watobo 0.9.19 → 0.9.20

data/lib/watobo/utils/url.rb

@@ -1,46 +1,34 @@
-# .
+#.
 # url.rb
-# 
-# Copyright 2013 by siberas, http://www.siberas.de
-# 
-# This file is part of WATOBO (Web Application Tool Box)
-#        http://watobo.sourceforge.com
-# 
-# WATOBO is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation version 2 of the License.
-# 
-# WATOBO is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-# 
-# You should have received a copy of the GNU General Public License
-# along with WATOBO; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-# .
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
 # @private 
-module Watobo#:nodoc: all
-  module Utils
-    module URL
-      def self.create_url(chat, path)
-        url = path
-        # only expand path if not url
-        unless path =~ /^http/
-          # check if path is absolute
-          if path =~ /^\//
-            url = File.join("#{chat.request.proto}://#{chat.request.host}", path)
-          else
-            # it's relative
-            url = File.join(File.dirname(chat.request.url.to_s), path)
-          end
-        end
-        # resolve path traversals
-        while url =~ /(\/[^\.\/]*\/\.\.\/)/
-          url.gsub!( $1,"/")
-        end
-        url
-      end
-    end
-  end
+module Watobo#:nodoc: all
+  module Utils
+    module URL
+      def self.create_url(chat, path)
+        url = path
+        # only expand path if not url
+        unless path =~ /^http/
+          # check if path is absolute
+          if path =~ /^\//
+            url = File.join("#{chat.request.proto}://#{chat.request.host}", path)
+          else
+            # it's relative
+            url = File.join(File.dirname(chat.request.url.to_s), path)
+          end
+        end
+        # resolve path traversals
+        while url =~ /(\/[^\.\/]*\/\.\.\/)/
+          url.gsub!( $1,"/")
+        end
+        url
+      end
+    end
+  end
 end

data/lib/watobo/utils/utf16.rb

@@ -0,0 +1,22 @@
+#.
+# utf16.rb
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
+module Watobo
+  module UTF16
+     def self.decode_utf16le(str)
+        str.force_encoding(Encoding::UTF_16LE)
+        str.encode(Encoding::UTF_8, Encoding::UTF_16LE).force_encoding('UTF-8')
+      end
+
+      def self.encode_utf16le(str)
+        str = str.force_encoding('UTF-8') if [::Encoding::ASCII_8BIT,::Encoding::US_ASCII].include?(str.encoding)
+        str.dup.force_encoding('UTF-8').encode(Encoding::UTF_16LE, Encoding::UTF_8).force_encoding('UTF-8')
+      end
+  end
+end

data/modules/active/Apache/mod_status.rb

@@ -1,3 +1,12 @@
+#.
+# mod_status.rb
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
 # .
 # mod_status.rb
 #

