watobo 0.9.12 → 0.9.13

data/lib/watobo/core/min_class.rb

@@ -0,0 +1,27 @@
+# .
+# min_class.rb
+# 
+# Copyright 2013 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+# @private 
+module Watobo#:nodoc: all
+  class MinClass
+    
+  end
+end

data/lib/watobo/core/netfilter_queue.rb

@@ -1,7 +1,7 @@
 # .
 # netfilter_queue.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -19,7 +19,8 @@
 # along with WATOBO; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
-module Watobo
+# @private 
+module Watobo#:nodoc: all
   module NFQueue
     @ssl_requests = Hash.new
     @cert_list = Hash.new

data/lib/watobo/core/ott_cache.rb

@@ -0,0 +1,156 @@
+# .
+# ott_cache.rb
+# 
+# Copyright 2013 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+# @private 
+module Watobo#:nodoc: all
+  class OTTCache
+    @otts = {}
+    @otts_lock = Mutex.new
+    
+    attr :tokens
+    
+    def initialize()
+      @tokens = {}
+      @tokens_lock = Mutex.new
+    end
+    
+    def self.acquire(request)
+      urh = request.uniq_hash
+      unless @otts.has_key? urh
+        @otts[urh] = OTTCache.new()
+      end
+      @otts[urh]
+    end
+    
+    
+    def self.patterns(&block)
+   
+        Watobo::Conf::OttCache.patterns.each do |p|
+          yield p if block_given?
+        end
+        YAML.load(YAML.dump(Watobo::Conf::OttCache.patterns))
+   
+    end
+    
+      
+    def update_tokens(response)
+        
+        begin
+          #   site = request.site
+          @tokens_lock.synchronize do
+            response.each do |line|
+              # puts line
+              self.class.patterns do |pat|
+                puts pat if $DEBUG
+                if line =~ /#{pat}/i then
+                  token_key = Regexp.quote($1.upcase)
+                  token_value = $2
+                  #print "U"
+                    puts "GOT NEW TOKEN (#{token_key}): #{token_value}" if $DEBUG
+                  #   @session[:valid_csrf_tokens][site] = Hash.new if @session[:valid_csrf_tokens][site].nil?
+                  #   @session[:valid_csrf_tokens][site][token_key] = token_value
+                  @tokens[token_key] = token_value
+                end
+              end
+
+            end
+          end
+        rescue => bang
+          puts bang
+          if $DEBUG
+          puts bang.backtrace 
+          puts "= Request"
+          puts request 
+          puts "= Response"
+          puts response
+          puts "==="
+          end
+
+        end
+        # }
+      end
+    
+    # target could be a Watobo::Chat or a Watobo::Request object
+    def self.set_chat_ids(target, ott_chat_ids)
+      r = target
+      r = target.request if target.respond_to? :request
+      @otts_lock.synchronize do
+        Watobo::Conf::OttCache.request_ids[r.uniq_hash] = ott_chat_ids
+      end
+    end
+    
+    # returns an array of Watobo::Requests which are necessary 
+    # to update the token
+    def self.requests(target)
+      requests = []
+      request = target.respond_to?(:request) ? target.request : target
+      urh = request.uniq_hash
+      @otts_lock.synchronize do
+        return requests unless Watobo::Conf::OttCache.request_ids.has_key? urh
+        Watobo::Conf::OttCache.request_ids[urh].each do |id|
+         #puts "* [OTT] get chat for id #{id}"
+          chat = Watobo::Chats.get_by_id(id)        
+          requests << chat.copyRequest unless chat.nil?
+        end
+      end
+      requests
+    end
+    
+    
+    # update tokens for a specific request
+    def update_request(request)     
+      #urh = target_request.uniq_hash 
+      #return false unless @tokens.has_key? urh       
+        @tokens_lock.synchronize do       
+          request.map!{ |line|
+            res = line
+            self.class.patterns do |pat|
+              begin
+                if line =~ /#{pat}/i then
+                  key = Regexp.quote($1.upcase)
+                  old_value = $2
+                  if @tokens.has_key?(key) then
+                    res = line.gsub!(/#{Regexp.quote(old_value)}/, @tokens[key])
+                    if res.nil? then
+                      res = line
+                      puts "!!!could not update token (#{key})"
+                    end
+                  else
+                    if $DEBUG
+                      puts "[OTT] nothing to update?"
+                      puts @tokens.to_yaml
+                      puts request
+                    end 
+                  end
+                end
+              rescue => bang
+                puts bang
+                puts bang.backtrace if $DEBUG
+                # puts @session.to_yaml
+              end
+            end
+            res
+          }
+        end
+        # end
+      end
+  end
+end

data/lib/watobo/core/parameter.rb

@@ -0,0 +1,66 @@
+# .
+# parameter.rb
+# 
+# Copyright 2013 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+# @private 
+module Watobo#:nodoc: all
+=begin 
+  
+ possible locations
+ - url
+ - header
+ - cookie
+ - data (body)
+
+=end
+  class Parameter
+    attr :location
+    attr :name
+    attr_accessor :value
+    
+    def initialize(prefs)
+      @location = nil
+      @name = prefs[:name]
+      @value = prefs[:value]      
+    end
+  end
+  
+  class WWWFormParameter < Parameter
+    def initialize(prefs)
+      super prefs
+      @location = :data
+    end
+  end
+  
+  
+  class UrlParameter < Parameter
+    def initialize(prefs)
+      super prefs
+      @location = :url
+    end
+  end
+  
+  class CookieParameter < Parameter
+    def initialize(prefs)
+      super prefs
+      @location = :cookie
+    end
+  end
+end

