watobo 0.9.12 → 0.9.13

data/modules/active/domino/domino_db.rb

@@ -1,7 +1,7 @@
 # .
 # domino_db.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -22,18 +22,15 @@
 require 'digest/md5'
 require 'digest/sha1'
 
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module Modules
     module Active
       module Domino
         
         
         class Domino_db < Watobo::ActiveCheck
-          
-          def initialize(project, prefs={})
-            super(project, prefs)
-            
-            @info.update(
+          @info.update(
                          :check_name => 'Lotus Domino DB Enumeration',    # name of check which briefly describes functionality, will be used for tree and progress views
             :description => "Enumeration of well known Domino DBs.",   # description of checkfunction
             :author => "Andreas Schmidt", # author of check
@@ -47,6 +44,8 @@ module Watobo
             :type => FINDING_TYPE_HINT         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN 
             )
             
+          def initialize(project, prefs={})
+            super(project, prefs)
             
             @domino_dbs = []
             
@@ -70,7 +69,7 @@ module Watobo
           
           def generateChecks(chat)            
             begin              
-              if chat.request.url =~ /(.*)\/\w*\.nsf/ then
+              if chat.request.url.to_s =~ /(.*)\/\w*\.nsf/ then
                 @domino_dbs.each do |db|
                   checker = proc{
                     test_request = nil
@@ -78,7 +77,7 @@ module Watobo
                     test = chat.copyRequest
                     line = test.shift
                     line.gsub!(/(\w*\.nsf.*) (HTTP\/.*)/, "#{db} \\2")
-                    puts line
+                   # puts line
                     test.unshift line
                     
                     test_request,test_response = doRequest(test,:default => true)
@@ -88,7 +87,7 @@ module Watobo
                      # test_chat = Chat.new(test, test_response, chat.id)
                       if test_response.join =~ /(names\.nsf\?Login)/ # if default db found, check for content
                         addFinding( test_request,test_response,
-                        :test_item => chat.request.url,
+                        :test_item => chat.request.url.to_s,
                                    :check_pattern => "#{db}",
                         :proof_pattern => "#{test_response.status}", 
                         :chat=>chat,
@@ -98,7 +97,7 @@ module Watobo
                         addFinding(test_request,test_response,
                                    :check_pattern => "#{db}",
                         :proof_pattern => "#{test_response.status}",
-                        :test_item => chat.request.url,
+                        :test_item => chat.request.url.to_s,
                         :class => "Lotus Domino: Unprotected Default DB",
                         :type => FINDING_TYPE_VULN,
                         :chat => chat,