data/modules/active/Apache/multiview.rb

@@ -0,0 +1,161 @@
+#.
+# multiview.rb
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
+=begin
+http://www.wisec.it/sectou.php?id=4698ebdc59d15
+
+$ curl -i -H "Negotiate: watobo" http://192.168.70.134/index
+HTTP/1.1 406 Not Acceptable
+Date: Fri, 24 Jan 2014 08:46:35 GMT
+Server: Apache/2.2.22 (Debian)
+Alternates: {"index.bak" 1 {type application/x-trash} {length 0}}, {"index.html" 1 {type text/html} {length 177}}, {"index.tgz" 1 {type application/x-gzip} {length 0}}
+Vary: negotiate,accept,Accept-Encoding
+TCN: list
+Content-Length: 568
+Content-Type: text/html; charset=iso-8859-1
+
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
+<html><head>
+<title>406 Not Acceptable</title>
+</head><body>
+<h1>Not Acceptable</h1>
+<p>An appropriate representation of the requested resource /index could not be found on this server.</p>
+Available variants:
+<ul>
+<li><a href="index.bak">index.bak</a> , type application/x-trash</li>
+<li><a href="index.html">index.html</a> , type text/html</li>
+<li><a href="index.tgz">index.tgz</a> , type application/x-gzip</li>
+</ul>
+<hr>
+<address>Apache/2.2.22 (Debian) Server at 192.168.70.134 Port 80</address>
+</body></html>
+
+=end
+
+# @private 
+module Watobo#:nodoc: all
+  module Modules
+    module Active
+      module Apache
+        
+        
+        class Multiview < Watobo::ActiveCheck
+          
+          @@tested_paths = []
+          
+          details =<<EOD           
+$ curl -i -H "Negotiate: watobo" http://192.168.70.134/index
+HTTP/1.1 406 Not Acceptable
+Date: Fri, 24 Jan 2014 08:46:35 GMT
+Server: Apache/2.2.22 (Debian)
+Alternates: {"index.bak" 1 {type application/x-trash} {length 0}}, {"index.html" 1 {type text/html} {length 177}}, {"index.tgz" 1 {type application/x-gzip} {length 0}}
+Vary: negotiate,accept,Accept-Encoding
+TCN: list
+Content-Length: 568
+Content-Type: text/html; charset=iso-8859-1
+
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
+<html><head>
+<title>406 Not Acceptable</title>
+</head><body>
+<h1>Not Acceptable</h1>
+<p>An appropriate representation of the requested resource /index could not be found on this server.</p>
+Available variants:
+<ul>
+<li><a href="index.bak">index.bak</a> , type application/x-trash</li>
+<li><a href="index.html">index.html</a> , type text/html</li>
+<li><a href="index.tgz">index.tgz</a> , type application/x-gzip</li>
+</ul>
+<hr>
+<address>Apache/2.2.22 (Debian) Server at 192.168.70.134 Port 80</address>
+</body></html>
+EOD
+          
+           @info.update(
+                         :check_name => 'MultiViews',    # name of check which briefly describes functionality, will be used for tree and progress views
+            :description => "Checks if MultiViews option is present in Apache. See http://www.wisec.it/sectou.php?id=4698ebdc59d15",   # description of checkfunction
+            :author => "Andreas Schmidt", # author of check
+            :check_group => AC_GROUP_APACHE,
+            :version => "1.0"   # check version
+            )
+            
+            @finding.update(
+                            :threat => 'Makes enumeration of backup or renamed files easier. see also http://www.wisec.it/sectou.php?id=4698ebdc59d15',        # thread of vulnerability, e.g. loss of information
+            :class => "MultiViews",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+            :rating => VULN_RATING_INFO,
+            :measure => "Disable MultiViews in your Apache configuration.",
+            :details => details,
+            :type => FINDING_TYPE_VULN         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN 
+            )
+            
+          
+          def initialize(session_name=nil, prefs={})
+          #  @project = project
+            super(session_name, prefs)
+            
+            #  @tested_directories = Hash.new
+            @fext = %w( php asp aspx jsp cfm shtm htm html shml )
+            
+          end
+          
+          def reset()
+            @@tested_paths.clear
+          end
+          
+          
+          def generateChecks(chat)
+            
+            begin
+              file = chat.request.file              
+              return nil if @@tested_paths.include? file
+              @@tested_paths << file
+              
+              if file != "" and file =~ /\.(#{@fext.join("|")})$/ then
+                 checker = proc{
+                      test_request = nil
+                      test_response = nil
+                      new_file = file.gsub(/\.\w{1,4}$/, "")
+                      test_request = chat.copyRequest
+                      #test_request.addHeader("Vary","negotiate,accept")
+                      test_request.set_header("Accept","application/watobo; q=1.0")
+                      
+                      test_request.replaceFileExt(new_file)
+                      result_request, result_response = doRequest(test_request, :default => true)
+                      
+                      tcn_headers = result_response.headers("^TCN")
+                      unless tcn_headers.empty?                     
+                        puts "MULTIVIEW - #{self.class}!!!\n"
+                        #test_chat = Chat.new(test_request, test_response, chat.id)
+                        addFinding( result_request, result_response,
+                                   :check_pattern => "#{new_file}",
+                                   :test_item => file,
+                        :proof_pattern => "#{new_file}",
+                        :chat => chat,
+                        :title => "#{new_file}"
+                        #:debug => true
+                        )                        
+                      end
+                      [ test_request, test_response ] 
+                    }
+                    yield checker
+              end
+            rescue => bang
+              
+              puts "ERROR!! #{Module.nesting[0].name} "
+              puts "chatid: #{chat.id}"
+              puts bang
+              puts 
+              
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/modules/active/Flash/crossdomain.rb

@@ -1,3 +1,12 @@
+#.
+# crossdomain.rb
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
 # .
 # crossdomain.rb
 #   

data/modules/active/directories/dirwalker.rb

@@ -1,24 +1,12 @@
-# .
+#.
 # dirwalker.rb
-# 
-# Copyright 2013 by siberas, http://www.siberas.de
-# 
-# This file is part of WATOBO (Web Application Tool Box)
-#        http://watobo.sourceforge.com
-# 
-# WATOBO is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation version 2 of the License.
-# 
-# WATOBO is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-# 
-# You should have received a copy of the GNU General Public License
-# along with WATOBO; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-# .
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
 # @private 
 module Watobo#:nodoc: all
   module Modules

