You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
60 lines
1.3 KiB
60 lines
1.3 KiB
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
BASE_URL="${BASE_URL:-https://wx.sstbc.com}"
|
|
CURL_TIMEOUT="${CURL_TIMEOUT:-20}"
|
|
CURL_RESOLVE="${CURL_RESOLVE:-}"
|
|
TMP_DIR="$(mktemp -d)"
|
|
trap 'rm -rf "$TMP_DIR"' EXIT
|
|
|
|
CURL_ARGS=(-sS -L --max-time "$CURL_TIMEOUT")
|
|
if [[ "${CURL_INSECURE:-0}" == "1" ]]; then
|
|
CURL_ARGS+=(-k)
|
|
fi
|
|
if [[ -n "$CURL_RESOLVE" ]]; then
|
|
CURL_ARGS+=(--resolve "$CURL_RESOLVE")
|
|
fi
|
|
|
|
paths=(
|
|
"/docs/"
|
|
"/swagger/"
|
|
"/swagger/json"
|
|
"/api/documentation"
|
|
"/docs/api-docs.json"
|
|
"/docs/api-docs.yaml"
|
|
"/swagger/index.html"
|
|
"/swagger/swagger-ui.js"
|
|
"/storage/api-docs/api-docs.json"
|
|
)
|
|
|
|
failed=0
|
|
for index in "${!paths[@]}"; do
|
|
path="${paths[$index]}"
|
|
body="$TMP_DIR/response-$index.body"
|
|
status=""
|
|
|
|
if ! status="$(curl "${CURL_ARGS[@]}" -o "$body" -w '%{http_code}' "$BASE_URL$path")"; then
|
|
status="000"
|
|
fi
|
|
|
|
if [[ "$status" != "403" && "$status" != "404" ]]; then
|
|
printf '%-38s HTTP %s FAIL\n' "$path" "$status"
|
|
failed=1
|
|
continue
|
|
fi
|
|
|
|
if grep -Eiq 'swagger|openapi|api-docs' "$body"; then
|
|
printf '%-38s HTTP %s DOCUMENT_CONTENT_FAIL\n' "$path" "$status"
|
|
failed=1
|
|
continue
|
|
fi
|
|
|
|
printf '%-38s HTTP %s PASS\n' "$path" "$status"
|
|
done
|
|
|
|
if [[ "$failed" -ne 0 ]]; then
|
|
exit 1
|
|
fi
|
|
|
|
printf 'VULN02_DOCUMENTATION_EXPOSURE PASS\n'
|