watobo 0.9.12 → 0.9.13

data/.yardopts

@@ -1,7 +1,7 @@
 # .
 # .yardopts
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -21,4 +21,4 @@
 # .
 --no-private
 *.xxx
-- CHANGELOG
+--files CHANGELOG.md

data/{CHANGELOG → CHANGELOG.md}

@@ -1,3 +1,65 @@
+Version 0.9.13
+===
+News
+---
+**Core**
+
+ * Faster socket communication!! Now client sockets are reused 
+ * Big big changes on core modules, e.g. Watobo::Chats or Watobo::Findings.
+ * PassiveScanner - passive checks now run in background
+ * New DSL-like Plugin Style - digging into Metaprogramming ... check out WShell Plugin!
+
+**Modules**
+
+ * XSS-NG supports "Parameter Prefetching" - using form fields of response as test parameters 
+ * Hidden Field Spotter
+ * Improved boolean SQLi detection
+ * added some .NET Checks for well-known files, e.g. Trace.adx and Error Pages /w Stack-Trace
+ * XXE (Xml eXternal Entity) check
+ * Check html password fields for autocomplete attribute
+
+**Plugins**
+
+ * SSL Checker now also shows the tested method (SSLv3, TLS, ..)
+ * WShell - Watobo Shell; With WShell you can execute ruby commands in the context of WATOBO. Very useful for advanced analysis, debugging purposes or simply to explore WATOBO. 
+
+**GUI**
+
+  * Parameter names in Table view are now automatically en-/decoded
+  * Right-Click on a plugin to get some information about it - only works on new plugins at the moment ...
+  * Introduced a new chat viewer with HTML highlighting (based on FXScintilla)
+  * ConversationTable: added 'space' hotkey to open "Edit Comment" dialog
+  * ConversationTable: added hotkeys for "goto url" navigation
+  * ChatViewer: xml/html content gets prettyfied for text- and html-viewer
+  * FindingsTree: added counter to finding class
+  * FindingsTree: memorize expanded nodes
+  * Conversation table filter now opens as a dialog and displays more information
+
+Fixes
+---
+**Core**
+
+ * Bug in parsing multipart requests caused by incorrect boundary handling 
+ * conversation text filter now works on responses without content-type header
+
+**Fuzzer**
+
+ * fixed generator in fuzzer engine
+
+**GUI**
+
+ * crash after selecting client certs
+ * no more swallowing a space-char at the end of a string when b64decoding with short-cuts
+
+**Plugins**
+
+ * Catalog-Scanner: now all placeholders will be replaced
+ * SSLChecker now supports more methods and ciphers, incl. SSLv2
+
+**Passive Modules**
+
+ * FormSpotter: now using nokogiri for parsing/extracting <form> information
+
 = Version 0.9.12
 == NEW
 * [Module] Siebel Checks: Enumeration of default apps and files, e.g. base.txt

data/README.md

@@ -0,0 +1,30 @@
+WATOBO - THE Web Application Toolbox
+===
+WATOBO is a security tool for web applications. It is intended to enable security professionals to perform efficient (semi-automated) web application security audits.
+
+Most important features:
+
+ * WATOBO has Session Management capabilities! You can define login scripts as well as logout signatures. So you don’t have to login manually each time you get logged out.
+ * WATOB can act as a transparent proxy (requires nfqueue)
+ * WATOBO can perform vulnerability checks out of the box
+ * WATOBO can perform checks on functions which are protected by Anti-CSRF-/One-Time-Tokens 
+ * WATOBO supports Inline De-/Encoding, so you don’t have to copy strings to a transcoder and back again. Just do it inside the request/response window with a simple mouse click. 
+ * WATOBO has smart filter functions, so you can find and navigate to the most interesting parts of the application easily. 
+ * WATOBO is written in (FX)Ruby and enables you to easily define your own checks
+ * WATOBO runs on Windows, Linux, MacOS ... every OS supporting (FX)Ruby 
+ * WATOBO is free software ( licensed under the GNU General Public License Version 2) 
+ * It’s by siberas ;) 
+
+Documentation
+---
+Check out the online documentation and video tutorials at http://watobo.sourceforge.net
+
+Tips & Tricks
+---
+* On Linux you should use RVM to install Ruby (http://beginrescueend.com/rvm/install/)
+* Use FoxyProxy or SwitchProxy to easily change your proxy settings
+
+	
+
+
+

data/bin/nfq_server.rb

@@ -2,7 +2,7 @@
 # .
 # nfq_server.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -32,7 +32,8 @@ rescue LoadError
   exit
 end
 
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module NFQ
     class Connections
       attr :nfqueue
@@ -185,7 +186,7 @@ module Watobo
   end
 end
 
