watobo 0.9.12 → 0.9.13

data/lib/watobo/gui/findings_tree.rb

@@ -1,7 +1,7 @@
 # .
 # findings_tree.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -19,7 +19,8 @@
 # along with WATOBO; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module Gui
     class FindingsTree < FXTreeList
       include Watobo::Constants
@@ -31,6 +32,7 @@ module Watobo
       end
 
       def expandFullTree(item)
+        @expandeds = []
         self.expandTree(item)
         item.each do |c|
           expandFullTree(c) if !self.itemLeaf?(c)
@@ -38,6 +40,7 @@ module Watobo
       end
 
       def collapseFullTree(item)
+        @expandeds = []
         self.collapseTree(item)
         item.each do |c|
           collapseFullTree(c) if !self.itemLeaf?(c)
@@ -49,26 +52,24 @@ module Watobo
         false
       end
 
-      def refresh_tree
-        self.clearItems
-
-        @findings.each_value do |finding|
-
-          addFinding(finding)
-
-        end
-      end
-
+     
       def reload()
-
-        unless @project.nil?
+         self.clearItems        
           @findings.clear
-          @project.findings.each do |fid, finding|
-            @findings[fid] = finding
-          end
-        end
-        refresh_tree
-
+          Watobo::Findings.each do |fid, finding|
+            addFinding(finding)
+          end   
+         expand_findings
+         @expandeds.each do |t|
+           site, text = t.split("|")
+           if( site = self.findItem(site, nil, SEARCH_FORWARD|SEARCH_NOWRAP) )
+             if( node = self.findItem(text, site, SEARCH_FORWARD|SEARCH_NOWRAP) )
+               self.expandTree(node)
+             else
+               @expandeds.delete t
+             end
+           end
+         end     
       end
 
       def useRegularIcons()
@@ -77,6 +78,7 @@ module Watobo
         regular_font.create
         # Findings Tree Icons
         @icon_vuln = ICON_VULN
+        @icon_vuln_bp = ICON_VULN_BP
         @icon_vuln_low = ICON_VULN_LOW
         @icon_vuln_medium = ICON_VULN_MEDIUM
         @icon_vuln_high = ICON_VULN_HIGH
@@ -95,6 +97,7 @@ module Watobo
         small_font = FXFont.new(getApp(), "helvetica", GUI_SMALL_FONT_SIZE)
         small_font.create
         @icon_vuln = ICON_VULN_SMALL
+        @icon_vuln_bp = ICON_VULN_BP_SMALL
         @icon_vuln_low = ICON_VULN_LOW_SMALL
         @icon_vuln_medium = ICON_VULN_MEDIUM_SMALL
         @icon_vuln_high = ICON_VULN_HIGH_SMALL
@@ -119,7 +122,7 @@ module Watobo
         #  puts finding.details[:title]
         @findings[finding.details[:fid]] = finding
         if @show_scope_only == true
-          addFindingItem(finding) if @project.siteInScope?(finding.request.site)
+          addFindingItem(finding) if Watobo::Scope.match_site?(finding.request.site)
         else
           addFindingItem(finding)
         end
@@ -161,6 +164,8 @@ module Watobo
 
             when FINDING_TYPE_VULN
               finding_type = "Vulnerabilities"
+              icon = @icon_vuln_bp
+              
               if finding.details[:rating] == VULN_RATING_LOW
               icon = @icon_vuln_low
               #  puts "low-rating-vuln"
@@ -179,7 +184,7 @@ module Watobo
             sub_tree = self.findItem(finding_type, site, SEARCH_FORWARD|SEARCH_IGNORECASE|SEARCH_NOWRAP)
             if sub_tree and sub_tree.parent == site and finding.details[:class]
 
