Skip to content

25 – Software

The test works out what the website is built from and compares the versions against registers of known vulnerabilities.

Alfa

The Swedish name for this test carries an "Alfa" marker. Identification works, but accuracy varies between products and the assessment may be adjusted.

What is tested?

The test identifies, among other things:

  • Content management system
  • Web server
  • Operating system
  • Analytics
  • JavaScript libraries
  • CSS libraries
  • Programming languages
  • Image formats and the software that produced the images

For each identified component with a known version, a check is made against CVE registers.

How it affects the score

The score is affected by known vulnerabilities in the software found, and by how far behind current versions the components are. That no content management system could be identified is neither good nor bad in itself. It appears in the review as information.

Running the test 

python default.py -u https://example.com -t 25 -r

Settings

Setting Default Meaning
tests.software.browser chrome Browser used for identification
tests.software.stealth.use true Avoid being detected as an automated visitor
tests.software.advisory.path empty Path to a local copy of GitHub's advisory database
github.api.key empty GitHub key, set by -d when updating the definitions

The last two are only needed when the definitions are updated, not when you run the test. See below.

The advisory database

Not needed to run the test

When you run -t 25, the test reads defaults/software-sources.json, which is already in the repository. You only need the advisory database if you're regenerating that file with -d, which is a project maintenance task.

The definitions are built from GitHub's advisory database, which holds CVE data in machine-readable form. Webperf Core reads only the reviewed advisories in advisories/github-reviewed. It never touches advisories/unreviewed.

Cloning it

The repository is large: an ordinary clone comes to roughly 4.6 GB, of which 3.2 GB is version history you have no use for. Two steps shrink that considerably.

Baseline shallow clone. Skip the history:

git clone --depth 1 https://github.com/github/advisory-database.git

Only what's actually read. A shallow clone plus a sparse checkout of the one directory Webperf Core opens. This takes the database from 4.6 GB to around 170 MB:

git clone --depth 1 --filter=blob:none --sparse \
  https://github.com/github/advisory-database.git
cd advisory-database
git sparse-checkout set advisories/github-reviewed
Method Size on disk
Ordinary clone ~4.6 GB
--depth 1 ~1.4 GB
--depth 1 + sparse checkout ~170 MB

Pointing at it 

python default.py -d YOUR-GITHUB-KEY \
  --setting tests.software.advisory.path=/path/to/advisory-database

The path should point at the repository root, that is, the directory containing advisories/. If you give no path, the tool looks for a directory named advisory_database in the working directory.

To avoid repeating the flag, put it in settings.json:

{
  "tests": {
    "software": {
      "advisory": {
        "path": "/path/to/advisory-database"
      }
    }
  }
}

Keeping it current

A shallow clone isn't updated by an ordinary git pull. Fetch a fresh shallow snapshot instead:

cd advisory-database
git fetch --depth 1 origin main
git reset --hard origin/main

The database is updated several times a day. Refresh it just before running -d, or you'll build definitions from stale data.

Worth knowing

Worth knowing

A version being visible from the outside is itself information for an attacker. But hiding version numbers doesn't fix an insecure version. It only makes the problem harder to spot, including for you.

See also