miketracy-wwmd 0.2.11

data/History.txt

@@ -0,0 +1,3 @@
+== 0.2.9 / 2009-05-05
+
+* bonesify

data/README

@@ -0,0 +1,62 @@
+
+	<;'"}()[]>{  XSSFish says, "Swim wif me"
+
+== DESCRIPTION:
+
+WWMD was originally intended to provide a console helper tool for 
+conducting web application security assessments (which is something I 
+find myself doing alot of).  I've spent alot of time and had alot of 
+success writing application specific fuzzers + scrapers to test with.  
+WWMD provides a base of useful code to help you work with web sites both 
+in IRB and by writing scripts that can be as generic or as application 
+specific as you choose.
+
+There's alot of helpful stuff crammed in here and its usage has evolved 
+alot.  It's not intended to replace, remove or be better than any of the 
+tools you currently use.  In fact, WWMD works best *with* the tools you 
+currently use to get stuff done.  You get convenience methods for 
+getting, scraping, spidering, decoding, decrypting and munging user 
+inputs, pages and web applications.
+
+It doesn't try to be smart.  That's up to you.
+
+What's here is the basic framework for getting started.  There's a raft 
+of cookbook scripts and examples that are coming soon so make sure you 
+check the wiki regularly.
+
+== REQUIREMENTS:
+
+* rubygems
+* ruby-debug
+* curb
+* nokogiri
+* hpricot (for the time being)
+* htmlentities
+
+== LICENSE:
+
+(The MIT License)
+
+Copyright (c) 2008
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+## Blah blah blah
+

data/README.txt

@@ -0,0 +1,62 @@
+
+	<;'"}()[]>{  XSSFish says, "Swim wif me"
+
+== DESCRIPTION:
+
+WWMD was originally intended to provide a console helper tool for 
+conducting web application security assessments (which is something I 
+find myself doing alot of).  I've spent alot of time and had alot of 
+success writing application specific fuzzers + scrapers to test with.  
+WWMD provides a base of useful code to help you work with web sites both 
+in IRB and by writing scripts that can be as generic or as application 
+specific as you choose.
+
+There's alot of helpful stuff crammed in here and its usage has evolved 
+alot.  It's not intended to replace, remove or be better than any of the 
+tools you currently use.  In fact, WWMD works best *with* the tools you 
+currently use to get stuff done.  You get convenience methods for 
+getting, scraping, spidering, decoding, decrypting and munging user 
+inputs, pages and web applications.
+
+It doesn't try to be smart.  That's up to you.
+
+What's here is the basic framework for getting started.  There's a raft 
+of cookbook scripts and examples that are coming soon so make sure you 
+check the wiki regularly.
+
+== REQUIREMENTS:
+
+* rubygems
+* ruby-debug
+* curb
+* nokogiri
+* hpricot (for the time being)
+* htmlentities
+
+== LICENSE:
+
+(The MIT License)
+
+Copyright (c) 2008
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+## Blah blah blah
+

data/Rakefile

@@ -0,0 +1,34 @@
+# Look in the tasks/setup.rb file for the various options that can be
+# configured in this Rakefile. The .rake files in the tasks directory
+# are where the options are used.
+
+begin
+  require 'bones'
+  Bones.setup
+rescue LoadError
+  begin
+    load 'tasks/setup.rb'
+  rescue LoadError
+    raise RuntimeError, '### please install the "bones" gem ###'
+  end
+end
+
+ensure_in_path 'lib'
+require 'wwmd'
+
+task :default => 'spec:run'
+
+PROJ.name = 'wwmd'
+PROJ.authors = 'Michael L. Tracy'
+PROJ.email = 'mtracy@matasano.com'
+PROJ.url = 'http://github.com/miketracy/wwmd/tree/master'
+PROJ.version = WWMD::VERSION
+#PROJ.rubyforge.name = 'wwmd'
+
+PROJ.spec.opts << '--color'
+
+depend_on 'ruby-debug'
+depend_on 'curb'
+depend_on 'nokogiri'
+
+# EOF

data/examples/config_example.yaml

@@ -0,0 +1,24 @@
+#---
+:base_url: "http://www.example.com"
+:header_file: "./HEADERS.default" # argv
+:username: "username" # argv
+:password: "password" # argv
+
+# opts for spider (only spider local urls)
+:spider_local_only: true
+
+# opts for curl object
+#	set max_redirects and follow_location (follows 302s)
+:follow_location: true
+:max_redirects: 20
+
+# --use_proxy=host:port overrides both of these settings
+# to use a proxy (I use burp and so should you)
+:use_proxy: false
+:proxy_url: "localhost:8080"
+
+# cookies (where are we going to save our cookies?)
+:enable_cookies: true
+:cookiejar: "./__cookiejar"
+
+#+++