data/lib/watobo/core/passive_check.rb

@@ -1,7 +1,7 @@
 # .
 # passive_check.rb
 # 
-# Copyright 2012 by siberas, http://www.siberas.de
+# Copyright 2013 by siberas, http://www.siberas.de
 # 
 # This file is part of WATOBO (Web Application Tool Box)
 #        http://watobo.sourceforge.com
@@ -19,28 +19,16 @@
 # along with WATOBO; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
-module Watobo
+# @private 
+module Watobo#:nodoc: all
     class PassiveCheck
       include Watobo::Constants
+      extend Watobo::Subscriber
+      
       @@lock = Mutex.new
       attr :info
      
-      def subscribe(event, &callback)
-        (@event_dispatcher_listeners[event] ||= []) << callback
-      end
-
-      def clear_event(event)
-        @event_dispatcher_listeners[event].clear
-      end
-
-      def notify(event, *args)
-        if @event_dispatcher_listeners[event]
-          @event_dispatcher_listeners[event].each do |m|
-            m.call(*args) if m.respond_to? :call
-          end
-        end
-      end
-     
+           
       def addFinding(details)
         t = Time.now
 
@@ -52,19 +40,22 @@ module Watobo
           new_details.update(details)
 
           new_details[:tstamp] = now
+          
+          unless new_details.has_key?(:fid)
 
           id_string = ''
 
-          id_string << new_details[:chat].request.url if new_details[:chat]
+          id_string << new_details[:chat].request.url.to_s if new_details[:chat]
           id_string << new_details[:class] if new_details[:class]
           id_string << new_details[:title]  if new_details[:title]
           id_string << new_details[:unique]  if new_details[:unique]
 
-          if id_string == '' then
+          if id_string.empty? then
             id_string = rand(10000)
           end
           #puts "Finding #{id_string}"
           new_details[:fid] = Digest::MD5.hexdigest(id_string)
+          end 
 
           new_details[:module] = self.class.to_s
 
@@ -80,9 +71,11 @@ module Watobo
           new_details.delete(:chat)
 
           new_finding = Watobo::Finding.new(request, response, new_details)
+          
+          Watobo::Findings.add new_finding
 
           #@project.addFinding(new_finding)
-          notify(:new_finding, new_finding)
+         # notify(:new_finding, new_finding)
         }
       end
 
@@ -109,7 +102,7 @@ module Watobo
         @project = project
         @enabled = true
 
-@event_dispatcher_listeners = Hash.new
+#@event_dispatcher_listeners = Hash.new
 
         @info = {
           :check_name => '',    # name of check which briefly describes functionality, will be used for tree and progress views

data/lib/watobo/core/passive_checks.rb

@@ -0,0 +1,72 @@
+# .
+# passive_checks.rb
+# 
+# Copyright 2013 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+# @private 
+module Watobo#:nodoc: all
+  class PassiveModules
+    @checks = []
+    
+    def self.each(&block)
+      if block_given?
+        @checks.map{|c| yield c }
+      end
+      
+    end
+    
+    def self.to_a
+      @checks
+    end
+    
+    def self.length
+      @checks.length  
+    end
+    
+    def self.init
+      passive_modules = []
+
+      Dir["#{Watobo.passive_module_path}/*.rb"].each do |mod_file|
+        begin
+          mod = File.basename(mod_file)
+
+          load mod_file
+        rescue => bang
+          puts "!!!"
+          puts bang
+        end
+      end
+
+      Watobo::Modules::Passive.constants.each do |m|
+        begin
+          class_constant = Watobo::Modules::Passive.const_get(m)
+          pc = class_constant.new(self)
+          print "."
+          @checks << pc
+
+        rescue => bang
+          puts "!!!"
+          puts bang
+        end
+      end
+      
+      passive_modules
+    end
+  end
+end

data/lib/watobo/core/passive_scanner.rb

@@ -0,0 +1,69 @@
+# .
+# passive_scanner.rb
+# 
+# Copyright 2013 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+# @private 
+module Watobo#:nodoc: all
+  module PassiveScanner
+    @queue = Queue.new
+    @max_threads = 1
+    @scanners = []
+    class Engine
+      def initialize
+        @t = nil
+      end
+
+      def run
+        @t = Thread.new{
+          loop do
+            chat = Watobo::PassiveScanner.pop
+            unless chat.nil?
+              Watobo::PassiveModules.each do |test_module|
+                begin
+                  test_module.do_test(chat)
+                rescue => bang
+                  puts bang
+                  puts bang.backtrace if $DEBUG
+                  return false
+                end
+              end
+            end
+         end
+        }
+      end
+    end
+
+    def self.pop
+      return @queue.pop
+    end
+
+    def self.start
+      @max_threads.times do |i|
+        e = Engine.new
+        e.run
+      end
+    end
+
+    def self.add(chat)
+      @queue.push chat
+    end
+
+  end
+end

data/lib/watobo/core/plugin.rb

@@ -0,0 +1,33 @@
+# .
+# plugin.rb
+# 
+# Copyright 2013 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+# @private 
+module Watobo#:nodoc: all
+
+  module Plugin
+    def self.each
+      constants.each do |c|
+        yield c if block_given?
+      end
+    end
+  end
+
+end