Implemented tests and removed duplicates for wordlists (#1039)

* added tests for wordlists, removed duplicates

* removed src from conftest

---------

Co-authored-by: Sam Stepanyan <sam.stepanyan@owasp.org>
This commit is contained in:
Achintya Jai 2025-03-18 06:56:42 +05:30 committed by GitHub
parent f7ce6a0e2c
commit 809b6e2e5c
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
7 changed files with 54 additions and 99 deletions

View File

@ -36,12 +36,10 @@ backup-db
mysql.sql
phpmyadmin
admin
administrator
server-status
server-info
info.php
php.php
info.php
phpinfo.php
test.php
.git
@ -131,15 +129,12 @@ admin/account.asp
admin/account.html
admin/account.php
admin/add_banner.php/
admin/
addblog.php
admin/add_gallery_image.php
admin/add.php
admin/add
room.php
admin/add
slider.php
admin/
add_testimonials.php
admin/admin/
admin/adminarea.php
@ -151,15 +146,12 @@ admin/AdminHome.php
admin/admin.html
admin/admin_index.php
admin/admin_login.asp
admin/admin
login.asp/admin/adminLogin.asp
admin/admin_login.html/admin/admin
login.html
admin/adminLogin.html
admin/admin_login.php
admin/admin
login.php
admin/
adminLogin.php
admin/admin_management.php
admin/admin.php
@ -172,7 +164,6 @@ admin_area/admin.asp
adminarea/admin.asp
admin_area/admin.html
adminarea/admin.html
admin_area/
admin.php
adminarea/admin.php
admin_area/index.asp
@ -191,7 +182,6 @@ admin.asp
admin/banner.php
admin/banners_report.php
admin/category.php
admin/
change_gallery.php
admin/checklogin.php
admin/configration.php
@ -235,7 +225,6 @@ admin.html
admin/index.asp
admin/index
digital.php
admin/
index.html
admin/index.php
admin/index_ref.php
@ -251,7 +240,6 @@ administratie/
administration/
administration.html
administration.php
administrator
_administrator_/
_administrator/
administrator/
@ -263,7 +251,6 @@ administrator.asp
administrator.html
administrator/index.asp
administrator/index.html
administrator/
index.php
administratorlogin/
administrator/login.asp
@ -271,35 +258,24 @@ administratorlogin.asp
administrator/login.html
administrator/login.php
administratorlogin.php
administratorlogin.php
administrator.php
administrators/
administrivia/
admin/
leads.php
admin/list_gallery.php
admin/login
adminLogin/
admin_login.asp
admin
login.asp
admin/login.asp
adminLogin.asp
admin/login
home.php
admin_login.html
admin
login.html
admin/login.html
adminLogin.html
ADMIN/login.html/admin_login.php
admin_login.php
admin
login.php
admin
login.php/
admin/login.php
adminLogin.php
ADMIN/login.php
admin/login_success.php
admin/loginsuccess.php
@ -307,7 +283,6 @@ admin/log.php
admin_main.html
admin/main_page.php
admin/main.php/
admin/
ManageAdmin.php
admin/manageImages.php
admin/manage_team.php
@ -321,7 +296,6 @@ admin/pages/home_admin.php
adminpanel//adminpanel.asp
adminpanel.html
adminpanel.php
admin.php
Admin/private/
adminpro/
admin/product.php
@ -358,11 +332,7 @@ autologin/
banneradmin/
base/admin/
bb
admin/
bbadmin/
bb
admin/admin.asp
bb
admin/admin.html /bb
admin/admin.php /bb
admin/index.asp /bb
@ -370,13 +340,10 @@ admin/index.html /bb
admin/index.php /bb
admin/login.asp /bb
admin/login.html /bb
admin/login.php
bigadmin/
blogindex/
cadmins/
ccms/
ccms/
index.php
ccms/login.php
ccp14admin/
cms/
@ -416,7 +383,6 @@ forum/admin
globes_admin/
home.asp
home.html
home.php
hpwebjetadmin/
include/admin.php
includes/login.php
@ -427,23 +393,17 @@ irc
macadmin/
links/login.php
LiveUser_Admin/
login/
login1/
login.asp
login_db/
loginflat/
login.html
login/login.php
login.php
login
redirect/
logins/
login
us/
logon/
logo_sysadmin/
Lotus_Domino_Admin/
macadmin/
mag/admin/
maintenance/
manage_admin.php
@ -457,13 +417,10 @@ members/
memlogin/
meta_login/
modelsearch/
admin.asp
modelsearch/admin.html
modelsearch/admin.php
modelsearch/index.asp
modelsearch/index.html
modelsearch/
index.php
modelsearch/login.asp
modelsearch/login.html
modelsearch/login.php
@ -484,17 +441,11 @@ newsadmin/
nsw/admin/login.php
openvpnadmin/
pages/admin/admin
login.asp
pages/admin/admin
login.html
pages/admin/admin
login.php /panel/
panel
administracion/ /panel
administracion/admin.asp
panel
administracion/admin.html
panel
administracion/admin.php /panel
administracion/index.asp /panel
administracion/index.html /panel
@ -513,19 +464,17 @@ platz_login/
pma/
power_user/
project
admins/
pureadmin/
radmind/
radmind
1/ /rcjakar/admin/login.php
rcLogin/
/server/
/server/
Server/
ServerAdministrator/
server_admin_small/
Server.asp
Server.html
Server.php
showlogin/
simpleLogin/
site/admin/
@ -538,7 +487,6 @@ site_admin/login.php
siteadmin/login.php
smblogin/
sql
admin/
sshadmin/
ss_vms_admin_sm/
staradmin/
@ -576,7 +524,6 @@ webadmin.php
webmaster/ /websvn/ /wizmysqladmin/ /wp
admin/ /wp
login/ /wplogin/ /wp
login.php
xlogin/
yonetici.asp
yonetici.html

