watobo 0.9.16 → 0.9.17

data/lib/watobo/interceptor/proxy.rb

@@ -150,8 +150,7 @@ module Watobo#:nodoc: all
               
             # puts "#{c_sock} - read request"
              request = c_sock.request
-            #puts ">>>"
-            # puts request
+            
              if request.nil? or request.empty? then
                 print "c/"
                 c_sock.close

data/lib/watobo/mixins/httpparser.rb

@@ -610,17 +610,29 @@ def content_encoding
         nil
       end
       
-      def body_is_text?
+      def is_text?
         ct = self.content_type(nil) 
         if ct.nil?
           return true if self.body_encoded.ascii_only?
           return false
         else
-          return true if ct =~ /text/
+          return true if ct =~ /text/i
           return false
         end
       end
       
+      def is_wwwform?
+        ct = self.content_type
+        return true if ct =~ /form/i
+        return false
+      end
+      
+      def is_xml?
+        ct = self.content_type
+        return true if ct =~ /xml/i
+        return false
+      end
+      
       def body_encoded
         b = self.body
         cs = self.charset
@@ -695,8 +707,8 @@ end
           return header_list if cl.strip.empty?
           unless filter.nil?
             if cl =~ /#{filter}/
-            yield line if block_given?
-            header_list.push line
+              yield line if block_given?
+              header_list.push line
             end
           else
             yield line if block_given?
@@ -716,7 +728,7 @@ end
         end
       end
 
-      def cookies
+      def cookies_UNUSED
         cookie_list=[]
         self.headers.each do |line|
           if line =~ /Cookie2?: (.*)/i then

data/lib/watobo/mixins/shapers.rb

@@ -184,6 +184,7 @@ module Watobo#:nodoc: all
           begin
             matches = []
             headers.each_with_index do |h,i|
+              next if i == 0
               matches << i if h =~ /#{header}/i
             end
             matches.map{ |m| self.delete_at(m) }
@@ -342,17 +343,7 @@ module Watobo#:nodoc: all
           self.first.gsub!(/(.*) (HTTP\/.*)/, "\\1#{pref}#{parms} \\2")
 
         end
-
-        def setCookie(cname="Cookie", value=nil)
-          return nil if value.nil?
-
-          self.map!{ |l|
-            break if l.strip.empty?
-            if l =~ /^#{cname}:/i
-              l = "#{cname}: #{value}"
-            end
-          }
-        end
+        
         
         def set_content_length(length)
           set_header("Content-Length", length)     

data/lib/watobo/{http_socket.rb → sockets.rb}

@@ -1,5 +1,5 @@
 # .
-# http_socket.rb
+# sockets.rb
 # 
 # Copyright 2013 by siberas, http://www.siberas.de
 # 
@@ -20,6 +20,6 @@
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 # .
 %w( client_socket http_socket ).each do |lib|
-  require "watobo/http_socket/#{lib}"
+  require "watobo/sockets/#{lib}"
 end
 

data/lib/watobo/{http_socket → sockets}/client_socket.rb

@@ -262,6 +262,21 @@ module Watobo#:nodoc: all
             # puts ssl_socket.methods.sort
 
             ssl_session = ssl_socket.accept
+
+            session = ssl_session
+            request = []
+
+            Watobo::HTTPSocket.read_header(session) do |line|
+              request << line
+            end
+            return nil if request.empty?
+            return nil if request.first.nil?
+
+            unless request.first =~ /(^[^[:space:]]{1,}) http/
+              request.first.gsub!(/(^[^[:space:]]{1,})( )(\/.*)/, "\\1 https://#{site}\\3")
+            end
+
+            request = Watobo::Request.new(request)
           rescue => bang
             puts bang
             puts bang.backtrace if $DEBUG
@@ -269,10 +284,9 @@ module Watobo#:nodoc: all
             return nil
 
           end
-          session = ssl_session
-          request = nil
+
         else
-         # puts "* create request object"
+        # puts "* create request object"
           request = Watobo::Request.new(request)
         site = request.site
         #puts request
@@ -318,9 +332,9 @@ module Watobo#:nodoc: all
       # e.g., hop_by_hop headers
       def clean_request(request)
         # puts request
-        request.remove_header "Connection"
-        request.remove_header "Proxy\-Connection"
-        request.remove_header "If\-"
+        request.remove_header "^Connection"
+        request.remove_header "^Proxy\-Connection"
+        request.remove_header "^If\-"
 