data/modules/active/dotNET/custom_errors.rb

@@ -0,0 +1,124 @@
+# .
+# custom_errors.rb
+# 
+# Copyright 2013 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+# @private 
+module Watobo#:nodoc: all
+  module Modules
+    module Active
+      module Dotnet
+        #class Dir_indexing < Watobo::Mixin::Session
+        class Custom_errors < Watobo::ActiveCheck
+          @@tested_directories = Hash.new
+          
+           @info.update(
+            :check_name => '.NET Custom Error',    # name of check which briefly describes functionality, will be used for tree and progress views
+            :description => "This module checks if custom errors messages are used and Stack-Tracing is enabled.",   # description of checkfunction
+            :author => "Andreas Schmidt", # author of check
+            :version => "1.0",   # check version
+            :check_group => ".NET"
+            )
+
+            @finding.update(
+            :threat => 'Information Disclosure. Internal error messages are exposed to end users.',        # thread of vulnerability, e.g. loss of information
+            :class => ".NET: Custom Errors",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+            :type => FINDING_TYPE_VULN,         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN
+            :rating => VULN_RATING_INFO
+            )
+            
+          def initialize(project, prefs={})
+            super(project, prefs)
+
+           
+
+          end
+
+          def generateChecks(chat)
+
+            begin
+
+              if chat.request.url.to_s =~ /\.aspx/ then
+
+                checker = proc {
+                  begin
+                    test_request = nil
+                    test_response = nil
+
+                    test = chat.copyRequest
+                    test.set_method("POST")
+                    
+                    test.set_content_type("application/x-www-form-urlencoded")
+                    test.set_content_length("0")
+                    test.setData "__VIEWSTATE=watobo"
+                    
+                    status, test_request, test_response = fileExists?(test)
+                    
+                    if test_response.has_body? and test_response.body =~ /Server Error in/
+
+                      puts ".NET Custom Error >> #{test.url.to_s}"
+
+                      addFinding(  test_request, test_response,
+                             :test_item => "__VIEWSTATE",
+                             :proof_pattern => Regexp.quote("Server Error in"),
+                  :check_pattern => Regexp.quote("__VIEWSTATE"),
+                  :chat => chat,
+                  :threat => "Information Disclosure: Error messages may disclose potentially sensitive information about the internal implementation of the website.",
+                  :title => "[Server Error]"
+                  )
+
+                      trace_pattern = "customErrors mode=.*RemoteOnly"
+                      if test_response.body =~ /#{trace_pattern}/i
+                        #puts "STACK-TRACE!!!"
+                        addFinding(  test_request, test_response,
+                             :test_item => "__VIEWSTATE",
+                             :proof_pattern => trace_pattern,
+                  :check_pattern => Regexp.quote("__VIEWSTATE"),
+                  :chat => chat,
+                  :threat => "Information Disclosure: A Stack-Trace may disclose potentially sensitive information about the internal implementation of the website.",
+                  :title => "[Stack-Trace]",
+                  :class => ".NET: Stack-Trace"
+                  )
+
+                      end
+
+                    end
+
+                    [ test_request, test_response ]
+
+                  rescue => bang
+                    puts bang
+                    puts bang.backtrace if $DEBUG
+                  end
+                  [ nil, nil ]
+
+                }
+              yield checker
+              end
+            rescue => bang
+              puts "!error in module #{Module.nesting[0].name}"
+              puts bang
+            end
+          end
+
+        end
+      end
+    end
+  end
+end

data/modules/active/dotNET/dotnet_files.rb

@@ -0,0 +1,112 @@
+# .
+# dotnet_files.rb
+# 
+# Copyright 2013 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+# @private 
+module Watobo#:nodoc: all
+  module Modules
+    module Active
+      module Dotnet
+        
+        #class Dir_indexing < Watobo::Mixin::Session
+        class Dotnet_files < Watobo::ActiveCheck
+          @@tested_directories = Hash.new
+          
+           @info.update(
+                         :check_name => '.NET Files',    # name of check which briefly describes functionality, will be used for tree and progress views
+            :description => "This module checks your application for well known files, e.g. trace.axd.",   # description of checkfunction
+            :author => "Andreas Schmidt", # author of check
+            :version => "1.0",   # check version
+            :check_group => ".NET"
+            )
+            
+             @finding.update(
+                            :threat => 'Information Disclosure.',        # thread of vulnerability, e.g. loss of information
+            :class => ".NET: Well-Known Files",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+            :type => FINDING_TYPE_VULN,         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN
+             :rating => VULN_RATING_INFO 
+            )
+            
+          def initialize(project, prefs={})
+            super(project, prefs)
+            
+            @wnfs = []
+            @wnfs << { :name => "Trace.axd", :pattern => "Trace\.axd.clear=1" }
+            @wnfs << { :name => "elmah.axd", :pattern => "Error log for" }
+            
+            
+          end
+          
+          def reset()
+            @@tested_directories.clear
+          end
+          
+          def generateChecks(chat)
+            
+            begin
+              path = chat.request.dir
+              if !@@tested_directories.has_key?(path) then
+                @@tested_directories[path] = true
+                @wnfs.each do |wnf|
+                checker = proc {
+                  begin
+                      test_request = nil
+                      test_response = nil
+                     
+                      test = chat.copyRequest
+                 
+                      test.replaceFileExt(wnf[:name])
+                       status, test_request, test_response = fileExists?(test)
+                 
+                
+                if status == true and test_response.has_body?
+                  if test_response.body =~ /#{wnf[:pattern]}/
+                    addFinding(  test_request, test_response,
+                      :test_item => "#{wnf[:name]}",
+                      :proof_pattern => "#{wnf[:pattern]}",
+                      :check_pattern => "#{Regexp.quote(wnf[:name])}",
+                      :chat => chat,
+                      :threat => "depends on the file ;)",
+                      :title => "[#{wnf[:name]}]"
+                      )
+                  end
+                  
+                end
+                  rescue => bang
+                    puts bang
+                    puts bang.backtrace if $DEBUG
+                  end
+                 [ test_request, test_response ]
+                  
+                }
+                yield checker
+              end
+              end
+            rescue => bang
+              puts "!error in module #{Module.nesting[0].name}"
+              puts bang
+            end
+          end
+          
+        end
+      end
+    end  
+  end
+end

data/modules/active/fileinclusion/lfi_simple.rb

@@ -1,7 +1,7 @@
 # .
 # lfi_simple.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -22,18 +22,15 @@
 require 'digest/md5'
 require 'digest/sha1'
 