View File

@ -436,7 +436,6 @@ cfg
cfide
cgi
cgi-bin
cgi-bin
cgi-exe
cgi-home
cgi-local

View File

@ -3,7 +3,6 @@ accounts/login/
admin1.php/
admin.php/
admin.html/
admin1.php/
admin1.html/
login.php/
admin/cp.php/
@ -57,12 +56,10 @@ phpMyAdmin-2.6.1-pl2/
phpMyAdmin-2.6.1-pl3/
phpMyAdmin-2.6.2-rc1/
phpMyAdmin-2.6.2-beta1/
phpMyAdmin-2.6.2-rc1/
phpMyAdmin-2.6.2/
phpMyAdmin-2.6.2-pl1/
phpMyAdmin-2.6.3/
phpMyAdmin-2.6.3-rc1/
phpMyAdmin-2.6.3/
phpMyAdmin-2.6.3-pl1/
phpMyAdmin-2.6.4-rc1/
phpMyAdmin-2.6.4-pl1/

View File

@ -280,7 +280,6 @@ redux-framework
loginizer
wp-file-manager
sucuri-scanner
ninja-forms
the-plus-addons-for-elementor-page-builder
wp-seopress
media-library-assistant

View File

@ -102,7 +102,6 @@ wp-plugins/image-symlinks/thumb.php
wp-plugins/image-symlinks/thumb/thumb.php
wp-plugins/image-symlinks/thumb/timthumb.php
wp-plugins/image-symlinks/timthumb.php
wp-plugins/image-symlinks/timthumb.php
wp-plugins/image-symlinks/timthumb/timthumb.php
wp-plugins/image-symlinks/tools/thumb.php
wp-plugins/image-symlinks/tools/thumb/thumb.php
@ -271,7 +270,6 @@ wp-content/themes/abstract/scripts/thumb/timthumb.php
wp-content/themes/abstract/scripts/timthumb.php
wp-content/themes/abstract/scripts/timthumb/timthumb.php
wp-content/themes/abstract/thumb.php
wp-content/themes/abstract/thumb.php
wp-content/themes/abstract/thumb/thumb.php
wp-content/themes/abstract/thumb/timthumb.php
wp-content/themes/abstract/timthumb.php
@ -424,11 +422,9 @@ wp-content/themes/backstage/scripts/thumb/timthumb.php
wp-content/themes/backstage/scripts/timthumb.php
wp-content/themes/backstage/scripts/timthumb/timthumb.php
wp-content/themes/backstage/thumb.php
wp-content/themes/backstage/thumb.php
wp-content/themes/backstage/thumb/thumb.php
wp-content/themes/backstage/thumb/timthumb.php
wp-content/themes/backstage/timthumb.php
wp-content/themes/backstage/timthumb.php
wp-content/themes/backstage/timthumb/timthumb.php
wp-content/themes/backstage/tools/thumb.php
wp-content/themes/backstage/tools/thumb/thumb.php
@ -503,7 +499,6 @@ wp-content/themes/bloggingstream/scripts/thumb/timthumb.php
wp-content/themes/bloggingstream/scripts/timthumb.php
wp-content/themes/bloggingstream/scripts/timthumb/timthumb.php
wp-content/themes/bloggingstream/thumb.php
wp-content/themes/bloggingstream/thumb.php
wp-content/themes/bloggingstream/thumb/thumb.php
wp-content/themes/bloggingstream/thumb/timthumb.php
wp-content/themes/bloggingstream/timthumb.php
@ -621,11 +616,9 @@ wp-content/themes/canvas/scripts/thumb/timthumb.php
wp-content/themes/canvas/scripts/timthumb.php
wp-content/themes/canvas/scripts/timthumb/timthumb.php
wp-content/themes/canvas/thumb.php
wp-content/themes/canvas/thumb.php
wp-content/themes/canvas/thumb/thumb.php
wp-content/themes/canvas/thumb/timthumb.php
wp-content/themes/canvas/timthumb.php
wp-content/themes/canvas/timthumb.php
wp-content/themes/canvas/timthumb/timthumb.php
wp-content/themes/canvas/tools/thumb.php
wp-content/themes/canvas/tools/thumb/thumb.php
@ -636,7 +629,6 @@ wp-content/themes/canvaswoo/thumb.php