-              class_item = self.findItem(finding.details[:class], sub_tree, SEARCH_FORWARD|SEARCH_IGNORECASE|SEARCH_NOWRAP)
+              class_item = self.findItem(finding.details[:class], sub_tree, SEARCH_FORWARD|SEARCH_IGNORECASE|SEARCH_NOWRAP|SEARCH_PREFIX)
               if not class_item or class_item.parent != sub_tree
                 class_item = self.appendItem(sub_tree, finding.details[:class], icon, icon)
                 self.setItemData(class_item, :finding_class )
@@ -199,6 +204,13 @@ module Watobo
               request_item = self.appendItem(title_item, text)
               self.setItemData(request_item, finding)
               end
+              
+              #
+              unless class_item.text =~ / \(\d+\)$/
+                class_item.text = class_item.text + " (#{class_item.numChildren})"
+              else
+              class_item.text = class_item.text.gsub(/ \(\d+\)$/, " (#{class_item.numChildren})")
+              end
             end
 
           end
@@ -217,6 +229,8 @@ module Watobo
         @findings = Hash.new
         @show_scope_only = false
         @hide_false_positives = false
+        @clipboard = ""
+        @expandeds = []
 
         @event_dispatcher_listeners = Hash.new
 
@@ -225,6 +239,30 @@ module Watobo
         useRegularIcons()
 
         @filtered_domains = Hash.new # domains which already have been filtered
+        
+        self.connect(SEL_CLIPBOARD_REQUEST) do
+            setDNDData(FROM_CLIPBOARD, FXWindow.stringType, Fox.fxencodeStringData(@clipboard.to_s))
+        end
+        
+        self.connect(SEL_EXPANDED) do |sender, sel, item|
+          parent = item
+          while parent.parent
+            parent = parent.parent
+          end
+          unless parent.nil? or item.nil?
+            node = "#{parent.text}|#{item.text}"
+            @expandeds << node
+          end
+        end
+        
+        self.connect(SEL_COLLAPSED) do |sender, sel, item|
+          parent = item
+          while parent.parent
+            parent = parent.parent
+          end
+          node = "#{parent.text}|#{item.text}"
+          @expandeds.delete node
+        end
 
         self.connect(SEL_COMMAND) do |sender, sel, item|
           if self.itemLeaf?(item)
@@ -293,7 +331,7 @@ module Watobo
 
               target.connect(SEL_COMMAND) { |ts, sl, it|
                 @show_scope_only = ts.checked?
-                refresh_tree
+                reload
               }
 
               target = FXMenuCheck.new(menu_pane, "hide false-positives" )
@@ -302,7 +340,7 @@ module Watobo
 
               target.connect(SEL_COMMAND) { |ts, sl, it|
                 @hide_false_positives = ts.checked?
-                refresh_tree
+                reload
               }
             
             
@@ -317,8 +355,9 @@ module Watobo
                 if data == :item_type_site then
                  # FXMenuSeparator.new(menu_pane)
                   FXMenuCommand.new(menu_pane, "add site to scope" ).connect(SEL_COMMAND) {
-
-                    notify(:add_site_to_scope, item.to_s)
+                    #notify(:add_site_to_scope, item.to_s)
+                    Watobo::Scope.add item.to_s
+                    reload
                   }
                # 
                 elsif data == :title
@@ -329,6 +368,8 @@ module Watobo
                       end
                       
                    fp_submenu = FXMenuPane.new(self) do |sub|
+                     
+                     
 
                     target = FXMenuCommand.new(sub, "Set False Positive" )
                     target.connect(SEL_COMMAND) {
@@ -429,6 +470,22 @@ module Watobo
                       end
                       
                   fp_submenu = FXMenuPane.new(self) do |sub|
+                    
+                     target = FXMenuCommand.new(sub, "Copy URLs" )
+                    target.connect(SEL_COMMAND) {
+                     
+                     urls = []
+                     findings.each do |f|
+                       proto = f.request.proto
+                       site = f.request.site
+                       path = f.request.path
+                       urls << "#{proto}://#{site}/#{path}"
+                     end
+                     types = [ FXWindow.stringType ]
+                     if acquireClipboard(types)
+                       @clipboard = urls.uniq.join("\n")
+                     end
+                    }
 
