watobo 0.9.19 → 0.9.20

data/modules/passive/detect_fileupload.rb

@@ -1,24 +1,12 @@
-# .
+#.
 # detect_fileupload.rb
-# 
-# Copyright 2013 by siberas, http://www.siberas.de
-# 
-# This file is part of WATOBO (Web Application Tool Box)
-#        http://watobo.sourceforge.com
-# 
-# WATOBO is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation version 2 of the License.
-# 
-# WATOBO is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-# 
-# You should have received a copy of the GNU General Public License
-# along with WATOBO; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-# .
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
 # @private 
 module Watobo#:nodoc: all
   module Modules
@@ -42,7 +30,7 @@ module Watobo#:nodoc: all
           )
 
           @pattern_list = []
-          @pattern_list << Regexp.new("<input [^>]*type=.file.")
+          @pattern_list << '<input [^>]*type=.file.'
 
         end
 
@@ -53,7 +41,8 @@ module Watobo#:nodoc: all
                           
               @pattern_list.each do |pat|
               #puts "+check pattern #{pat}"
-                if pat.match(chat.response.body) # =~ /(#{pat})/i then
+               # if pat.match(chat.response.body) # =~ /(#{pat})/i then
+                if chat.response.body_encoded =~ /(#{pat})/i then
                 #   puts "!!! MATCH (FILE UPLOAD)!!!"
                 match = $1
                 #   puts match

data/modules/passive/detect_infrastructure.rb

@@ -1,24 +1,12 @@
-# .
+#.
 # detect_infrastructure.rb
-# 
-# Copyright 2013 by siberas, http://www.siberas.de
-# 
-# This file is part of WATOBO (Web Application Tool Box)
-#        http://watobo.sourceforge.com
-# 
-# WATOBO is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation version 2 of the License.
-# 
-# WATOBO is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-# 
-# You should have received a copy of the GNU General Public License
-# along with WATOBO; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-# .
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
 # @private 
 module Watobo#:nodoc: all
   module Modules
@@ -42,23 +30,23 @@ module Watobo#:nodoc: all
           )
 
           @pattern_list = []
-          @pattern_list << [ 'Server', Regexp.new('<address>(.*)Server at') ]
-          @pattern_list << [ 'eZPublish CMS', Regexp.new('title="(eZ Publish)')]
-          @pattern_list << [ 'Imperia CMS', Regexp.new('content=[^>]*(IMPERIA [\d\.]*)')]
-          @pattern_list << [ 'Typo3 CMS', Regexp.new('content=[^>]*(TYPO3 [\d\.]* CMS)')]
-          @pattern_list << [ 'Open Text CMS', Regexp.new('published by[^>]*(Open Text Web Solutions[\-\s\d\.]*)')]
+          @pattern_list << [ 'Server', '<address>([^<]+)</addr' ]
+          @pattern_list << [ 'eZPublish CMS', 'title="(eZ Publish)']
+          @pattern_list << [ 'Imperia CMS', 'content=[^>]*(IMPERIA [\d\.]*)']
+          @pattern_list << [ 'Typo3 CMS', 'content=[^>]*(TYPO3 [\d\.]* CMS)']
+          @pattern_list << [ 'Open Text CMS', 'published by[^>]*(Open Text Web Solutions[\-\s\d\.]*)']
           #<meta name="generator" content="Sefrengo / www.sefrengo.org" >
           #<meta name="author" content="CMS Sefrengo">
-          @pattern_list << [ 'Sefrengo CMS', Regexp.new('content=[^>]*(Sefrengo[\s\d\.]*)')]
-          @pattern_list << [ 'Tomcat', Regexp.new('(Apache Tomcat\/\d{1,4}\.\d{1,4}\.\d{1,4})') ]
-          @pattern_list << [ 'Microsoft-IIS', Regexp.new('<img src="welcome.png" alt="(IIS7)"')]
+          @pattern_list << [ 'Sefrengo CMS', 'content=[^>]*(Sefrengo[\s\d\.]*)']
+          @pattern_list << [ 'Tomcat', '(Apache Tomcat\/\d{1,4}\.\d{1,4}\.\d{1,4})' ]
+          @pattern_list << [ 'Microsoft-IIS', '<img src="welcome.png" alt="(IIS7)"']
 #          When it’s a SharePoint 2010 site, you will get the result is like this: MicrosoftSharePointTeamServices: 14.0.0.6106
-@pattern_list << [ 'SharePoint 2010', Regexp.new('MicrosoftSharePointTeamServices.*14.0.0.6106')]
+@pattern_list << [ 'SharePoint 2010', 'MicrosoftSharePointTeamServices.*14.0.0.6106']
 # And in SharePoint 2007 site, the result is like this: MicrosoftSharePointTeamServices:12.0.0.4518
-@pattern_list << [ 'SharePoint 2007', Regexp.new('MicrosoftSharePointTeamServices.*12.0.0.4518')]
+@pattern_list << [ 'SharePoint 2007', 'MicrosoftSharePointTeamServices.*12.0.0.4518']
           # "vaadinVersion":"7.0.4"
-          @pattern_list << [ 'VAADIN }>', Regexp.new('vaadinVersion":"(\d+\.\d+\.\d+)')]
-          @pattern_list << [ 'JBoss'    ,Regexp.new('JBoss Web.(\d+\.\d+\.\d+)')]
+          @pattern_list << [ 'VAADIN }>', 'vaadinVersion":"(\d+\.\d+\.\d+)']
+          @pattern_list << [ 'JBoss'    , 'JBoss Web.(\d+\.\d+\.\d+)']
 
           #@pattern_list << 'sample code'
 
