watobo 0.9.12 → 0.9.13

data/lib/watobo/core/chats.rb

@@ -0,0 +1,301 @@
+# .
+# chats.rb
+# 
+# Copyright 2013 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+# @private 
+module Watobo#:nodoc: all
+  class Chats
+    @chats = []
+    @chats_lock = Mutex.new
+    @event_dispatcher_listeners = Hash.new
+    def self.subscribe(event, &callback)
+      (@event_dispatcher_listeners[event] ||= []) << callback
+    end
+
+    def self.clearEvents(event)
+      @event_dispatcher_listeners[event] ||= []
+      @event_dispatcher_listeners[event].clear
+    end
+
+    def self.notify(event, *args)
+      if @event_dispatcher_listeners[event]
+        @event_dispatcher_listeners[event].each do |m|
+          m.call(*args) if m.respond_to? :call
+        end
+      end
+    end
+
+    def self.reset
+      @chats = []
+      @event_dispatcher_listeners = Hash.new
+    end
+
+    def self.load
+
+    end
+
+    def self.select(site, opts={}, &block)
+      o = {
+        :dir => "",
+        #:file => nil,
+        :method => nil,
+        :max_count => 0
+      }
+      o.update opts
+      o[:dir].strip!
+      o[:dir].gsub!(/^\//,"")
+
+      matches = []
+      @chats.each do |c|
+        if c.request.site == site then
+          matches.push c if o[:dir] == c.request.dir
+        end
+        return matches if o[:max_count] > 0 and matches.length >= o[:max_count]
+      end
+      return matches
+
+    end
+
+    def self.sites(prefs={}, &block)
+      list = Hash.new
+
+      cprefs = { :in_scope => false,
+        :ssl => false
+      }
+      cprefs.update prefs
+
+      Watobo::Chats.each do |chat|
+        next if list.has_key?(chat.request.site)
+        site = chat.request.site
+        next if cprefs[:in_scope] == true and not Watobo::Scope.match_site?(site)
+        next if cprefs[:ssl] and not chat.use_ssl?
+
+        yield site if block_given?
+        list[site] = nil
+
+      end
+      return list.keys
+    end
+
+    def self.dirs(site, list_opts={}, &block)
+      opts = { :base_dir => "",
+        :include_subdirs => true
+      }
+      opts.update(list_opts) if list_opts.is_a? Hash
+      list = Hash.new
+      @chats.each do |chat|
+        next if chat.request.site != site
+        next if list.has_key?(chat.request.path)
+        next if opts[:base_dir] != "" and chat.request.path !~ /^#{Regexp.quote(opts[:base_dir])}/
+        subdirs = chat.request.subDirs
+        subdirs.each do |dir|
+          next if dir.nil?
+          next if list.has_key?(dir)
+          list[dir] = :path
+          if opts[:include_subdirs] == true then
+            yield dir if block_given?
+          else
+            d = dir.gsub(/#{Regexp.quote(opts[:base_dir])}/,"")
+            yield dir unless d =~ /\// and block_given?
+          # otherwise it is a subdir of base_dir
+          end
+        end
+      end
+    end
+
+    def self.get_by_id(chatid)
+      @chats_lock.synchronize do
+        @chats.each do |c|
+          if c.id.to_s == chatid.to_s then
+          return c
+          end
+        end
+      end
+      return nil
+    end
+
+    def self.each(&block)
+      if block_given?
+        @chats_lock.synchronize do
+          @chats.map{|c| yield c }
+        end
+      end
+    end
+    
+    def self.to_a
+      @chats
+    end
+
+    def self.length
+      l = 0
+      @chats_lock.synchronize do
+        l = @chats.length
+      end
+      l
+    end
+
+    def self.in_scope(&block)
+      scan_prefs = Watobo::Conf::Scanner.to_h
+      #puts scan_prefs.to_yaml
+      unique_list = Hash.new
+      cis = []
+
+      @chats.each do |chat|
+        next if scan_prefs[:excluded_chats].include?(chat.id)
+        uch = chat.request.uniq_hash
+
+        next if unique_list.has_key?(uch) and scan_prefs[:smart_scan] == true
+        unique_list[uch] = nil
+        if Watobo::Scope.match_chat? chat
+          cis << chat
+          yield chat if block_given?
+        end
+      end
+      cis
+    end
+    
+    # only returns/yields chats wich match filter
