watobo 0.9.12 → 0.9.13

data/modules/active/xss/{xss_rated.rb → xss_ng.rb}

@@ -1,7 +1,7 @@
 # .
-# xss_rated.rb
+# xss_ng.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -19,18 +19,16 @@
 # along with WATOBO; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module Modules
     module Active
       module Xss
         
         
-        class Xss_rated < Watobo::ActiveCheck
+        class Xss_ng < Watobo::ActiveCheck
           
-          def initialize(project, prefs={})
-            super(project, prefs)
-            
-            threat =<<'EOF'
+          threat =<<'EOF'
 Cross-site Scripting (XSS) is an attack technique that involves echoing attacker-supplied code into a user's browser instance. 
 A browser instance can be a standard web browser client, or a browser object embedded in a software product such as the browser 
 within WinAmp, an RSS reader, or an email client. The code itself is usually written in HTML/JavaScript, but may also extend to 
@@ -49,49 +47,65 @@ EOF
             measure = "All user input should be filtered and/or escaped using a method appropriate for the output context"
             
             @info.update(
-                         :check_name => 'Rated Cross Site Scripting Checks',    # name of check which briefly describes functionality, will be used for tree and progress views
+                         :check_name => 'NextGeneration Cross Site Scripting Checks',    # name of check which briefly describes functionality, will be used for tree and progress views
             :check_group => AC_GROUP_XSS,
-            :description => "Checking every URL parameter for missing output sanitisation. The results have a rated exploitability.",   # description of checkfunction
+            :description => "XSS Checks with rating. Additional parameters are created by extracting input fields (name/value pairs) of the original response.",   # description of checkfunction
             :author => "Andreas Schmidt", # author of check
             :version => "1.0"   # check version
             )
             
             @finding.update(
                             :threat => threat,        # thread of vulnerability, e.g. loss of information
-                            :class => "Reflected XSS [RATED]",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+                            :class => "Reflected XSS",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
             :type => FINDING_TYPE_VULN,         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN
             :rating => VULN_RATING_HIGH,
             :measure => measure
             )
+          
+          def initialize(project, prefs={})
+            super(project, prefs)
+            
             
-            @envelop = [ "watobo", "watobo".reverse]
+            @envelop = "watobo"
+            @env_count = 0
             @evasions = [ "%0a", "%00"]
             @xss_chars= %w( < > ' " ) 
             @escape_chars = ['\\']       
+            @additional_parms = []
+            
+            def reset
+              @additional_parms = []
+              @env_count = 0
+            end
+            
             
           end
           
           
           def generateChecks(chat)    
-            #
-            #  Check GET-Parameters
-            #
-            begin
+            begin   
+              # 
+              if chat.response.respond_to? :input_fields           
+              chat.response.input_fields do |field|                
+                @additional_parms << field.to_www_form_parm if chat.request.method_post?
+                @additional_parms << field.to_url_parm
+               
+              end
+              end
               
-              log_console("generating checks ...")
-              urlParmNames(chat).each do |parm|
-                log_console( parm )
-                # puts "#{Module.nesting[0].name}: run check on chat-id (#{chat.id}) with parm (#{parm})"
-                pval = chat.request.get_parm_value(parm)
+              @parm_list = chat.request.parameters(:data, :url)
+              @parm_list.concat @additional_parms
+              @parm_list.each do |parm|
+               #log_console( "#{parm.location} - #{parm.name} = #{parm.value}")
+               
                 checks = []
                 @xss_chars.each do |xss|
-                   tp = "#{@envelop[0]}"
-                   tp << CGI.escape(xss)
-                   tp << "#{@envelop[1]}"
-                   pattern = "#{@envelop[0]}([^#{@envelop[0]}]*#{xss})#{@envelop[1]}"   
-                   checks << [ xss.dup, "#{tp}" , pattern ]
-                   checks << [xss.dup, "#{pval}#{tp}", pattern ]
-                   checks << [xss.dup, "#{tp}#{pval}", pattern ]
+                  @env_count += 1
+                  
+                  check_id = "#{@envelop}#{@env_count}"
+                   checks << [ xss.dup, "#{xss}", check_id ]
+                   checks << [xss.dup, "#{parm.value}#{xss}", check_id ]
+                   checks << [xss.dup, "#{xss}#{parm.value}", check_id ]
                       
                   end
                   checker = proc {
@@ -99,13 +113,32 @@ EOF
                     rating = 0
                        test_request = nil
                       test_response = nil
-               
+                      
+                      # first we check, if parameter is injectable
+                      test = chat.copyRequest
+                     
+                      proof = "INJ#{Time.now.to_i.to_s}"
+                      parm.value = proof
+                      test.set parm
+                      
+                      test_request,test_response = doRequest(test)
+                      
+                      
+                      next [ test_request, test_response ] unless test_response.has_body?
+                                       
+                      next [ test_request, test_response ] unless test_response.body =~ /#{proof}/i
+                      
                     
