search

owasp-noir / noir

Attack surface detector that identifies endpoints by static analysis
https://owasp.org/www-project-noir/
MIT License
555 stars 41 forks source link

Add --diff-path flag #302

Closed hahwul closed 3 months ago

hahwul commented 4 months ago

How

More options?

hahwul commented 4 months ago

Sample - plain

./bin/noir -b ./spec/functional_test/fixtures/oas3 --diff-path ./spec/functional_test/fixtures/oas2

░█▄─░█ ░█▀▀▀█ ▀█▀ ░█▀▀█
░█░█░█ ░█──░█ ░█─ ░█▄▄▀
░█──▀█ ░█▄▄▄█ ▄█▄ ░█─░█ {v0.15.1}

[*] Running Noir with Diff mode.
[*] Detecting technologies to base directory.
[I] Detected 1 technologies.
    oas3
[*] Start code analysis based on the detected technology.
[*] Initializing analyzers
    27 Analyzers initialized
[*] Analysis Started
    Code Analyzer: 1 in use
    Found 15 endpoints
[*] Optimizing endpoints.
[I] Finally identified 10 endpoints.
[*] Diffing base and diff codebases.
[*] Generating Diff Report.
GET /gems_json?query=&sort=
  ○ cookies: cookie=
POST /gems_json?query=&sort=
  ○ cookies: cookie=
GET /gems
GET /gems_yml?query=&sort=
  ○ cookies: cookie=
PUT /gems_yml?query=&sort=
  ○ cookies: cookie=
GET /pets?query=&sort=
  ○ cookies: cookie=
POST /pets
  ○ body: {"name":""}
GET /pets/{petId}
PUT /pets/{petId}
  ○ body: {"name":"","breed":""}
GET /shards
[*] ============== DIFF ==============
[I] Added: /gems_json GET
[I] Added: /gems_json POST
[I] Added: /gems GET
[I] Added: /gems_yml GET
[I] Added: /gems_yml PUT
[I] Added: /pets GET
[I] Added: /pets POST
[I] Added: /pets/{petId} GET
[I] Added: /pets/{petId} PUT
[I] Added: /shards GET
[I] Removed: /v1/pets GET
[I] Removed: /v1/pets POST
[I] Removed: /v1/pets/{petId} GET
[I] Removed: /v1/pets/{petId} PUT

Sample - JSON/YAML

./bin/noir -b ./spec/functional_test/fixtures/oas3 --diff-path ./spec/functional_test/fixtures/oas2 -f json

