watobo 0.9.12 → 0.9.13

Sign up to get free protection for your applications and to get access to all the features.
Files changed (263) hide show
  1. data/.yardopts +2 -2
  2. data/{CHANGELOG → CHANGELOG.md} +62 -0
  3. data/README.md +30 -0
  4. data/bin/nfq_server.rb +4 -3
  5. data/bin/watobo_gui.rb +1 -1
  6. data/config/ott_cache.yml +4 -0
  7. data/config/scanner.yml +1 -18
  8. data/config/sid_cache.yml +14 -0
  9. data/extras/private-hostspot.sh +17 -0
  10. data/extras/watobo-installer.sh +61 -0
  11. data/extras/watobo-transparent.sh +38 -0
  12. data/icons/BestPractice_16x16.ico +0 -0
  13. data/icons/BestPractice_24x24.ico +0 -0
  14. data/lib/watobo/adapters/data_store.rb +25 -3
  15. data/lib/watobo/adapters/file/file_store.rb +19 -11
  16. data/lib/watobo/adapters/session_store.rb +3 -2
  17. data/lib/watobo/adapters.rb +1 -1
  18. data/lib/watobo/ca.rb +1 -1
  19. data/lib/watobo/config.rb +17 -19
  20. data/lib/watobo/constants.rb +3 -2
  21. data/lib/watobo/core/active_check.rb +62 -40
  22. data/lib/watobo/core/active_checks.rb +73 -0
  23. data/lib/watobo/core/ca.rb +3 -2
  24. data/lib/watobo/core/cert_store.rb +3 -2
  25. data/lib/watobo/core/chat.rb +122 -0
  26. data/lib/watobo/core/chats.rb +301 -0
  27. data/lib/watobo/core/conversation.rb +71 -0
  28. data/lib/watobo/core/cookie.rb +9 -25
  29. data/lib/watobo/core/finding.rb +89 -0
  30. data/lib/watobo/core/findings.rb +132 -0
  31. data/lib/watobo/core/forwarding_proxy.rb +4 -2
  32. data/lib/watobo/core/fuzz_gen.rb +3 -2
  33. data/lib/watobo/core/intercept_carver.rb +24 -12
  34. data/lib/watobo/core/intercept_filter.rb +4 -3
  35. data/lib/watobo/core/interceptor.rb +9 -888
  36. data/lib/watobo/core/min_class.rb +27 -0
  37. data/lib/watobo/core/netfilter_queue.rb +3 -2
  38. data/lib/watobo/core/ott_cache.rb +156 -0
  39. data/lib/watobo/core/parameter.rb +66 -0
  40. data/lib/watobo/core/passive_check.rb +15 -22
  41. data/lib/watobo/core/passive_checks.rb +72 -0
  42. data/lib/watobo/core/passive_scanner.rb +69 -0
  43. data/lib/watobo/core/plugin.rb +33 -0
  44. data/lib/watobo/core/project.rb +40 -547
  45. data/lib/watobo/core/proxy.rb +7 -2
  46. data/lib/watobo/core/request.rb +95 -10
  47. data/lib/watobo/core/response.rb +44 -3
  48. data/lib/watobo/core/scanner.rb +6 -7
  49. data/lib/watobo/core/scanner3.rb +439 -0
  50. data/lib/watobo/core/scope.rb +106 -0
  51. data/lib/watobo/core/session.rb +106 -286
  52. data/lib/watobo/core/sid_cache.rb +121 -0
  53. data/lib/watobo/core/subscriber.rb +48 -0
  54. data/lib/watobo/core.rb +2 -2
  55. data/lib/watobo/defaults.rb +3 -2
  56. data/lib/watobo/external/diff/lcs/array.rb +1 -1
  57. data/lib/watobo/external/diff/lcs/block.rb +1 -1
  58. data/lib/watobo/external/diff/lcs/callbacks.rb +1 -1
  59. data/lib/watobo/external/diff/lcs/change.rb +1 -1
  60. data/lib/watobo/external/diff/lcs/hunk.rb +1 -1
  61. data/lib/watobo/external/diff/lcs/ldiff.rb +1 -1
  62. data/lib/watobo/external/diff/lcs/string.rb +1 -1
  63. data/lib/watobo/external/diff/lcs.rb +1 -1
  64. data/lib/watobo/external/ntlm/ntlm.rb +1 -1
  65. data/lib/watobo/externals.rb +1 -1
  66. data/lib/watobo/framework/create_project.rb +19 -12
  67. data/lib/watobo/framework/init.rb +4 -3
  68. data/lib/watobo/framework/init_modules.rb +32 -3
  69. data/lib/watobo/framework/license_text.rb +3 -2
  70. data/lib/watobo/framework/load_chat.rb +36 -0
  71. data/lib/watobo/framework.rb +2 -2
  72. data/lib/watobo/gui/about_watobo.rb +3 -2
  73. data/lib/watobo/gui/browser_preview.rb +4 -3
  74. data/lib/watobo/gui/certificate_dialog.rb +3 -2
  75. data/lib/watobo/gui/chat_diff.rb +6 -14
  76. data/lib/watobo/gui/chatviewer_frame.rb +30 -5
  77. data/lib/watobo/gui/checkboxtree.rb +13 -12
  78. data/lib/watobo/gui/checks_policy_frame.rb +8 -10
  79. data/lib/watobo/gui/client_cert_dialog.rb +8 -6
  80. data/lib/watobo/gui/confirm_scan_dialog.rb +5 -3
  81. data/lib/watobo/gui/conversation_table.rb +288 -51
  82. data/lib/watobo/gui/conversation_table_ctrl.rb +36 -3
  83. data/lib/watobo/gui/conversation_table_ctrl2.rb +416 -0
  84. data/lib/watobo/gui/csrf_token_dialog.rb +25 -33
  85. data/lib/watobo/gui/dashboard.rb +47 -45
  86. data/lib/watobo/gui/define_scope_frame.rb +27 -22
  87. data/lib/watobo/gui/differ_frame.rb +238 -0
  88. data/lib/watobo/gui/edit_comment.rb +3 -2
  89. data/lib/watobo/gui/edit_scope_dialog.rb +7 -6
  90. data/lib/watobo/gui/finding_info.rb +3 -2
  91. data/lib/watobo/gui/findings_tree.rb +101 -26
  92. data/lib/watobo/gui/full_scan_dialog.rb +5 -6
  93. data/lib/watobo/gui/fuzzer_gui.rb +51 -18
  94. data/lib/watobo/gui/goto_url_dialog.rb +92 -0
  95. data/lib/watobo/gui/hex_viewer.rb +16 -5