wp-content/themes/Chameleon/imthumb.php
wp-content/themes/Chameleon/scripts/timthumb.php
wp-content/themes/Chameleon/thumb.php
wp-content/themes/Chameleon/thumb.php
wp-content/themes/Chameleon/timthumb.php
wp-content/themes/Chameleon/tools/timthumb.php
wp-content/themes/chapters/thumb.php
@ -742,11 +734,9 @@ wp-content/themes/continuum/scripts/thumb/timthumb.php
wp-content/themes/continuum/scripts/timthumb.php
wp-content/themes/continuum/scripts/timthumb/timthumb.php
wp-content/themes/continuum/thumb.php
wp-content/themes/continuum/thumb.php
wp-content/themes/continuum/thumb/thumb.php
wp-content/themes/continuum/thumb/timthumb.php
wp-content/themes/continuum/timthumb.php
wp-content/themes/continuum/timthumb.php
wp-content/themes/continuum/timthumb/timthumb.php
wp-content/themes/continuum/tools/thumb.php
wp-content/themes/continuum/tools/thumb/thumb.php
@ -825,7 +815,6 @@ wp-content/themes/DailyNotes/thumb.php
wp-content/themes/DailyNotes/thumb/thumb.php
wp-content/themes/DailyNotes/thumb/timthumb.php
wp-content/themes/DailyNotes/timthumb.php
wp-content/themes/DailyNotes/timthumb.php
wp-content/themes/DailyNotes/timthumb/timthumb.php
wp-content/themes/DailyNotes/tools/thumb.php
wp-content/themes/DailyNotes/tools/thumb/thumb.php
@ -904,11 +893,9 @@ wp-content/themes/DelicateNews/scripts/thumb/timthumb.php
wp-content/themes/DelicateNews/scripts/timthumb.php
wp-content/themes/DelicateNews/scripts/timthumb/timthumb.php
wp-content/themes/DelicateNews/thumb.php
wp-content/themes/DelicateNews/thumb.php
wp-content/themes/DelicateNews/thumb/thumb.php
wp-content/themes/DelicateNews/thumb/timthumb.php
wp-content/themes/DelicateNews/timthumb.php
wp-content/themes/DelicateNews/timthumb.php
wp-content/themes/DelicateNews/timthumb/timthumb.php
wp-content/themes/DelicateNews/tools/thumb.php
wp-content/themes/DelicateNews/tools/thumb/thumb.php
@ -973,7 +960,6 @@ wp-content/themes/deliciousmagazine/scripts/thumb/timthumb.php
wp-content/themes/deliciousmagazine/scripts/timthumb.php
wp-content/themes/deliciousmagazine/scripts/timthumb/timthumb.php
wp-content/themes/deliciousmagazine/thumb.php
wp-content/themes/deliciousmagazine/thumb.php
wp-content/themes/deliciousmagazine/thumb/thumb.php
wp-content/themes/deliciousmagazine/thumb/timthumb.php
wp-content/themes/deliciousmagazine/timthumb.php
@ -1078,11 +1064,9 @@ wp-content/themes/ecobiz/scripts/thumb/timthumb.php
wp-content/themes/ecobiz/scripts/timthumb.php
wp-content/themes/ecobiz/scripts/timthumb/timthumb.php
wp-content/themes/ecobiz/thumb.php
wp-content/themes/ecobiz/thumb.php
wp-content/themes/ecobiz/thumb/thumb.php
wp-content/themes/ecobiz/thumb/timthumb.php
wp-content/themes/ecobiz/timthumb.php
wp-content/themes/ecobiz/timthumb.php
wp-content/themes/eCobiz/timthumb.php
wp-content/themes/ecobiz/timthumb.phptimthumb.php
wp-content/themes/ecobiz/timthumb/timthumb.php
@ -1094,7 +1078,6 @@ wp-content/themes/ecobiz/tools/timthumb/timthumb.php
wp-content/themes/editorial/functions/thumb.php
wp-content/themes/eGallery/timthumb.php