                     target = FXMenuCommand.new(sub, "Set False Positive" )
                     target.connect(SEL_COMMAND) {
@@ -490,6 +547,13 @@ module Watobo
                   }
 
                 elsif data.is_a? Watobo::Finding then
+                  FXMenuCommand.new(menu_pane, "Copy URL" ).connect(SEL_COMMAND){
+                    types = [ FXWindow.stringType ]
+                     if acquireClipboard(types)
+                       @clipboard = item.data.request.url.to_s
+                     end
+                    
+                  }
                  # FXMenuSeparator.new(menu_pane)
                   doManual = FXMenuCommand.new(menu_pane, "Manual Request.." )
                   doManual.connect(SEL_COMMAND) {
@@ -514,6 +578,17 @@ module Watobo
       end
 
       private
+      
+      def expand_findings()
+        self.each do |site|
+          expandTree site
+           %w(Vulnerabilities Hints Info).each do |item|
+              f = self.findItem(item, site,SEARCH_FORWARD|SEARCH_IGNORECASE)
+              expandTree(f) unless site.nil?
+           end
+        end
+       
+      end
 
       def notify(event, *args)
         if @event_dispatcher_listeners[event]

data/lib/watobo/gui/full_scan_dialog.rb

@@ -1,7 +1,7 @@
 # .
 # full_scan_dialog.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -19,7 +19,8 @@
 # along with WATOBO; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module Gui
     
     class FullScanDialog < FXDialogBox
@@ -96,15 +97,13 @@ module Watobo
         
         @switcher = FXSwitcher.new(base_frame,LAYOUT_FILL_X|LAYOUT_FILL_Y)   
         
-        @selectedSites = []
-        #    @selectSitesFrame = SelectSitesFrame.new(@switcher, project, prefs)
-        @defineScopeFrame = DefineScopeFrame.new(@switcher, @project.listSites(), @project.scope, prefs)
+        @defineScopeFrame = DefineScopeFrame.new(@switcher, prefs)
         
         @policyBase = FXVerticalFrame.new(@switcher, :opts => LAYOUT_FILL_X|LAYOUT_FILL_Y, :padding => 0)
         smf = FXHorizontalFrame.new(@policyBase, :opts => LAYOUT_FILL_X|LAYOUT_SIDE_TOP|FRAME_GROOVE)
         FXLabel.new(smf, "Select Checks")
         
-        @policyFrame = ChecksPolicyFrame.new(@policyBase, @project.active_checks, @project.getScanPolicy)
+        @policyFrame = ChecksPolicyFrame.new(@policyBase, @project.getScanPolicy)
         
       #  @scannerOptions = ScannerSettingsFrame.new(@switcher, @project.getScanPreferences(),:opts => LAYOUT_FILL_X|LAYOUT_FILL_Y, :padding => 0)
         @scannerOptions = ScannerSettingsFrame.new(@switcher, :opts => LAYOUT_FILL_X|LAYOUT_FILL_Y, :padding => 0)

data/lib/watobo/gui/fuzzer_gui.rb

@@ -1,7 +1,7 @@
 # .
 # fuzzer_gui.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -20,7 +20,8 @@
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
 require 'watobo/gui/request_editor.rb'
-module Watobo
+# @private 
+module Watobo#:nodoc: all
 
 
    module Gui
@@ -63,10 +64,10 @@ module Watobo
          def generateChecks(chat)
             unless @fuzzer_list.empty?
                fuzzels(@fuzzer_list) do |fuzzle|
-                  checker = proc{
-                     test_fuzzle = Hash.new
-                     test_fuzzle.update fuzzle
-
+                 test_fuzzle = Hash.new
+                 test_fuzzle.update YAML.load(YAML.dump(fuzzle))
+                  checker = proc{                     
+                     #puts test_fuzzle
                      fuzz_request = @requestEditor.parseRequest(test_fuzzle)
                      fuzz_request.extend Watobo::Mixin::Shaper::Web10
                      fuzz_request.extend Watobo::Mixin::Parser::Web10
@@ -1000,8 +1001,9 @@ module Watobo
                scan_prefs[:scanlog_name] = @log_dir_dt.value unless @log_dir_dt.value.empty?
           end
           