+    #
+    #
+    def self.filtered(filter, &block)
+      #puts filter.to_yaml
+      @uniq_chats = {}
+      filtered_chats = []
+      @chats.each do |chat|
+        if match?(chat, filter)
+          yield chat if block_given?
+          filtered_chats << chat
+        end
+      end
+      
+      filtered_chats      
+    end
+    
+    
+
+    def self.add(chat, prefs={})
+      @chats_lock.synchronize do
+        begin
+          if chat.request.host then
+            @chats << chat
+
+            options = {
+              :run_passive_checks => true,
+              :notify => true
+            }
+            options.update prefs
+
+            Watobo::PassiveScanner.add(chat) if options[:run_passive_checks] == true
+            # puts "[#{self}] add"
+
+            #@interface.addChat(self, chat) if @interface
+            notify(:new, chat) if options[:notify] == true
+
+            if chat.id != 0 then
+              Watobo::DataStore.add_chat(chat)
+            else
+              puts "!!! Could not add chat #{chat.id}"
+            end
+          end
+
+          # p "!P!"
+        rescue => bang
+          puts bang
+          puts bang.backtrace if $DEBUG
+        end
+      end
+    end
+    
+    private
+    
+    def self.match?(chat, filter)
+        begin
+         # return false if filter[:ok_only] == true and chat.response.responseCode !~ /200/ 
+           
+          if filter[:unique]
+            uniq_hash = chat.request.uniq_hash
+            return false if @uniq_chats.has_key? uniq_hash
+            @uniq_chats[uniq_hash] = nil
+          end
+          #puts "scope"
+          if filter[:scope_only]
+             return false unless Watobo::Scope.match_site?(chat.request.site)
+          end
+          # puts "* passed scope"
+          if filter[:hide_tested]
+            return false if chat.tested?
+          end
+          
+           if filter.has_key?(:status_codes) and not filter[:status_codes].empty?
+             return false if filter[:status_codes].find_index{|i| chat.response.status =~ /#{i}/}.nil?
+           end
+          
+          if filter.has_key?(:mime_types) and not filter[:mime_types].empty?
+            match = false
+            filter[:mime_types].each do |mt|
+              if chat.response.content_type =~ /#{mt}/i
+                match = true
+              end
+            end
+            puts "MIME_TYPE: #{match}"
+            return false if match == false
+          end
+          
+          #puts "extensions"
+          # puts "* passed hide tested"
+          if filter[:hidden_extensions] == true
+            return false if filter[:hidden_extension_patterns].include?(chat.request.doctype)
+          end
+          
+          unless filter[:show_extension_patterns].empty? or filter[:show_extensions] == false
+            return false unless filter[:show_extension_patterns].include?(chat.request.doctype)
+          end
+            #return true if filter[:text].empty?
+         # puts "url pattern"
+          unless filter[:url_pattern].empty?
+            return false unless chat.request.first =~ /#{filter[:url_pattern]}/i
+            #return false
+          end
+          
+          unless filter[:request_pattern].empty?
+            return false unless chat.request.join =~ /#{filter[:request_pattern]}/i
+            #return false
+          end
+            
+            # puts filter.to_yaml
+            # puts chat.response.responseCode
+
+          unless filter[:response_pattern].empty? 
+              #return false if filter[:text_only] == true and chat.response.content_type !~ /(text|javascript|xml|json)/ 
+              return false unless chat.response.join.unpack("C*").pack("C*") =~ /#{filter[:response_pattern]}/i
+              #return false
+            end
+            
+          return true
+
+          
+        rescue => bang
+          puts bang
+          puts bang.backtrace if $DEBUG
+        end
+        false
+      end
+  end
+end