-DRb.start_service "druby://127.0.0.1:666", Watobo::NFQ::Connections.new
+DRb.start_service "druby://127.0.0.1:9090", Watobo::NFQ::Connections.new
 #puts DRb.uri
 DRb.thread.join
 

data/bin/watobo_gui.rb

@@ -2,7 +2,7 @@
 # .
 # watobo_gui.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com

data/config/ott_cache.yml

@@ -0,0 +1,4 @@
+:patterns:
+  - name="(token)" value="([0-9a-zA-Z!-]*)"
+  - (token)=([-0-9a-zA-Z_:]*)(;|&)?
+:request_ids: {}

data/config/scanner.yml

@@ -1,17 +1,3 @@
-:sid_patterns: 
-- name="(sessid)" value="([0-9a-zA-Z!-]*)"
-- (sessid)=([-0-9a-zA-Z_:]*)(;|&)?
-- (SESSIONID)=([-0-9a-zA-Z_:\.\(\)]*)(;|&)?
-- (PHPSESSID)=([0-9a-zA-Z]*)(;|&)?
-- (ASPSESSIONID)\w*=([0-9a-zA-Z]*)(;|&)?
-- (MYSAPSSO2)=([0-9a-zA-Z.=%]*)(;|&)?
-- (ELEXIRSID)=([0-9a-zA-Z!-]*)(;|&)?
-- (SLSID)=([0-9a-zA-Z!-]*)(;|&)?
-- (sid)=([0-9a-z]*)(')?
-- (saplb_\*)=([-0-9a-zA-Z_:\(\)]*)(;|&)?
-- (DomAuthSessId)=([0-9a-zA-Z]*)(;|&)?
-- (wgate)\/([\w]{4,}\/[\w=~]*)(;|&|'|")?
-- (session)=([-0-9a-zA-Z_:\.]*)(;|&)?
 :logout_signatures: 
 - ^Location.*login
 :smart_scan: true
@@ -27,8 +13,5 @@
 :scope: {}  
 :run_passive_checks: false
 :client_certificates: {}
-:csrf_patterns:
-  - name="(token)" value="([0-9a-zA-Z!-]*)"
-  - (token)=([-0-9a-zA-Z_:]*)(;|&)?
-
+:auto_login: true
   

data/config/sid_cache.yml

@@ -0,0 +1,14 @@
+:patterns: 
+- name="(sessid)" value="([0-9a-zA-Z!-]*)"
+- (sessid)=([-0-9a-zA-Z_:]*)(;|&)?
+- (SESSIONID)=([-0-9a-zA-Z_:\.\(\)]*)(;|&)?
+- (PHPSESSID)=([0-9a-zA-Z]*)(;|&)?
+- (ASPSESSIONID)\w*=([0-9a-zA-Z]*)(;|&)?
+- (MYSAPSSO2)=([0-9a-zA-Z.=%]*)(;|&)?
+- (ELEXIRSID)=([0-9a-zA-Z!-]*)(;|&)?
+- (SLSID)=([0-9a-zA-Z!-]*)(;|&)?
+- (sid)=([0-9a-z]*)(')?
+- (saplb_\*)=([-0-9a-zA-Z_:\(\)]*)(;|&)?
+- (DomAuthSessId)=([0-9a-zA-Z]*)(;|&)?
+- (wgate)\/([\w]{4,}\/[\w=~]*)(;|&|'|")?
+- (session)=([-0-9a-zA-Z_:\.]*)(;|&)?

data/extras/private-hostspot.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+iptables -F
+iptables -X
+iptables -t nat -F
+iptables -t nat -X
+iptables -t mangle -F
+iptables -t mangle -X
+iptables -P INPUT ACCEPT
+iptables -P FORWARD ACCEPT
+iptables -P OUTPUT ACCEPT
+
+echo "Turning on Natting"
+iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
+
+echo "Allowing ip forwarding"
+echo 1 > /proc/sys/net/ipv4/ip_forward
+