         request.remove_header("^Accept-Encoding")
       end
@@ -568,7 +582,7 @@ module Watobo#:nodoc: all
           session = ssl_session
           request = nil
         else
-         # puts "* create request object"
+        # puts "* create request object"
           request = Watobo::Request.new(request)
         site = request.site
         #puts request

data/modules/active/sqlinjection/sql_boolean.rb

@@ -97,74 +97,72 @@ EOF
             #  Check GET-Parameters
             #
             begin
-              urlParmNames(chat).each do |get_parm|
+              chat.request.parameters(:url, :wwwform, :xml) do |param|
                 checks = []
                 @prefs.each do |p|
-                @fins.each do |f|
-                  @boolean_checks.each do  |c| 
-                    checks << [ p + c[0] + f, p + c[1] +f ]
+                  @fins.each do |f|
+                    @boolean_checks.each do  |c| 
+                      checks << [ p + c[0] + f, p + c[1] +f ]
+                    end
                   end
                 end
-                end
+                
                 checks.each do |check_true, check_false|
                   checker = proc {
                     begin
-                     # puts "TRUE ==> #{check_true}"
-                     # puts "FALSE ==> #{check_false}"
-                      parm = get_parm.dup
+                     
                       check_t = CGI::escape(check_true)
                       check_f = CGI::escape(check_false)
                       test_request = nil
                       test_response = nil
+                      orig_value = "#{param.value}"
                       
                       # first do request double time to check if hashes are the same
-                      test = chat.copyRequest
+                      test = chat.request.copy
                       test_request,test_response = doRequest(test, :default => true)
                       text_1, hash_1 = Watobo::Utils.smartHash(chat.request, test_request, test_response)
-                     # puts test_response
-                      test = chat.copyRequest
+                      
                       test_request,test_response = doRequest(test, :default => true)
-                     # puts test_response
                       text_2, hash_2 = Watobo::Utils.smartHash(chat.request, test_request, test_response)
+                      
                       #puts "=== SQL BOOLEAN (#{parm}) ===="
                       #puts "=TEXT_1 (#{parm})\r\n#{text_1}\r\n=HASH_1\r\n#{hash_1}" if parm =~ /button/
                       #puts "=TEXT_2 (#{parm})\r\n#{text_2}\r\n=HASH_2\r\n#{hash_2}" if parm =~ /button/
                      
                       if hash_1 == hash_2 then
-                        test = chat.copyRequest
-                        val = test.get_parm_value(parm)
+                        val = "#{orig_value}"
                        # val << "AB" if val.empty?
                         val << check_t
                        
-                        test.replace_get_parm(parm, val)
+                        param.value = val
+                        test.set param
                         true_request,true_response = doRequest(test, :default => true)
                         text_true, hash_true = Watobo::Utils.smartHash(chat.request, true_request, true_response)
                         
-                        test = chat.copyRequest
-                        val = test.get_parm_value(parm)
-                       # val << "AB" if val.empty?
+                        val = "#{orig_value}"
+                        val = (1..8).inject(""){|x,v| x << rand(16).to_s(16) } if val.empty?
                         val.reverse!
                         val += check_t
+                        
+                        param.value = val
                        
-                        test.replace_get_parm(parm, val)
+                        test.set param
                         random_request,random_response = doRequest(test, :default => true)
                         text_random, hash_random = Watobo::Utils.smartHash(chat.request, random_request, random_response)
                         
-                        test = chat.copyRequest
-                        val = test.get_parm_value(parm)
-                        #val << "AB" if val.empty?
+                        val = "#{orig_value}"
                         val += check_f
+                        param.value = val
                        
-                        test.replace_get_parm(parm, val)
+                        test.set param
                         false_request,false_response = doRequest(test, :default => true)
                         text_false, hash_false = Watobo::Utils.smartHash(chat.request, false_request, false_response)
                          
                         unless (hash_true == hash_false) and (hash_true == hash_random) then
-                          test = chat.copyRequest
-                          val = test.get_parm_value(parm)
-                          #val << "AB" if val.empty?
+                          val = "#{orig_value}"
                           val += check_t
-                          test.replace_get_parm(parm, val)
+                          param.value = val
+                          test.set param
                           test_request,test_response = doRequest(test, :default => true)
                           text_true, hash_true = Watobo::Utils.smartHash(chat.request, test_request, test_response)
                         