  96. data/lib/watobo/gui/html_viewer.rb +309 -0
  97. data/lib/watobo/gui/intercept_filter_dialog.rb +3 -2
  98. data/lib/watobo/gui/interceptor_gui.rb +5 -4
  99. data/lib/watobo/gui/interceptor_settings_dialog.rb +4 -3
  100. data/lib/watobo/gui/list_box.rb +4 -3
  101. data/lib/watobo/gui/log_file_viewer.rb +55 -0
  102. data/lib/watobo/gui/log_viewer.rb +3 -82
  103. data/lib/watobo/gui/login_wizzard.rb +3 -3
  104. data/lib/watobo/gui/main_window.rb +183 -164
  105. data/lib/watobo/gui/manual_request_editor.rb +157 -642
  106. data/lib/watobo/gui/master_pw_dialog.rb +3 -2
  107. data/lib/watobo/gui/mixins/gui_settings.rb +3 -2
  108. data/lib/watobo/gui/page_tree.rb +3 -2
  109. data/lib/watobo/gui/password_policy_dialog.rb +3 -2
  110. data/lib/watobo/gui/plugin_board.rb +103 -73
  111. data/lib/watobo/gui/preferences_dialog.rb +3 -2
  112. data/lib/watobo/gui/progress_window.rb +3 -2
  113. data/lib/watobo/gui/project_wizzard.rb +3 -2
  114. data/lib/watobo/gui/proxy_dialog.rb +3 -2
  115. data/lib/watobo/gui/quick_scan_dialog.rb +17 -32
  116. data/lib/watobo/gui/request_builder_frame.rb +134 -0
  117. data/lib/watobo/gui/request_editor.rb +14 -9
  118. data/lib/watobo/gui/rewrite_filters_dialog.rb +4 -3
  119. data/lib/watobo/gui/rewrite_rules_dialog.rb +4 -3
  120. data/lib/watobo/gui/save_chat_dialog.rb +7 -3
  121. data/lib/watobo/gui/scanner_settings_dialog.rb +4 -3
  122. data/lib/watobo/gui/select_chat_dialog.rb +15 -25
  123. data/lib/watobo/gui/session_management_dialog.rb +21 -25
  124. data/lib/watobo/gui/sites_tree.rb +5 -4
  125. data/lib/watobo/gui/status_bar.rb +3 -2
  126. data/lib/watobo/gui/table_editor.rb +398 -386
  127. data/lib/watobo/gui/tagless_viewer.rb +3 -2
  128. data/lib/watobo/gui/templates/plugin.rb +3 -2
  129. data/lib/watobo/gui/templates/plugin2.rb +4 -3
  130. data/lib/watobo/gui/templates/plugin_base.rb +168 -0
  131. data/lib/watobo/gui/text_viewer.rb +49 -3
  132. data/lib/watobo/gui/transcoder_window.rb +3 -2
  133. data/lib/watobo/gui/utils/gui_utils.rb +5 -4
  134. data/lib/watobo/gui/utils/init_icons.rb +5 -2
  135. data/lib/watobo/gui/utils/load_icons.rb +3 -2
  136. data/lib/watobo/gui/utils/load_plugins.rb +22 -5
  137. data/lib/watobo/gui/utils/master_password.rb +3 -2
  138. data/lib/watobo/gui/utils/save_default_settings.rb +7 -5
  139. data/lib/watobo/gui/utils/save_project_settings.rb +1 -1
  140. data/lib/watobo/gui/utils/save_proxy_settings.rb +4 -3
  141. data/lib/watobo/gui/utils/save_scanner_settings.rb +5 -4
  142. data/lib/watobo/gui/utils/session_history.rb +3 -2
  143. data/lib/watobo/gui/workspace_dialog.rb +3 -2
  144. data/lib/watobo/gui/www_auth_dialog.rb +4 -3
  145. data/lib/watobo/gui/xml_viewer_frame.rb +3 -2
  146. data/lib/watobo/gui.rb +6 -3
  147. data/lib/watobo/http/cookies/cookies.rb +66 -0
  148. data/lib/watobo/http/data/data.rb +68 -0
  149. data/lib/watobo/{gui/mixins/subscriber.rb → http/url/url.rb} +33 -19
  150. data/lib/watobo/http_socket/agent.rb +851 -0
  151. data/lib/watobo/http_socket/client_socket.rb +290 -0
  152. data/lib/watobo/http_socket/connection.rb +423 -0
  153. data/lib/watobo/http_socket/http_socket.rb +273 -0
  154. data/lib/watobo/http_socket/ntlm_auth.rb +152 -0
  155. data/lib/watobo/http_socket/proxy.rb +31 -0
  156. data/lib/watobo/http_socket.rb +25 -0
  157. data/lib/watobo/interceptor/proxy.rb +883 -0
  158. data/lib/watobo/interceptor/transparent.rb +37 -0
  159. data/lib/watobo/interceptor.rb +25 -0
  160. data/lib/watobo/mixins/check_info.rb +50 -0
  161. data/lib/watobo/mixins/httpparser.rb +92 -20
  162. data/lib/watobo/mixins/request_parser.rb +103 -88
  163. data/lib/watobo/mixins/shapers.rb +42 -11
  164. data/lib/watobo/mixins/transcoders.rb +61 -57
  165. data/lib/watobo/mixins.rb +3 -2
  166. data/lib/watobo/parser/html.rb +106 -0
  167. data/lib/watobo/parser.rb +22 -0
  168. data/lib/watobo/utils/check_regex.rb +3 -2
  169. data/lib/watobo/utils/copy_object.rb +3 -2
  170. data/lib/watobo/utils/crypto.rb +3 -2
  171. data/lib/watobo/utils/expand_range.rb +3 -2
  172. data/lib/watobo/utils/file_management.rb +7 -3
  173. data/lib/watobo/utils/hexprint.rb +3 -2
  174. data/lib/watobo/utils/load_chat.rb +4 -3
  175. data/lib/watobo/utils/load_icon.rb +3 -2
  176. data/lib/watobo/utils/print_debug.rb +3 -2
  177. data/lib/watobo/utils/response_builder.rb +6 -4
  178. data/lib/watobo/utils/response_hash.rb +66 -49
  179. data/lib/watobo/utils/secure_eval.rb +3 -2
  180. data/lib/watobo/utils/strings.rb +3 -2
  181. data/lib/watobo/utils/text2request.rb +4 -5
  182. data/lib/watobo/utils/url.rb +46 -0
  183. data/lib/watobo/utils.rb +3 -2
  184. data/lib/watobo.rb +13 -3