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module Modules
     module Active
       module Fileinclusion
         
         
         class Lfi_simple < Watobo::ActiveCheck
-          
-          def initialize(project, prefs={})
-            super(project, prefs)
-            
-            @info.update(
+           @info.update(
                          :check_name => 'Local File Inclusion',    # name of check which briefly describes functionality, will be used for tree and progress views
             :description => "Checks for parameters, which can lead to local file inclusion.",   # description of checkfunction
             :author => "Andreas Schmidt", # author of check
@@ -47,6 +44,11 @@ module Watobo
             :type => FINDING_TYPE_VULN         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN 
             )
             
+          def initialize(project, prefs={})
+            super(project, prefs)
+            
+           
+            
             @include_checks = [ 
                                 ["etc/passwd",'root:[^:]+:\w+:\w+' ],
                                 ["etc/passwd%00",'root:[^:]+:\w+:\w+' ],

data/modules/active/jboss/jboss_basic.rb

@@ -1,7 +1,7 @@
 # .
 # jboss_basic.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -19,7 +19,8 @@
 # along with WATOBO; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module Modules
     module Active
       module Jboss
@@ -27,13 +28,7 @@ module Watobo
         
         class Jboss_basic < Watobo::ActiveCheck
           
-          def reset()
-            @checked_dirs.clear  
-          end
-          
-          def initialize(project, prefs={})
-            super(project, prefs)
-            @info.update(
+          @info.update(
                          :check_name => 'Basic JBoss enumeration',    # name of check which briefly describes functionality, will be used for tree and progress views
             :check_group => AC_GROUP_JBOSS,
             :description => "Check every parameter for SQL-Injection flaws.",   # description of checkfunction
@@ -47,6 +42,14 @@ module Watobo
                             :class => "JBoss-AS (critical)",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
             :type => FINDING_TYPE_VULN         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN
             )
+          
+          def reset()
+            @checked_dirs.clear  
+          end
+          
+          def initialize(project, prefs={})
+            super(project, prefs)
+            
             
             measure = "Remove all unnecessary JBoss-Interfaces like JMX-Console."
             

data/modules/active/sap/its_commands.rb

@@ -1,7 +1,7 @@
 # .
 # its_commands.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -19,7 +19,8 @@
 # along with WATOBO; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module Modules
     module Active
       module Sap
@@ -27,12 +28,7 @@ module Watobo
         
         class Its_commands < Watobo::ActiveCheck
           
-          def initialize(project, prefs={})
-           
-            super(project, prefs)
-            
-            
-            @info.update(
+          @info.update(
                          :check_name => 'SAP ITS: Default Commands',    # name of check which briefly describes functionality, will be used for tree and progress views
             :description => "Identifies vulnerable SAP ITS commands",   # description of checkfunction
             :author => "Andreas Schmidt", # author of check
@@ -46,6 +42,11 @@ module Watobo
             :type => FINDING_TYPE_VULN         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN 
             )
             
+          
+          def initialize(project, prefs={})
+           
+            super(project, prefs)
+            
             # commands 2d array containing the command name and risk rating
             @commands=[
             ["AgateInstallCheck", VULN_RATING_LOW],
@@ -57,7 +58,7 @@ module Watobo
           def generateChecks(chat)
             
             begin
-              if chat.request.url =~ /\/wgate\/(\w*)\// then 
+              if chat.request.url.to_s =~ /\/wgate\/(\w*)\// then 
                 
                 @commands.each do |cmd, risk|
                   checker = proc{

data/modules/active/sap/its_service_parameter.rb

@@ -1,7 +1,7 @@
 # .
 # its_service_parameter.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -22,7 +22,8 @@
 require 'digest/md5'
 require 'digest/sha1'
 