wp-content/themes/eGamer/thumb.php
wp-content/themes/eGamer/timthumb.php
wp-content/themes/eGamer/tools/timthumb.php
wp-content/themes/elefolio/functions/thumb.php
wp-content/themes/elefolio/thumb.php
@ -1249,7 +1232,6 @@ wp-content/themes/groovyblog/scripts/thumb/timthumb.php
wp-content/themes/groovyblog/scripts/timthumb.php
wp-content/themes/groovyblog/scripts/timthumb/timthumb.php
wp-content/themes/groovyblog/thumb.php
wp-content/themes/groovyblog/thumb.php
wp-content/themes/groovyblog/thumb/thumb.php
wp-content/themes/groovyblog/thumb/timthumb.php
wp-content/themes/groovyblog/timthumb.php
@ -1457,11 +1439,9 @@ wp-content/themes/LondonLive/scripts/timthumb.php
wp-content/themes/LondonLive/scripts/timthumb/timthumb.php
wp-content/themes/londonlive/thumb.php
wp-content/themes/LondonLive/thumb.php
wp-content/themes/LondonLive/thumb.php
wp-content/themes/LondonLive/thumb/thumb.php
wp-content/themes/LondonLive/thumb/timthumb.php
wp-content/themes/LondonLive/timthumb.php
wp-content/themes/LondonLive/timthumb.php
wp-content/themes/LondonLive/timthumb/timthumb.php
wp-content/themes/LondonLive/tools/thumb.php
wp-content/themes/LondonLive/tools/thumb/thumb.php
@ -1557,7 +1537,6 @@ wp-content/themes/modularity/images/timthumb.php
wp-content/themes/modularity/includes/thumb.php
wp-content/themes/modularity/includes/thumb/thumb.php
wp-content/themes/modularity/includes/thumb/timthumb.php
wp-content/themes/modularity/includes/timthumb.php
wp-content/themes/modularity/includes/timthumb/timthumb.php
wp-content/themes/modularity/inc/thumb.php
wp-content/themes/modularity/inc/timthumb.php
@ -1593,11 +1572,9 @@ wp-content/themes/modularity/scripts/thumb/timthumb.php
wp-content/themes/modularity/scripts/timthumb.php
wp-content/themes/modularity/scripts/timthumb/timthumb.php
wp-content/themes/modularity/thumb.php
wp-content/themes/modularity/thumb.php
wp-content/themes/modularity/thumb/thumb.php
wp-content/themes/modularity/thumb/timthumb.php
wp-content/themes/modularity/timthumb.php
wp-content/themes/modularity/timthumb.php
wp-content/themes/modularity/timthumb/timthumb.php
wp-content/themes/modularity/tools/thumb.php
wp-content/themes/modularity/tools/thumb/thumb.php
@ -1610,7 +1587,6 @@ wp-content/themes/multidesign/scripts/thumb.php
wp-content/themes/multidesign/scripts/timthumb.php
wp-content/themes/multidesign/timthumb.php
wp-content/themes/MyCuisine/timthumb.php
wp-content/themes/MyCuisine/timthumb.php
wp-content/themes/MyCuisine/timthumb.phpthumb.php
wp-content/themes/MyCuisine/timthumb.phptimthumb.php
wp-content/themes/my-heli/images/timthumb.php
@ -1711,11 +1687,9 @@ wp-content/themes/newsworld/scripts/thumb/timthumb.php
wp-content/themes/newsworld/scripts/timthumb.php
wp-content/themes/newsworld/scripts/timthumb/timthumb.php
wp-content/themes/newsworld/thumb.php
wp-content/themes/newsworld/thumb.php
wp-content/themes/newsworld/thumb/thumb.php
wp-content/themes/newsworld/thumb/timthumb.php
wp-content/themes/newsworld/timthumb.php
wp-content/themes/newsworld/timthumb.php