data/lib/watobo/core/conversation.rb

@@ -0,0 +1,71 @@
+# .
+# conversation.rb
+# 
+# Copyright 2013 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+# @private 
+module Watobo#:nodoc: all
+  class Conversation
+    include Watobo::Constants
+    attr_accessor :file
+    def id()
+      # must be defined
+    end
+
+    def copyRequest()
+      # req_copy = []
+      # self.request.each do |line|
+      #   req_copy.push line.clone
+      # end
+      orig = Utils.copyObject(@request)
+      # now extend the new request with the Watobo mixins
+      #copy.extend Watobo::Mixin::Parser::Url
+      #copy.extend Watobo::Mixin::Parser::Web10
+      #copy.extend Watobo::Mixin::Shaper::Web10
+       copy = Watobo::Request.new(orig)
+      return copy
+    end
+
+    private
+
+    # def extendRequest
+    #   @request.extend Watobo::Mixin::Shaper::Web10
+    #   @request.extend Watobo::Mixin::Parser::Web10
+    #   @request.extend Watobo::Mixin::Parser::Url
+    # end
+
+    # def extendResponse
+    #   @response.extend Watobo::Mixin::Parser::Web10
+    # end
+
+    def initialize(request, response)
+      @request = Watobo::Request.new request
+      @response = Watobo::Response.new response
+      @file = nil
+
+      #  extendRequest()
+      #  extendResponse()
+      #Watobo::Request.create @request
+      #Watobo::Response.create @response
+
+    end
+
+  end
+
+end

data/lib/watobo/core/cookie.rb

@@ -1,7 +1,7 @@
 # .
 # cookie.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -19,12 +19,13 @@
 # along with WATOBO; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   
   
 #Set-Cookie: mycookie=b41dc9e55d6163f78321996b10c940edcec1b4e55a76464c4e9d25e160ac0ec5b769806b; path=/; secure
 
-  class Cookie
+  class Cookie < Parameter
     
     attr :name
     attr :value
@@ -37,33 +38,16 @@ module Watobo
     end
     
     def initialize(prefs)
-      @value = nil
-      @name = nil
-      @secure = false
-      @http_only = false
-      @path = nil
+      @secure = prefs.has_key?(:secure) ? prefs[:secure] : false
+      @http_only = prefs.has_key?(:http_only) ? prefs[:http_only] : false
+      @location = :cookie
       
-      if prefs.is_a? String
-        # remove Set-Cookie: from string
-      #  puts "* create new Cookie"
-      #  puts ">> #{prefs}"
-        cs = prefs.gsub(/^Set-Cookie:/,'').strip.split(";").map{ |c| c.strip }
-        @name, @value = cs.shift.split("=") 
-        cs.each do |o|
-          if o =~ /^path=(.*)/
-            @path = $1
-          end
-          
-          @secure = true if o =~ /secure/i
-          @http_only = true if o =~ /httponly/i
-        end
-      elsif prefs.is_a? Hash
+      if prefs.is_a? Hash
         #TODO: create cookie with hash-settings
       else
         raise ArgumentError, "Need hash (:name, :value, ...) or string (Set-Cookie:...)"
       end
     end
-  end
-  
   
+  end
 end

data/lib/watobo/core/finding.rb

@@ -0,0 +1,89 @@
+# .
+# finding.rb
+# 
+# Copyright 2013 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+# @private 
+module Watobo#:nodoc: all
+  class Finding < Conversation
+
+    @@numFindings = 0
+    @@max_id = 0
+
+    @@lock = Mutex.new
+
+    attr :details
+    attr :request
+    attr :response
+    def resetCounters()
+      @@numFindings = 0
+      @@max_id = 0
+    end
+
+    def id()
+      @details[:id]
+    end
+
+    def false_positive?
+      @details[:false_positive]
+    end
+
+    def set_false_positive
+      @details[:false_positive] = true
+    end
+
+    def unset_false_positive
+      @details[:false_positive] = false
+    end
+    
+    def method_missing(name, *args, &block)
+      if @details.has_key? name
+        return @details[name]
+      end
+      super
+    end
+
+    def initialize(request, response, details = {})
+      super(request, response)
+      @details = {
+        :id => -1,
+        :comment => '',
+        :false_positive => false    # FalsePositive
+      }
+
+      @details.update details if details.is_a? Hash
+
+      @@lock.synchronize{
+      # enter critical section here ???
+        if @details[:id] > 0 and @details[:id] > @@max_id
+          @@max_id = @details[:id]
+        elsif @details[:id] < 0
+          @@max_id += 1
+          @details[:id] = @@max_id
+        end
+        @@numFindings += 1
+
+      }
+    #  extendRequest()
+    #  extendResponse()
+
+    end
+
+  end
+end