{
  "added": [
    {
      "url": "/gems_json",
      "method": "GET",
      "params": [
        {
          "name": "query",
          "value": "",
          "param_type": "query",
          "tags": []
        },
        {
          "name": "sort",
          "value": "",
          "param_type": "query",
          "tags": []
        },
        {
          "name": "cookie",
          "value": "",
          "param_type": "cookie",
          "tags": []
        }
      ],
      "details": {
        "code_paths": [
          {
            "path": "./spec/functional_test/fixtures/oas3/param_in_path/doc_param_in_json.json"
          }
        ]
      },
      "protocol": "http",
      "tags": []
    },
    {
      "url": "/gems_json",
      "method": "POST",
      "params": [
        {
          "name": "query",
          "value": "",
          "param_type": "query",
          "tags": []
        },
        {
          "name": "sort",
          "value": "",
          "param_type": "query",
          "tags": []
        },
        {
          "name": "cookie",
          "value": "",
          "param_type": "cookie",
          "tags": []
        }
      ],
      "details": {
        "code_paths": [
          {
            "path": "./spec/functional_test/fixtures/oas3/param_in_path/doc_param_in_json.json"
          }
        ]
      },
      "protocol": "http",
      "tags": []
    },
    {
      "url": "/gems",
      "method": "GET",
      "params": [],
      "details": {
        "code_paths": [
          {
            "path": "./spec/functional_test/fixtures/oas3/no_servers/doc_no_servers.yml"
          }
        ]
      },
      "protocol": "http",
      "tags": []
    },
    {
      "url": "/gems_yml",
      "method": "GET",
      "params": [
        {
          "name": "query",
          "value": "",
          "param_type": "query",
          "tags": []
        },
        {
          "name": "sort",
          "value": "",
          "param_type": "query",
          "tags": []
        },
        {
          "name": "cookie",
          "value": "",
          "param_type": "cookie",
          "tags": []
        }
      ],
      "details": {
        "code_paths": [
          {
            "path": "./spec/functional_test/fixtures/oas3/param_in_path/doc_param_in_path.yml"
          }
        ]
      },
      "protocol": "http",
      "tags": []
    },
    {
      "url": "/gems_yml",
      "method": "PUT",
      "params": [
        {
          "name": "query",
          "value": "",
          "param_type": "query",
          "tags": []
        },
        {
          "name": "sort",
          "value": "",
          "param_type": "query",
          "tags": []
        },
        {
          "name": "cookie",
          "value": "",
          "param_type": "cookie",
          "tags": []
        }
      ],
      "details": {
        "code_paths": [
          {
            "path": "./spec/functional_test/fixtures/oas3/param_in_path/doc_param_in_path.yml"
          }
        ]
      },
      "protocol": "http",
      "tags": []
    },
    {
      "url": "/pets",
      "method": "GET",
      "params": [
        {
          "name": "query",
          "value": "",
          "param_type": "query",
          "tags": []
        },
        {
          "name": "sort",
          "value": "",
          "param_type": "query",
          "tags": []
        },
        {
          "name": "cookie",
          "value": "",
          "param_type": "cookie",
          "tags": []
        }
      ],
      "details": {
        "code_paths": [
          {
            "path": "./spec/functional_test/fixtures/oas3/common/doc.yml"
          }
        ]
      },
      "protocol": "http",
      "tags": []
    },
    {
      "url": "/pets",
      "method": "POST",
      "params": [
        {
          "name": "name",
          "value": "",
          "param_type": "json",
          "tags": []
        }
      ],
      "details": {
        "code_paths": [
          {
            "path": "./spec/functional_test/fixtures/oas3/common/doc.yml"
          }
        ]
      },
      "protocol": "http",
      "tags": []
    },
    {
      "url": "/pets/{petId}",
      "method": "GET",
      "params": [],
      "details": {
        "code_paths": [
          {
            "path": "./spec/functional_test/fixtures/oas3/common/doc.yml"
          }
        ]
      },
      "protocol": "http",
      "tags": []
    },
    {
      "url": "/pets/{petId}",
      "method": "PUT",
      "params": [
        {
          "name": "name",
          "value": "",
          "param_type": "json",
          "tags": []
        },
        {
          "name": "breed",
          "value": "",
          "param_type": "json",
          "tags": []
        }
      ],
      "details": {
        "code_paths": [
          {
            "path": "./spec/functional_test/fixtures/oas3/common/doc.yml"
          }
        ]
      },
      "protocol": "http",
      "tags": []
    },
    {
      "url": "/shards",
      "method": "GET",
      "params": [],
      "details": {
        "code_paths": [
          {
            "path": "./spec/functional_test/fixtures/oas3/multiple_docs/second.yml"
          }
        ]
      },
      "protocol": "http",
      "tags": []
    }
  ],
  "removed": [
    {
      "url": "/v1/pets",
      "method": "GET",
      "params": [],
      "details": {
        "code_paths": [
          {
            "path": "./spec/functional_test/fixtures/oas2/doc.yml"
          }
        ]
      },
      "protocol": "http",
      "tags": []
    },
    {
      "url": "/v1/pets",
      "method": "POST",
      "params": [],
      "details": {
        "code_paths": [
          {
            "path": "./spec/functional_test/fixtures/oas2/doc.yml"
          }
        ]
      },
      "protocol": "http",
      "tags": []
    },
    {
      "url": "/v1/pets/{petId}",
      "method": "GET",
      "params": [],
      "details": {
        "code_paths": [
          {
            "path": "./spec/functional_test/fixtures/oas2/doc.yml"
          }
        ]
      },
      "protocol": "http",
      "tags": []
    },
    {
      "url": "/v1/pets/{petId}",
      "method": "PUT",
      "params": [],
      "details": {
        "code_paths": [
          {
            "path": "./spec/functional_test/fixtures/oas2/doc.yml"
          }
        ]
      },
      "protocol": "http",
      "tags": []
    }
  ],
  "changed": []
}