wp-content/themes/newsworld/timthumb/timthumb.php
wp-content/themes/newsworld/tools/thumb.php
wp-content/themes/newsworld/tools/thumb/thumb.php
@ -1770,7 +1744,6 @@ wp-content/themes/OptimizePress/scripts/timthumb.php
wp-content/themes/OptimizePress/thumb.php
wp-content/themes/Optimizepress/timthumb.php
wp-content/themes/OptimizePress/timthumb.php
wp-content/themes/OptimizePress/timthumb.php
wp-content/themes/OptimizePress/timthumb.phpthumb.php
wp-content/themes/OptimizePress/timthumb.phptimthumb.php
wp-content/themes/OptimizePress/tools/timthumb.php
@ -1870,12 +1843,10 @@ wp-content/themes/premiumnews/scripts/thumb/timthumb.php
wp-content/themes/premiumnews/scripts/timthumb.php
wp-content/themes/premiumnews/scripts/timthumb/timthumb.php
wp-content/themes/premiumnews/thumb.php
wp-content/themes/premiumnews/thumb.php
wp-content/themes/premiumnews/thumb.phptimthumb.php
wp-content/themes/premiumnews/thumb/thumb.php
wp-content/themes/premiumnews/thumb/timthumb.php
wp-content/themes/premiumnews/timthumb.php
wp-content/themes/premiumnews/timthumb.php
wp-content/themes/premiumnews/timthumb.phptimthumb.php
wp-content/themes/premiumnews/timthumb/timthumb.php
wp-content/themes/premiumnews/tools/thumb.php
@ -2056,11 +2027,9 @@ wp-content/themes/sealight/scripts/thumb/timthumb.php
wp-content/themes/sealight/scripts/timthumb.php
wp-content/themes/sealight/scripts/timthumb/timthumb.php
wp-content/themes/sealight/thumb.php
wp-content/themes/sealight/thumb.php
wp-content/themes/sealight/thumb/thumb.php
wp-content/themes/sealight/thumb/timthumb.php
wp-content/themes/sealight/timthumb.php
wp-content/themes/sealight/timthumb.php
wp-content/themes/sealight/timthumb/timthumb.php
wp-content/themes/sealight/tools/thumb.php
wp-content/themes/sealight/tools/thumb/thumb.php
@ -2129,12 +2098,10 @@ wp-content/themes/SimplePress/scripts/timthumb.php
wp-content/themes/SimplePress/scripts/timthumb/timthumb.php
wp-content/themes/simplepress/SimplePress/timthumb.php
wp-content/themes/SimplePress/thumb.php
wp-content/themes/SimplePress/thumb.php
wp-content/themes/SimplePress/thumb/thumb.php
wp-content/themes/SimplePress/thumb/timthumb.php
wp-content/themes/simplepress/timthumb.php
wp-content/themes/SimplePress/timthumb.php
wp-content/themes/SimplePress/timthumb.php
wp-content/themes/SimplePress/timthumb.phptimthumb.php
wp-content/themes/SimplePress/timthumb/timthumb.php
wp-content/themes/SimplePress/tools/thumb.php
@ -2366,11 +2333,9 @@ wp-content/themes/typebased/scripts/thumb/timthumb.php
wp-content/themes/typebased/scripts/timthumb.php
wp-content/themes/typebased/scripts/timthumb/timthumb.php
wp-content/themes/typebased/thumb.php
wp-content/themes/typebased/thumb.php
wp-content/themes/typebased/thumb/thumb.php
wp-content/themes/typebased/thumb/timthumb.php
wp-content/themes/typebased/timthumb.php
wp-content/themes/typebased/timthumb.php
wp-content/themes/typebased/timthumb/timthumb.php
wp-content/themes/typebased/tools/thumb.php
wp-content/themes/typebased/tools/thumb/thumb.php