  185. data/modules/active/Apache/mod_status.rb +15 -11
  186. data/modules/active/Flash/crossdomain.rb +17 -14
  187. data/modules/active/RoR/cve_2013_015x.rb +21 -0
  188. data/modules/active/directories/dirwalker.rb +10 -16
  189. data/modules/active/discovery/fileextensions.rb +10 -7
  190. data/modules/active/discovery/http_methods.rb +8 -9
  191. data/modules/active/domino/domino_db.rb +10 -11
  192. data/modules/active/dotNET/custom_errors.rb +124 -0
  193. data/modules/active/dotNET/dotnet_files.rb +112 -0
  194. data/modules/active/fileinclusion/lfi_simple.rb +9 -7
  195. data/modules/active/jboss/jboss_basic.rb +12 -9
  196. data/modules/active/sap/its_commands.rb +10 -9
  197. data/modules/active/sap/its_service_parameter.rb +10 -9
  198. data/modules/active/sap/its_services.rb +10 -9
  199. data/modules/active/sap/its_xss.rb +11 -10
  200. data/modules/active/siebel/siebel_apps.rb +14 -16
  201. data/modules/active/sqlinjection/sql_boolean.rb +139 -75
  202. data/modules/active/sqlinjection/sqli_error.rb +9 -6
  203. data/modules/active/sqlinjection/sqli_timing.rb +13 -11
  204. data/modules/active/xml/xml_xxe.rb +134 -0
  205. data/modules/active/xss/{xss_rated.rb → xss_ng.rb} +89 -56
  206. data/modules/active/xss/xss_simple.rb +9 -6
  207. data/modules/passive/ajax.rb +85 -0
  208. data/modules/passive/autocomplete.rb +78 -0
  209. data/modules/passive/cookie_options.rb +3 -2
  210. data/modules/passive/cookie_xss.rb +3 -2
  211. data/modules/passive/detect_code.rb +7 -4
  212. data/modules/passive/detect_fileupload.rb +3 -2
  213. data/modules/passive/detect_infrastructure.rb +7 -4
  214. data/modules/passive/detect_one_time_tokens.rb +3 -2
  215. data/modules/passive/dirindexing.rb +3 -2
  216. data/modules/passive/disclosure_domino.rb +3 -2
  217. data/modules/passive/disclosure_emails.rb +3 -2
  218. data/modules/passive/disclosure_ipaddr.rb +3 -2
  219. data/modules/passive/filename_as_parameter.rb +3 -2
  220. data/modules/passive/form_spotter.rb +10 -7
  221. data/modules/passive/hidden_fields.rb +73 -0
  222. data/modules/passive/hotspots.rb +7 -4
  223. data/modules/passive/in_script_parameter.rb +3 -2
  224. data/modules/passive/multiple_server_headers.rb +4 -3
  225. data/modules/passive/possible_login.rb +3 -2
  226. data/modules/passive/redirect_url.rb +3 -2
  227. data/modules/passive/redirectionz.rb +6 -3
  228. data/modules/passive/xss_dom.rb +16 -9
  229. data/plugins/catalog/catalog.rb +119 -193
  230. data/plugins/crawler/crawler.rb +4 -3
  231. data/plugins/crawler/gui/auth_frame.rb +3 -2
  232. data/plugins/crawler/gui/crawler_gui.rb +3 -2
  233. data/plugins/crawler/gui/general_settings_frame.rb +3 -2
  234. data/plugins/crawler/gui/hooks_frame.rb +3 -2
  235. data/plugins/crawler/gui/scope_frame.rb +3 -2
  236. data/plugins/crawler/gui/settings_tabbook.rb +3 -2
  237. data/plugins/crawler/gui/status_frame.rb +3 -2
  238. data/plugins/crawler/gui.rb +3 -2
  239. data/plugins/crawler/lib/bags.rb +3 -2
  240. data/plugins/crawler/lib/constants.rb +3 -2
  241. data/plugins/crawler/lib/engine.rb +3 -2
  242. data/plugins/crawler/lib/grabber.rb +3 -2
  243. data/plugins/crawler/lib/uri_mp.rb +1 -1
  244. data/plugins/filefinder/filefinder.rb +92 -70
  245. data/plugins/sqlmap/bin/test.rb +3 -2
  246. data/plugins/sqlmap/gui/main.rb +3 -2
  247. data/plugins/sqlmap/gui/options_frame.rb +4 -3
  248. data/plugins/sqlmap/gui.rb +1 -1
  249. data/plugins/sqlmap/lib/sqlmap_ctrl.rb +3 -2
  250. data/plugins/sqlmap/sqlmap.rb +1 -1
  251. data/plugins/sslchecker/cli/sslchecker_cli.rb +1 -1
  252. data/plugins/sslchecker/gui/cipher_table.rb +17 -10
  253. data/plugins/sslchecker/gui/gui.rb +59 -56
  254. data/plugins/sslchecker/gui/sslchecker.rb +1 -1
  255. data/plugins/sslchecker/lib/check.rb +43 -18
  256. data/plugins/wshell/gui/main.rb +130 -0
  257. data/plugins/wshell/icons/wsh.ico +0 -0
  258. data/plugins/wshell/lib/core.rb +99 -0
  259. data/plugins/wshell/wshell.rb +33 -0
  260. metadata +80 -8
  261. data/README +0 -26
  262. data/lib/watobo/core/http_socket.rb +0 -161
  263. data/lib/watobo/gui/plugin/base.rb +0 -82
@@ -1,7 +1,7 @@
1
1
  # .
2
2
  # catalog.rb
3
3
  #
4
- # Copyright 2012 by siberas, http://www.siberas.de
4
+ # Copyright 2013 by siberas, http://www.siberas.de
5
5
  #
6
6
  # This file is part of WATOBO (Web Application Tool Box)
7
7
  # http://watobo.sourceforge.com
@@ -19,7 +19,8 @@
19
19
  # along with WATOBO; if not, write to the Free Software
20
20
  # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
21
21
  # .
22
- module Watobo
22
+ # @private
23
+ module Watobo#:nodoc: all
23
24
  module Plugin
24
25
  module Catalog
25
26
 
