Open
Description
System and Python versions
$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 22.04 LTS
Release: 22.04
Codename: jammy
$ python3 --version
Python 3.10.4
steps to reproduse:
- download targets: vulnerable node.js app with package.json , vulnerable python app with requirements.txt , vulnerable java app with pom.xml
$ cd ~/Downloads
$ git clone https://github.com/clarkio/vulnerable-app.git
Cloning into 'vulnerable-app'...
[...]
Resolving deltas: 100% (237/237), done.
$ git clone https://github.com/stamparm/DSVW.git
Cloning into 'DSVW'...
[...]
Resolving deltas: 100% (68/68), done.
$ git clone https://github.com/rafaelrpinto/VulnerableJavaWebApplication
Cloning into 'VulnerableJavaWebApplication'...
[...]
Resolving deltas: 100% (66/66), done.
- scan targets:
$ cd *path_to_combobulator_folder*
$ python src/combobulator.py --type npm --directory ~/Downloads/vulnerable-app/
____ _____ ____ _____ _ _ ____ _____ _ _ ______ __
| _ \| ____| _ \| ____| \ | | _ \| ____| \ | |/ ___\ \ / /
| | | | _| | |_) | _| | \| | | | | _| | \| | | \ V /
| |_| | |___| __/| |___| |\ | |_| | |___| |\ | |___ | |
|____/|_____|_| |_____|_| \_|____/|_____|_| \_|\____| |_|
____ ____ __ __ ____ ____ ____ _ _ _ _ _____ ____ ____
/ ___/ /\ \| \/ | __ ) / /\ \| __ )| | | | | / \|_ _/ /\ \| _ \
| | / / \ \ |\/| | _ \/ / \ \ _ \| | | | | / _ \ | |/ / \ \ |_) |
| |__\ \ / / | | | |_) \ \ / / |_) | |_| | |___ / ___ \| |\ \ / / _ <
\____\_\/_/|_| |_|____/ \_\/_/|____/ \___/|_____/_/ \_\_| \_\/_/|_| \_
[PROC] Arguments parsed.
[PROC] Package list imported.... ['body-parser', 'cookie-parser', 'express', 'morgan', 'serve-favicon', dict_keys(['browser-sync', 'chai', 'chai-as-promised', 'chalk', 'dateformat', 'debug', 'del', 'glob', 'gulp', 'gulp-angular-templatecache', 'gulp-autoprefixer', 'gulp-bump', 'gulp-bytediff', 'gulp-concat', 'gulp-filter', 'gulp-header', 'gulp-if', 'gulp-imagemin', 'gulp-inject', 'gulp-jscs', 'gulp-jshint', 'gulp-less', 'gulp-load-plugins', 'gulp-minify-css', 'gulp-minify-html', 'gulp-ng-annotate', 'gulp-nodemon', 'gulp-order', 'gulp-plumber', 'gulp-print', 'gulp-rev', 'gulp-rev-replace', 'gulp-sourcemaps', 'gulp-task-listing', 'gulp-uglify', 'gulp-useref', 'gulp-util', 'jshint-stylish', 'karma', 'karma-chai', 'karma-chai-sinon', 'karma-chrome-launcher', 'karma-coverage', 'karma-firefox-launcher', 'karma-growl-reporter', 'karma-mocha', 'karma-phantomjs-launcher', 'karma-safari-launcher', 'karma-sinon', 'lodash', 'method-override', 'minimist', 'mocha', 'node-notifier', 'phantomjs-prebuilt', 'plato', 'q', 'sinon', 'sinon-chai', 'wiredep', 'yargs'])]
Traceback (most recent call last):
File "combobulator/src/combobulator.py", line 195, in <module>
main()
File "combobulator/src/combobulator.py", line 173, in main
metapkg(x, args.package_type)
File "combobulator/src/metapackage.py", line 7, in __init__
if len(pkgname.split(':')) == 2:
AttributeError: 'dict_keys' object has no attribute 'split'
$ python src/combobulator.py --type pypi --directory ~/Downloads/DSVW/
____ _____ ____ _____ _ _ ____ _____ _ _ ______ __
| _ \| ____| _ \| ____| \ | | _ \| ____| \ | |/ ___\ \ / /
| | | | _| | |_) | _| | \| | | | | _| | \| | | \ V /
| |_| | |___| __/| |___| |\ | |_| | |___| |\ | |___ | |
|____/|_____|_| |_____|_| \_|____/|_____|_| \_|\____| |_|
____ ____ __ __ ____ ____ ____ _ _ _ _ _____ ____ ____
/ ___/ /\ \| \/ | __ ) / /\ \| __ )| | | | | / \|_ _/ /\ \| _ \
| | / / \ \ |\/| | _ \/ / \ \ _ \| | | | | / _ \ | |/ / \ \ |_) |
| |__\ \ / / | | | |_) \ \ / / |_) | |_| | |___ / ___ \| |\ \ / / _ <
\____\_\/_/|_| |_|____/ \_\/_/|____/ \___/|_____/_/ \_\_| \_\/_/|_| \_
[PROC] Arguments parsed.
[ERROR] Selected package type doesn't support import scan.
$ python src/combobulator.py --type maven --directory ~/Downloads/VulnerableJavaWebApplication/
____ _____ ____ _____ _ _ ____ _____ _ _ ______ __
| _ \| ____| _ \| ____| \ | | _ \| ____| \ | |/ ___\ \ / /
| | | | _| | |_) | _| | \| | | | | _| | \| | | \ V /
| |_| | |___| __/| |___| |\ | |_| | |___| |\ | |___ | |
|____/|_____|_| |_____|_| \_|____/|_____|_| \_|\____| |_|
____ ____ __ __ ____ ____ ____ _ _ _ _ _____ ____ ____
/ ___/ /\ \| \/ | __ ) / /\ \| __ )| | | | | / \|_ _/ /\ \| _ \
| | / / \ \ |\/| | _ \/ / \ \ _ \| | | | | / _ \ | |/ / \ \ |_) |
| |__\ \ / / | | | |_) \ \ / / |_) | |_| | |___ / ___ \| |\ \ / / _ <
\____\_\/_/|_| |_|____/ \_\/_/|____/ \___/|_____/_/ \_\_| \_\/_/|_| \_
[PROC] Arguments parsed.
[PROC] Package list imported.... ['org.springframework.boot:spring-boot-starter-web', 'org.apache.tomcat.embed:tomcat-embed-jasper', 'javax.servlet:jstl', 'org.springframework:spring-jdbc', 'com.h2database:h2']
[PROC] Maven checker engaged.
[ANALYSIS] Package: spring-boot-starter-web is present on public provider.
[ANALYSIS] Package: tomcat-embed-jasper is present on public provider.
[ANALYSIS] Package: jstl is present on public provider.
[ANALYSIS] Package: spring-jdbc is present on public provider.
[ANALYSIS] Package: h2 is present on public provider.
summary:
Only java scan are stable. Please, fix it. Also, please, update a readme.md