View File

@ -2,7 +2,7 @@ import sys
from os.path import abspath, dirname, join
project_root = dirname(dirname(__file__))
nettacker_dir = abspath(join(project_root, "src/nettacker"))
nettacker_dir = abspath(join(project_root, "nettacker"))
tests_dir = abspath(join(project_root, "tests"))
sys.path.insert(0, nettacker_dir)

View File

@ -0,0 +1,48 @@
from collections import Counter
from tests.common import TestCase
wordlists = {
"admin_file": ["lib/payloads/wordlists/admin_wordlist.txt", 533],
"dir_file": ["lib/payloads/wordlists/dir_wordlist.txt", 1966],
"pma_file": ["lib/payloads/wordlists/pma_wordlist.txt", 174],
"wp_plugin_small_file": ["lib/payloads/wordlists/wp_plugin_small.txt", 291],
"wp_theme_small_file": ["lib/payloads/wordlists/wp_theme_small.txt", 41],
"wp_timethumb_file": ["lib/payloads/wordlists/wp_timethumbs.txt", 2424],
}
class TestWordlists(TestCase):
def test_admin_wordlist(self):
self.run_wordlist_test("admin_file")
def test_dir_wordlist(self):
self.run_wordlist_test("dir_file")
def test_pma_wordlist(self):
self.run_wordlist_test("pma_file")
def test_wp_plugin_small_wordlist(self):
self.run_wordlist_test("wp_plugin_small_file")
def test_wp_theme_small_wordlist(self):
self.run_wordlist_test("wp_theme_small_file")
def test_wp_timethumb_wordlist(self):
self.run_wordlist_test("wp_timethumb_file")
def run_wordlist_test(self, key):
wordlist_path = wordlists[key][0]
wordlist_length = wordlists[key][1]
with open(self.nettacker_path / wordlist_path) as wordlist_file:
paths = [line.strip() for line in wordlist_file.readlines()]
self.assertEqual(
len(paths), wordlist_length, f"There are {wordlist_length} paths in {key}"
)
self.assertEqual(
len(set(paths)),
len(paths),
f"The paths aren't unique in {key}: {Counter(paths).most_common(1)[0][0]}",
)