-                    checks.each do |xss, check, proof|
+                    checks.each do |xss, check, check_id|
+                     
+                     # accept only one (escape) char between check_id and check string
+                      proof = "#{check_id}([^#{Regexp.quote(check)}]?(#{Regexp.quote(check)}){1})"
                       next if results.has_key? xss
                       test = chat.copyRequest
-                      test.replace_get_parm(parm, check)
-                        
+                     
+                      parm.value = check_id + CGI.escape(check)
+                      test.set parm
+                      
                       test_request,test_response = doRequest(test)
                                        
                       if not test_response then
@@ -115,8 +148,8 @@ EOF
                         end
                       elsif test_response.join =~ /#{proof}/i
                         match = $1
-                      #  puts "MATCH: #{match}/#{xss}"
-                        if match == xss
+                      #puts "MATCH: [ #{match} ] / [ #{check} ]"
+                        if match == check
                         results[xss] = { :match => :full, :check => check, :proof => proof }
                         end
                         
@@ -124,67 +157,67 @@ EOF
                           @escape_chars.each do |ec|
                             ep = Regexp.quote("#{ec}#{xss}")
                           #  puts "Escaped: #{match} / #{ep}"
-                            results[xss] = { :match => :escaped, :check => check, :proof => proof} if match =~ /#{ep}/
+                            results[xss] = { :match => :escaped, :check => check, :proof => proof, :escape_char => "#{ec}"} if match =~ /#{ep}/
                           end
                         end
                         
-                        results[xss] = { :match => :modified, :check => check, :proof => proof } unless results.has_key? xss
-                        
                       end
-                      puts results.to_yaml if $DEBUG
+                      
                     end
                     
-                   
+                   puts results.to_yaml if $DEBUG
                     xss_combo = ""
+                    combo_patterns = []
                    results.each do |k,v|
                      mp = CGI.escape(k)
                      rp = CGI.escape(@xss_chars.join)
+                     xss_combo += CGI.escape(k)
+                     #puts "[#{k}] - #{v}"
                      case v[:match]
+                       
                      when :full
-                         rating += 100/@xss_chars.length
-                         xss_combo = v[:check].gsub(/#{mp}/, rp)
+                         rating += 100/@xss_chars.length                         
+                         combo_patterns << k 
                        when :escaped
                           rating += 100/(@xss_chars.length*4)
-                          xss_combo = v[:check].gsub(/#{mp}/, rp) if xss_combo.empty?
-                       when :modified
-                         rating += 100/(@xss_chars.length*4)
-                         xss_combo = v[:check].gsub(/#{mp}/, rp) if xss_combo.empty?
+                          combo_patterns << Regexp.quote("#{v[:escape_char]}#{k}") 
                        end
                    end                   
                     
                     if rating > 0
                       test = chat.copyRequest
-                      puts "COMBO-REQUEST: #{xss_combo}"
-                      test.replace_get_parm(parm, xss_combo)
+                      #puts "COMBO-REQUEST: #{xss_combo}"
+                      parm.value = "#{@envelop}#{@env_count}#{xss_combo}"
+                      pattern = "(#{@envelop}#{@env_count}(#{combo_patterns.join("|")})+)"
+                      test.set parm
                         
-                    #  puts "Reflected XSS: #{ts}"
-                   #     pattern = "#{@envelop[0]}[^#{@envelop[0]}]*(\\\\)?#{@xss_chars.join('(\\\\)?')}#{@envelop[1]}"
                       match = ""
-                      pattern = "#{@envelop[0]}([^#{@envelop[0]}]*(#{@xss_chars.join("|")})+[^#{@envelop[0]}]*)#{@envelop[1]}"
+                      
                       test_request,test_response = doRequest(test)
                       if not test_response then
                         puts "got no response :("
                       elsif test_response.join =~ /#{pattern}/i
                         match = $1
-                        puts "MATCH: #{match}"
+                        #puts "MATCH: #{match}"
                       end
                      