@@ -33,17 +34,13 @@ module Watobo
33
34
 
34
35
  about_txt = FXText.new(main, :opts => LAYOUT_FILL_X|LAYOUT_FILL_Y|TEXT_WORDWRAP)
35
36
  about_txt.editable = false
36
-
37
- about_txt.disable
37
+ about_txt.disable
38
38
  about_txt.setText text
39
39
  about_txt.font = FXFont.new(getApp(), "courier", 12, FONTWEIGHT_BOLD)
40
40
  about_txt.backColor = FXColor::White
41
41
 
42
42
  bottom = FXHorizontalFrame.new(main, :opts => LAYOUT_FILL_X)
43
- FXButton.new(bottom, "OK" ,
44
- :target => self, :selector => FXDialogBox::ID_ACCEPT,
45
- :opts => BUTTON_NORMAL|LAYOUT_RIGHT)
46
-
43
+ FXButton.new(bottom, "OK" , :target => self, :selector => FXDialogBox::ID_ACCEPT, :opts => BUTTON_NORMAL|LAYOUT_RIGHT)
47
44
  end
48
45
  end
49
46
 
@@ -52,6 +49,21 @@ about_txt.disable
52
49
  attr_writer :var_files
53
50
  attr_writer :path
54
51
 
52
+ @info.update(
53
+ :check_name => 'Catalog-Scan', # name of check which briefly describes functionality, will be used for tree and progress views
54
+ :description => "Using catalog databases for testing the web application.", # description of checkfunction
55
+ :author => "Andreas Schmidt", # author of check
56
+ :version => "1.0" # check version
57
+ )
58
+
59
+ @finding.update(
60
+ :threat => 'catalog db finding', # thread of vulnerability, e.g. loss of information
61
+ :class => "Catalog", # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
62
+ :type => FINDING_TYPE_VULN, # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN
63
+ :rating => VULN_RATING_LOW
64
+ )
65
+
66
+
55
67
  def loadVars(path)
56
68
  dbpath = Dir.getwd
57
69
  dbpath = path if not path.nil?
@@ -75,6 +87,7 @@ about_txt.disable
75
87
  end
76
88
  # puts "* db vars total: #{@dbvars.length}"
77
89
  end
90
+ @dbvars["@RFIURL"] = [ "http://cirt.net/rfiinc.txt" ] unless @dbvars.has_key? "@RFIURL"
78
91
  end
79
92
 
80
93
  def loadDBFiles(path, *opts)
@@ -88,21 +101,15 @@ about_txt.disable
88
101
  if File.exists?(fname)
89
102
  File.open(fname) { |fh|
90
103
  fh.each do |line|
91
-
92
- next if line.strip =~ /^#/
93
- # puts "+ #{line}"
104
+ next if line.strip =~ /^#/
94
105
  fields = line.split("\",")
95
106
  fields.map!{ |f| f.gsub!(/^"/,'') }
96
107
  fields.first.gsub!(/^\"/,"")
97
108
  fields.last.gsub!(/\"?/,"")
98
- # puts fields.join(" : ")
99
- # puts "*" + fields.length.to_s
100
- # gets
101
109
  @catalog_checks.push fields
102
110
  end
103
111
  }
104
- # puts "* db checks total: #{@catalog_checks.length}"
105
- else
112
+ else
106
113
  puts "* file (#{fname}) does not exist. Please check path and name."
107
114
  end
108
115
  end
@@ -123,43 +130,31 @@ about_txt.disable
123
130
 
124
131
  if pattern and uri =~ /(#{pattern})/
125
132
  key = $1
126
- #puts "+ found var key: #{key}"
127
133
  @dbvars[key].each do |v|
128
- # puts "--#{v}"
129
- new_uri = uri.gsub(/#{key}/, v)
130
- #count += 1
131
- #print "\r[Plugin] Total Checks. #{count} "
132
- yield dbid, osvdb, threat, new_uri, method, match, or_match, and_match, fail, or_fail, summary, post_data, headers
134
+ new_uri = uri.gsub(/#{key}/, v)
135
+ if new_uri =~ /#{pattern}/
136
+ @catalog_checks << [ dbid, osvdb, threat, new_uri, method, match, or_match, and_match, fail, or_fail, summary, post_data, headers ]
137
+ else
138
+ yield dbid, osvdb, threat, new_uri, method, match, or_match, and_match, fail, or_fail, summary, post_data, headers
139
+ end
140
+
133
141
  end
134
142
  else
135
- #count += 1
136
- #print "\r[Plugin] Total Checks. #{count} "
137
143
  yield dbid, osvdb, threat, uri, method, match, or_match, and_match, fail, or_fail, summary, post_data, headers
138
144
  end
139
145
  end
140
- #puts "[Plugin] Total Checks. #{count}"
141
146
  rescue => bang
142
147
  puts bang
143
148
  puts bang.backtrace if $DEBUG
144
149
  end
145
150
  end
146
151
 
152
+
153
+
147
154
  def initialize(project)
148
155
  super(project, project.getScanPreferences())
149
156
 
