RetireJS/retire.js
Retire.js
Retire.js is a JavaScript vulnerability scanner and dependency security analyzer. It identifies outdated or insecure JavaScript libraries with known security flaws within web applications and local projects.
The tool functions as a web security auditing utility that can be used during penetration testing to detect vulnerable scripts on live websites. It supports the generation of Software Bills of Materials using the CycloneDX format to document project dependencies.
The system utilizes signature-based library detection and pattern-matching to map identified versions against a JSON-based security database. Scanning capabilities include the use of headless browsers to analyze scripts loaded by live applications.
Features
- JavaScript Libraries - Identifies outdated or insecure JavaScript libraries within projects and live websites to mitigate security risks.
- Dependency Vulnerability Scanning - Analyzes project dependencies to identify outdated libraries with documented security vulnerabilities.
- JavaScript Dependency Tree Scanners - Provides a specialized scanner for identifying vulnerabilities in JavaScript dependency trees across projects and web apps.
- Library Detection - Detects insecure libraries on visited websites using headless scanners or browser extensions to alert users.
- Vulnerability Matching - Matches detected library versions against known vulnerability databases using version range comparisons.
- Third Party Dependency Risk Assessment - Analyzes third-party modules to identify known security flaws and outdated versions.
- Vulnerable Library Detectors - Detects the use of outdated software libraries with known security vulnerabilities across various environments.
- Web Security Auditing - Functions as a tool for auditing the security posture of web applications by detecting insecure scripts.
- Rule-Based Library Matching - Detects library versions by scanning source code for unique identifying strings and metadata markers.
- SBOM Generators - Produces a Software Bill of Materials in CycloneDX format to document all detected project dependencies.
- Multi-Format Exports - Provides the capability to export discovered dependencies into standardized machine-readable formats like CycloneDX.
- Pentesting Toolkits - Provides scanning capabilities that can be embedded into penetration testing toolkits to identify vulnerable scripts.
- Web Application Penetration Testing - Integrates security scanning into penetration testing workflows to detect vulnerable scripts on live web applications.
- Software Bill of Materials Generators - Generates a detailed Software Bill of Materials using the CycloneDX format for security auditing.
- Headless Browsers - Utilizes a headless browser environment to intercept and analyze JavaScript files loaded by live web applications.
- Technology Fingerprinting - Detects vulnerable JavaScript libraries.
- Dependency Management - Detects vulnerable JavaScript library versions.
- Testing Tools - Scanner for detecting vulnerable JavaScript dependencies.
- Vulnerability Exploitation Frameworks - Detects vulnerable JavaScript libraries.
- Vulnerability Scanners - Detects vulnerable JavaScript libraries.