data/examples/wwmd_example.rb

@@ -0,0 +1,73 @@
+#!/usr/bin/env ruby
+require 'rubygems'
+require 'wwmd'
+include WWMD
+
+$stop = lambda { Debugger.breakpoint; Debugger.catchpoint }
+
+module WWMD
+	class Page
+		# here we add directly to Page.login instead of creating an outside
+		# helper class.  Normally we create a mixin script for this.
+		def login
+			self.get(self.opts[:base_url])             ;# GET the main page redirects to /login
+			form = self.get_form                       ;# get the login form
+			if form.nil? then                          ;# did we actually get a form?
+				puts "WARN: No login form on base page"
+				return (self.logged_in = false)
+			end
+			form.set("name",self.opts[:username])      ;# set login form variables from config
+			form.set("password",self.opts[:password])
+			self.url = self.action                     ;# set the url to submit to to the form action
+			self.submit(form)                          ;# submit the form
+
+			# perform some check to make sure we aren't still on the login page
+			# (this naively checks to make sure we don't have any password fields on the current page
+			self.logged_in = (self.search("//input[@type='password']").size == 0)
+		end
+	end
+end
+
+# parse options and load configuration file
+inopts = WWMDConfig.parse_opts(ARGV)
+conf = ARGV[0] || "./config_example.yaml"
+opts = WWMDConfig.load_config(conf)
+inopts.each_pair { |k,v| opts[k] = v }
+$opts = opts
+
+# create our Page object and name it page
+page = Page.new(opts)
+page.scrape.warn = false  ;# don't complain about not overwriting scrape
+
+# move our spider object up here
+spider = page.spider
+
+# output current configuration
+puts "current configuration:\n"
+page.opts.each_pair { |k,v|
+	if k == :password then
+		puts "#{k} :: ********"
+	else
+		puts "#{k} :: #{v}"
+	end
+}
+puts "\n"
+
+# use the Helper method to login to the application
+if page.opts[:use_auth] then
+	page.login
+	if page.logged_in? then
+		puts "logged in as #{opts[:username]}"
+	else
+		puts "WARN: could not log in" if !page.logged_in?
+	end
+else
+	page.get opts[:base_url]
+end
+
+# report our current location and let's drop to irb with
+# our whole context complete
+puts "current location: #{page.current}"
+puts "enter \"irb\" to go to the console"
+
+$stop.call

data/lib/wwmd.rb

@@ -0,0 +1,78 @@
+# third-party
+require 'rubygems'
+require 'ruby-debug'
+require 'curb'
+require 'yaml'
+require 'fileutils'
+require 'base64'
+require 'optparse'
+require 'digest'
+require 'uri'
+require 'htmlentities'
+require 'nkf'
+require 'rexml/document'
+
+module WWMD
+
+  # :stopdoc:
+  VERSION = "0.2.11"
+  PARSER = :nokogiri  # :nokogiri || :hpricot
+  LIBPATH = ::File.expand_path(::File.dirname(__FILE__)) + ::File::SEPARATOR
+  PATH = ::File.dirname(LIBPATH) + ::File::SEPARATOR
+  # :startdoc:
+
+  # Returns the version string for the library.
+  #
+  def self.version
+    VERSION
+  end
+
+  # Returns the library path for the module. If any arguments are given,
+  # they will be joined to the end of the libray path using
+  # <tt>File.join</tt>.
+  #
+  def self.libpath( *args )
+    args.empty? ? LIBPATH : ::File.join(LIBPATH, args.flatten)
+  end
+
+  # Returns the lpath for the module. If any arguments are given,
+  # they will be joined to the end of the path using
+  # <tt>File.join</tt>.
+  #
+  def self.path( *args )
+    args.empty? ? PATH : ::File.join(PATH, args.flatten)
+  end
+
+  # Utility method used to require all files ending in .rb that lie in the
+  # directory below this file that has the same name as the filename passed
+  # in. Optionally, a specific _directory_ name can be passed in such that
+  # the _filename_ does not have to be equivalent to the directory.
+  #
+  def self.require_all_libs_relative_to( fname, dir = nil )
+    dir ||= ::File.basename(fname, '.*')
+    search_me = ::File.expand_path(
+        ::File.join(::File.dirname(fname), dir, '**', '*.rb'))
+
+    Dir.glob(search_me).sort.each do |rb|
+      next if rb =~ /_html2text/
+      require rb
+    end
+  end
+
+end  # module WWMD
+
+WWMD.require_all_libs_relative_to(__FILE__)
+
+# special case parser
+
+if WWMD::PARSER == :nokogiri
+  require 'nokogiri'
+  WWMD::HDOC = Nokogiri::HTML
+  require 'wwmd/nokogiri_html2text'
+else
+  require 'hpricot'
+  WWMD::HDOC = Hpricot
+  require 'wwmd/hpricot_html2text'
+end
+
+# EOF