150
- @info.update(
151
- :check_name => 'Catalog-Scan', # name of check which briefly describes functionality, will be used for tree and progress views
152
- :description => "Using catalog databases for testing the web application.", # description of checkfunction
153
- :author => "Andreas Schmidt", # author of check
154
- :version => "1.0" # check version
155
- )
156
-
157
- @finding.update(
158
- :threat => 'catalog db finding', # thread of vulnerability, e.g. loss of information
159
- :class => "Catalog", # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
160
- :type => FINDING_TYPE_VULN, # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN
161
- :rating => VULN_RATING_LOW
162
- )
157
+
163
158
 
164
159
  @path = nil
165
160
 
@@ -187,8 +182,7 @@ about_txt.disable
187
182
  checker = proc {
188
183
  test_request = nil
189
184
  test_response = nil
190
- # !!! ATTENTION !!!
191
- # MAKE COPY BEFORE MODIFIYING REQUEST
185
+
192
186
  test = chat.copyRequest
193
187
  test.replaceFileExt(uri.gsub(/^\//,''))
194
188
 
@@ -199,7 +193,7 @@ about_txt.disable
199
193
  if method =~ /post/i then
200
194
  test.addHeader("Content-Length", "0")
201
195
  end
202
-
196
+
203
197
  status, test_request, test_response = fileExists?(test, :default => true)
204
198
 
205
199
 
@@ -207,15 +201,7 @@ about_txt.disable
207
201
  test_result = false
208
202
  response = test_response.join
209
203
  if status == true
210
- if test_request.url =~ /splashAdmin/
211
- puts "splashAdmin.php exists!"
212
- puts "Match: #{match}"
213
- puts "Or-Match: #{or_match}"
214
- puts "Fail: #{fail}"
215
- puts "Or-Fail: #{or_fail}"
216
-
217
- end
218
-
204
+
219
205
  if ( (match.empty? and or_match.empty?) or ( match != "" and response =~ /#{Regexp.quote(match)}/i) or ( or_match != "" and response =~ /#{Regexp.quote(or_match)}/i )) then
220
206
  test_result = true
221
207
  if and_match != "" then
@@ -227,13 +213,8 @@ about_txt.disable
227
213
  test_result = false if fail != "" and response =~ /#{Regexp.quote(fail)}/i
228
214
  test_result = false if or_fail != "" and response =~ /#{Regexp.quote(or_fail)}/i
229
215
 
230
- # test_chat = Chat.new(test_request, test_response, chat.id)
231
-
232
216
  if test_result then
233
-
234
- # path = test_request.url.gsub(/#{uri}/,"")
235
217
  path = test_request.path
236
- # puts "ADD FINDING!"
237
218
  addFinding( test_request, test_response,
238
219
  :test_item => uri,
239
220
  :proof_pattern => "#{Regexp.quote(match)}",
@@ -243,13 +224,9 @@ about_txt.disable
243
224
  :title => "[#{uri}] - #{path}"
244
225
 
245
226
  )
246
- # puts "OK"
247
-
248
227
  end
249
228
  end
250
229
  end
251
-
252
- # notify(:db_finished)
253
230
  [ test_request, test_response ]
254
231
  }
255
232
  yield checker
@@ -266,21 +243,19 @@ about_txt.disable
266
243
  include Watobo::Constants
267
244
 
268
245
  def updateView()
269
- #@project = project
270
246
  @sites_combo.clearItems()
271
247
  @dir_combo.clearItems()
272
248
  @dir_combo.disable
273
249
 
274
- if @project then
250
+
275
251
  @sites_combo.appendItem("no site selected", nil)
276
- scope_only = Watobo.project.has_scope?
277
- sites = @project.listSites(:in_scope => Watobo.project.has_scope? )
252
+ scope_only = Watobo::Scope.exist?
253
+ sites = Watobo::Chats.sites(:in_scope => Watobo::Scope.exist? )
278
254
  if sites.empty?
279
255
  scope_only = false
280
256
  @log_viewer.log(LOG_INFO, "Defined scope does not match one site. Using all sites.")
281
257
  end
282
- @project.listSites(:in_scope => scope_only ).each do |site|
283
- #puts "Site: #{site}"
258
+ Watobo::Chats.sites(:in_scope => scope_only ).each do |site|
284
259
  site_string = site
285
260
  if site.length > 60
286
261
  site_string = site.slice(0..55)
@@ -293,21 +268,19 @@ about_txt.disable
293
268
  @sites_combo.setCurrentItem(0) if @sites_combo.numItems > 0
294
269
  ci = @sites_combo.currentItem
295
270
  site = ( ci >= 0 ) ? @sites_combo.getItemData(ci) : nil
271
+ puts site
272
+ puts site.class
296
273
 
297
- if site
274
+ unless site.nil?
298
275
  @dir_combo.enable
299
- @project.listDirs(@site) do |dir|
276
+ Watobo::Chats.dirs(site) do |dir|
277
+ puts dir
300
278
  @dir_combo.appendItem(dir.slice(0..35), dir)
301
279
  end
302
280
  @dir_combo.setCurrentItem(0, true) if @dir_combo.numItems > 0
303
281
 
304
282
  end
305
- end
306
-
307
- end
308
-
309
- def onClose
310
-
283
+
311
284
  end
312
285
 
313
286
  def initialize(owner, project)
@@ -328,15 +301,10 @@ about_txt.disable
328
301
  dlg = Watobo::Plugin::Catalog::About.new(self, text)
329
302
  dlg.execute
330
303
  }
331
-
332
- self.connect(SEL_CLOSE, method(:onClose))
333
304
 
334
305
  @event_dispatcher_listeners = Hash.new
335
306
  @scanner = nil
336
307
  @plugin_name = "Catalog-Scan"
337
- @project = project
338
-
339
-
340
308
 
