webaudit

Documentation

Overview

Package webaudit audits URLs from a sitemap (WR audit_website.py), SSRF-safe.

Index

• Constants
• func Collect(ctx context.Context, opt Options) (sitemapURL string, urls []string, err error)
• func ExtForKind(kind string) string
• func FetchURL(ctx context.Context, client *http.Client, rawURL string, timeout time.Duration, ...) ([]byte, string, error)
• func GuessKind(rawURL string, data []byte, contentType string) string
• type Failure
• type FileResult
• type Options
• type Report

Constants

const (
	DefaultMaxBytes = 4 << 20
	DefaultTimeout  = 15 * time.Second
	DefaultMaxPages = 200
)

Functions

func Collect

func Collect(ctx context.Context, opt Options) (sitemapURL string, urls []string, err error)

Collect downloads sitemap URLs (same-origin, public IPs only).

func ExtForKind

func ExtForKind(kind string) string

ExtForKind maps kind to a temp file extension.

func FetchURL

func FetchURL(ctx context.Context, client *http.Client, rawURL string, timeout time.Duration, maxBytes int, allowed *origin) ([]byte, string, error)

FetchURL downloads one URL with SSRF protections; returns body and content-type.

func GuessKind

func GuessKind(rawURL string, data []byte, contentType string) string

GuessKind classifies downloaded bytes (WR guess_kind).

Types

type Failure

type Failure struct {
	URL   string `json:"url"`
	Error string `json:"error"`
}

Failure records a fetch/inspect error.

type FileResult

type FileResult struct {
	URL   string `json:"url"`
	Kind  string `json:"kind"`
	Bytes int    `json:"bytes"`
	Error string `json:"error,omitempty"`
	Raw   []byte `json:"-"`
}

FileResult is one inspected remote asset (caller fills findings).

type Options

type Options struct {
	Sitemap    string
	Base       string
	MaxPages   int
	Timeout    time.Duration
	MaxBytes   int
	HTTPClient *http.Client
}

Options configure a website audit.

type Report

type Report struct {
	Sitemap       string       `json:"sitemap"`
	Base          string       `json:"base,omitempty"`
	URLsCollected int          `json:"urls_collected"`
	URLsScanned   int          `json:"urls_scanned"`
	Failures      []Failure    `json:"urls_failed,omitempty"`
	Files         []FileResult `json:"files"`
}

Report is the audit aggregate shell (engine fills scan results).