data/lib/wwmd/encoding.rb

@@ -0,0 +1,40 @@
+=begin rdoc
+Place methods to character encodings here
+=end
+
+module WWMD
+  # This is where character encodings should go as singletons
+  # to be used as mixins for the String class
+  class Encoding
+
+    # Helper for String.to_utf7 mixin
+    # (complete hack but it works)
+    #
+    # if all=true, encode all characters.
+    # if all.class=Regexp encode only characters in the passed
+    # regular expression else default to /[^0-9a-zA-Z]/
+    #
+    # used by:
+    #  String.to_utf7
+    #  String.to_utf7!
+    def self.to_utf7(str,all=nil)
+      if all.kind_of?(Regexp)
+        reg = all
+      elsif all.kind_of?(TrueClass)
+        reg = ESCAPE[:all]
+      else
+        reg = ESCAPE[:nalnum] || /[^a-zA-Z0-9]/
+      end
+      puts reg.inspect
+      ret = ''
+      str.each_byte do |b|
+        if b.chr.match(reg)
+          ret += "+" + Base64.encode64(b.chr.toutf16)[0..2] + "-"
+        else
+          ret += b.chr
+        end
+      end
+      return ret
+    end
+  end
+end

data/lib/wwmd/form.rb

@@ -0,0 +1,110 @@
+=begin rdoc
+=end
+module WWMD
+  # == original author of hpricot_form
+  #
+  #  Chew Choon Keat <choonkeat at gmail>
+  #  http://blog.yanime.org/
+  #  19 July 2006
+  #
+  # updated by mtracy at matasano.com for use with Nokogiri and WWMD
+  #
+  class Form
+    attr_accessor :hdoc
+    attr_accessor :fields
+    attr_accessor :formtag
+
+    def initialize(doc)
+      @hdoc = doc
+      @formtag = @hdoc.search("//form")
+    end
+
+    def method_missing(*args)
+      hdoc.send(*args)
+    end
+
+    alias_method :old_fields, :fields
+    def fields
+      if PARSER == :nokogiri
+        @fields ||= (hdoc.search(".//input[@name]",".//select[@name]",".//textarea")).map { |x| Field.new(x) }
+      else
+        @fields ||= (hdoc.search("//input[@name]") + hdoc.search("//select[@name]") + hdoc.search("//textarea")).map { |x| Field.new(x) }
+      end
+    end
+
+    def field_names
+      fields.map { |x| x.get_attribute("name") }
+    end
+
+    def action
+      return self.get_attribute("action")
+    end
+
+    def report
+      puts "action = #{self.action}"
+      self.fields.each { |field| puts field.to_text }
+      return nil
+    end
+
+    alias_method :show, :report
+
+    def to_form_array
+      FormArray.new(self.fields)
+    end
+
+    def to_array
+      self.to_form_array
+    end
+  end
+
+  class Field < Form
+    def value
+      self._value.nil? ? self.get_attribute("value") : self._value
+    end
+
+    alias_method :get_value, :value #:nodoc:
+    alias_method :fvalue, :value #:nodoc:
+
+    def fname
+      self.get_attribute('name')
+    end
+
+    def ftype
+      self.get_attribute('type')
+    end
+
+    def _value
+      # selection (array)
+      if PARSER == :nokogiri
+        ret = hdoc.search(".//option[@selected]").collect { |x| x.get_attribute("value") }
+      else
+        ret = hdoc.search("//option[@selected]").collect { |x| x.get_attribute("value") }
+      end
+      case ret.size
+      when 0
+        if name == "textarea"
+          if PARSER == :nokogiri
+            hdoc.text
+          else
+            hdoc.innerHTML
+          end
+        else
+          hdoc.get_attribute("value") if (hdoc.get_attribute("checked") || !hdoc.get_attribute("type") =~ /radio|checkbox/)
+        end
+      when 1
+        ret.first
+      else
+        ret
+      end
+    end
+
+    def to_arr
+      return [self.name, self.ftype, self.fname, self.fvalue]
+    end
+
+    def to_text
+      return "tag=#{self.name} type=#{self.ftype} name=#{self.fname} value=#{self.fvalue}"
+    end
+
+  end
+end