data/modules/active/discovery/fileextensions.rb

@@ -1,24 +1,12 @@
-# .
+#.
 # fileextensions.rb
-# 
-# Copyright 2013 by siberas, http://www.siberas.de
-# 
-# This file is part of WATOBO (Web Application Tool Box)
-#        http://watobo.sourceforge.com
-# 
-# WATOBO is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation version 2 of the License.
-# 
-# WATOBO is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-# 
-# You should have received a copy of the GNU General Public License
-# along with WATOBO; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-# .
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
 # @private 
 module Watobo#:nodoc: all
   module Modules
@@ -27,7 +15,7 @@ module Watobo#:nodoc: all
         
         
         class Fileextensions < Watobo::ActiveCheck
-          
+           
            @info.update(
                          :check_name => 'FileExtensions',    # name of check which briefly describes functionality, will be used for tree and progress views
             :description => "Checks for temporary- or backup-files",   # description of checkfunction
@@ -57,7 +45,7 @@ module Watobo#:nodoc: all
           end
           
           def reset()
-            
+           
           end
           
           def generateChecks(chat)

data/modules/active/discovery/http_methods.rb

@@ -1,24 +1,12 @@
-# .
+#.
 # http_methods.rb
-# 
-# Copyright 2013 by siberas, http://www.siberas.de
-# 
-# This file is part of WATOBO (Web Application Tool Box)
-#        http://watobo.sourceforge.com
-# 
-# WATOBO is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation version 2 of the License.
-# 
-# WATOBO is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-# 
-# You should have received a copy of the GNU General Public License
-# along with WATOBO; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-# .
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
 # @private 
 module Watobo#:nodoc: all
   module Modules

data/modules/active/domino/domino_db.rb

@@ -1,24 +1,12 @@
-# .
+#.
 # domino_db.rb
-# 
-# Copyright 2013 by siberas, http://www.siberas.de
-# 
-# This file is part of WATOBO (Web Application Tool Box)
-#        http://watobo.sourceforge.com
-# 
-# WATOBO is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation version 2 of the License.
-# 
-# WATOBO is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-# 
-# You should have received a copy of the GNU General Public License
-# along with WATOBO; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-# .
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
 require 'digest/md5'
 require 'digest/sha1'
 