-            @scanner = Watobo::Scanner2.new(chat_list, check_list, @project.passive_checks, scan_prefs)
-            @pbar.total = @scanner.numTotalChecks
+          #  @scanner = Watobo::Scanner2.new(chat_list, check_list, @project.passive_checks, scan_prefs)
+           @scanner = Watobo::Scanner3.new(chat_list, check_list , [], scan_prefs)
+            @pbar.total = @scanner.sum_total
             @pbar.progress = 0
             @pbar.barColor = 'red'
 
@@ -1015,7 +1017,7 @@ module Watobo
 
             }
 
-            Thread.new {
+           # Thread.new {
                begin
                   m = "start fuzzing..."
                   @log_viewer.log(LOG_INFO,m)
@@ -1027,17 +1029,17 @@ module Watobo
                   puts scan_prefs.to_yaml
 puts "run scanner"
                   @scanner.run(scan_prefs)
-                  @fuzz_button.text = "Start"
-                  @pbar.total = 0
-                  @pbar.progress = 0
-                  @pbar.barColor = 'grey'
-                  m = "finished fuzzing!"
-                  @log_viewer.log(LOG_INFO,m)
+                  #@fuzz_button.text = "Start"
+                  #@pbar.total = 0
+                  #@pbar.progress = 0
+                  #@pbar.barColor = 'grey'
+                  #m = "finished fuzzing!"
+                  #@log_viewer.log(LOG_INFO,m)
                rescue => bang
                   puts bang
                   puts bang.backtrace if $DEBUG
                end
-            }
+           # }
 
          end
 
@@ -1051,6 +1053,7 @@ puts "run scanner"
             @request = chat.request.dup
             @fuzzing_paused = false
             @fuzzing_started = false
+            @scan_status_lock = Mutex.new
 
             #  @scan_prefs = @project.getScanPreferences()
 
@@ -1210,8 +1213,38 @@ puts "run scanner"
             FXLabel.new(log_frame_header, "Logs:" )
             log_text_frame = FXVerticalFrame.new(log_frame, LAYOUT_FILL_X|LAYOUT_FILL_Y|FRAME_SUNKEN|FRAME_GROOVE, :padding=>0)
             @log_viewer = LogViewer.new(log_text_frame, :opts => LAYOUT_FILL_X|LAYOUT_FILL_Y)
-
-         end
+            
+            add_update_timer(250)
+
+         end
+         
+         def add_update_timer(ms)
+          @update_timer = FXApp.instance.addTimeout( ms, :repeat => true) {
+            unless @scanner.nil?
+              @scan_status_lock.synchronize do
+
+              if @pbar.total > 0
+                sum_progress = 0
+                @scanner.progress.each_value do |v|
+                  sum_progress += v[:progress]
+                end
+                @pbar.progress = sum_progress
+              end
+        
+             if @scanner.finished?
+              @scanner = nil
+              #logger("Scan Finished!")
+               @log_viewer.log(LOG_INFO,"Done fuzzing!")
+              @pbar.progress = 0
+              @pbar.total = 0
+              @pbar.barColor = 'grey' #FXRGB(255,0,0)
+             # @btn_quickscan.text = "QuickScan"
+             end
+           end
+         
+    end
+    }
+    end
       end
 