341
309
  @site = nil
342
310
  @dir = nil
@@ -371,22 +339,14 @@ about_txt.disable
371
339
  FXLabel.new(request_frame, "Select a request template from drop-down list or enter manually.")
372
340
  @requestCombo = FXComboBox.new(request_frame, 5, nil, 0,
373
341
  COMBOBOX_STATIC|FRAME_SUNKEN|FRAME_THICK|LAYOUT_SIDE_TOP|LAYOUT_FILL_X)
374
- #@filterCombo.width =200
375
342
 
376
343
  @requestCombo.numVisible = 0
377
344
  @requestCombo.numColumns = 50
378
345
  @requestCombo.editable = false
379
346
  @requestCombo.connect(SEL_COMMAND, method(:onSelectRequest))
380
347
 
381
- #log_text_frame = FXVerticalFrame.new(request_frame, LAYOUT_FILL_X|LAYOUT_FILL_Y|FRAME_SUNKEN|FRAME_THICK, :padding=>0)
382
- # @request_box = FXText.new(log_text_frame, :opts => LAYOUT_FILL_X|LAYOUT_FILL_Y)
383
- # @request_box.styled = true
384
- # Set the styles
385
- # @request_box.hiliteStyles = [ hs_green, hs_red]
386
-
387
348
  @request_editor = RequestEditor.new(request_frame, :opts => LAYOUT_FILL_X|LAYOUT_FILL_Y|FRAME_SUNKEN|FRAME_THICK, :padding=>0)
388
349
 
389
- # FXLabel.new(@settings_frame, "Select Site:")
390
350
  ts_frame = FXGroupBox.new(@settings_frame, "Scan Settings", LAYOUT_SIDE_TOP|FRAME_GROOVE|LAYOUT_FILL_X, 0, 0, 0, 0)
391
351
 
392
352
  # @scope_only_cb = FXCheckButton.new(@settings_frame, "target scope only", nil, 0, ICON_BEFORE_TEXT|LAYOUT_SIDE_LEFT)
@@ -395,7 +355,6 @@ about_txt.disable
395
355
 
396
356
  @sites_combo = FXComboBox.new(ts_frame, 5, nil, 0,
397
357
  COMBOBOX_STATIC|FRAME_SUNKEN|FRAME_THICK|LAYOUT_SIDE_TOP|LAYOUT_FILL_X)
398
- #@filterCombo.width =200
399
358
 
400
359
  @sites_combo.numVisible = @sites_combo.numItems >= 20 ? 20 : @sites_combo.numItems
401
360
  @sites_combo.numColumns = 35
@@ -426,13 +385,9 @@ about_txt.disable
426
385
  if @logScanChats.checked? then
427
386
  @scanlog_dir_text.enabled = true
428
387
  @scanlog_dir_text.backColor = FXColor::White
429
- # @scanlog_dir_label.enabled = true
430
- # @scanlog_dir_btn.enable
431
388
  else
432
389
  @scanlog_dir_text.enabled = false
433
390
  @scanlog_dir_text.backColor = @scanlog_dir_text.parent.backColor
434
- # @scanlog_dir_label.enabled = false
435
- # @scanlog_dir_btn.disable
436
391
  end
437
392
  end
438
393
 
@@ -448,9 +403,6 @@ about_txt.disable
448
403
  @scanlog_dir_text.enabled = false
449
404
  @scanlog_dir_text.backColor = @scanlog_dir_text.parent.backColor
450
405
  end
451
- #@scanlog_dir_btn = FXButton.new(scanlog_frame, "Change")
452
- # @scanlog_dir_btn.connect(SEL_COMMAND, method(:selectScanlogDirectory))
453
-
454
406
 
455
407
  @db_files = %w( db_tests db_variables )
456
408
 
@@ -514,11 +466,9 @@ about_txt.disable
514
466
  @db_path_combo.currentItem = path_index if @db_path_combo.numItems > 0
515
467
 
516
468
  @pbar = FXProgressBar.new(@settings_frame, nil, 0, LAYOUT_FILL_X|FRAME_SUNKEN|FRAME_THICK|PROGRESSBAR_HORIZONTAL)
517
- @pbar.progress = 0
518
- @pbar.total = 0
519
- @pbar.barColor=0
520
- @pbar.barColor = 'grey' #FXRGB(255,0,0)
521
-
469
+
470
+ reset_pbar
471
+
522
472
  @speed = FXLabel.new(@settings_frame, "Requests per second: 0")
523
473
 
524
474
  @start_button = FXButton.new(@settings_frame, "start")
@@ -546,6 +496,8 @@ about_txt.disable
546
496
  @log_viewer = LogViewer.new(log_text_frame, nil, :opts => LAYOUT_FILL_X|LAYOUT_FILL_Y)
547
497
 
548
498
  updateView()
499
+ start_update_timer()
500
+
549
501
  rescue => bang
550
502
  puts bang
551
503
  puts bang.backtrace if $DEBUG
@@ -563,11 +515,18 @@ about_txt.disable
563
515
  show(PLACEMENT_SCREEN) # Make the main window appear
564
516
  disableOptions()
565
517
  @start_button.disable
518
+
519
+ updateView()
566
520
  end
567
521
 
568
522
 
569
523
  private
570
524
 
525
+ def reset_pbar
526
+ @pbar.progress = 0
527
+ @pbar.total = 0
528
+ @pbar.barColor = 'grey' #FXRGB(255,0,0)
529
+ end
571
530
 
572
531
  def updateRequestEditor(chat=nil)
573
532
  @request_editor.setText('')
@@ -599,7 +558,7 @@ about_txt.disable
599
558
  def updateRequestCombo(chat_list)
600
559
  @requestCombo.clearItems()
601
560
  chat_list.each do |chat|
602
- text = "[#{chat.id}] #{chat.request.url}"
561
+ text = "[#{chat.id}] #{chat.request.url.to_s}"
603
562
  @requestCombo.appendItem(text, chat)
604
563
  end
605
564
  if @requestCombo.numItems > 0 then
@@ -626,17 +585,17 @@ about_txt.disable
626
585
  if @site
627
586
  @dir_combo.appendItem("/", nil)
628
587
 