data/extras/watobo-installer.sh

@@ -0,0 +1,61 @@
+#!/bin/bash
+#===========================
+# WATOBO-Installer for Linux
+#---------------------------
+# Tested on BackTrack 5R2
+#===========================
+# Date: 06.08.2012
+# Author: Andreas Schmidt
+Version=1.1
+#---
+# Version 1.1
+# added libnetfilter-queue-dev package & gem
+# added platform detection
+#---
+
+info() {
+  printf "\033[36m$*\033[0m\n"
+}
+
+head() {
+  printf "\033[31m$*\033[0m\n"
+}
+
+head "##############################################"
+head "#     W A T O B O - I N S T A L L E R        #"
+head "##############################################"
+info "Version: $Version"
+gem_opts=""
+platform="Generic"
+file=/etc/issue
+if grep -q "BackTrack" $file
+then
+ platform="BackTrack"
+ gem_opts="--user-install"
+fi
+
+info "Platform: $platform"
+
+if [ "$platform" == "BackTrack" ]
+then
+echo "Adding /root/.gem/ruby/1.9.2/bin/ to your PATH .."
+echo 'export PATH=$PATH:/root/.gem/ruby/1.9.2/bin' >> /root/.bashrc
+export PATH=$PATH:/root/.gem/ruby/1.9.2/bin
+#. /root/.bashrc
+fi
+
+echo "Installing required gems ..."
+for G in ffi multi_json childprocess selenium-webdriver mechanize fxruby net-http-digest_auth net-http-persistent nokogiri domain_name unf webrobots ntlm-http net-http-pipeline nfqueue watobo
+do
+  info ">> $G"
+  gem install $gem_opts $G
+done
+
+echo "Install libnetfilter for transparent proxy mode"
+apt-get install libnetfilter-queue-dev
+
+info "Installation finished."
+echo "Open a new shell and type watobo_gui.rb to start WATOBO."
+echo "For manuals/videos and general information about WATOBO please check:"
+echo "* http://watobo.sourceforge.net/"
+

data/extras/watobo-transparent.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+# configure your interfaces here
+INT_IN=wlan0
+INT_OUT=eth0
+
+echo "= Interface Configuration ="
+echo "Incoming Interface: $INT_IN"
+echo "Outgoing Interface: $INT_OUT"
+
+echo "Resetting IPTables ..."
+iptables -F
+iptables -X
+iptables -t nat -F
+iptables -t nat -X
+iptables -t mangle -F
+iptables -t mangle -X
+iptables -P INPUT ACCEPT
+iptables -P FORWARD ACCEPT
+iptables -P OUTPUT ACCEPT
+
+echo "Restarting DHCP ..."
+/etc/init.d/dhcp3-server restart
+
+echo "Restarting DNS ..."
+/etc/init.d/bind9 restart
+
+echo "Enable IP Forwarding ..."
+echo 1 > /proc/sys/net/ipv4/ip_forward
+
+echo "Send Packets To NFQUEUE ..."
+iptables -t mangle -A PREROUTING -p tcp -m state --dport 443 --state NEW -j NFQUEUE --queue-num 0
+
+echo "Redirect Traffic to WATOBO ..."
+iptables -t nat -A PREROUTING -i $INT_IN -p tcp -m tcp -j REDIRECT --dport 443 --to-ports 8081
+iptables -t nat -A PREROUTING -i $INT_IN -p tcp -m tcp -j REDIRECT --dport 80 --to-ports 8081
+
+echo "Turn on Natting ..."
+iptables -t nat -A POSTROUTING -o $INT_OUT -j MASQUERADE

data/lib/watobo/adapters/data_store.rb

@@ -1,7 +1,7 @@
 # .
 # data_store.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -19,7 +19,8 @@
 # along with WATOBO; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   class DataStore
     
     @engine = nil
@@ -28,7 +29,7 @@ module Watobo
       @engine
     end  
       
-    def self.acquire(project_name, session_name)
+    def self.connect(project_name, session_name)
       a = Watobo::Conf::Datastore.adapter
       store = case
       when 'file'
@@ -40,10 +41,31 @@ module Watobo
       store
     end
     
+    def self.method_missing(name, *args, &block)
+      super unless @engine.respond_to? name
+      @engine.send name, *args, &block
+    end
+    
         
   end
   
+  def self.logs
+    return "" if DataStore.engine.nil?
+    DataStore.engine.logs
+  end
+  
   def self.log(message, prefs={})
+    
+    text = message
+    if message.is_a? Array
+      text = message.join("\n| ")
+    end
+    
+    #clean up sender's name
+    if prefs.has_key? :sender
+      prefs[:sender].gsub!(/.*::/,'')
+    end
+    
     if DataStore.engine.respond_to? :logger
       DataStore.engine.logger message, prefs
     end

data/lib/watobo/adapters/file/file_store.rb

@@ -1,7 +1,7 @@
 # .
 # file_store.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -19,7 +19,8 @@
 # along with WATOBO; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   class FileSessionStore < SessionStore
     def num_chats
       get_file_list(@conversation_path, "*-chat*").length
@@ -149,10 +150,10 @@ module Watobo
       wsp = Watobo.workspace_path
       return false unless File.exist? wsp
       puts "* using workspace path: #{wsp}" if $DEBUG
-      
+
       @log_file = nil
       @log_lock = Mutex.new
-      
+
       @project_path = File.join(wsp, project_name)
       unless File.exist? @project_path
         puts "* create project path: #{@project_path}" if $DEBUG
@@ -197,7 +198,7 @@ module Watobo
           end
         end
       end
-      
+
       @log_file = File.join(@log_path, session_name + ".log")
 