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module Modules
     module Active
       module Sap
@@ -30,12 +31,7 @@ module Watobo
         
         class Its_service_parameter < Watobo::ActiveCheck
           
-          def initialize(project,prefs={})
-           
-            super(project, prefs)
-            
-            
-            @info.update(
+           @info.update(
                          :check_name => 'SAP ITS: Service Parameters',    # name of check which briefly describes functionality, will be used for tree and progress views
             :description => "Checks SAP ITS services for default parameters.",   # description of checkfunction
             :author => "Andreas Schmidt", # author of check
@@ -48,6 +44,11 @@ module Watobo
             :class => "SAP ITS: Service Parameters",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
             :type => FINDING_TYPE_HINT         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN 
             )
+          
+          def initialize(project,prefs={})
+           
+            super(project, prefs)
+           
             
             @default_service_parameters = [
             ["~command","AgateInstallCheck"],
@@ -62,7 +63,7 @@ module Watobo
             
             begin
               
-              if chat.request.url =~ /\/wgate\/(\w*)\/!?/ then
+              if chat.request.url.to_s =~ /\/wgate\/(\w*)\/!?/ then
                 @default_service_parameters.each do |sp, val|
                   checker = proc{
                     test_request = nil

data/modules/active/sap/its_services.rb

@@ -1,7 +1,7 @@
 # .
 # its_services.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -22,7 +22,8 @@
 require 'digest/md5'
 require 'digest/sha1'
 
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module Modules
     module Active
       module Sap
@@ -30,12 +31,7 @@ module Watobo
         
         class Its_services < Watobo::ActiveCheck
           
-          def initialize(project, prefs={})
-          
-            super(project, prefs)
-            
-            
-            @info.update(
+          @info.update(
                          :check_name => 'SAP ITS: Default Services',    # name of check which briefly describes functionality, will be used for tree and progress views
             :description => "Checks SAP ITS System for enabled default services.",   # description of checkfunction
             :author => "Andreas Schmidt", # author of check
@@ -48,6 +44,11 @@ module Watobo
             :class => "SAP ITS: Default Services",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
             :type => FINDING_TYPE_HINT         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN 
             )
+          
+          def initialize(project, prefs={})
+          
+            super(project, prefs)
+            
             
             @its_services = [ 
                   "admin", 
@@ -60,7 +61,7 @@ module Watobo
             
             begin
               
-              if chat.request.url =~ /\/wgate\/(\w*\/!?)/ then
+              if chat.request.url.to_s =~ /\/wgate\/(\w*\/!?)/ then
                 service_name = $1
                 @its_services.each do |service|
                   checker = proc{

data/modules/active/sap/its_xss.rb

@@ -1,7 +1,7 @@
 # .
 # its_xss.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -22,7 +22,8 @@
 require 'digest/md5'
 require 'digest/sha1'
 
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module Modules
     module Active
       module Sap
@@ -30,12 +31,7 @@ module Watobo
         
         class Its_xss < Watobo::ActiveCheck
           
-          def initialize(project, prefs={})
-            @project = project
-            super(project, prefs)
-            
-            
-            @info.update(
+          @info.update(
                          :check_name => 'SAP ITS: XSS',    # name of check which briefly describes functionality, will be used for tree and progress views
             :description => "Checks for generic XSS flaws in SAP ITS Systems.",   # description of checkfunction
             :author => "Andreas Schmidt", # author of check
@@ -48,6 +44,11 @@ module Watobo
             :class => "SAP ITS: XSS",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
             :type => FINDING_TYPE_HINT         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN 
             )
+          
+          def initialize(project, prefs={})
+            @project = project
+            super(project, prefs)
+            
           end
           
           def generateChecks(chat)
@@ -57,7 +58,7 @@ module Watobo
             #
             begin
               
-              if chat.request.url =~ /!$/ then 
+              if chat.request.url.to_s =~ /!$/ then 
                 checker = proc{
                 test = chat.copyRequest
                 new_p = "~urlmime"
@@ -69,7 +70,7 @@ module Watobo
                 if test_response.join =~ /watobo/i then
                   #test_chat = Chat.new(test,test_response,chat.id)
                   addFinding(test_request,test_response,
-                  :test_item => chat.request.url,
+                  :test_item => chat.request.url.to_s,
                          :check_pattern => "#{new_p}",
                          :proof_pattern => "#{new_v}",
                          :chat => chat,