./bin/noir -b ./spec/functional_test/fixtures/oas3 --diff-path ./spec/functional_test/fixtures/oas2 -f yaml

added:
- url: /gems_json
  method: GET
  params:
  - name: query
    value: ""
    param_type: query
    tags: &1 []
  - name: sort
    value: ""
    param_type: query
    tags: &2 []
  - name: cookie
    value: ""
    param_type: cookie
    tags: &3 []
  details:
    code_paths: &4
    - path: ./spec/functional_test/fixtures/oas3/param_in_path/doc_param_in_json.json
  protocol: http
  tags: []
- url: /gems_json
  method: POST
  params:
  - name: query
    value: ""
    param_type: query
    tags: *1
  - name: sort
    value: ""
    param_type: query
    tags: *2
  - name: cookie
    value: ""
    param_type: cookie
    tags: *3
  details:
    code_paths: *4
  protocol: http
  tags: []
- url: /gems
  method: GET
  params: []
  details:
    code_paths:
    - path: ./spec/functional_test/fixtures/oas3/no_servers/doc_no_servers.yml
  protocol: http
  tags: []
- url: /gems_yml
  method: GET
  params:
  - name: query
    value: ""
    param_type: query
    tags: &5 []
  - name: sort
    value: ""
    param_type: query
    tags: &6 []
  - name: cookie
    value: ""
    param_type: cookie
    tags: &7 []
  details:
    code_paths: &8
    - path: ./spec/functional_test/fixtures/oas3/param_in_path/doc_param_in_path.yml
  protocol: http
  tags: []
- url: /gems_yml
  method: PUT
  params:
  - name: query
    value: ""
    param_type: query
    tags: *5
  - name: sort
    value: ""
    param_type: query
    tags: *6
  - name: cookie
    value: ""
    param_type: cookie
    tags: *7
  details:
    code_paths: *8
  protocol: http
  tags: []
- url: /pets
  method: GET
  params:
  - name: query
    value: ""
    param_type: query
    tags: []
  - name: sort
    value: ""
    param_type: query
    tags: []
  - name: cookie
    value: ""
    param_type: cookie
    tags: []
  details:
    code_paths: &9
    - path: ./spec/functional_test/fixtures/oas3/common/doc.yml
  protocol: http
  tags: []
- url: /pets
  method: POST
  params:
  - name: name
    value: ""
    param_type: json
    tags: []
  details:
    code_paths: *9
  protocol: http
  tags: []
- url: /pets/{petId}
  method: GET
  params: []
  details:
    code_paths: *9
  protocol: http
  tags: []
- url: /pets/{petId}
  method: PUT
  params:
  - name: name
    value: ""
    param_type: json
    tags: []
  - name: breed
    value: ""
    param_type: json
    tags: []
  details:
    code_paths: *9
  protocol: http
  tags: []
- url: /shards
  method: GET
  params: []
  details:
    code_paths:
    - path: ./spec/functional_test/fixtures/oas3/multiple_docs/second.yml
  protocol: http
  tags: []
removed:
- url: /v1/pets
  method: GET
  params: []
  details:
    code_paths: &10
    - path: ./spec/functional_test/fixtures/oas2/doc.yml
  protocol: http
  tags: []
- url: /v1/pets
  method: POST
  params: []
  details:
    code_paths: *10
  protocol: http
  tags: []
- url: /v1/pets/{petId}
  method: GET
  params: []
  details:
    code_paths: *10
  protocol: http
  tags: []
- url: /v1/pets/{petId}
  method: PUT
  params: []
  details:
    code_paths: *10
  protocol: http
  tags: []
changed: []