@@ -174,10 +172,10 @@ EOF
                            # test_chat = Chat.new(test,test_response,chat.id)
                          #  puts "MATCH !!! #{self.to_s.gsub(/.*::/,'')}"
                             addFinding(test_request,test_response,
-                            :test_item => parm,
-                                       :check_pattern => "#{parm}",
+                            :test_item => param.name,
+                                       :check_pattern => "#{param.name}",
                             :chat => chat,
-                            :title => "[#{parm}] - #{path}",
+                            :title => "[#{param.name}] - #{path}",
                             :debug => true
                             )                            
                           end                          
@@ -206,114 +204,7 @@ EOF
                 
               end
               
-              postParmNames(chat).each do |post_parm|
-                checks = []
-                @prefs.each do |p|
-                @fins.each do |f|
-                  @boolean_checks.each do  |c| 
-                    checks << [ p + c[0] + f, p + c[1] +f ]
-                  end
-                end
-                end
-                checks.each do |check_true, check_false|
-                  
-                  checker = proc {
-                    begin
-                     # puts "TRUE ==> #{check_true}"
-                     # puts "FALSE ==> #{check_false}"
-                      parm = post_parm.dup
-                      check_t = CGI::escape(check_true)
-                      check_f = CGI::escape(check_false)
-                      test_request = nil
-                      test_response = nil
-                      
-                      # first do request double time to check if hashes are the same
-                      test = chat.copyRequest
-                      test_request,test_response = doRequest(test, :default => true)
-                      text_1, hash_1 = Watobo::Utils.smartHash(chat.request, test_request, test_response)
-                     # puts test_response
-                      test = chat.copyRequest
-                      test_request,test_response = doRequest(test, :default => true)
-                     # puts test_response
-                      text_2, hash_2 = Watobo::Utils.smartHash(chat.request, test_request, test_response)
-                      #puts "=== SQL BOOLEAN (#{parm}) ===="
-                      #puts "=TEXT_1 (#{parm})\r\n#{text_1}\r\n=HASH_1\r\n#{hash_1}" if parm =~ /button/
-                      #puts "=TEXT_2 (#{parm})\r\n#{text_2}\r\n=HASH_2\r\n#{hash_2}" if parm =~ /button/
-                     
-                      if hash_1 == hash_2 then
-                        test = chat.copyRequest
-                        val = test.post_parm_value(parm)
-                       # val << "AB" if val.empty?
-                        val << check_t
-                       
-                        test.replace_post_parm(parm, val)
-                        true_request,true_response = doRequest(test, :default => true)
-                        text_true, hash_true = Watobo::Utils.smartHash(chat.request, true_request, true_response)
-                        
-                        test = chat.copyRequest
-                        val = test.post_parm_value(parm)
-                       # val << "AB" if val.empty?
-                        val.reverse!
-                        val += check_t
-                       
-                        test.replace_post_parm(parm, val)
-                        random_request,random_response = doRequest(test, :default => true)
-                        text_random, hash_random = Watobo::Utils.smartHash(chat.request, random_request, random_response)
-                        
-                        test = chat.copyRequest
-                        val = test.post_parm_value(parm)
-                        #val << "AB" if val.empty?
-                        val += check_f
-                       
-                        test.replace_post_parm(parm, val)
-                        false_request,false_response = doRequest(test, :default => true)
-                        text_false, hash_false = Watobo::Utils.smartHash(chat.request, false_request, false_response)
-                         
-                        unless (hash_true == hash_false) and (hash_true == hash_random) then
-                          test = chat.copyRequest
-                          val = test.post_parm_value(parm)
-                          #val << "AB" if val.empty?
-                          val += check_t
-                          test.replace_post_parm(parm, val)
-                          test_request,test_response = doRequest(test, :default => true)
-                          text_true, hash_true = Watobo::Utils.smartHash(chat.request, test_request, test_response)
-                        
-                          if hash_true == hash_1 or hash_false == hash_1 or hash_true == hash_random or hash_false == hash_random then
-                        
-                            path = "/" + test_request.path
-                           # test_chat = Chat.new(test,test_response,chat.id)
-                          # puts "MATCH !!! #{self.to_s.gsub(/.*::/,'')}"
-                            addFinding(test_request,test_response,
-                            :test_item => parm,
-                                       :check_pattern => "#{parm}",
-                            :chat => chat,
-                            :title => "[#{parm}] - #{path}",
-                            :debug => true
-                            )                            
-                          end                          
-                        else
-                          #puts "\n! Boolean check not possible on chat #{chat.id}. URL parmeter #{parm} is imune :("
-                          #puts "--- Hashes are equal!"
-                          #puts text_true
-                          #puts "---"
-                          #puts text_false
-                          #puts "---"
-                          #puts text_random
-                          #puts "==="
-                        end
-                      else
-                         puts "\n! Boolean check not possible on chat #{chat.id}. Response differs too much :(" if $DEBUG
-                      end
-                    rescue => bang
-                      puts bang
-                      raise
-                    end
-                    [ test_request, test_response ]
-                  }
-                  yield checker
-                  
-                end                
-              end
+              
             rescue => bang
               puts bang
             end