+                     fclass = "Reflected XSS - #{rating}%"
+                     fclass = "Reflected XSS (POST) - #{rating}%" if parm.location == :data
                       addFinding( test_request, test_response,
                                  :check_pattern => xss_combo, 
                       :proof_pattern => "#{match}", 
-                      :test_item => parm,
-                      :class => "Reflected XSS", 
+                      :test_item => parm.name,
+                      :class => fclass, 
                       :chat => chat,
-                      :title => "[#{parm} - #{rating}%] - #{test_request.path}"
+                      :title => "[#{parm.name}] - #{test_request.path}"
                       )
                     end
-                    #@project.new_finding(:short_name=>"#{parm}", :check=>"#{check}", :proof=>"#{pattern}", :kategory=>"XSS-Post", :type=>"Vuln", :chat=>test_chat, :rating=>"High")
+                   
                     [ test_request, test_response ]
                   }
                   yield checker
                
               end
-             
               
             rescue => bang
               puts bang

data/modules/active/xss/xss_simple.rb

@@ -1,7 +1,7 @@
 # .
 # xss_simple.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -19,7 +19,8 @@
 # along with WATOBO; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module Modules
     module Active
       module Xss
@@ -27,10 +28,7 @@ module Watobo
         
         class Xss_simple < Watobo::ActiveCheck
           
-          def initialize(project, prefs={})
-            super(project, prefs)
-            
-            threat =<<'EOF'
+          threat =<<'EOF'
 Cross-site Scripting (XSS) is an attack technique that involves echoing attacker-supplied code into a user's browser instance. 
 A browser instance can be a standard web browser client, or a browser object embedded in a software product such as the browser 
 within WinAmp, an RSS reader, or an email client. The code itself is usually written in HTML/JavaScript, but may also extend to 
@@ -63,6 +61,11 @@ EOF
             :rating => VULN_RATING_HIGH,
             :measure => measure
             )
+          
+          def initialize(project, prefs={})
+            super(project, prefs)
+            
+            
             
             @xss_checks=[ 
             ["<script>watobo</script>", "<script>watobo</script>"],

data/modules/passive/ajax.rb

@@ -0,0 +1,85 @@
+# .
+# ajax.rb
+# 
+# Copyright 2013 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+require 'cgi'
+
+# @private 
+module Watobo#:nodoc: all
+  module Modules
+    module Passive
+      
+      
+      class Ajax < Watobo::PassiveCheck
+        
+        def initialize(project)
+          @project = project
+          super(project)
+          
+          @info.update(
+                       :check_name => 'Ajax',    # name of check which briefly describes functionality, will be used for tree and progress views
+          :description => "Spots Ajax Frameworks like jQuery.",   # description of checkfunction
+          :author => "Andreas Schmidt", # author of check
+          :version => "1.0"   # check version
+          )
+          
+          @finding.update(
+                          :threat => 'Framework may contain vulnerabilities.',        # thread of vulnerability, e.g. loss of information
+          :class => "Ajax Framework",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+          :type => FINDING_TYPE_INFO         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN 
+          )
+          
+            @fw_patterns = []
+            @fw_patterns << { :name => 'jQuery', :pattern => 'jQuery v([0-9\.]*) jquery.com'}
+        end
+        
+        def showError(chatid, message)
+          puts "!!! Error"  
+          puts "Chat: [#{chatid}]"
+          puts message
+        end
+        
+        def do_test(chat)
+          begin
+
+            return true unless chat.response.content_type =~ /(text|script)/ 
+            
+            @fw_patterns.each do |pattern|
+              if chat.response.body =~ /#{pattern[:pattern]}/i then
+               version = $1.strip
+               addFinding(
+                           :check_pattern => "#{pattern[:pattern]}", 
+                :proof_pattern => "#{pattern}",
+                :chat=>chat,
+                :title =>"[ #{pattern[:name]} #{version} ] - #{chat.request.path}",            
+                )
+                
+              end
+            end
+          rescue => bang
+            # raise
+            showError(chat.id, bang)
+          end
+        end
+        
+      end
+    end
+  end
+end

data/modules/passive/autocomplete.rb

@@ -0,0 +1,78 @@
+# .
+# autocomplete.rb
+# 
+# Copyright 2013 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+# @private 
+module Watobo#:nodoc: all
+  module Modules
+    module Passive
+      
+      
+      class Autocomplete < Watobo::PassiveCheck
+        def initialize(project)
+          @project = project
+          super(project)
+          
+          @info.update(
+                       :check_name => 'Password AutoComplete',    # name of check which briefly describes functionality, will be used for tree and progress views
+          :description => "Checks Password Fields For AutoCompletion",   # description of checkfunction
+          :author => "Andreas Schmidt", # author of check
+          :version => "0.9"   # check version
+          )
+          
+          @finding.update(
+                          :threat => 'Password values may be stored on the local filesystem.',        # thread of vulnerability, e.g. loss of information
+          :class => "Password Autocompletion",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+          :type => FINDING_TYPE_VULN,         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN
+           :rating => VULN_RATING_LOW,
+          :measure => "The form field should have an attribute autocomplete=\"off\"" 
+          )
+        end
+        
+        def do_test(chat)
+          begin
+                       
+           if chat.response.respond_to? :input_fields     
+             chat.response.input_fields do |f|
+            
+              ac = f.autocomplete.nil? ? "" : f.autocomplete
+              
+              if f.type =~ /password/i and ( ac =~ /off/i or ac.empty? )          
+              addFinding(  
+                         :proof_pattern => "input[^>]*type=[^>=]*password.*>{1}", 
+              :title => "#{chat.request.file}",
+              :chat => chat
+              )  
+              end
+              end
+            end
+          rescue => bang
+            #  raise
+            puts "ERROR!! #{Module.nesting[0].name}"
+            puts bang
+            puts bang.backtrace if $DEBUG
+          end
+          return false
+        end
+      end
+      
+    end
+  end
+end

