Retire.js (Burp plugin)

Burp/ZAP/Maven 扩展可集成 Retire.js 资源库以查找易受攻击的 Javascript 库。「Burp/ZAP/Maven extension that integrate Retire.js repository to find vulnerable Javascript libraries.」

Github stars Tracking Chart

Retire.js (Burp plugin) Build Status

Burp / ZAP extension that integrate Retire.js repository to find vulnerable JavaScript libraries. It passively look at JavaScript files loaded and identify those vulnerable based on various signature types (URL, filename, file content or specific hash).

License

This software is release under Apache 2.0.

Downloads

Last updated : December 10th, 2019

Burp Suite plugin : Download (also available on the BApp Store)

ZAP plugin : Download


Burp plugin

Retire.js Burp plugin

Retire.js Burp plugin

ZAP plugin

Retire.js ZAP plugin

Maven plugin Maven Central

Run the Maven plugin with the goal scan:

$ cd myproject
$ mvn com.h3xstream.retirejs:retirejs-maven-plugin:scan
   [...]
[INFO] --- retirejs-maven-plugin:1.0.0-SNAPSHOT:scan (default-cli) @ myproject ---
[WARNING] jquery.js contains a vulnerable JavaScript library.
[INFO] Path: C:\Code\myproject\src\main\webapp\js\jquery.js
[INFO] jquery version 1.8.1 is vulnerable.
[INFO] + http://bugs.jquery.com/ticket/11290
[INFO] + http://research.insecurelabs.org/jquery/test/
   [...]

The additional parameter -DretireJsBreakOnFailure can be use to break the build when at least one vulnerability is found.

[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 1.450 s
[INFO] Finished at: 2015-02-19T13:37:00-05:00
[INFO] Final Memory: 11M/245M
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal com.h3xstream.retirejs:retirejs-maven-plugin:1.0.0:scan (default-cli) on project
my-web-app: 6 known vulnerabilities were identified in the JavaScript librairies. -> [Help 1]
[ERROR]

Run the Maven plugin as part of your build

Use the following configuration to run the Maven plugin as part of your build. Only one <repoUrl> may be specified at a time.
To scan / iterate earlier in your build cycle, you can bind the plugin to the validate phase.

  <plugin>    
    <groupId>com.h3xstream.retirejs</groupId>
    <artifactId>retirejs-maven-plugin</artifactId>
    <version>3.0.1</version>
    <configuration>
      <repoUrl>https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository.json</repoUrl>
      <!--<repoUrl>https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/npmrepository.json</repoUrl>-->
    </configuration>
    <executions>
      <execution>
        <id>scanProjectJavascript</id>
        <goals>
          <goal>scan</goal>
        </goals>
        <phase>install</phase>
      </execution>
    </executions>
  </plugin>

Main metrics

Overview
Name With Ownerh3xstream/burp-retire-js
Primary LanguageJavaScript
Program languageJava (Language Count: 4)
Platform
License:Apache License 2.0
所有者活动
Created At2014-11-26 23:39:42
Pushed At2024-06-14 06:19:56
Last Commit At2023-05-11 16:02:56
Release Count1
Last Release Nameversion-3.0.3 (Posted on )
First Release Nameversion-3.0.3 (Posted on )
用户参与
Stargazers Count206
Watchers Count21
Fork Count53
Commits Count169
Has Issues Enabled
Issues Count49
Issue Open Count6
Pull Requests Count26
Pull Requests Open Count2
Pull Requests Close Count5
项目设置
Has Wiki Enabled
Is Archived
Is Fork
Is Locked
Is Mirror
Is Private