data/modules/active/sqlinjection/sqli_error.rb

@@ -33,7 +33,7 @@ module Watobo#:nodoc: all
             :check_group => AC_GROUP_SQL,
             :description => "Check every parameter for SQL-Injection flaws. The detection is based on error messages of the database.",   # description of checkfunction
             :author => "Andreas Schmidt", # author of check
-            :version => "0.9"   # check version
+            :version => "1.0"   # check version
             )
             
             threat =<<'EOF'
@@ -89,14 +89,14 @@ EOF
           def generateChecks(chat)
             
             begin
-              urlParmNames(chat).each do |parm|
+              chat.request.parameters( :url, :wwwform ) do |parm|
                 # puts "#{Module.nesting[0].name}: run check on chat-id (#{chat.id}) with parm (#{parm})"
                 #@sql_checks.each do |check, pattern|
                 test_values = []
                 @sql_checks.each do |check|
                   test_values << check
-                  test_values << "#{chat.request.get_parm_value(parm)}#{check}"
-                  test_values << "#{check}#{chat.request.get_parm_value(parm)}"
+                  test_values << "#{parm.value}#{check}"
+                  test_values << "#{check}#{parm.value}"
                 end
                 test_values.each do |check|
                   checker = proc {
@@ -105,10 +105,11 @@ EOF
                     test_response = nil
                     # IMPORTANT!!!
                     # use prepareRequest(chat) for cloning the original request 
-                    test = chat.copyRequest
-                    test_parm = "#{parm.clone}"
-                    # modify the test request
-                    test.replace_get_parm(test_parm, check)
+                    test = chat.request.copy
+                    parm.value = check
+                    test.set parm
+                    
+                    puts test
                     # fire it up!
                     #puts req_copy
                     test_request,test_response = doRequest(test)
@@ -122,11 +123,11 @@ EOF
                        # test_chat = Chat.new(test,test_response,chat.id)
                       #  path = "/" + test_request.path_ext
                         addFinding(test_request,test_response,
-                            :test_item => parm,
-                                   :check_pattern => "#{check}", 
+                            :test_item => parm.name,
+                                   :check_pattern => "#{parm.name}.*#{check}", 
                         :proof_pattern => "#{match}",
                         :chat => chat,
-                        :title => "[#{test_parm}] - #{test_request.path}"
+                        :title => "[#{parm.name}] - #{test_request.path}"
                         )
                       end
                       
@@ -137,62 +138,7 @@ EOF
                   yield checker
                 end            
               end
-              
-              
-              #
-              #  Check POST-Parameters
-              #           
-              
-              postParmNames(chat).each do |parm|
-                #puts "#{chat.id}: run check on post parm #{parm}"
-                test_values = []
-                @sql_checks.each do |check|
-                  test_values << check
-                  test_values << "#{chat.request.post_parm_value(parm)}#{check}"
-                  test_values << "#{check}#{chat.request.post_parm_value(parm)}"
-                end
-                test_values.each do |check|
-                  checker = proc {
-                    test_request = nil
-                    test_response = nil
-                    # IMPORTANT!!!
-                    # use prepareRequest(chat) for cloning the original request 
-                    test = chat.copyRequest
-                    test_parm = "#{parm.clone}"
-                    
-                    
-                    # modify the test request
-                    test.replace_post_parm(test_parm,check)
-                    # puts test.last
-                    # fire it up!
-                    #puts req_copy
-                    test_request,test_response = doRequest(test)
-                    
-                    # puts test_response
-                    # verify response
-                    match = nil
-                    @sql_patterns.each do |pattern|
-                      if test_response.join =~ /(#{pattern})/i
-                        match = $1
-                        # puts "found xss (post)"
-                       # test_chat = Chat.new(test,test_response,chat.id)
-                        #resource = "/" + test_request.resource
-                        addFinding(test_request,test_response,
-                            :test_item => parm,
-                                   :check_pattern => "#{check}", 
-                        :proof_pattern => "#{match}",
-                        :chat => chat,
-                        :title => "[#{test_parm}] - #{test_request.path}"
-                        )
-                      end
-                      
-                    end
-                    [ test_request, test_response ]
-                  }
-                  yield checker
-                  
-                end
-              end            
+                        
             rescue => bang
               puts bang
               puts "ERROR!! #{Module.nesting[0].name}"