powered by strapi
`))
+ w.Write([]byte(`welcome
`))
}))
defer server.Close()
diff --git a/internal/scan/frameworks/detectors/backend.go b/internal/scan/frameworks/detectors/backend.go
index f9616041..80bda9d7 100644
--- a/internal/scan/frameworks/detectors/backend.go
+++ b/internal/scan/frameworks/detectors/backend.go
@@ -22,6 +22,7 @@ package detectors
import (
"math"
"net/http"
+ "strings"
fw "github.com/vmfunc/sif/internal/scan/frameworks"
)
@@ -43,6 +44,15 @@ func init() {
fw.Register(&adonisDetector{})
fw.Register(&cakephpDetector{})
fw.Register(&codeigniterDetector{})
+ fw.Register(&tornadoDetector{})
+ fw.Register(&cherrypyDetector{})
+ fw.Register(&playDetector{})
+ fw.Register(&sailsDetector{})
+ fw.Register(&beegoDetector{})
+ fw.Register(&jsfDetector{})
+ fw.Register(&gwtDetector{})
+ fw.Register(&vaadinDetector{})
+ fw.Register(&coldfusionDetector{})
}
// sigmoidConfidence maps the matched-weight fraction to a 0-1 confidence,
@@ -52,7 +62,22 @@ func sigmoidConfidence(score float32) float32 {
return float32(1.0 / (1.0 + math.Exp(-(float64(score)-0.3)*10.0)))
}
-// laravelDetector detects Laravel framework.
+// serverVersion pulls the trailing version out of a "Whitelabel Error Page
This application has no explicit mapping for /error
There was an unexpected error (type=Not Found, status=404).
`, http.Header{}},
+ }
+
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ conf, _ := tt.detector.Detect(tt.body, tt.headers)
+ if conf <= 0.5 {
+ t.Errorf("%s: confidence = %.3f, want > 0.5", tt.name, conf)
+ }
+ })
+ }
+}
+
+func TestWebFrameworkDetectors_Negative(t *testing.T) {
+ tests := []struct {
+ name string
+ detector fw.Detector
+ body string
+ headers http.Header
+ }{
+ {"JSF prose", &jsfDetector{}, "In JSF, the javax.faces.ViewState field stores view state.
", http.Header{}}, + {"GWT prose", &gwtDetector{}, "GWT writes a .nocache.js bootstrap that is never cached.
", http.Header{}}, + {"Vaadin prose", &vaadinDetector{}, "Vaadin is a Java web framework with a Vaadin-Security-Key concept.
", http.Header{}}, + {"Vaadin path only", &vaadinDetector{}, ``, http.Header{}}, + {"Vaadin global only", &vaadinDetector{}, ``, http.Header{}}, + {"ColdFusion id only", &coldfusionDetector{}, "", hdr("Set-Cookie", "CFID=2401; Path=/")}, + {"CakePHP prose", &cakephpDetector{}, `cakephp tag`, http.Header{}}, + {"Strapi prose", &strapiDetector{}, "Strapi is an open source headless CMS built on Node.
", http.Header{}}, + {"Strapi domain link header", &strapiDetector{}, "", hdr("Link", "TYPO3 CMS is a popular enterprise CMS.
`, http.Header{}}, + {"Webflow review", &webflowDetector{}, ``, http.Header{}}, + {"HubSpot pricing", &hubspotDetector{}, ``, http.Header{}}, + {"Webflow brand og", &webflowDetector{}, ``, http.Header{}}, + {"HubSpot brand og", &hubspotDetector{}, ``, http.Header{}}, + {"Wix mention", &wixDetector{}, `I built my first site on Wix.com years ago.
`, http.Header{}}, + {"Sitecore plain cookie", &sitecoreDetector{}, "", hdr("Set-Cookie", "sessionid=abc; path=/")}, + {"OpenCart plain cookie", &opencartDetector{}, "", hdr("Set-Cookie", "PHPSESSID=abc; path=/")}, + {"DotNetNuke plain cookie", &dnnDetector{}, "", hdr("Set-Cookie", "ASP.NET_SessionId=abc; path=/")}, + {"Liferay plain header", &liferayDetector{}, "", hdr("Server", "nginx/1.25.3")}, + {"Liferay prose", &liferayDetector{}, "Liferay is a Java portal platform.