data/modules/passive/cookie_options.rb

@@ -1,7 +1,7 @@
 # .
 # cookie_options.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -40,7 +40,8 @@
 # along with WATOBO; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module Modules
     module Passive
       

data/modules/passive/cookie_xss.rb

@@ -1,7 +1,7 @@
 # .
 # cookie_xss.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -20,7 +20,8 @@
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
 
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module Modules
     module Passive
       

data/modules/passive/detect_code.rb

@@ -1,7 +1,7 @@
 # .
 # detect_code.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -19,7 +19,8 @@
 # along with WATOBO; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module Modules
     module Passive
       
@@ -46,7 +47,9 @@ module Watobo
          
           @pattern_list = []
           @pattern_list << ['<\?php', "PHP" ]
-          @pattern_list << [ '<!--.*select ', "COMMENT" ]
+          @pattern_list << [ '<!--[^>]*select ', "COMMENT" ]
+          @pattern_list << [ '\/\*[^(\*\/)]*select ', "COMMENT" ]
+          @pattern_list << [ '\/\/[^(\*\/\n)]*select ', "COMMENT" ]
           @pattern_list << [ 'sample code', "COMMENT" ]
               @pattern_list << [ '<%[^<%]*%>', "ASP" ]
           
@@ -68,7 +71,7 @@ module Watobo
                   match = $1
                   path = "/" + chat.request.path
                   addFinding(  
-                  :proof_pattern => "#{match}", 
+                  :proof_pattern => "#{Regexp.quote(match)}", 
                   :chat => chat,
                   :title => "[#{type}] - #{path}"
                   )

data/modules/passive/detect_fileupload.rb

@@ -1,7 +1,7 @@
 # .
 # detect_fileupload.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -19,7 +19,8 @@
 # along with WATOBO; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module Modules
     module Passive
       class Detect_fileupload < Watobo::PassiveCheck

data/modules/passive/detect_infrastructure.rb

@@ -1,7 +1,7 @@
 # .
 # detect_infrastructure.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -19,7 +19,8 @@
 # along with WATOBO; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module Modules
     module Passive
       class Detect_infrastructure < Watobo::PassiveCheck
@@ -55,7 +56,9 @@ module Watobo
 @pattern_list << [ 'SharePoint 2010', Regexp.new('MicrosoftSharePointTeamServices.*14.0.0.6106')]
 # And in SharePoint 2007 site, the result is like this: MicrosoftSharePointTeamServices:12.0.0.4518
 @pattern_list << [ 'SharePoint 2007', Regexp.new('MicrosoftSharePointTeamServices.*12.0.0.4518')]
-          
+          # "vaadinVersion":"7.0.4"
+          @pattern_list << [ 'VAADIN }>', Regexp.new('vaadinVersion":"(\d+\.\d+\.\d+)')]
+          @pattern_list << [ 'JBoss'    ,Regexp.new('JBoss Web.(\d+\.\d+\.\d+)')]
 
           #@pattern_list << 'sample code'
 
@@ -76,7 +79,7 @@ module Watobo
                     addFinding(
                     :proof_pattern => "#{match}",
                     :chat => chat,
-                    :title => "[#{pat[0]}] - #{match.slice(0..15)}"
+                    :title => "[#{pat[0]}] - #{match.slice(0..21)}"
                     )
                     break
                   end

data/modules/passive/detect_one_time_tokens.rb

@@ -1,7 +1,7 @@
 # .
 # detect_one_time_tokens.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -19,7 +19,8 @@
 # along with WATOBO; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module Modules
     module Passive
       

data/modules/passive/dirindexing.rb

@@ -1,7 +1,7 @@
 # .
 # dirindexing.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -20,7 +20,8 @@
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
 
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module Modules
     module Passive
       

data/modules/passive/disclosure_domino.rb

@@ -1,7 +1,7 @@
 # .
 # disclosure_domino.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -19,7 +19,8 @@
 # along with WATOBO; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module Modules
     module Passive