Skip to content

Commit 563f381

Browse files
vmfuncvmfunc
authored
Merge pull request #40 from vmfunc/feat/framework-detection
feat: framework detection module
2 parents ecf71be + 20ea60c commit 563f381

File tree

7 files changed

+1434
-2
lines changed

7 files changed

+1434
-2
lines changed

‎.github/workflows/runtest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
run: make
2121
- name: Run Sif with features
2222
run: |
23-
./sif -u https://google.com -dnslist small -dirlist small -dork -git -whois -cms
23+
./sif -u https://example.com -dnslist small -dirlist small -dork -git -whois -cms -framework
2424
if [ $? -eq 0 ]; then
2525
echo "Sif ran successfully"
2626
else

‎CONTRIBUTING.md‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,98 @@ When making a pull request, please adhere to the following conventions:
5353

5454
If you have any questions, feel free to ask around on the IRC channel.
5555

56+
## Contributing Framework Detection Patterns
57+
58+
The framework detection module (`pkg/scan/frameworks/detect.go`) identifies web frameworks by analyzing HTTP headers and response bodies. To add support for a new framework:
59+
60+
### Adding a New Framework Signature
61+
62+
1. Add your framework to the `frameworkSignatures` map:
63+
64+
```go
65+
"MyFramework": {
66+
{Pattern: `unique-identifier`, Weight: 0.5},
67+
{Pattern: `header-signature`, Weight: 0.4, HeaderOnly: true},
68+
{Pattern: `body-signature`, Weight: 0.3},
69+
},
70+
```
71+
72+
**Pattern Guidelines:**
73+
- `Weight`: How much this signature contributes to detection (0.0-1.0)
74+
- `HeaderOnly`: Set to `true` for HTTP header patterns
75+
- Use unique identifiers that won't false-positive on other frameworks
76+
- Include multiple patterns for higher confidence
77+
78+
### Adding Version Detection
79+
80+
Add version patterns to `extractVersionWithConfidence()`:
81+
82+
```go
83+
"MyFramework": {
84+
{`MyFramework[/\s]+[Vv]?(\d+\.\d+(?:\.\d+)?)`, 0.9, "explicit version"},
85+
{`"myframework":\s*"[~^]?(\d+\.\d+(?:\.\d+)?)"`, 0.85, "package.json"},
86+
},
87+
```
88+
89+
### Adding CVE Data
90+
91+
Add known vulnerabilities to the `knownCVEs` map:
92+
93+
```go
94+
"MyFramework": {
95+
{
96+
CVE: "CVE-YYYY-XXXXX",
97+
AffectedVersions: []string{"1.0.0", "1.0.1", "1.1.0"},
98+
FixedVersion: "1.2.0",
99+
Severity: "high", // critical, high, medium, low
100+
Description: "Brief description of the vulnerability",
101+
Recommendations: []string{"Update to 1.2.0 or later"},
102+
},
103+
},
104+
```
105+
106+
### Testing Your Changes
107+
108+
Always add tests for new frameworks in `detect_test.go`:
109+
110+
```go
111+
func TestDetectFramework_MyFramework(t *testing.T) {
112+
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
113+
w.WriteHeader(http.StatusOK)
114+
w.Write([]byte(`<html><body>unique-identifier</body></html>`))
115+
}))
116+
defer server.Close()
117+
118+
result, err := DetectFramework(server.URL, 5*time.Second, "")
119+
// assertions...
120+
}
121+
```
122+
123+
### Future Enhancements (Help Wanted)
124+
125+
- **Custom Signature Support**: Allow users to define signatures via config file
126+
- **CVE API Integration**: Real-time CVE data from NVD or other sources
127+
- **Automated Signature Updates**: Fetch new signatures from a central repository
128+
- **Framework Fingerprint Database**: Community-maintained signature database
129+
130+
## Configuration
131+
132+
### Framework Detection Flags
133+
134+
| Flag | Description |
135+
|------|-------------|
136+
| `-framework` | Enable framework detection |
137+
| `-timeout` | HTTP request timeout (affects all modules) |
138+
| `-threads` | Number of concurrent workers |
139+
| `-log` | Directory to save scan results |
140+
| `-debug` | Enable debug logging for verbose output |
141+
142+
### Environment Variables
143+
144+
| Variable | Description |
145+
|----------|-------------|
146+
| `SHODAN_API_KEY` | API key for Shodan host intelligence |
147+
56148
## Packaging
57149

58150
We'd love it if you helped us bring sif to your distribution.

‎README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,9 @@ requires go 1.23+
6363
# sql recon + lfi scanning
6464
./sif -u https://example.com -sql -lfi
6565

66+
# framework detection (with cve lookup)
67+
./sif -u https://example.com -framework
68+
6669
# everything
6770
./sif -u https://example.com -all
6871
```
@@ -88,6 +91,7 @@ run `./sif -h` for all options.
8891
| `shodan` | shodan host intelligence (requires SHODAN_API_KEY) |
8992
| `sql` | sql admin panel and error disclosure detection |
9093
| `lfi` | local file inclusion vulnerability scanning |
94+
| `framework` | web framework detection with version + cve lookup |
9195

9296
## contribute
9397

‎pkg/config/config.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ type Settings struct {
4444
Shodan bool
4545
SQL bool
4646
LFI bool
47+
Framework bool
4748
}
4849

4950
const (
@@ -89,6 +90,7 @@ func Parse() *Settings {
8990
flagSet.BoolVar(&settings.Shodan, "shodan", false, "Enable Shodan lookup (requires SHODAN_API_KEY env var)"),
9091
flagSet.BoolVar(&settings.SQL, "sql", false, "Enable SQL reconnaissance (admin panels, error disclosure)"),
9192
flagSet.BoolVar(&settings.LFI, "lfi", false, "Enable LFI (Local File Inclusion) reconnaissance"),
93+
flagSet.BoolVar(&settings.Framework, "framework", false, "Enable framework detection"),
9294
)
9395

9496
flagSet.CreateGroup("runtime", "Runtime",

0 commit comments

Comments
 (0)