfx/xpath v1.2.4 h1:dW1HB/JxKvGtJ9WyVGJ0sIoEcqftV3SqIstujI+B9XY= +github.com/antchfx/xpath v1.2.4/go.mod h1:i54GszH55fYfBmoZXapTHN8T8tkcHfRgLyVwwqzXNcs= github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/fatih/color v1.14.1 h1:qfhVLaG5s+nCROl1zJsZRxFeYrHLqWroPOQ8BWiNb4w= -github.com/fatih/color v1.14.1/go.mod h1:2oHN61fhTpgcxD3TSWCgKDiH1+x4OiDVVGH8WlgGZGg= +github.com/fatih/color v1.15.0 h1:kOqh6YHBtK8aywxGerMG2Eq3H6Qgoqeo13Bk2Mv/nBs= +github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBDUSsw= github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y= github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8= github.com/gocolly/colly v1.2.0 h1:qRz9YAn8FIH0qzgNUw+HT9UN7wm1oF9OBAilwEWpyrI= @@ -23,6 +32,8 @@ github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5y github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw= github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= +github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg= +github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU= github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/kennygrant/sanitize v1.2.4 h1:gN25/otpP5vAsO2djbMhF/LQX6R7+O1TB4yv8NzpJ3o= @@ -36,6 +47,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/saintfish/chardet v0.0.0-20120816061221-3af4cd4741ca h1:NugYot0LIVPxTvN8n+Kvkn6TrbMyxQiuvKdEwFdR9vI= github.com/saintfish/chardet v0.0.0-20120816061221-3af4cd4741ca/go.mod h1:uugorj2VCxiV1x+LzaIdVa9b4S4qGAcH6cbhh4qVxOU= +github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d h1:hrujxIzL1woJ7AwssoOcM/tq5JjjG2yYOc8odClEiXA= +github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d/go.mod h1:uugorj2VCxiV1x+LzaIdVa9b4S4qGAcH6cbhh4qVxOU= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= @@ -52,8 +65,11 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v golang.org/x/net v0.0.0-20210916014120-12bc252f5db8/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= -golang.org/x/net v0.4.0 h1:Q5QPcMlvfxFTAPV0+07Xz/MpK9NTXu2VDUuy0FeMfaU= -golang.org/x/net v0.4.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE= +golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws= +golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g= +golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= +golang.org/x/net v0.8.0 h1:Zrh2ngAOFYneWTAIAPethzeaQLuHwhuBkuV6ZiRnUaQ= +golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -65,18 +81,24 @@ golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.3.0 h1:w8ZOecv6NaNa/zC8944JTU3vz4u6Lagfk4RPQxv92NQ= -golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ= +golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= -golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA= +golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ= +golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= -golang.org/x/text v0.5.0 h1:OLmvp0KP+FVG99Ct/qFiL/Fhk4zp4QQnZ7b2U+5piUM= -golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= +golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= +golang.org/x/text v0.7.0 h1:4BRB4x83lYWy72KwLD/qYDuTu7q9PjSagHvijDw7cLo= +golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= +golang.org/x/text v0.8.0 h1:57P1ETyNKtuIjB4SRd15iJxuhj8Gc416Y78H3qgMh68= +golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= @@ -89,3 +111,5 @@ google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp0 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w= google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= +google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng= +google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= diff --git a/pkg/crawler/colly.go b/pkg/crawler/colly.go index 118e05e..0d3f472 100644 --- a/pkg/crawler/colly.go +++ b/pkg/crawler/colly.go @@ -144,98 +144,20 @@ func New(scan *Scan) *Results { c := CreateColly(scan.Delay, scan.Concurrency, scan.Cache, scan.Timeout, scan.Intensive, scan.Rua, scan.Proxy, scan.UserAgent, scan.Target) - // On every request that Colly is making, print the URL it's currently visiting - c.OnRequest(func(e *colly.Request) { - if scan.JSON == false { - fmt.Println(e.URL.String()) - } - }) + event := &Event{ + ProtocolTemp: protocolTemp, + TargetTemp: targetTemp, + Target: scan.Target, + Intensive: scan.Intensive, + Ignore: ignoreBool, + Debug: scan.Debug, + JSON: scan.JSON, + IgnoreSlice: ignoreSlice, + URLs: &results.URLs, + } - // On every a element which has href attribute call callback - c.OnHTML("a[href]", func(e *colly.HTMLElement) { - link := e.Attr("href") - if len(link) != 0 && link[0] != '#' { - visitHTMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive, - ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c) - } - }) - - // On every script element which has src attribute call callback - c.OnHTML("script[src]", func(e *colly.HTMLElement) { - link := e.Attr("src") - visitHTMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive, - ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c) - }) - - // On every link element which has href attribute call callback - c.OnHTML("link[href]", func(e *colly.HTMLElement) { - link := e.Attr("href") - visitHTMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive, - ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c) - }) - - // On every iframe element which has src attribute call callback - c.OnHTML("iframe[src]", func(e *colly.HTMLElement) { - link := e.Attr("src") - visitHTMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive, - ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c) - }) - - // On every svg element which has src attribute call callback - c.OnHTML("svg[src]", func(e *colly.HTMLElement) { - link := e.Attr("src") - visitHTMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive, - ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c) - }) - - // On every img element which has src attribute call callback - c.OnHTML("img[src]", func(e *colly.HTMLElement) { - link := e.Attr("src") - visitHTMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive, - ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c) - }) - - // On every from element which has action attribute call callback - c.OnHTML("form[action]", func(e *colly.HTMLElement) { - link := e.Attr("action") - visitHTMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive, - ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c) - }) - - // Create a callback on the XPath query searching for the URLs - c.OnXML("//url", func(e *colly.XMLElement) { - link := e.Text - visitXMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive, - ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c) - }) - - // Create a callback on the XPath query searching for the URLs - c.OnXML("//link", func(e *colly.XMLElement) { - link := e.Text - visitXMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive, - ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c) - }) - - // Create a callback on the XPath query searching for the URLs - c.OnXML("//href", func(e *colly.XMLElement) { - link := e.Text - visitXMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive, - ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c) - }) - - // Create a callback on the XPath query searching for the URLs - c.OnXML("//loc", func(e *colly.XMLElement) { - link := e.Text - visitXMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive, - ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c) - }) - - // Create a callback on the XPath query searching for the URLs - c.OnXML("//fileurl", func(e *colly.XMLElement) { - link := e.Text - visitXMLLink(link, protocolTemp, targetTemp, scan.Target, scan.Intensive, - ignoreBool, scan.Debug, ignoreSlice, &results.URLs, e, c) - }) + registerHTMLEvents(c, event) + registerXMLEvents(c, event) // Add headers (if needed) on each request if (len(scan.Headers)) > 0 { @@ -260,13 +182,13 @@ func New(scan *Scan) *Results { (1 <= scan.FileType && scan.FileType <= 7) || scan.ErrorsFlag || scan.InfoFlag { // HERE SCAN FOR SECRETS if scan.SecretsFlag && lengthOk { - secretsSlice := huntSecrets(scan.SecretsSlice, r.Request.URL.String(), string(r.Body)) + secretsSlice := huntSecrets(r.Request.URL.String(), string(r.Body), &scan.SecretsSlice) results.Secrets = append(results.Secrets, secretsSlice...) secrets = append(secrets, secretsSlice...) } // HERE SCAN FOR ENDPOINTS if scan.EndpointsFlag { - endpointsSlice := huntEndpoints(scan.EndpointsSlice, r.Request.URL.String()) + endpointsSlice := huntEndpoints(r.Request.URL.String(), &scan.EndpointsSlice) for _, elem := range endpointsSlice { if len(elem.Parameters) != 0 { results.Endpoints = append(results.Endpoints, elem) @@ -297,7 +219,7 @@ func New(scan *Scan) *Results { } } if scan.JSON { - jsonOutput, err := output.GetJsonString( + jsonOutput, err := output.GetJSONString( r, secrets, parameters, filetype, errors, infos, ) if err == nil { @@ -322,7 +244,7 @@ func New(scan *Scan) *Results { if path == "" || path == "/" { absoluteURL = protocolTemp + "://" + scan.Target + addPath + "robots.txt" - if !ignoreBool || (ignoreBool && !IgnoreMatch(absoluteURL, ignoreSlice)) { + if !ignoreBool || (ignoreBool && !IgnoreMatch(absoluteURL, &ignoreSlice)) { err = c.Visit(absoluteURL) if err != nil && scan.Debug && !errors.Is(err, colly.ErrAlreadyVisited) { log.Println(err) @@ -330,7 +252,7 @@ func New(scan *Scan) *Results { } absoluteURL = protocolTemp + "://" + scan.Target + addPath + "sitemap.xml" - if !ignoreBool || (ignoreBool && !IgnoreMatch(absoluteURL, ignoreSlice)) { + if !ignoreBool || (ignoreBool && !IgnoreMatch(absoluteURL, &ignoreSlice)) { err = c.Visit(absoluteURL) if err != nil && scan.Debug && !errors.Is(err, colly.ErrAlreadyVisited) { log.Println(err) @@ -435,3 +357,81 @@ func CreateColly(delayTime int, concurrency int, cache bool, timeout int, return c } + +// registerHTMLEvents registers the associated functions for each +// HTML event triggering an action. +func registerHTMLEvents(c *colly.Collector, event *Event) { + // On every request that Colly is making, print the URL it's currently visiting + c.OnRequest(func(e *colly.Request) { + if (!event.JSON){ + fmt.Println(e.URL.String()) + } + }) + + // On every a element which has href attribute call callback + c.OnHTML("a[href]", func(e *colly.HTMLElement) { + link := e.Attr("href") + if len(link) != 0 && link[0] != '#' { + visitHTMLLink(link, event, e, c) + } + }) + + // On every script element which has src attribute call callback + c.OnHTML("script[src]", func(e *colly.HTMLElement) { + visitHTMLLink(e.Attr("src"), event, e, c) + }) + + // On every link element which has href attribute call callback + c.OnHTML("link[href]", func(e *colly.HTMLElement) { + visitHTMLLink(e.Attr("href"), event, e, c) + }) + + // On every iframe element which has src attribute call callback + c.OnHTML("iframe[src]", func(e *colly.HTMLElement) { + visitHTMLLink(e.Attr("src"), event, e, c) + }) + + // On every svg element which has src attribute call callback + c.OnHTML("svg[src]", func(e *colly.HTMLElement) { + visitHTMLLink(e.Attr("src"), event, e, c) + }) + + // On every img