", http.Header{}}, + {"Squarespace prose", &squarespaceDetector{}, `Squarespace is a hosted website builder.
`, http.Header{}}, + {"Shopify cdn link header", &shopifyDetector{}, "", hdr("Link", "We migrated from Bitrix to Shopify last year.
`, http.Header{}}, + {"Blogger comparison prose", &bloggerDetector{}, ``, http.Header{}}, + {"MediaWiki brand og", &mediawikiDetector{}, ``, http.Header{}}, + {"Discourse comparison og", &discourseDetector{}, ``, http.Header{}}, + {"XenForo prose", &xenforoDetector{}, `XenForo is a commercial forum platform.
`, http.Header{}}, + {"Moodle unrelated cookie", &moodleDetector{}, "", hdr("Set-Cookie", "sessionid=abc; path=/")}, + {"Moodle minified collision", &moodleDetector{}, ``, http.Header{}}, + {"Plone brand og", &ploneDetector{}, ``, http.Header{}}, + {"Grav prose", &gravDetector{}, `Grav is a flat-file CMS.
`, http.Header{}}, + {"Textpattern brand og", &textpatternDetector{}, ``, http.Header{}}, + {"Statamic unrelated header", &statamicDetector{}, "", hdr("Server", "nginx/1.25.3")}, + {"Statamic domain in link header", &statamicDetector{}, "", hdr("Link", "Flarum is a delightfully simple forum platform.
`, http.Header{}}, + {"Flarum near miss id", &flarumDetector{}, ``, http.Header{}}, + {"Flarum generic forum asset", &flarumDetector{}, `
`, http.Header{}},
+ {"XWiki prose", &xwikiDetector{}, `XWiki is an enterprise wiki platform.
`, http.Header{}}, + {"Bolt brand og", &boltDetector{}, ``, http.Header{}}, + {"ExpressionEngine prose", &expressionengineDetector{}, `ExpressionEngine is a flexible PHP CMS.
`, http.Header{}}, + {"ExpressionEngine exp prefix collision", &expressionengineDetector{}, "", hdr("Set-Cookie", "exp_date=2026; path=/")}, + {"NodeBB prose", &nodebbDetector{}, `We run NodeBB for our community forum.
`, http.Header{}}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + conf, _ := tt.detector.Detect(tt.body, tt.headers) + if conf > 0.5 { + t.Errorf("%s: confidence = %.3f, want <= 0.5", tt.name, conf) + } + }) + } +} + +func TestPlatformDetectors_Version(t *testing.T) { + tests := []struct { + name string + detector fw.Detector + body string + want string + }{ + {"TYPO3 4.x", &typo3Detector{}, ``, "4.5"}, + {"TYPO3 modern", &typo3Detector{}, ``, "unknown"}, + {"MediaWiki", &mediawikiDetector{}, ``, "1.47.0"}, + {"Discourse", &discourseDetector{}, ``, "3.2.0"}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + _, version := tt.detector.Detect(tt.body, http.Header{}) + if version != tt.want { + t.Errorf("%s: version = %q, want %q", tt.name, version, tt.want) + } + }) + } +} diff --git a/internal/scan/frameworks/detectors/frontend.go b/internal/scan/frameworks/detectors/frontend.go index 488cfa46..46a9596c 100644 --- a/internal/scan/frameworks/detectors/frontend.go +++ b/internal/scan/frameworks/detectors/frontend.go @@ -35,9 +35,16 @@ func init() { fw.Register(&backboneDetector{}) fw.Register(&meteorDetector{}) fw.Register(&htmxDetector{}) + fw.Register(&alpineDetector{}) + fw.Register(&jqueryDetector{}) + fw.Register(&knockoutDetector{}) + fw.Register(&livewireDetector{}) + fw.Register(&qwikDetector{}) + fw.Register(&stimulusDetector{}) + fw.Register(&turboDetector{}) + fw.Register(&unpolyDetector{}) } -// reactDetector detects React framework. type reactDetector struct{} func (d *reactDetector) Name() string { return "React" } @@ -64,7 +71,6 @@ func (d *reactDetector) Detect(body string, headers http.Header) (float32, strin return confidence, version } -// vueDetector detects Vue.js framework. type vueDetector struct{} func (d *vueDetector) Name() string { return "Vue.js" } @@ -92,7 +98,6 @@ func (d *vueDetector) Detect(body string, headers http.Header) (float32, string) return confidence, version } -// angularDetector detects Angular framework. type angularDetector struct{} func (d *angularDetector) Name() string { return "Angular" } @@ -122,7 +127,6 @@ func (d *angularDetector) Detect(body string, headers http.Header) (float32, str return confidence, version } -// svelteDetector detects Svelte framework. type svelteDetector struct{} func (d *svelteDetector) Name() string { return "Svelte" } @@ -147,7 +151,6 @@ func (d *svelteDetector) Detect(body string, headers http.Header) (float32, stri return confidence, version } -// emberDetector detects Ember.js framework. type emberDetector struct{} func (d *emberDetector) Name() string { return "Ember.js" } @@ -175,7 +178,6 @@ func (d *emberDetector) Detect(body string, headers http.Header) (float32, strin return confidence, version } -// backboneDetector detects Backbone.js framework. type backboneDetector struct{} func (d *backboneDetector) Name() string { return "Backbone.js" } @@ -202,7 +204,6 @@ func (d *backboneDetector) Detect(body string, headers http.Header) (float32, st return confidence, version } -// htmxDetector detects the htmx library. type htmxDetector struct{} func (d *htmxDetector) Name() string { return "htmx" } @@ -230,7 +231,208 @@ func (d *htmxDetector) Detect(body string, headers http.Header) (float32, string return confidence, version } -// meteorDetector detects Meteor framework. +type alpineDetector struct{} + +func (d *alpineDetector) Name() string { return "Alpine.js" } + +func (d *alpineDetector) Signatures() []fw.Signature { + return []fw.Signature{ + {Pattern: " x-data", Weight: 0.6}, + {Pattern: "alpinejs", Weight: 0.5}, + {Pattern: "x-cloak", Weight: 0.4}, + {Pattern: "x-transition", Weight: 0.4}, + } +} + +func (d *alpineDetector) Detect(body string, headers http.Header) (float32, string) { + base := fw.NewBaseDetector(d.Name(), d.Signatures()) + score := base.MatchSignatures(body, headers) + confidence := sigmoidConfidence(score) + + var version string + if confidence > 0.5 { + version = fw.ExtractVersionOptimized(body, d.Name()).Version + } + return confidence, version +} + +type qwikDetector struct{} + +func (d *qwikDetector) Name() string { return "Qwik" } + +func (d *qwikDetector) Signatures() []fw.Signature { + return []fw.Signature{ + {Pattern: "q:container", Weight: 0.5}, + {Pattern: "q:version", Weight: 0.4}, + {Pattern: "q:base", Weight: 0.3}, + {Pattern: "qwikloader", Weight: 0.3}, + } +} + +func (d *qwikDetector) Detect(body string, headers http.Header) (float32, string) { + base := fw.NewBaseDetector(d.Name(), d.Signatures()) + score := base.MatchSignatures(body, headers) + confidence := sigmoidConfidence(score) + + var version string + if confidence > 0.5 { + version = fw.ExtractVersionOptimized(body, d.Name()).Version + } + return confidence, version +} + +type jqueryDetector struct{} + +func (d *jqueryDetector) Name() string { return "jQuery" } + +func (d *jqueryDetector) Signatures() []fw.Signature { + return []fw.Signature{ + {Pattern: "jquery.min.js", Weight: 0.5}, + {Pattern: "jquery-", Weight: 0.5}, + {Pattern: "jQuery.fn.jquery", Weight: 0.4}, + } +} + +func (d *jqueryDetector) Detect(body string, headers http.Header) (float32, string) { + base := fw.NewBaseDetector(d.Name(), d.Signatures()) + score := base.MatchSignatures(body, headers) + confidence := sigmoidConfidence(score) + + var version string + if confidence > 0.5 { + version = fw.ExtractVersionOptimized(body, d.Name()).Version + } + return confidence, version +} + +// livewireDetector detects Laravel Livewire. +type livewireDetector struct{} + +func (d *livewireDetector) Name() string { return "Livewire" } + +func (d *livewireDetector) Signatures() []fw.Signature { + return []fw.Signature{ + {Pattern: "wire:id", Weight: 0.5}, + {Pattern: "wire:snapshot", Weight: 0.4}, + {Pattern: "wire:model", Weight: 0.4}, + {Pattern: "wire:click", Weight: 0.4}, + } +} + +func (d *livewireDetector) Detect(body string, headers http.Header) (float32, string) { + base := fw.NewBaseDetector(d.Name(), d.Signatures()) + score := base.MatchSignatures(body, headers) + confidence := sigmoidConfidence(score) + + var version string + if confidence > 0.5 { + version = fw.ExtractVersionOptimized(body, d.Name()).Version + } + return confidence, version +} + +// stimulusDetector detects the Stimulus controller framework (part of Hotwire, the Rails 7 default). +type stimulusDetector struct{} + +func (d *stimulusDetector) Name() string { return "Stimulus" } + +func (d *stimulusDetector) Signatures() []fw.Signature { + return []fw.Signature{ + // data-controller= alone is a common enough attribute name in + // unrelated hand-rolled JS that it must not clear the threshold by + // itself; neither must data-action= alone. each needs the other (or + // the definitive @hotwired/stimulus import) alongside it to fire. + {Pattern: "data-controller=", Weight: 0.2}, + {Pattern: "data-action=", Weight: 0.2}, + {Pattern: "@hotwired/stimulus", Weight: 0.6}, + } +} + +func (d *stimulusDetector) Detect(body string, headers http.Header) (float32, string) { + base := fw.NewBaseDetector(d.Name(), d.Signatures()) + score := base.MatchSignatures(body, headers) + confidence := sigmoidConfidence(score) + + var version string + if confidence > 0.5 { + version = fw.ExtractVersionOptimized(body, d.Name()).Version + } + return confidence, version +} + +// turboDetector detects Turbo (part of Hotwire, the Rails 7 default). +type turboDetector struct{} + +func (d *turboDetector) Name() string { return "Turbo" } + +func (d *turboDetector) Signatures() []fw.Signature { + return []fw.Signature{ + {Pattern: "`},
+ {"Alpine cdn plus cloak", &alpineDetector{}, ``},
+ {"Qwik container only", &qwikDetector{}, ``},
+ {"Qwik bootstrap", &qwikDetector{}, ``},
+ {"jQuery cdn", &jqueryDetector{}, ``},
+ {"jQuery googleapis", &jqueryDetector{}, ``},
+ {"jQuery wp bundled", &jqueryDetector{}, ``},
+ {"Livewire component", &livewireDetector{}, ``},
+ {"Stimulus controller", &stimulusDetector{}, ``},
+ {"Stimulus script reference", &stimulusDetector{}, ``},
+ {"Turbo frame", &turboDetector{}, `
Alpine.js is a lightweight framework.
`}, + {"Vue at-click not Alpine", &alpineDetector{}, ``}, + {"Alpine max-data substring", &alpineDetector{}, `Qwik is a resumable framework, see qwik.dev for details.
`}, + {"jQuery prose", &jqueryDetector{}, `migrating off jquery this year.
`}, + {"Livewire single directive", &livewireDetector{}, ``}, + {"Livewire prose", &livewireDetector{}, `Livewire is a full-stack framework for Laravel.
`}, + {"Stimulus prose", &stimulusDetector{}, `Stimulus is a modest JavaScript framework for the HTML you already have.
`}, + {"Stimulus generic data-action", &stimulusDetector{}, ``}, + {"Stimulus generic data-controller only", &stimulusDetector{}, `2 items
`},
+ {"Turbo prose og", &turboDetector{}, `Turbo Drive is great.
`}, + {"Turbo vs legacy turbolinks", &turboDetector{}, ``}, + {"Knockout prose", &knockoutDetector{}, `Knockout.js is an MVVM library for JavaScript.