629
- chats = @project.findChats(@site, :method => "GET")
588
+ chats = Watobo::Chats.select(@site, :method => "GET")
630
589
  updateRequestCombo(chats)
631
590
  updateRequestEditor(chats.first)
632
- if @project then
633
- @project.listDirs(@site) do |dir|
634
- text = "/" + dir #.slice(0..35)
635
- text.gsub!(/\/+/, '/')
636
- @dir_combo.appendItem(text, dir)
637
- end
638
- @dir_combo.setCurrentItem(0, true) if @dir_combo.numItems > 0
591
+
592
+ Watobo::Chats.dirs(@site) do |dir|
593
+ text = "/" + dir #.slice(0..35)
594
+ text.gsub!(/\/+/, '/')
595
+ @dir_combo.appendItem(text, dir)
639
596
  end
597
+ @dir_combo.setCurrentItem(0, true) if @dir_combo.numItems > 0
598
+
640
599
  end
641
600
  enableOptions()
642
601
  @dir_combo.enable
@@ -724,15 +683,15 @@ about_txt.disable
724
683
  else
725
684
  @dir = ""
726
685
  end
727
- chats = @project.findChats(@site, :method => "GET", :dir => @dir)
686
+ chats = Watobo::Chats.select(@site, :method => "GET", :dir => @dir)
728
687
  updateRequestCombo(chats)
729
688
  updateRequestEditor(chats.first)
730
689
  end
731
690
 
732
691
  def hide()
733
-
734
- # puts "* #{self.class} closed"
692
+ # TODO: Warn user if scan is in progress
735
693
  @scanner.cancel() if @scanner
694
+ @scanner = nil
736
695
 
737
696
  super
738
697
 
@@ -779,13 +738,37 @@ about_txt.disable
779
738
  file = File.join(conf_dir, dir_name + "_config.yml")
780
739
  config = Watobo::Utils.load_settings(file)
781
740
  end
741
+
742
+ def start_update_timer
743
+ @timer = FXApp.instance.addTimeout( 250, :repeat => true) {
744
+ unless @scanner.nil?
745
+ progress = @scanner.progress
746
+ sum_progress = progress.values.inject(0){|i, v| i += v[:progress] }
747
+ @speed.text = "Checks per second: #{sum_progress - @pbar.progress}"
748
+ @pbar.progress = sum_progress
749
+
750
+ if @scanner.finished?
751
+ msg = "Scan Finished!"
752
+ @log_viewer.log(LOG_INFO, msg)
753
+ Watobo.log(msg, :sender => "Catalog")
754
+ @scanner = nil
755
+ reset_pbar()
756
+
757
+ @speed.text = "Requests per second: -"
758
+ @start_button.text = "Start"
759
+ end
760
+ end
761
+ }
762
+ end
782
763
 
783
764
  def start(sender, sel, item)
784
765
  if @start_button.text =~ /cancel/i then
785
766
  @scanner.cancel()
786
767
  @start_button.text = "Start"
787
- @pbar.progress = 0
788
- Watobo.log("Scan Canceled By User", :sender => "Catalog")
768
+ reset_pbar
769
+ msg = "Scan Canceled By User"
770
+ Watobo.log(msg, :sender => "Catalog")
771
+ @log_viewer.log(LOG_INFO, msg)
789
772
  return
790
773
  end
791
774
 
@@ -799,19 +782,7 @@ about_txt.disable
799
782
  @start_button.text = "Cancel"
800
783
 
801
784
 
802
- @check = Check.new(@project)
803
-
804
- #@check.subscribe(:db_finished) {
805
- # @pbar.increment(1)
806
- #puts @pbar.progress.to_s + "/" + @pbar.total.to_s
807
- # if @pbar.progress == @pbar.total-1
808
- # @pbar.barColor = 'grey'
809
- # puts @pbar.progress.to_s + "/" + @pbar.total.to_s
810
- # end
811
-
812
- #}
813
-
814
-
785
+ @check = Check.new(Watobo.project)
815
786
 
816
787
  @check.path = @path
817
788
 
@@ -824,22 +795,15 @@ about_txt.disable
824
795
 
825
796
  @log_viewer.log( LOG_INFO, "Starting ...")
826
797
  puts "Site: #{@site}"
827
- # progressWindow = Watobo::Gui::ProgressWindow.new(self, "Initialize Plugin")
828
-
829
- # progressWindow.create
830
- # progressWindow.show(PLACEMENT_SCREEN)
831
- # progressWindow.newProject(@active_project, project_settings)
832
-
833
- # progressWindow.register(self)
834
- progressWindow = nil
798
+ progressWindow = nil
835
799
  # Thread.new(progressWindow){ |pw|
836
800
  begin
837
801
  c=1
838
802
  if @test_all_dirs.checked? then
839
803
  c = 0
840
- @project.listDirs(@site, :base_dir => @dir, :include_subdirs => @test_all_dirs.checked?) { c += 1 }
841
- notify(:update_progress, :total => c, :job => @dir)
842
- @project.listDirs(@site, :base_dir => @dir, :include_subdirs => @test_all_dirs.checked?) do |dir|
804
+ Watobo::Chats.dirs(@site, :base_dir => @dir, :include_subdirs => @test_all_dirs.checked?) { c += 1 }
805
+
806
+ Watobo::Chats.dirs(@site, :base_dir => @dir, :include_subdirs => @test_all_dirs.checked?) do |dir|
843
807
  msg = "running checks in #{@path} on #{@site} for /#{dir}"
844
808
  puts msg
845
809
  Watobo.log(msg, :sender => "Catalog")
@@ -848,93 +812,55 @@ about_txt.disable
848
812
  chat.request.replaceFileExt('')
849
813
  chat.request.setDir(dir)
850
814
  chatlist.push chat
851
- # @check.getCheckCount(chat)
815
+
852
816
  @check.updateCounters(chat)
853
- # pw.update_progress( :progress => 1)
817
+
854
818
  end
855
819
  else
856
- # notify(:update_progress, :total => c, :job => @dir)
857
- msg = "running checks in #{@path} on #{@site} for /#{@dir}"
858
- puts msg
859
- Watobo.log(msg, :sender => "Catalog")
860
- @log_viewer.log(LOG_INFO, msg)
820
+
861
821
  chat = createChat()
862
- # puts chat.request.first
863
822
  chat.request.replaceFileExt('')
864
- chat.request.setDir(@dir)
865
- # puts chat.request.first
823
+
866
824
  chatlist.push chat
867
825
  @check.updateCounters(chat)
868
- # notify(:update_progress, :progress => 1)
826
+
827
+ msg = "running checks in #{@path} on #{@site} for /#{chat.request.dir}"
828
+ puts msg
829
+ Watobo.log(msg, :sender => "Catalog")
830
+ @log_viewer.log(LOG_INFO, msg)
869
831
  end
870
832
  rescue => bang
871
833
  puts bang
872
834
  puts bang.backtrace if $DEBUG
873
835
  ensure
874
- # pw.hide
836
+
875
837
  end
876
- # }
877
-
878
- # getApp().runModalWhileShown(progressWindow)
879
-
880
- scan_prefs = @project.getScanPreferences
881
-
882
-
838
+ #scan_prefs = @project.getScanPreferences
839
+ scan_prefs = Watobo::Conf::Scanner.to_h
883
840
  if @logScanChats.checked?
884
841
  scan_prefs[:scanlog_name] = @scanlog_dir_dt.value unless @scanlog_dir_dt.value.empty?
885
842
  end
886
843
 
