Contents

=begin
                  Arachni
  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <[e-mail]>

  This is free software; you can copy and distribute and modify
  this program under the term of the GPL v2.0 License
  (See LICENSE file for details)

=end

module Arachni
module Modules

#
# CVS/SVN users recon module.
#
# Scans every page for CVS/SVN users.
#
# @author: morpheuslaw <[e-mail]>
# @version: 0.1
#
class CvsSvnUsers < Arachni::Module::Base

    def initialize( page )
        @page = page
    end

    def run
        regexps = [
            /\$Author: (.*) \$/,
            /\$Locker: (.*) \$/,
            /\$Header: .* (.*) (Exp )?\$/,
            /\$Id: .* (.*) (Exp )?\$/
        ]

        matches = regexps.map {
            |regexp|
            @page.html.scan( regexp )
        }.flatten.reject{ |match| !match || match =~ /Exp/ }.map{ |match| match.strip }.uniq

        matches.each {
            |match|
            log(
                :regexp  => regexps.to_s,
                :match   => match,
                :element => Issue::Element::BODY
            )
        }

    end

    def self.info
        {
            :name           => 'CVS/SVN users',
            :description    => %q{Scans every page for CVS/SVN users.},
            :author         => 'morpheuslaw <[e-mail]>',
            :version        => '0.1',
            :targets        => { 'Generic' => 'all' },
            :issue   => {
                :name        => %q{CVS/SVN user disclosure.},
                :description => %q{A CVS or SVN user is disclosed in the body of the HTML page.},
                :cwe         => '200',
                :severity    => Issue::Severity::LOW,
                :cvssv2      => '0',
                :remedy_guidance    => %q{Remove all CVS and SVN users from the body of the HTML page.},
                :remedy_code => '',
            }
        }
    end

end
end
end

Version data entries

5 entries across 5 versions & 1 rubygems

Version	Path
arachni-0.4.0.4	modules/recon/grep/cvs_svn_users.rb
arachni-0.4.0.3	modules/recon/grep/cvs_svn_users.rb
arachni-0.4.0.2	modules/recon/grep/cvs_svn_users.rb
arachni-0.4.0.1	modules/recon/grep/cvs_svn_users.rb
arachni-0.4	modules/recon/grep/cvs_svn_users.rb