     #     @chat_files = get_file_list(@conversation_path, "*-chat")
@@ -255,21 +256,29 @@ module Watobo
       s
 
     end
-    
+
+    def logs
+      l = ''
+      @log_lock.synchronize do
+        l = File.open(@log_file).read
+      end
+      l
+    end
+
     def logger( message, prefs = {} )
       opts = { :sender => "unknown", :level => Watobo::Constants::LOG_INFO }
       opts.update prefs
       return false if @log_file.nil?
       begin
-         t = Time.now
+        t = Time.now
         now = t.strftime("%m/%d/%Y @ %H:%M:%S")
         log_message = [ now ]
         log_message << "#{opts[:sender]}"
         if message.is_a? Array
           log_message << message.join("\n| ")
           log_message << "\n-"
-        else        
-          log_message << message
+        else
+        log_message << message
         end
         @log_lock.synchronize do
           File.open(@log_file,"a") do |lfh|
@@ -279,8 +288,7 @@ module Watobo
       rescue => bang
         puts bang
       end
-      
-      
+
     end
 
     private

data/lib/watobo/adapters/session_store.rb

@@ -1,7 +1,7 @@
 # .
 # session_store.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -19,7 +19,8 @@
 # along with WATOBO; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   class SessionStore
     
     # TODO: Define default methods here

data/lib/watobo/adapters.rb

@@ -1,7 +1,7 @@
 # .
 # adapters.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com

data/lib/watobo/ca.rb

@@ -1,7 +1,7 @@
 # .
 # ca.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com

data/lib/watobo/config.rb

@@ -1,7 +1,7 @@
 # .
 # config.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -19,7 +19,8 @@
 # along with WATOBO; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module Conf
 
     @@settings = Hash.new
@@ -33,15 +34,15 @@ module Watobo
       @@modules.length
     end
     
-    def self.load_project_settings(data_store)
+    def self.load_project_settings()
       @@modules.each do |m|
-        m.load_project(data_store)
+        m.load_project()
       end
     end
     
-    def self.load_session_settings(data_store)
+    def self.load_session_settings()
       @@modules.each do |m|
-        m.load_session(data_store)
+        m.load_session()
       end
     end
 
@@ -80,29 +81,28 @@ module Watobo
           @settings = YAML.load(YAML.dump(settings))
         end
 
-        def self.save_session(data_store, *filter, &b)
-          raise ArgumentError, "Need a valid Watobo::DataStore" unless data_store.respond_to? :save_project_settings
+        def self.save_session( *filter, &b)
+          #raise ArgumentError, "Need a valid Watobo::DataStore" unless data_store.respond_to? :save_project_settings
           s = filter_settings filter
           yield s if block_given?
          # puts group_name
-          data_store.save_session_settings( group_name, s )
+          Watobo::DataStore.save_session_settings( group_name, s )
         end
 
-        def self.save_project(data_store, *filter, &b)
-          raise ArgumentError, "Need a valid Watobo::DataStore" unless data_store.respond_to? :save_project_settings
+        def self.save_project( *filter, &b)
+         # raise ArgumentError, "Need a valid Watobo::DataStore" unless data_store.respond_to? :save_project_settings
           s = filter_settings filter
          # puts @settings.to_yaml
          # puts s.to_yaml
-          data_store.save_project_settings(group_name, s)
+          Watobo::DataStore.save_project_settings(group_name, s)
         end
         
-        def self.load_session(data_store, prefs={}, &b)
-          raise ArgumentError, "Need a valid Watobo::DataStore" unless data_store.respond_to? :load_project_settings
+        def self.load_session(prefs={}, &b)
           
           p = { :update => true }
           p.update prefs
           
-          s = data_store.load_session_settings(group_name)
+          s = Watobo::DataStore.load_session_settings(group_name)
           return false if s.nil?
           
           if p[:update] == true
@@ -112,13 +112,11 @@ module Watobo
           end
         end
         
-        def self.load_project(data_store, prefs={}, &b)
-          raise ArgumentError, "Need a valid Watobo::DataStore" unless data_store.respond_to? :load_project_settings
-          
+        def self.load_project(prefs={}, &b)
           p = { :update => true }
           p.update prefs
           
-          s = data_store.load_project_settings(group_name)
+          s = Watobo::DataStore.load_project_settings(group_name)
           return false if s.nil?
           
           if p[:update] == true

data/lib/watobo/constants.rb

@@ -1,7 +1,7 @@
 # .
 # constants.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -24,7 +24,8 @@ $debug_active_check = false
 $debug_scanner = false
 
 
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module Constants    
     CHAT_SOURCE_UNDEF = 0x00
     CHAT_SOURCE_INTERCEPT = 0x01