element which has src attribute call callback + c.OnHTML("img[src]", func(e *colly.HTMLElement) { + visitHTMLLink(e.Attr("src"), event, e, c) + }) + + // On every from element which has action attribute call callback + c.OnHTML("form[action]", func(e *colly.HTMLElement) { + visitHTMLLink(e.Attr("action"), event, e, c) + }) +} + +// registerXMLEvents registers the associated functions for each +// XML event triggering an action. +func registerXMLEvents(c *colly.Collector, event *Event) { + // Create a callback on the XPath query searching for the URLs + c.OnXML("//url", func(e *colly.XMLElement) { + visitXMLLink(e.Text, event, e, c) + }) + + // Create a callback on the XPath query searching for the URLs + c.OnXML("//link", func(e *colly.XMLElement) { + visitXMLLink(e.Text, event, e, c) + }) + + // Create a callback on the XPath query searching for the URLs + c.OnXML("//href", func(e *colly.XMLElement) { + visitXMLLink(e.Text, event, e, c) + }) + + // Create a callback on the XPath query searching for the URLs + c.OnXML("//loc", func(e *colly.XMLElement) { + visitXMLLink(e.Text, event, e, c) + }) + + // Create a callback on the XPath query searching for the URLs + c.OnXML("//fileurl", func(e *colly.XMLElement) { + visitXMLLink(e.Text, event, e, c) + }) +} diff --git a/pkg/crawler/utils.go b/pkg/crawler/utils.go index 7f63e53..7854162 100644 --- a/pkg/crawler/utils.go +++ b/pkg/crawler/utils.go @@ -12,46 +12,49 @@ import ( "github.com/gocolly/colly" ) +type Event struct { + ProtocolTemp string + TargetTemp string + Target string + Intensive bool + Ignore bool + Debug bool + JSON bool + IgnoreSlice []string + URLs *[]string +} + // visitHTMLLink checks if the collector should visit a link or not. -func visitHTMLLink(link, protocolTemp, targetTemp, target string, intensive, ignoreBool, debug bool, - ignoreSlice []string, finalResults *[]string, e *colly.HTMLElement, c *colly.Collector) { - if len(link) != 0 { - absoluteURL := urlUtils.AbsoluteURL(protocolTemp, targetTemp, e.Request.AbsoluteURL(link)) +func visitHTMLLink(link string, event *Event, e *colly.HTMLElement, c *colly.Collector) { + if len(link) != 0 && !strings.HasPrefix(link, "data:image") { + absoluteURL := urlUtils.AbsoluteURL(event.ProtocolTemp, event.TargetTemp, e.Request.AbsoluteURL(link)) // Visit link found on page // Only those links are visited which are in AllowedDomains - if (!intensive && urlUtils.SameDomain(protocolTemp+"://"+target, absoluteURL)) || - (intensive && intensiveOk(targetTemp, absoluteURL, debug)) { - if !ignoreBool || (ignoreBool && !IgnoreMatch(absoluteURL, ignoreSlice)) { - err := c.Visit(absoluteURL) - if !errors.Is(err, colly.ErrAlreadyVisited) { - *finalResults = append(*finalResults, absoluteURL) - - if err != nil && debug { - log.Println(err) - } - } - } - } + visitLink(event, c, absoluteURL) } } // visitXMLLink checks if the collector should visit a link or not. -func visitXMLLink(link, protocolTemp, targetTemp, target string, intensive, ignoreBool, debug bool, - ignoreSlice []string, finalResults *[]string, e *colly.XMLElement, c *colly.Collector) { - if len(link) != 0 { - absoluteURL := urlUtils.AbsoluteURL(protocolTemp, targetTemp, e.Request.AbsoluteURL(link)) +func visitXMLLink(link string, event *Event, e *colly.XMLElement, c *colly.Collector) { + if len(link) != 0 && !strings.HasPrefix(link, "data:image") { + absoluteURL := urlUtils.AbsoluteURL(event.ProtocolTemp, event.TargetTemp, e.Request.AbsoluteURL(link)) // Visit link found on page // Only those links are visited which are in AllowedDomains - if (!intensive && urlUtils.SameDomain(protocolTemp+"://"+target, absoluteURL)) || - (intensive && intensiveOk(targetTemp, absoluteURL, debug)) { - if !ignoreBool || (ignoreBool && !IgnoreMatch(absoluteURL, ignoreSlice)) { - err := c.Visit(absoluteURL) - if !errors.Is(err, colly.ErrAlreadyVisited) { - *finalResults = append(*finalResults, absoluteURL) + visitLink(event, c, absoluteURL) + } +} - if err != nil && debug { - log.Println(err) - } +// visitLink is a protocol agnostic wrapper to visit a link. +func visitLink(event *Event, c *colly.Collector, absoluteURL string) { + if (!event.Intensive && urlUtils.SameDomain(event.ProtocolTemp+"://"+event.Target, absoluteURL)) || + (event.Intensive && intensiveOk(event.TargetTemp, absoluteURL, event.Debug)) { + if !event.Ignore || (event.Ignore && !IgnoreMatch(absoluteURL, &event.IgnoreSlice)) { + err := c.Visit(absoluteURL) + if !errors.Is(err, colly.ErrAlreadyVisited) { + *event.URLs = append(*event.URLs, absoluteURL) + + if err != nil && event.Debug { + log.Println(err) } } } @@ -59,16 +62,16 @@ func visitXMLLink(link, protocolTemp, targetTemp, target string, intensive, igno } // huntSecrets hunts for secrets. -func huntSecrets(secretsFile []string, target string, body string) []scanner.SecretMatched { +func huntSecrets(target, body string, secretsFile *[]string) []scanner.SecretMatched { secrets := SecretsMatch(target, body, secretsFile) return secrets } // SecretsMatch checks if a body matches some secrets. -func SecretsMatch(url string, body string, secretsFile []string) []scanner.SecretMatched { +func SecretsMatch(url, body string, secretsFile *[]string) []scanner.SecretMatched { var secrets []scanner.SecretMatched - if len(secretsFile) == 0 { + if len(*secretsFile) == 0 { for _, secret := range scanner.GetSecretRegexes() { if matched, err := regexp.Match(secret.Regex, []byte(body)); err == nil && matched { re := regexp.MustCompile(secret.Regex) @@ -91,7 +94,7 @@ func SecretsMatch(url string, body string, secretsFile []string) []scanner.Secre } } } else { - for _, secret := range secretsFile { + for _, secret := range *secretsFile { if matched, err := regexp.Match(secret, []byte(body)); err == nil && matched { re := regexp.MustCompile(secret) match := re.FindStringSubmatch(body) @@ -106,18 +109,18 @@ func SecretsMatch(url string, body string, secretsFile []string) []scanner.Secre } // huntEndpoints hunts for juicy endpoints. -func huntEndpoints(endpointsFile []string, target string) []scanner.EndpointMatched { +func huntEndpoints(target string, endpointsFile *[]string) []scanner.EndpointMatched { endpoints := EndpointsMatch(target, endpointsFile) return endpoints } // EndpointsMatch check if an endpoint matches a juicy parameter. -func EndpointsMatch(target string, endpointsFile []string) []scanner.EndpointMatched { +func EndpointsMatch(target string, endpointsFile *[]string) []scanner.EndpointMatched { endpoints := []scanner.EndpointMatched{} matched := []scanner.Parameter{} parameters := urlUtils.RetrieveParameters(target) - if len(endpointsFile) == 0 { + if len(*endpointsFile) == 0 { for _, parameter := range scanner.GetJuicyParameters() { for _, param := range parameters { if strings.ToLower(param) == parameter.Parameter { @@ -127,7 +130,7 @@ func EndpointsMatch(target string, endpointsFile []string) []scanner.EndpointMat } endpoints = append(endpoints, scanner.EndpointMatched{Parameters: matched, URL: target}) } else { - for _, parameter := range endpointsFile { + for _, parameter := range *endpointsFile { for _, param := range parameters { if param == parameter { matched = append(matched, scanner.Parameter{Parameter: parameter, Attacks: []string{}}) @@ -162,13 +165,13 @@ func huntExtensions(target string, severity int) scanner.FileTypeMatched { } // huntErrors hunts for