data/modules/active/dotNET/custom_errors.rb

@@ -1,124 +1,112 @@
-# .
+#.
 # custom_errors.rb
-# 
-# Copyright 2013 by siberas, http://www.siberas.de
-# 
-# This file is part of WATOBO (Web Application Tool Box)
-#        http://watobo.sourceforge.com
-# 
-# WATOBO is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation version 2 of the License.
-# 
-# WATOBO is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-# 
-# You should have received a copy of the GNU General Public License
-# along with WATOBO; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-# .
-# @private 
-module Watobo#:nodoc: all
-  module Modules
-    module Active
-      module Dotnet
-        #class Dir_indexing < Watobo::Mixin::Session
-        class Custom_errors < Watobo::ActiveCheck
-          @@tested_directories = Hash.new
-          
-           @info.update(
-            :check_name => '.NET Custom Error',    # name of check which briefly describes functionality, will be used for tree and progress views
-            :description => "This module checks if custom errors messages are used and Stack-Tracing is enabled.",   # description of checkfunction
-            :author => "Andreas Schmidt", # author of check
-            :version => "1.0",   # check version
-            :check_group => ".NET"
-            )
-
-            @finding.update(
-            :threat => 'Information Disclosure. Internal error messages are exposed to end users.',        # thread of vulnerability, e.g. loss of information
-            :class => ".NET: Custom Errors",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
-            :type => FINDING_TYPE_VULN,         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN
-            :rating => VULN_RATING_INFO
-            )
-            
-          def initialize(project, prefs={})
-            super(project, prefs)
-
-           
-
-          end
-
-          def generateChecks(chat)
-
-            begin
-
-              if chat.request.url.to_s =~ /\.aspx/ then
-
-                checker = proc {
-                  begin
-                    test_request = nil
-                    test_response = nil
-
-                    test = chat.copyRequest
-                    test.set_method("POST")
-                    
-                    test.set_content_type("application/x-www-form-urlencoded")
-                    test.set_content_length("0")
-                    test.setData "__VIEWSTATE=watobo"
-                    
-                    status, test_request, test_response = fileExists?(test)
-                    
-                    if test_response.has_body? and test_response.body =~ /Server Error in/
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 
-                      puts ".NET Custom Error >> #{test.url.to_s}"
-
-                      addFinding(  test_request, test_response,
-                             :test_item => "__VIEWSTATE",
-                             :proof_pattern => Regexp.quote("Server Error in"),
-                  :check_pattern => Regexp.quote("__VIEWSTATE"),
-                  :chat => chat,
-                  :threat => "Information Disclosure: Error messages may disclose potentially sensitive information about the internal implementation of the website.",
-                  :title => "[Server Error]"
-                  )
-
-                      trace_pattern = "customErrors mode=.*RemoteOnly"
-                      if test_response.body =~ /#{trace_pattern}/i
-                        #puts "STACK-TRACE!!!"
-                        addFinding(  test_request, test_response,
-                             :test_item => "__VIEWSTATE",
-                             :proof_pattern => trace_pattern,
-                  :check_pattern => Regexp.quote("__VIEWSTATE"),
-                  :chat => chat,
-                  :threat => "Information Disclosure: A Stack-Trace may disclose potentially sensitive information about the internal implementation of the website.",
-                  :title => "[Stack-Trace]",
-                  :class => ".NET: Stack-Trace"
-                  )
-
-                      end
-
-                    end
-
-                    [ test_request, test_response ]
-
-                  rescue => bang
-                    puts bang
-                    puts bang.backtrace if $DEBUG
-                  end
-                  [ nil, nil ]
-
-                }
-              yield checker
-              end
-            rescue => bang
-              puts "!error in module #{Module.nesting[0].name}"
-              puts bang
-            end
-          end
-
-        end
-      end
-    end
-  end
-end
+# @private 
+module Watobo#:nodoc: all
+  module Modules
+    module Active
+      module Dotnet
+        #class Dir_indexing < Watobo::Mixin::Session
+        class Custom_errors < Watobo::ActiveCheck
+          @@tested_directories = Hash.new
+          
+           @info.update(
+            :check_name => '.NET Custom Error',    # name of check which briefly describes functionality, will be used for tree and progress views
+            :description => "This module checks if custom errors messages are used and Stack-Tracing is enabled.",   # description of checkfunction
+            :author => "Andreas Schmidt", # author of check
+            :version => "1.0",   # check version
+            :check_group => ".NET"
+            )
+
+            @finding.update(
+            :threat => 'Information Disclosure. Internal error messages are exposed to end users.',        # thread of vulnerability, e.g. loss of information
+            :class => ".NET: Custom Errors",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+            :type => FINDING_TYPE_VULN,         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN
+            :rating => VULN_RATING_INFO
+            )
+            
+          def initialize(project, prefs={})
+            super(project, prefs)
+
+           
+
+          end
+
+          def generateChecks(chat)
+
+            begin
+
+              if chat.request.url.to_s =~ /\.aspx/ then
+
+                checker = proc {
+                  begin
+                    test_request = nil
+                    test_response = nil
+
+                    test = chat.copyRequest
+                    test.set_method("POST")
+                    
+                    test.set_content_type("application/x-www-form-urlencoded")
+                    test.set_content_length("0")
+                    test.setData "__VIEWSTATE=watobo"
+                    
+                    status, test_request, test_response = fileExists?(test)
+                    
+                    if test_response.has_body? and test_response.body =~ /Server Error in/
+
+                      puts ".NET Custom Error >> #{test.url.to_s}"
+
+                      addFinding(  test_request, test_response,
+                             :test_item => "__VIEWSTATE",
+                             :proof_pattern => Regexp.quote("Server Error in"),
+                  :check_pattern => Regexp.quote("__VIEWSTATE"),
+                  :chat => chat,
+                  :threat => "Information Disclosure: Error messages may disclose potentially sensitive information about the internal implementation of the website.",
+                  :title => "[Server Error]"
+                  )
+
+                      trace_pattern = "customErrors mode=.*RemoteOnly"
+                      if test_response.body =~ /#{trace_pattern}/i
+                        #puts "STACK-TRACE!!!"
+                        addFinding(  test_request, test_response,
+                             :test_item => "__VIEWSTATE",
+                             :proof_pattern => trace_pattern,
+                  :check_pattern => Regexp.quote("__VIEWSTATE"),
+                  :chat => chat,
+                  :threat => "Information Disclosure: A Stack-Trace may disclose potentially sensitive information about the internal implementation of the website.",
+                  :title => "[Stack-Trace]",
+                  :class => ".NET: Stack-Trace"
+                  )
+
+                      end
+
+                    end
+
+                    [ test_request, test_response ]
+
+                  rescue => bang
+                    puts bang
+                    puts bang.backtrace if $DEBUG
+                  end
+                  [ nil, nil ]
+
+                }
+              yield checker
+              end
+            rescue => bang
+              puts "!error in module #{Module.nesting[0].name}"
+              puts bang
+            end
+          end
+
+        end
+      end
+    end
+  end
+end