`}, + {"Unpoly attr substring collision", &unpolyDetector{}, `x
`},
+ }
+
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ conf, _ := tt.detector.Detect(tt.body, http.Header{})
+ if conf > 0.5 {
+ t.Errorf("%s: confidence = %.3f, want <= 0.5", tt.name, conf)
+ }
+ })
+ }
+}
+
+func TestFrontendLibDetectors_Version(t *testing.T) {
+ tests := []struct {
+ name string
+ detector fw.Detector
+ body string
+ want string
+ }{
+ {"jQuery filename", &jqueryDetector{}, ``, "3.6.0"},
+ {"jQuery googleapis path", &jqueryDetector{}, ``, "3.7.1"},
+ {"Alpine cdn", &alpineDetector{}, ``, "3.13.0"},
+ {"Qwik attr", &qwikDetector{}, ``, "1.5.0"},
+ {"Knockout filename", &knockoutDetector{}, ``, "3.5.1"},
+ }
+
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ _, version := tt.detector.Detect(tt.body, http.Header{})
+ if version != tt.want {
+ t.Errorf("%s: version = %q, want %q", tt.name, version, tt.want)
+ }
+ })
+ }
+}
diff --git a/internal/scan/frameworks/detectors/hosting.go b/internal/scan/frameworks/detectors/hosting.go
new file mode 100644
index 00000000..2aae2c1a
--- /dev/null
+++ b/internal/scan/frameworks/detectors/hosting.go
@@ -0,0 +1,174 @@
+/*
+·━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━·
+: :
+: █▀ █ █▀▀ · Blazing-fast pentesting suite :
+: ▄█ █ █▀ · BSD 3-Clause License :
+: :
+: (c) 2022-2026 vmfunc, xyzeva, :
+: lunchcat alumni & contributors :
+: :
+·━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━·
+*/
+
+/*
+
+ BSD 3-Clause License
+ (c) 2022-2026 vmfunc, xyzeva & contributors
+
+*/
+
+package detectors
+
+import (
+ "net/http"
+
+ fw "github.com/vmfunc/sif/internal/scan/frameworks"
+)
+
+// Detectors in this file identify the hosting platform or edge/CDN provider in
+// front of a target rather than its application framework.
+
+func init() {
+ fw.Register(&vercelDetector{})
+ fw.Register(&netlifyDetector{})
+ fw.Register(&githubPagesDetector{})
+ fw.Register(&cloudflareDetector{})
+ fw.Register(&cloudfrontDetector{})
+ fw.Register(&akamaiDetector{})
+ fw.Register(&flyDetector{})
+ fw.Register(&amazonS3Detector{})
+}
+
+type vercelDetector struct{}
+
+func (d *vercelDetector) Name() string { return "Vercel" }
+
+func (d *vercelDetector) Signatures() []fw.Signature {
+ return []fw.Signature{
+ {Pattern: "x-vercel", Weight: 0.6, HeaderOnly: true},
+ }
+}
+
+func (d *vercelDetector) Detect(body string, headers http.Header) (float32, string) {
+ base := fw.NewBaseDetector(d.Name(), d.Signatures())
+ score := base.MatchSignatures(body, headers)
+ return sigmoidConfidence(score), ""
+}
+
+type netlifyDetector struct{}
+
+func (d *netlifyDetector) Name() string { return "Netlify" }
+
+func (d *netlifyDetector) Signatures() []fw.Signature {
+ return []fw.Signature{
+ {Pattern: "x-nf-request-id", Weight: 0.6, HeaderOnly: true},
+ }
+}
+
+func (d *netlifyDetector) Detect(body string, headers http.Header) (float32, string) {
+ base := fw.NewBaseDetector(d.Name(), d.Signatures())
+ score := base.MatchSignatures(body, headers)
+ return sigmoidConfidence(score), ""
+}
+
+// githubPagesDetector detects GitHub Pages (and GitHub-hosted infrastructure).