errors. -func huntErrors(target string, body string) []scanner.ErrorMatched { +func huntErrors(target, body string) []scanner.ErrorMatched { errorsSlice := ErrorsMatch(target, body) return errorsSlice } // ErrorsMatch checks the patterns for errors. -func ErrorsMatch(url string, body string) []scanner.ErrorMatched { +func ErrorsMatch(url, body string) []scanner.ErrorMatched { errors := []scanner.ErrorMatched{} for _, errorItem := range scanner.GetErrorRegexes() { @@ -186,13 +189,13 @@ func ErrorsMatch(url string, body string) []scanner.ErrorMatched { } // huntInfos hunts for infos. -func huntInfos(target string, body string) []scanner.InfoMatched { +func huntInfos(target, body string) []scanner.InfoMatched { infosSlice := InfoMatch(target, body) return infosSlice } // InfoMatch checks the patterns for infos. -func InfoMatch(url string, body string) []scanner.InfoMatched { +func InfoMatch(url, body string) []scanner.InfoMatched { infos := []scanner.InfoMatched{} for _, infoItem := range scanner.GetInfoRegexes() { @@ -210,8 +213,8 @@ func InfoMatch(url string, body string) []scanner.InfoMatched { } // RetrieveBody retrieves the body (in the response) of a url. -func RetrieveBody(target string) string { - sb, err := GetRequest(target) +func RetrieveBody(target *string) string { + sb, err := GetRequest(*target) if err == nil && sb != "" { return sb } @@ -220,8 +223,8 @@ func RetrieveBody(target string) string { } // IgnoreMatch checks if the URL should be ignored or not. -func IgnoreMatch(url string, ignoreSlice []string) bool { - for _, ignore := range ignoreSlice { +func IgnoreMatch(url string, ignoreSlice *[]string) bool { + for _, ignore := range *ignoreSlice { if strings.Contains(url, ignore) { return true } diff --git a/pkg/output/beautify.go b/pkg/output/beautify.go index f6deecf..29ed3f7 100644 --- a/pkg/output/beautify.go +++ b/pkg/output/beautify.go @@ -39,8 +39,8 @@ func Beautify() { banner2 := " ___ __ _ _ __(_) __| | __| (_)\n" banner3 := " / __/ _` | '__| |/ _` |/ _` | |\n" banner4 := " | (_| (_| | | | | (_| | (_| | |\n" - banner5 := " \\___\\__,_|_| |_|\\__,_|\\__,_|_| v1.2.1\n" - banner6 := "\n" + banner5 := " \\___\\__,_|_| |_|\\__,_|\\__,_|_| v1.3.0\n" + banner6 := "" banner7 := " > github.com/edoardottt/cariddi\n" banner8 := " > edoardoottavianelli.it\n" banner9 := "========================================\n" @@ -49,7 +49,7 @@ func Beautify() { bannerPart2 := banner6 + banner7 + banner8 + banner9 color.Set(color.FgCyan) - fmt.Fprintf(os.Stderr, bannerPart1) + fmt.Fprint(os.Stderr, bannerPart1) color.Unset() - fmt.Fprintf(os.Stderr, bannerPart2) + fmt.Fprint(os.Stderr, bannerPart2) } diff --git a/pkg/output/json.go b/pkg/output/json.go index d72fd2a..0e821ca 100644 --- a/pkg/output/json.go +++ b/pkg/output/json.go @@ -35,7 +35,7 @@ import ( "github.com/gocolly/colly" ) -type JsonData struct { +type JSONData struct { URL string `json:"url"` Method string `json:"method"` StatusCode int `json:"status_code"` @@ -60,7 +60,7 @@ type MatcherResult struct { Match string `json:"match"` } -func GetJsonString( +func GetJSONString( r *colly.Response, secrets []scanner.SecretMatched, parameters []scanner.Parameter, @@ -68,22 +68,28 @@ func GetJsonString( errors []scanner.ErrorMatched, infos []scanner.InfoMatched, ) ([]byte, error) { - // Parse response headers headers := r.Headers contentTypes := (*headers)["Content-Type"] + contentLengths := (*headers)["Content-Length"] contentType := "" + contentLength := 0 + errorList := []MatcherResult{} + infoList := []MatcherResult{} + secretList := []MatcherResult{} + + // Set content type if len(contentTypes) > 0 { - contentType = contentTypes[0] + contentType = strings.Split(contentTypes[0], "; ")[0] } - contentLength := 0 - contentLengths := (*headers)["Content-Length"] + // Set content length if len(contentLengths) > 0 { ret, err := strconv.Atoi(contentLengths[0]) if err != nil { return nil, err } + contentLength = ret } @@ -94,14 +100,12 @@ func GetJsonString( lines := len(strings.Split(string(r.Body), "\n")) // Process secrets - secretList := []MatcherResult{} for _, secret := range secrets { secretMatch := MatcherResult{secret.Secret.Name, secret.Match} secretList = append(secretList, secretMatch) } // Process infos - infoList := []MatcherResult{} for _, info := range infos { secretMatch := MatcherResult{info.Info.Name, info.Match} infoList = append(infoList, secretMatch) diff --git a/pkg/scanner/secrets.go b/pkg/scanner/secrets.go index 81b49a9..db2b000 100644 --- a/pkg/scanner/secrets.go +++ b/pkg/scanner/secrets.go @@ -86,14 +86,14 @@ func GetSecretRegexes() []Secret { "Facebook Secret Key", "Facebook Secret Key", `(?i)(facebook|fb)(.{0,20})?(?-i)['\"][0-9a-f]{32}['\"]`, - []string{"facebook.com/", "facebook.svg"}, + []string{"facebook.com", "facebook.svg"}, "?", }, { "Facebook Client ID", "Facebook Client ID", `(?i)(facebook|fb)(.{0,20})?['\"][0-9]{13,17}['\"]`, - []string{"facebook.com/", "facebook.svg"}, + []string{"facebook.com", "facebook.svg"}, "?", }, { @@ -114,14 +114,14 @@ func GetSecretRegexes() []Secret { "Twitter Secret Key", "Twitter Secret Key", `(?i)twitter(.{0,20})?[0-9a-z]{35,44}`, - []string{}, + []string{"twitter.com"}, "?", }, { "Twitter Client ID", "Twitter Client ID", `(?i)twitter(.{0,20})?[0-9a-z]{18,25}`, - []string{}, + []string{"twitter.com"}, "?", }, { @@ -156,14 +156,14 @@ func GetSecretRegexes() []Secret { "LinkedIn Client ID", "LinkedIn Client ID", `(?i)linkedin(.{0,20})?(?-i)[0-9a-z]{12}`, - []string{"linkedin.com/", "linkedin.svg"}, + []string{"linkedin.com", "linkedin.svg"}, "?", }, { "LinkedIn Secret Key", "LinkedIn Secret Key", `(?i)linkedin(.{0,20})?[0-9a-z]{16}`, - []string{"linkedin.com/", "linkedin.svg"}, + []string{"linkedin.com", "linkedin.svg"}, "?", }, { @@ -333,7 +333,42 @@ func GetSecretRegexes() []Secret { "S3 Bucket", `(?:[a-zA-Z0-9_-]+s3\.amazonaws\.com|[a-zA-Z0-9_.-]+amazonaws\.com|` + `[a-zA-Z0-9-\.\_]+\.s3\.amazonaws\.com|s3\:\/\/[a-zA-Z0-9-\.\_]+|` + - `s3-[a-zA-Z0-9-\.\_\/]+|s3\.amazonaws\.com/[a-zA-Z0-9-\.\_]+)`, + `s3\.amazonaws\.com/[a-zA-Z0-9-\.\_]+)`, + []string{}, + "?", + }, + { + "Discord Webhook", + "Discord Webhook", + `https\:\/\/discordapp\.com\/api\/webhooks\/[0-9]+/[A-Za-z0-9\-]+`, + []string{}, + "?", + }, + { + "Google Calendar URI", + "Google Calendar URI", + `https\:\/\/(.*)calendar\.google\.com\/calendar\/[0-9a-z\/]+\/embed\?src=[A-Za-z0-9%@&;=\-_\.\/]+`, + []string{}, + "?", + }, + { + "Google OAuth Access Key", + "Google OAuth Access Key", + `ya29\.[0-9A-Za-z\-_]+`, + []string{}, + "?", + }, + { + "Mapbox Token Disclosure", + "Mapbox Token Disclosure", + `(pk|sk)\.eyJ1Ijoi\w+\.[\w-]*`, + []string{}, + "?", + }, + { + "Microsoft Teams Webhook", + "Microsoft Teams Webhook", + `https\:\/\/outlook\.office\.com\/webhook\/[A-Za-z0-9\-@]+\/IncomingWebhook\/[A-Za-z0-9\-]+\/[A-Za-z0-9\-]+`, []string{}, "?", }, diff --git a/snapcraft.yaml b/snapcraft.yaml new file mode 100644 index 0000000..45006dd --- /dev/null +++ b/snapcraft.yaml @@ -0,0 +1,22 @@ +name: cariddi +summary: Fast web crawler and scanner +description: | + Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more +version: 1.3.0 +grade: stable +base: core20 + +confinement: strict + +apps: + cariddi: + command: bin/cariddi + plugs: + - home + - network + +parts: + cariddi: + plugin: go + source-type: git + source: https://github.com/edoardottt/cariddi