data/lib/watobo/core/findings.rb

@@ -0,0 +1,132 @@
+# .
+# findings.rb
+# 
+# Copyright 2013 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+# @private 
+module Watobo#:nodoc: all
+  module Findings
+    @findings = {}
+    @findings_lock = Mutex.new
+    @event_dispatcher_listeners = Hash.new
+    def self.subscribe(event, &callback)
+      (@event_dispatcher_listeners[event] ||= []) << callback
+    end
+
+    def self.clearEvents(event)
+      @event_dispatcher_listeners[event] ||= []
+      @event_dispatcher_listeners[event].clear
+    end
+
+    def self.notify(event, *args)
+      if @event_dispatcher_listeners[event]
+        @event_dispatcher_listeners[event].each do |m|
+          m.call(*args) if m.respond_to? :call
+        end
+      end
+    end
+    
+    def self.length
+      @findings.length
+    end
+
+    def self.reset
+      @findings = {}
+      @event_dispatcher_listeners = Hash.new
+    end
+
+    def self.exist?(finding)
+      @findings.has_key?(finding.details[:fid])
+    end
+
+    def self.set(finding, prefs)
+      @findings_lock.synchronize do
+        if @findings.has_key? finding.fid
+          @findings[finding.fid].details.update prefs
+          Watobo::DataStore.update_finding(finding)
+        return true
+        end
+        return false
+      end
+    end
+
+    def self.unset_false_positive(finding)
+      @findings_lock.synchronize do
+        if @findings.has_key? finding.fid
+          @findings[finding.fid].unset_false_positive
+          Watobo::DataStore.update_finding(finding)
+        return true
+        end
+        return false
+      end
+    end
+
+    def self.set_false_positive(finding)
+      @findings_lock.synchronize do
+        if @findings.has_key? finding.fid
+          @findings[finding.fid].set_false_positive
+          Watobo::DataStore.update_finding(finding)
+        return true
+        end
+        return false
+      end
+    end
+
+    def self.each(&block)
+      if block_given?
+        @findings_lock.synchronize do
+          @findings.map{|f| yield f }
+        end
+      end
+    end
+
+    def self.delete(finding)
+      @findings_lock.synchronize do
+        Watobo::DataStore.delete_finding(finding)
+        @findings.delete finding.fid        
+      end
+    end
+
+    def self.add(finding, opts={})
+      @findings_lock.synchronize do
+        options = {
+          :notify => true,
+          :save_finding => true
+        }
+        options.update opts
+        puts "[Project] add finding #{finding.fid}" if $DEBUG
+
+        unless @findings.has_key?(finding.fid)
+          begin
+            @findings[finding.fid] = finding
+            notify(:new, finding) if options[:notify] == true
+
+            Watobo::DataStore.add_finding(finding) if options[:save_finding] == true
+          rescue => bang
+            puts "!!!ERROR: #{Module.nesting[0].name}"
+            puts bang
+            puts bang.backtrace if $DEBUG
+          end
+        end
+      end
+
+    end
+
+  end
+end

data/lib/watobo/core/forwarding_proxy.rb

@@ -1,7 +1,7 @@
 # .
 # forwarding_proxy.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -19,7 +19,8 @@
 # along with WATOBO; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module ForwardingProxy
         
     def self.get(site=nil)
@@ -33,6 +34,7 @@ module Watobo
         puts bang
         puts bang.backtrace
       end
+      return nil
     end
   end
 end

data/lib/watobo/core/fuzz_gen.rb

@@ -1,7 +1,7 @@
 # .
 # fuzz_gen.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -19,7 +19,8 @@
 # along with WATOBO; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   
     # base class for generators
     class FuzzGenerator