+type githubPagesDetector struct{}
+
+func (d *githubPagesDetector) Name() string { return "GitHub Pages" }
+
+func (d *githubPagesDetector) Signatures() []fw.Signature {
+ return []fw.Signature{
+ {Pattern: "x-github-request-id", Weight: 0.6, HeaderOnly: true},
+ }
+}
+
+func (d *githubPagesDetector) Detect(body string, headers http.Header) (float32, string) {
+ base := fw.NewBaseDetector(d.Name(), d.Signatures())
+ score := base.MatchSignatures(body, headers)
+ return sigmoidConfidence(score), ""
+}
+
+type cloudflareDetector struct{}
+
+func (d *cloudflareDetector) Name() string { return "Cloudflare" }
+
+func (d *cloudflareDetector) Signatures() []fw.Signature {
+ return []fw.Signature{
+ {Pattern: "cf-ray", Weight: 0.6, HeaderOnly: true},
+ }
+}
+
+func (d *cloudflareDetector) Detect(body string, headers http.Header) (float32, string) {
+ base := fw.NewBaseDetector(d.Name(), d.Signatures())
+ score := base.MatchSignatures(body, headers)
+ return sigmoidConfidence(score), ""
+}
+
+// cloudfrontDetector detects the Amazon CloudFront CDN.
+type cloudfrontDetector struct{}
+
+func (d *cloudfrontDetector) Name() string { return "Amazon CloudFront" }
+
+func (d *cloudfrontDetector) Signatures() []fw.Signature {
+ return []fw.Signature{
+ {Pattern: "x-amz-cf-id", Weight: 0.6, HeaderOnly: true},
+ }
+}
+
+func (d *cloudfrontDetector) Detect(body string, headers http.Header) (float32, string) {
+ base := fw.NewBaseDetector(d.Name(), d.Signatures())
+ score := base.MatchSignatures(body, headers)
+ return sigmoidConfidence(score), ""
+}
+
+type akamaiDetector struct{}
+
+func (d *akamaiDetector) Name() string { return "Akamai" }
+
+func (d *akamaiDetector) Signatures() []fw.Signature {
+ return []fw.Signature{
+ {Pattern: "Akamai-GRN", Weight: 0.5, HeaderOnly: true},
+ {Pattern: "x-akamai", Weight: 0.4, HeaderOnly: true},
+ {Pattern: "AkamaiGHost", Weight: 0.4, HeaderOnly: true},
+ }
+}
+
+func (d *akamaiDetector) Detect(body string, headers http.Header) (float32, string) {
+ base := fw.NewBaseDetector(d.Name(), d.Signatures())
+ score := base.MatchSignatures(body, headers)
+ return sigmoidConfidence(score), ""
+}
+
+type flyDetector struct{}
+
+func (d *flyDetector) Name() string { return "Fly.io" }
+
+func (d *flyDetector) Signatures() []fw.Signature {
+ return []fw.Signature{
+ {Pattern: "fly-request-id", Weight: 0.6, HeaderOnly: true},
+ }
+}
+
+func (d *flyDetector) Detect(body string, headers http.Header) (float32, string) {
+ base := fw.NewBaseDetector(d.Name(), d.Signatures())
+ score := base.MatchSignatures(body, headers)
+ return sigmoidConfidence(score), ""
+}
+
+// amazonS3Detector detects content served from an Amazon S3 bucket.
+type amazonS3Detector struct{}
+
+func (d *amazonS3Detector) Name() string { return "Amazon S3" }
+
+func (d *amazonS3Detector) Signatures() []fw.Signature {
+ return []fw.Signature{
+ {Pattern: "AmazonS3", Weight: 0.6, HeaderOnly: true},
+ {Pattern: "x-amz-bucket-region", Weight: 0.4, HeaderOnly: true},
+ }
+}
+
