sif/internal/scan/frameworks/argmax_shadowing_test.go at f23fd00ddb8adc47c20d7b5b7e2994c60140fcd1 · vmfunc/sif · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
/*
·━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━·
:                                                                               :
:   █▀ █ █▀▀   ·   Blazing-fast pentesting suite                                :
:   ▄█ █ █▀    ·   BSD 3-Clause License                                         :
:                                                                               :
:   (c) 2022-2026 vmfunc, xyzeva,                                               :
:                 lunchcat alumni & contributors                                :
:                                                                               :
·━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━·
*/

package frameworks_test

import (
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/vmfunc/sif/internal/scan/frameworks"
	_ "github.com/vmfunc/sif/internal/scan/frameworks/detectors"
)

// DetectFramework reports a single argmax across one registry, so a detector
// that clears its own bar on one ubiquitous marker outranks a real framework
// that only landed its primary signal. these pin the two cases that bit.

// a real wordpress site behind cloudflare: the app framework must win, not the edge.
func TestHostingDoesNotShadowRealFramework(t *testing.T) {
	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
		w.Header().Set("CF-RAY", "8a1b2c3d4e5f6789-LAX")
		w.Header().Set("Server", "cloudflare")
		w.WriteHeader(200)
		_, _ = w.Write([]byte(`<!DOCTYPE html><html><head>
<link rel="stylesheet" href="/wp-content/themes/twentytwentyfour/style.css">
<script src="/wp-includes/js/jquery/jquery.min.js"></script>
<link rel="https://api.w.org/" href="/wp-json/">
</head><body>hello</body></html>`))
	}))
	defer srv.Close()

	res, err := frameworks.DetectFramework(srv.URL, 5e9, "")
	if err != nil {
		t.Fatalf("detect: %v", err)
	}
	if res == nil {
		t.Fatal("no framework detected")
	}
	t.Logf("winner=%q confidence=%.4f", res.Name, res.Confidence)
	if res.Name != "WordPress" {
		t.Errorf("edge/cdn shadowed the real framework: got %q (%.4f), want WordPress", res.Name, res.Confidence)
	}
}

// a django app that ships jquery, as a huge share of them do. jquery is a
// library on most of the web, so it must not outrank the app framework.
func TestJQueryDoesNotShadowRealFramework(t *testing.T) {
	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
		w.Header().Set("Set-Cookie", "csrftoken=abc123; Path=/")
		w.WriteHeader(200)
		_, _ = w.Write([]byte(`<!DOCTYPE html><html><head>
<script src="/static/js/jquery.min.js"></script>
<script src="/static/js/jquery-3.6.0.js"></script>
</head><body><form><input name="csrfmiddlewaretoken" value="x"></form></body></html>`))
	}))
	defer srv.Close()

	res, err := frameworks.DetectFramework(srv.URL, 5e9, "")
	if err != nil {
		t.Fatalf("detect: %v", err)
	}
	if res == nil {
		t.Fatal("no framework detected")
	}
	t.Logf("winner=%q confidence=%.4f", res.Name, res.Confidence)
	if res.Name == "jQuery" {
		t.Errorf("jquery shadowed the real framework (%.4f)", res.Confidence)
	}
}