pyfiscan - Free web-application vulnerability and version sca

项目说明

pyfiscan

About
-----

Pyfiscan is free web-application and scanner and can be
used to locate out-dated of common web-applications in Linux-servers.
Example use case is hosting-pro keeping eye on their users installations
to keep up with security-updates. Fingerprints are easy to create and modify as
user can write those in YAML-syntax. Pyfiscan also contains tool to create
email alerts using templates.

Requirements
------------

* Python 3
* Python modules PyYAML docopt chardet
* GNU/Linux web server

Testing is done mainly with GNU/Linux Debian stable.
Windows is not currently supported.

Detects following software
--------------------------

* Abantecart
* ATutor
* b2e
* BigTree CMS
* Bugzilla
* Centreon
* Claroline
* ClipperCMS
* CMSimple
* CMSimple_XH
* CMSMS
* Collabtive
* Concrete5
* Coppermine
* Cotonti
* Croogo
* CubeCart
* Dolibarr
* Dotclear
* Drupal
* e107
* Elefant CMS
* EspoCRM
* Etherpad
* flatCore CMS
* FluxBB
* Foswiki
* FUEL CMS
* Gallery
* Gollum
* HelpDEZk
* HumHub
* ImpressCMS
* ImpressPages
* Jamroom
* Joomla
* Kanboard
* KCFinder
* LiteCart
* Magnolia
* Mahara
* MantisBT
* MediaWiki
* Microweber
* MiniBB
* MODX Re
* MoinMoin
* MyBB
* Nibbleblog
* Open Source Social Network
* OpenCart (recommends not to use this software)
* osDate
* ownCloud
* Oxwall
* PBBoard
* phpBB3
* PhpGedView
* phpLiteAdmin
* phpMyAdmin
* Piwigo
* Piwik
* PmWiki
* Postfix Admin
* Redaxo
* Redmine
* Roundcube
* SaurusCMS
* Serendipity
* Shaarli
* Shopware
* SMF
* Spina CMS
* SPIP
* SQLiteManager
* SquirrelMail
* TestLink
* TikiWiki
* Trac
* Forums
* WikkaWiki
* WordPress
* Zenario
* Zenphoto
* Zikula

Detects following end-of-life software:
---------------------------------------

* Bugzilla 4.2 is end-of-life since 2015-11-30
* Drupal 6 is end-of-life since 2016-02-24
* Drupal 9.0 is end-of-life
* Gallery 1
* Joomla 1.5 is end-of-life since 2012-04-30
* Joomla 1.6 is end-of-life since 2011-08-19. 1.6.x should be upgraded to 1.6.6 before moving to 1.7.x
* Joomla 1.7 is end-of-life since 2012-02-24
* Joomla 2.5
* MediaWiki 1.18
* MediaWiki 1.19 is end-of-life since 2015-04-25
* MediaWiki 1.20
* MediaWiki 1.21 is end-of-life since 2014-06-25
* MediaWiki 1.22
* MediaWiki 1.23 is end-of-life since 2017-05-31
* MediaWiki 1.24
* MediaWiki 1.25
* MediaWiki 1.26 is end-of-life since 2016-11-20
* MediaWiki 1.27 is end-of-life since 2019-06-06
* MediaWiki 1.28 is end-of-life since 2017-11-01
* MediaWiki 1.29 is end-of-life since 2018-06
* MediaWiki 1.30 is end-of-life since 2019-06-06
* MediaWiki 1.31 is end-of-life since 2021-09-30
* MediaWiki 1.32 is end-of-life since 2020-01-23
* MediaWiki 1.33 is end-of-life since 2020-06-24
* MediaWiki 1.34 is end-of-life since 2020-11-30
* MediaWiki 1.36 is end-of-life since 2022-06-03
* MediaWiki 1.37 is end-of-life since 2022-11-30
* SaurusCMS
* ownCloud 4
* ownCloud 5
* ownCloud 6
* ownCloud 7
* ownCloud 8.0
* ownCloud 8.1
* ownCloud 8.2

Installation
------------

sudo apt install python3 python3-pip git
git clone && cd pyfiscan
-p python3 venv
source ./venv/bin/activate
pip3 install -r requirements.lst

or you can use BlackArch Linux.

Notes
-----

* WordPress
* Announcing a secure SWFUpload fork
* Joomla
* Upgrade should be done using "Extension manager -> Upgrade" in 1.6.6 and later
* Release and support cycle
* Setup Security checklist
* Upgrading and migrating Joomla
* Joomla 2.x creates random SQL table prefix
* Joomla 3.x informs and shows user a button to remoy
* Creates ./configuration.php in installation
* Creates robots.txt, which contains word "Joomla"
* SMF
* End of life of SMF 1.0
* Installer requests users with button to delete install.php
* TikiWiki
* End of life of TikiWiki 7.x
* 8.4 is last release of TikiWiki 8.x
* End of life of TikiWiki 8.x
* MediaWiki
* End of Life of 1.18.x
* Gallery
* Not installed when config.php is missing.
*
* Upgrade using:

php index.php upgrade
* phpBB ( unknown)
* Open installation is not a since web-interface requests user to authenticate by inserting random data to file.
* Coppermine
* Not installed when include/config.inc.php is missing.
* Owncloud
* status.php outputs: {"installed":"true","":"5.0.6","":"5.0.5","edition":""}
* Piwigo
* Not installed if local/config/database.inc.php is missing.
* Claroline
* Not installed when platform/conf/claro_main.conf.php is missing.
* Installation pages request user to remo/install/ directory.

Happy users
-----------

* DevNet Oy
* Kapsi Internet-käyttäjät ry
* Shellit.org
* Loopia.se

Contributors
------------

* aapa
* Ari-Martti Hopiavuori
* Atte H. "guaqua"
* Janne Cederberg
* Joonas Kuorilehto
* Juhamatti Niemelä
* Linus Fogelholk
* motikan2010
* Olli Pekkola
* Paul Grant
* Tuomo Komulainen

项目信息

开发语言：Python

Star 数：575

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Free web-application vulnerability and version scanner展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。