+func (d *amazonS3Detector) Detect(body string, headers http.Header) (float32, string) {
+ base := fw.NewBaseDetector(d.Name(), d.Signatures())
+ score := base.MatchSignatures(body, headers)
+ return sigmoidConfidence(score), ""
+}
diff --git a/internal/scan/frameworks/detectors/hosting_test.go b/internal/scan/frameworks/detectors/hosting_test.go
new file mode 100644
index 00000000..7221b475
--- /dev/null
+++ b/internal/scan/frameworks/detectors/hosting_test.go
@@ -0,0 +1,73 @@
+/*
+·━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━·
+: :
+: █▀ █ █▀▀ · Blazing-fast pentesting suite :
+: ▄█ █ █▀ · BSD 3-Clause License :
+: :
+: (c) 2022-2026 vmfunc, xyzeva, :
+: lunchcat alumni & contributors :
+: :
+·━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━·
+*/
+
+package detectors
+
+import (
+ "net/http"
+ "testing"
+
+ fw "github.com/vmfunc/sif/internal/scan/frameworks"
+)
+
+func TestHostingDetectors_Positive(t *testing.T) {
+ tests := []struct {
+ name string
+ detector fw.Detector
+ headers http.Header
+ }{
+ {"Vercel", &vercelDetector{}, hdr("x-vercel-id", "sfo1::pdx1::dmmpr-1782439760448-608ebdfc")},
+ {"Netlify", &netlifyDetector{}, hdr("x-nf-request-id", "01KW0V0MYRFJKYYNDRP7KC5DAJ")},
+ {"GitHub Pages", &githubPagesDetector{}, hdr("x-github-request-id", "8714:20C798:191901:19DD8B:6A3DDD67")},
+ {"Cloudflare", &cloudflareDetector{}, hdr("cf-ray", "a118ab5d9e7867e8-SJC")},
+ {"CloudFront", &cloudfrontDetector{}, hdr("x-amz-cf-id", "0MsbJpMBovZpIG2KNmafF4RVM4GXD_iKAnm9friazwXUpC")},
+ {"Akamai GRN", &akamaiDetector{}, hdr("Akamai-GRN", "0.1ea7cb17.1782439763.4a41c389")},
+ {"Akamai server", &akamaiDetector{}, hdr("Server", "AkamaiGHost")},
+ {"Fly.io", &flyDetector{}, hdr("fly-request-id", "01KW0V0QBEWMQ51YPTNZKE3EYJ-sjc")},
+ {"Amazon S3 server", &amazonS3Detector{}, hdr("Server", "AmazonS3")},
+ {"Amazon S3 region", &amazonS3Detector{}, hdr("x-amz-bucket-region", "us-east-2")},
+ }
+
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ conf, _ := tt.detector.Detect("", tt.headers)
+ if conf <= 0.5 {
+ t.Errorf("%s: confidence = %.3f, want > 0.5", tt.name, conf)
+ }
+ })
+ }
+}
+
+func TestHostingDetectors_Negative(t *testing.T) {
+ tests := []struct {
+ name string
+ detector fw.Detector
+ headers http.Header
+ }{
+ {"Vercel plain", &vercelDetector{}, hdr("Server", "nginx/1.25.3")},
+ {"Netlify plain", &netlifyDetector{}, hdr("Server", "nginx")},
+ {"Cloudflare plain", &cloudflareDetector{}, hdr("Server", "nginx")},
+ {"GitHub link header", &githubPagesDetector{}, hdr("Link", "Hugo is a designer.
`}, + {"Jekyll novel", &jekyllDetector{}, ``}, + {"Docusaurus tutorial", &docusaurusDetector{}, ``}, + {"Docusaurus brand og", &docusaurusDetector{}, ``}, + {"MkDocs guide", &mkdocsDetector{}, `MkDocs is great.
`}, + {"plain migration prose", &hugoDetector{}, `We migrated from Jekyll to Hugo last year.
`}, + {"Eleventy brand og", &eleventyDetector{}, ``}, + {"Hexo brand og", &hexoDetector{}, ``}, + {"VuePress release prose", &vuepressDetector{}, ``}, + {"Sphinx link only", &sphinxDetector{}, `Built with Sphinx.
