2021-03-31 13:43:28 +02:00
|
|
|
{ lib
|
|
|
|
|
, fetchFromGitHub
|
|
|
|
|
, python3
|
|
|
|
|
}:
|
|
|
|
|
|
|
|
|
|
python3.pkgs.buildPythonApplication rec {
|
|
|
|
|
pname = "wapiti";
|
2021-07-31 19:53:32 +02:00
|
|
|
version = "3.0.5";
|
2021-03-31 13:43:28 +02:00
|
|
|
|
|
|
|
|
src = fetchFromGitHub {
|
|
|
|
|
owner = "wapiti-scanner";
|
|
|
|
|
repo = pname;
|
|
|
|
|
rev = version;
|
2021-07-31 19:53:32 +02:00
|
|
|
sha256 = "0663hzpmn6p5xh65d2gk4yk2zh992lfd9lhdwwabhpv3n85nza75";
|
2021-03-31 13:43:28 +02:00
|
|
|
};
|
|
|
|
|
|
|
|
|
|
nativeBuildInputs = with python3.pkgs; [
|
|
|
|
|
pytest-runner
|
|
|
|
|
];
|
|
|
|
|
|
|
|
|
|
propagatedBuildInputs = with python3.pkgs; [
|
|
|
|
|
beautifulsoup4
|
|
|
|
|
browser-cookie3
|
2021-07-31 19:53:32 +02:00
|
|
|
cryptography
|
2021-03-31 13:43:28 +02:00
|
|
|
Mako
|
|
|
|
|
markupsafe
|
|
|
|
|
pysocks
|
2021-07-31 19:53:32 +02:00
|
|
|
httpx
|
|
|
|
|
httpx-ntlm
|
|
|
|
|
httpx-socks
|
2021-03-31 13:43:28 +02:00
|
|
|
six
|
|
|
|
|
tld
|
|
|
|
|
yaswfp
|
|
|
|
|
] ++ lib.optionals (python3.pythonOlder "3.8") [ importlib-metadata ];
|
|
|
|
|
|
|
|
|
|
checkInputs = with python3.pkgs; [
|
2021-07-31 19:53:32 +02:00
|
|
|
respx
|
|
|
|
|
pytest-asyncio
|
2021-03-31 13:43:28 +02:00
|
|
|
pytestCheckHook
|
|
|
|
|
];
|
|
|
|
|
|
|
|
|
|
postPatch = ''
|
2021-07-31 19:53:32 +02:00
|
|
|
# Ignore pinned versions
|
2021-03-31 13:43:28 +02:00
|
|
|
substituteInPlace setup.py \
|
2021-07-31 19:53:32 +02:00
|
|
|
--replace "==" ">="
|
|
|
|
|
substituteInPlace setup.cfg \
|
|
|
|
|
--replace " --cov" ""
|
|
|
|
|
'';
|
|
|
|
|
|
|
|
|
|
preCheck = ''
|
|
|
|
|
export HOME=$(mktemp -d);
|
2021-03-31 13:43:28 +02:00
|
|
|
'';
|
|
|
|
|
|
|
|
|
|
disabledTests = [
|
|
|
|
|
# Tests requires network access
|
|
|
|
|
"test_attr"
|
|
|
|
|
"test_bad_separator_used"
|
|
|
|
|
"test_blind"
|
|
|
|
|
"test_chunked_timeout"
|
2021-07-31 19:53:32 +02:00
|
|
|
"test_cookies"
|
|
|
|
|
"test_drop_cookies"
|
|
|
|
|
"test_save_and_restore_state"
|
|
|
|
|
"test_explorer_extract_links"
|
2021-03-31 13:43:28 +02:00
|
|
|
"test_cookies_detection"
|
|
|
|
|
"test_csrf_cases"
|
|
|
|
|
"test_detection"
|
|
|
|
|
"test_direct"
|
|
|
|
|
"test_escape_with_style"
|
|
|
|
|
"test_explorer_filtering"
|
|
|
|
|
"test_false"
|
|
|
|
|
"test_frame"
|
|
|
|
|
"test_headers_detection"
|
|
|
|
|
"test_html_detection"
|
|
|
|
|
"test_implies_detection"
|
|
|
|
|
"test_inclusion_detection"
|
|
|
|
|
"test_meta_detection"
|
|
|
|
|
"test_no_crash"
|
|
|
|
|
"test_options"
|
|
|
|
|
"test_out_of_band"
|
2021-07-31 19:53:32 +02:00
|
|
|
"test_multi_detection"
|
|
|
|
|
"test_vulnerabilities"
|
2021-03-31 13:43:28 +02:00
|
|
|
"test_partial_tag_name_escape"
|
|
|
|
|
"test_prefix_and_suffix_detection"
|
|
|
|
|
"test_qs_limit"
|
|
|
|
|
"test_rare_tag_and_event"
|
|
|
|
|
"test_redirect_detection"
|
|
|
|
|
"test_request_object"
|
|
|
|
|
"test_script"
|
|
|
|
|
"test_ssrf"
|
|
|
|
|
"test_tag_name_escape"
|
|
|
|
|
"test_timeout"
|
|
|
|
|
"test_title_false_positive"
|
|
|
|
|
"test_title_positive"
|
|
|
|
|
"test_true_positive_request_count"
|
|
|
|
|
"test_url_detection"
|
|
|
|
|
"test_warning"
|
|
|
|
|
"test_whole"
|
|
|
|
|
"test_xss_inside_tag_input"
|
|
|
|
|
"test_xss_inside_tag_link"
|
|
|
|
|
"test_xss_uppercase_no_script"
|
|
|
|
|
"test_xss_with_strong_csp"
|
|
|
|
|
"test_xss_with_weak_csp"
|
|
|
|
|
"test_xxe"
|
2021-07-31 19:53:32 +02:00
|
|
|
# Requires a PHP installation
|
|
|
|
|
"test_timesql"
|
|
|
|
|
"test_cookies"
|
2021-03-31 13:43:28 +02:00
|
|
|
];
|
|
|
|
|
|
|
|
|
|
pythonImportsCheck = [ "wapitiCore" ];
|
|
|
|
|
|
|
|
|
|
meta = with lib; {
|
|
|
|
|
description = "Web application vulnerability scanner";
|
|
|
|
|
longDescription = ''
|
|
|
|
|
Wapiti allows you to audit the security of your websites or web applications.
|
|
|
|
|
It performs "black-box" scans (it does not study the source code) of the web
|
|
|
|
|
application by crawling the webpages of the deployed webapp, looking for
|
|
|
|
|
scripts and forms where it can inject data. Once it gets the list of URLs,
|
|
|
|
|
forms and their inputs, Wapiti acts like a fuzzer, injecting payloads to see
|
|
|
|
|
if a script is vulnerable.
|
|
|
|
|
'';
|
|
|
|
|
homepage = "https://wapiti-scanner.github.io/";
|
|
|
|
|
license = with licenses; [ gpl2Only ];
|
|
|
|
|
maintainers = with maintainers; [ fab ];
|
|
|
|
|
};
|
|
|
|
|
}
|