       class FuzzerTree < FXTreeList

data/lib/watobo/gui/goto_url_dialog.rb

@@ -0,0 +1,92 @@
+# .
+# goto_url_dialog.rb
+# 
+# Copyright 2013 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+# @private 
+module Watobo#:nodoc: all
+  module Gui
+    class GotoUrlDialog < FXDialogBox
+      
+      include Responder
+      
+      attr :url_pattern
+      def initialize(owner, pattern=nil )
+        #super(owner, "Edit Target Scope", DECOR_TITLE|DECOR_BORDER, :width => 300, :height => 425)
+        super(owner, "Enter URL filter (regex):", DECOR_ALL, :width => 300, :height => 150)
+        
+        FXMAPFUNC(SEL_COMMAND, ID_ACCEPT, :onAccept)
+
+        base_frame = FXVerticalFrame.new(self, :opts => LAYOUT_FILL_X|LAYOUT_FILL_Y)
+        @url_pattern = ""
+
+      
+       @pattern_field = FXTextField.new(base_frame, 40, :target => @pattern, :selector => FXDataTarget::ID_VALUE, :opts => TEXTFIELD_NORMAL|LAYOUT_SIDE_LEFT)
+        @pattern_field.setText(pattern) unless pattern.nil?
+        @pattern_field.setFocus()
+        @pattern_field.setDefault()
+
+        @pattern_field.connect(SEL_KEYPRESS) { |sender, sel, event|
+          if event.code == KEY_Tab
+          @finishButton.setFocus()
+          @finishButton.setDefault()
+          true
+          else
+          false
+          end
+
+        }
+        buttons_frame = FXHorizontalFrame.new(base_frame,
+        :opts => LAYOUT_FILL_X|LAYOUT_SIDE_TOP)
+
+        @finishButton = FXButton.new(buttons_frame, "Accept" ,  nil, nil, :opts => BUTTON_NORMAL|LAYOUT_RIGHT)
+        @finishButton.enable
+        
+        
+        @finishButton.connect(SEL_COMMAND) do |sender, sel, item|
+        #self.handle(self, FXSEL(SEL_COMMAND, ID_CANCEL), nil)
+          self.handle(self, FXSEL(SEL_COMMAND, ID_ACCEPT), nil)
+          true
+        end
+
+        @cancelButton = FXButton.new(buttons_frame, "Cancel" ,
+        :target => self, :selector => FXDialogBox::ID_CANCEL,
+        :opts => BUTTON_NORMAL|LAYOUT_RIGHT)
+
+      end
+      
+      private 
+      
+      def onAccept(sender, sel, event)
+        begin
+          @url_pattern = @pattern_field.text
+          "regex_test".match(/#{@url_pattern}/)
+        rescue
+          @url_pattern = Regexp.quote @pattern_field.text
+        end
+
+       # Watobo::Scope.set @defineScopeFrame.getScope()
+
+        getApp().stopModal(self, 1)
+        self.hide()
+        return 0
+      end
+    end
+  end
+end

data/lib/watobo/gui/hex_viewer.rb

@@ -1,7 +1,7 @@
 # .
 # hex_viewer.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -19,17 +19,18 @@
 # along with WATOBO; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module Gui
     class HexViewer < FXHorizontalFrame
       def normalizeText(text)
         dummy = []
         begin
           text.headers.each do |h|
-            dummy.push h.strip + "\r\n"
+            dummy.push h.strip.unpack("C*").pack("C*") + "\r\n"
           end
           dummy.push "\r\n"
-          dummy.push text.body
+          dummy.push text.body.unpack("C*").pack("C*")
           dummy = dummy.join
         rescue => bang
           dummy = text
@@ -37,7 +38,16 @@ module Watobo
         return dummy
       end
       
-      def setText(raw_text)
+      def setText(tobject)
+        raw_text = tobject
+        
+        if tobject.respond_to? :has_body?
+          raw_text = ""
+         raw_text << tobject.body.to_s unless tobject.body.nil? 
+        end
+            
+       
+        
         initTable()
         
         if raw_text and not raw_text.empty? then
@@ -58,6 +68,7 @@ module Watobo
             
             if pos % 16 == 0 then
               chunk = raw_text[row*16..pos-1]
+              
              # puts chunk
               @hexTable.setItemText(row, 16, chunk.gsub(/[^[:print:]]/,'.')) if !chunk.nil?
               @hexTable.getItem(row, 16).justify = FXTableItem::LEFT