burp-retire-js - GitLite

KO | EN

gitlite — search

#python #hacktoberfest #react #go #android #nodejs #windows #kubernetes #vue #awesome-list #pytorch #security #ios #mcp

burp-retire-js

(★ 213)

Burp/ZAP/Maven extension that integrate Retire.js repository to find vulnerable Javascript libraries.

File Explorer

Download Latest Version (.zip)

- zap-2.4.3.jar
- pom.xml
- pom.xml
- pom.xml
- pom.xml
- - ember.js
- angular.safe.js
- external.html
- http_server.py
- jquery-1.6.2.js
- jquery-ui-1.6rc6-customized.js
.gitignore
.travis.yml
BappDescription.html
BappManifest.bmf
DEPLOYMENT.md
LICENSE
pom.xml
README.md

# Installation Guide

1. Get the code

git clone https://github.com/h3xstream/burp-retire-js

Downloads the entire project code from GitHub to your computer.

cd burp-retire-js

Moves into the project folder you just downloaded.

2. Maven (Java)

Medium Recommended

Prerequisites

Git Needed to download the project code from GitHub.
JDK (Java) Required to build and run Java projects.
Maven The build tool used for the mvn command.

$ mvn com.h3xstream.retirejs:retirejs-maven-plugin:scan

Installs dependencies and builds the project using Maven.

✅ A BUILD SUCCESS message means it worked. The output is created under target/.

Pulled directly from this repo's README.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Retire.js (Burp plugin) [![Build Status](https://travis-ci.org/h3xstream/burp-retire-js.svg)](https://travis-ci.org/h3xstream/burp-retire-js)

[Burp](http://portswigger.net/burp/) / [ZAP](https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project) extension that integrate [Retire.js](https://github.com/bekk/retire.js) repository to find vulnerable JavaScript libraries. It passively look at JavaScript files loaded and identify those vulnerable based on various signature types (URL, filename, file content or specific hash).

## License

This software is release under [Apache 2.0](https://www.apache.org/licenses/LICENSE-2.0).

## Downloads

Last updated : December 10th, 2019

Burp Suite plugin : [Download](https://raw.githubusercontent.com/h3xstream/burp-retire-js/gh-pages/releases/burp/burp-retire-js-3.0.2.jar) (also available on the [BApp Store](https://pro.portswigger.net/bappstore/ShowBappDetails.aspx?uuid=36238b534a78494db9bf2d03f112265c))

ZAP plugin : [Download](https://raw.githubusercontent.com/h3xstream/burp-retire-js/gh-pages/releases/zap/retirejs-alpha-3.0.2.zap)

--------------------------

## Burp plugin

![Retire.js Burp plugin](https://raw.githubusercontent.com/h3xstream/burp-retire-js/gh-pages/screenshots/screenshot_burp_plugin.png)

![Retire.js Burp plugin](https://raw.githubusercontent.com/h3xstream/burp-retire-js/gh-pages/screenshots/screenshot_burp_plugin_animate.gif)

## ZAP plugin

![Retire.js ZAP plugin](https://raw.githubusercontent.com/h3xstream/burp-retire-js/gh-pages/screenshots/screenshot_zap_plugin.png)

## Maven plugin [![Maven Central](https://maven-badges.herokuapp.com/maven-central/com.h3xstream.retirejs/retirejs-maven-plugin/badge.svg)](http://search.maven.org/#search%7Cga%7C1%7Cg%3A%22com.h3xstream.retirejs%22%20a%3A%22retirejs-maven-plugin%22)

Run the Maven plugin with the goal `scan`:

$ cd myproject
    $ mvn com.h3xstream.retirejs:retirejs-maven-plugin:scan
       [...]
    [INFO] --- retirejs-maven-plugin:1.0.0-SNAPSHOT:scan (default-cli) @ myproject ---
    [WARNING] jquery.js contains a vulnerable JavaScript library.
    [INFO] Path: C:\Code\myproject\src\main\webapp\js\jquery.js
    [INFO] jquery version 1.8.1 is vulnerable.
    [INFO] + http://bugs.jquery.com/ticket/11290
    [INFO] + http://research.insecurelabs.org/jquery/test/
       [...]

The additional parameter `-DretireJsBreakOnFailure` can be use to break the build when at least one vulnerability is found.

[INFO] ------------------------------------------------------------------------
    [INFO] BUILD FAILURE
    [INFO] ------------------------------------------------------------------------
    [INFO] Total time: 1.450 s
    [INFO] Finished at: 2015-02-19T13:37:00-05:00
    [INFO] Final Memory: 11M/245M
    [INFO] ------------------------------------------------------------------------
    [ERROR] Failed to execute goal com.h3xstream.retirejs:retirejs-maven-plugin:1.0.0:scan (default-cli) on project
    my-web-app: 6 known vulnerabilities were identified in the JavaScript librairies. -> [Help 1]
    [ERROR]

### Run the Maven plugin as part of your build

Use the following configuration to run the Maven plugin as part of your build.  Only one `<repoUrl>` may be specified at a time.
To scan / iterate earlier in your build cycle, you can bind the plugin to the `validate` phase.

```xml
  <plugin>    
    <groupId>com.h3xstream.retirejs</groupId>
    <artifactId>retirejs-maven-plugin</artifactId>
    <version>3.0.1</version>
    <configuration>
      <repoUrl>https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository.json</repoUrl>
      
    </configuration>
    <executions>
      <execution>
        <id>scanProjectJavascript</id>
        <goals>
          <goal>scan</goal>
        </goals>
        <phase>install</phase>
      </execution>
    </executions>
  </plugin>
```