`}, + {"Sphinx doctools only", &sphinxDetector{}, ``}, + {"Nikola Tesla og", &nikolaDetector{}, ``}, + {"Publii brand og", &publiiDetector{}, ``}, + {"Remix audio asset", &remixDetector{}, ``}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + conf, _ := tt.detector.Detect(tt.body, http.Header{}) + if conf > 0.5 { + t.Errorf("%s: confidence = %.3f, want <= 0.5", tt.name, conf) + } + }) + } +} + +func TestSiteGeneratorDetectors_Version(t *testing.T) { + tests := []struct { + name string + detector fw.Detector + body string + want string + }{ + {"Hugo", &hugoDetector{}, ``, "0.163.3"}, + {"Jekyll", &jekyllDetector{}, ``, "4.4.1"}, + {"Docusaurus", &docusaurusDetector{}, ``, "3.10.1"}, + {"MkDocs", &mkdocsDetector{}, ``, "1.6.1"}, + {"Eleventy", &eleventyDetector{}, ``, "3.0.0"}, + {"Eleventy custom label", &eleventyDetector{}, ``, "4.0.0"}, + {"Hexo", &hexoDetector{}, ``, "8.1.1"}, + {"VuePress", &vuepressDetector{}, ``, "2.0.0"}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + _, version := tt.detector.Detect(tt.body, http.Header{}) + if version != tt.want { + t.Errorf("%s: version = %q, want %q", tt.name, version, tt.want) + } + }) + } +} diff --git a/internal/scan/frameworks/version.go b/internal/scan/frameworks/version.go index ee7dc9ec..f28062dc 100644 --- a/internal/scan/frameworks/version.go +++ b/internal/scan/frameworks/version.go @@ -32,7 +32,6 @@ type compiledVersionPattern struct { } // frameworkVersionPatterns maps framework names to their pre-compiled version patterns. -// Patterns are compiled once at package initialization for optimal performance. var frameworkVersionPatterns map[string][]compiledVersionPattern func init() { @@ -142,6 +141,51 @@ func init() { {`Astro[/\s]+[Vv]?(\d+\.\d+(?:\.\d+)?)`, 0.9, "explicit version"}, {`"astro":\s*"[~^]?(\d+\.\d+(?:\.\d+)?)"`, 0.85, "package.json"}, }, + "Hugo": { + {`content="Hugo (\d+\.\d+(?:\.\d+)?)`, 0.95, "generator meta"}, + }, + "Jekyll": { + {`content="Jekyll v(\d+\.\d+(?:\.\d+)?)`, 0.95, "generator meta"}, + }, + "Docusaurus": { + {`content="Docusaurus v(\d+\.\d+(?:\.\d+)?)`, 0.95, "generator meta"}, + }, + "MkDocs": { + {`content="mkdocs-(\d+\.\d+(?:\.\d+)?)`, 0.9, "generator meta"}, + }, + "TYPO3": { + {`content="TYPO3 (\d+\.\d+(?:\.\d+)?)`, 0.9, "generator meta"}, + }, + "Eleventy": { + {`content="Eleventy[^"]*?v(\d+\.\d+(?:\.\d+)?)`, 0.9, "generator meta"}, + }, + "Hexo": { + {`content="Hexo (\d+\.\d+(?:\.\d+)?)`, 0.9, "generator meta"}, + }, + "VuePress": { + {`content="VuePress (\d+\.\d+(?:\.\d+)?)`, 0.9, "generator meta"}, + }, + "jQuery": { + {`jquery-(\d+\.\d+(?:\.\d+)?)(?:\.min)?\.js`, 0.9, "script filename"}, + {`jquery@(\d+\.\d+(?:\.\d+)?)`, 0.85, "CDN reference"}, + {`/jquery/(\d+\.\d+(?:\.\d+)?)/`, 0.85, "CDN path"}, + {`jQuery v(\d+\.\d+(?:\.\d+)?)`, 0.9, "library banner"}, + }, + "Alpine.js": { + {`alpinejs@(\d+\.\d+(?:\.\d+)?)`, 0.85, "CDN reference"}, + }, + "Qwik": { + {`q:version="(\d+\.\d+(?:\.\d+)?)"`, 0.9, "container attribute"}, + }, + "MediaWiki": { + {`content="MediaWiki (\d+\.\d+(?:\.\d+)?)`, 0.9, "generator meta"}, + }, + "Discourse": { + {`content="Discourse (\d+\.\d+(?:\.\d+)?)`, 0.9, "generator meta"}, + }, + "Knockout.js": { + {`knockout-(\d+\.\d+(?:\.\d+)?)`, 0.9, "script filename"}, + }, } // Compile all patterns @@ -160,7 +204,6 @@ func init() { } // ExtractVersionOptimized extracts version using pre-compiled patterns. -// This is exported for use by individual detector implementations. func ExtractVersionOptimized(body string, framework string) VersionMatch { patterns, exists := frameworkVersionPatterns[framework] if !exists { @@ -188,6 +231,8 @@ func ExtractVersionOptimized(body string, framework string) VersionMatch { return bestMatch } +// isValidVersionString checks if a version string is digits and dots only, with +// at most three dots. func isValidVersionString(v string) bool { if v == "" || len(v) > 20 { return false