887
-
888
- @scanner = Watobo::Scanner2.new(chatlist, checklist, @project.passive_checks, scan_prefs)
889
-
890
- @pbar.total = @check.numChecks * chatlist.length
844
+ @scanner = Watobo::Scanner3.new(chatlist, checklist, Watobo::PassiveModules.to_a, scan_prefs)
845
+ @pbar.total = @scanner.progress.values.inject(0){|i,v| i += v[:total]}
891
846
  @pbar.progress = 0
892
847
  @pbar.barColor = 'red'
893
848
 
894
849
  speed = 0
895
850
  lasttime = 0
896
- @scanner.subscribe(:progress) { |m|
897
- time = Time.now.to_i
898
- if time == lasttime then
899
- speed += 1
900
- else
901
- @speed.text = "Requests per second: #{speed}"
902
- speed = 1
903
- lasttime = time
904
- end
905
- @pbar.increment(1)
906
- }
907
-
908
- @scanner.subscribe(:new_finding) { |f|
909
- # puts "Project.addFinding"
910
- @project.addFinding(f)
911
- }
912
851
 
913
852
 
914
- msg= "Total Requests: #{@check.numChecks}"
853
+ msg= "Total Requests: #{@pbar.total}"
915
854
  @log_viewer.log(LOG_INFO, msg)
916
-
917
-
918
- st = Thread.new(@scanner){ |scan|
919
- begin
855
+ begin
920
856
  msg = "start scanning..."
921
857
  @log_viewer.log(LOG_INFO, msg)
922
-
923
- scan.run(:run_passive_checks => false)
924
-
925
- msg = "scanning finished!"
926
- @log_viewer.log(LOG_INFO, msg)
927
- Watobo.log("Scan finished", :sender => "Catalog")
858
+ @scanner.run(:run_passive_checks => false)
928
859
  rescue => bang
929
860
  puts bang
930
861
  puts bang.backtrace if $DEBUG
931
862
  end
932
- @pbar.progress = 0
933
- @pbar.barColor = 'grey'
934
- @speed.text = "Requests per second: 0"
935
- @start_button.text = "Start"
936
- }
937
- # st.join
863
+
938
864
  end
939
865
 
940
866
  end
@@ -1,7 +1,7 @@
1
1
  # .
2
2
  # crawler.rb
3
3
  #
4
- # Copyright 2012 by siberas, http://www.siberas.de
4
+ # Copyright 2013 by siberas, http://www.siberas.de
5
5
  #
6
6
  # This file is part of WATOBO (Web Application Tool Box)
7
7
  # http://watobo.sourceforge.com
@@ -36,7 +36,8 @@ path = File.expand_path(File.dirname(__FILE__))
36
36
  end
37
37
 
38
38
  if $0 == __FILE__
39
- module Watobo
39
+ # @private
40
+ module Watobo#:nodoc: all
40
41
  module Conf
41
42
  class Interceptor
42
43
  def self.port
@@ -64,7 +65,7 @@ if $0 == __FILE__
64
65
  puts "Cookie: #{cookie.name}"
65
66
  clean_jar.add! cookie unless cookie.name =~ /^box/i
66
67
  }
67
- exit unless agent.cookie_jar.empty?(request.url)
68
+ exit unless agent.cookie_jar.empty?(request.url.to_s)
68
69
  agent.cookie_jar = clean_jar
69
70
  rescue => bang
70
71
  puts bang
@@ -1,7 +1,7 @@
1
1
  # .
2
2
  # auth_frame.rb
3
3
  #
4
- # Copyright 2012 by siberas, http://www.siberas.de
4
+ # Copyright 2013 by siberas, http://www.siberas.de
5
5
  #
6
6
  # This file is part of WATOBO (Web Application Tool Box)
7
7
  # http://watobo.sourceforge.com
@@ -19,7 +19,8 @@
19
19
  # along with WATOBO; if not, write to the Free Software
20
20
  # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
21
21
  # .
22
- module Watobo
22
+ # @private
23
+ module Watobo#:nodoc: all
23
24
  module Plugin
24
25
  module Crawler
25
26
  class Gui
@@ -1,7 +1,7 @@
1
1
  # .
2
2
  # crawler_gui.rb
3
3
  #
4
- # Copyright 2012 by siberas, http://www.siberas.de
4
+ # Copyright 2013 by siberas, http://www.siberas.de
5
5
  #
6
6
  # This file is part of WATOBO (Web Application Tool Box)
7
7
  # http://watobo.sourceforge.com
@@ -19,7 +19,8 @@
19
19
  # along with WATOBO; if not, write to the Free Software
20
20
  # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
21
21
  # .
22
- module Watobo
22
+ # @private
23
+ module Watobo#:nodoc: all
23
24
  module Plugin
24
25
  module Crawler
25
26