@@ -70,15 +58,15 @@ module Watobo#:nodoc: all
             #   puts "body" + chat.response.body.join
             return if chat.response.nil? or chat.response.body.nil?
             if chat.response.content_type =~ /text/ then
-                body = chat.response.body.unpack("C*").pack("C*")
+                body = chat.response.body_encoded
                 @pattern_list.each do |pat|
-                  if body =~ /(#{pat[1]})/i then
+                  if body =~ /#{pat[1]}/i then
                     #   puts "!!! MATCH !!!"
                     match = $1
                     addFinding(
                     :proof_pattern => "#{match}",
                     :chat => chat,
-                    :title => "[#{pat[0]}] - #{match.slice(0..21)}"
+                    :title => "[#{match}] - #{match.slice(0..21)}"
                     )
                     break
                   end

data/modules/passive/detect_one_time_tokens.rb

@@ -1,24 +1,12 @@
-# .
+#.
 # detect_one_time_tokens.rb
-# 
-# Copyright 2013 by siberas, http://www.siberas.de
-# 
-# This file is part of WATOBO (Web Application Tool Box)
-#        http://watobo.sourceforge.com
-# 
-# WATOBO is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation version 2 of the License.
-# 
-# WATOBO is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-# 
-# You should have received a copy of the GNU General Public License
-# along with WATOBO; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-# .
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
 # @private 
 module Watobo#:nodoc: all
   module Modules

data/modules/passive/dirindexing.rb

@@ -1,24 +1,12 @@
-# .
+#.
 # dirindexing.rb
-# 
-# Copyright 2013 by siberas, http://www.siberas.de
-# 
-# This file is part of WATOBO (Web Application Tool Box)
-#        http://watobo.sourceforge.com
-# 
-# WATOBO is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation version 2 of the License.
-# 
-# WATOBO is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-# 
-# You should have received a copy of the GNU General Public License
-# along with WATOBO; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-# .
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
 
 # @private 
 module Watobo#:nodoc: all
@@ -62,7 +50,7 @@ module Watobo#:nodoc: all
           begin
             @pattern_list.each do |pat|
               next unless chat.response.has_body?
-               body = chat.response.body.unpack("C*").pack("C*")
+               body = chat.response.body_encoded
                if body =~ /(#{pat})/i then
                  match = $1
                  addFinding(  

data/modules/passive/disclosure_domino.rb

@@ -1,83 +1,70 @@
-# .
+#.
 # disclosure_domino.rb
-# 
-# Copyright 2013 by siberas, http://www.siberas.de
-# 
-# This file is part of WATOBO (Web Application Tool Box)
-#        http://watobo.sourceforge.com
-# 
-# WATOBO is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation version 2 of the License.
-# 
-# WATOBO is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-# 
-# You should have received a copy of the GNU General Public License
-# along with WATOBO; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-# .
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
 # @private 
-module Watobo#:nodoc: all
-  module Modules
-    module Passive
-      
-      
-      class Disclosure_domino < Watobo::PassiveCheck
-        
-        def initialize(project)
-           @project = project
-          super(project)
-          
-          @info.update(
-            :check_name => 'Domino DB name disclosure.',    # name of check which briefly describes functionality, will be used for tree and progress views
-            :description => "Identifies Domino DB names.",   # description of checkfunction
-            :author => "Andreas Schmidt", # author of check
-            :version => "1.0"   # check version
-            )
-            
-          @finding.update(
-            :threat => 'Unintended disclosure of Domino DB name can lead to data breach.',        # thread of vulnerability, e.g. loss of information
-            :class => "Domino DB Names",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
-            :type => FINDING_TYPE_INFO         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN 
-          )
-          
-        
-          @pattern = '([\w\/\-0-9\.:]+\.nsf)'
-          @dbs = []
-        end
-        
-        def do_test(chat)
-          begin
+module Watobo#:nodoc: all
+  module Modules
+    module Passive
+      
+      
+      class Disclosure_domino < Watobo::PassiveCheck
+        
+        def initialize(project)
+           @project = project
+          super(project)
+          
+          @info.update(
+            :check_name => 'Domino DB name disclosure.',    # name of check which briefly describes functionality, will be used for tree and progress views
+            :description => "Identifies Domino DB names.",   # description of checkfunction
+            :author => "Andreas Schmidt", # author of check
+            :version => "1.0"   # check version
+            )
+            
+          @finding.update(
+            :threat => 'Unintended disclosure of Domino DB name can lead to data breach.',        # thread of vulnerability, e.g. loss of information
+            :class => "Domino DB Names",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+            :type => FINDING_TYPE_INFO         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN 
+          )
+          
+        
+          @pattern = '([\w\/\-0-9\.:]+\.nsf)'
+          @dbs = []
+        end
+        
+        def do_test(chat)
+          begin
             #  puts "running module: #{Module.nesting[0].name}"
-            if chat.response.content_type =~ /text/ and not chat.response.content_type =~ /text.csv/ then
-            if chat.response.each do |line|
-                if line =~ /#{@pattern}/ then
-                  match = $1
-                  if not @dbs.include?(match) then
-                    @dbs.push match
+            return if chat.response.nil? or chat.response.body.nil?
+            if chat.response.content_type =~ /text/ then
+              chat.response.body_encoded.split("\n").each do |line|
+                if line =~ /#{@pattern}/ then
+                  match = $1
+                  if not @dbs.include?(match) then
+                    @dbs.push match
                     addFinding( 
-                                         :proof_pattern => "#{match}", 
-                                         :chat => chat,
-                                         :title => match
-                                         )
-                                         end
-                end
-                
-              end
-            end
-            end
-          rescue => bang
-          #  raise
-            puts "ERROR!! #{self.class}"
-            puts bang
-            puts bang.backtrace if $DEBUG
-          end
-        end
-      end
-      
-    end
-  end
-end
+                                :proof_pattern => "#{match}",
+                                :chat => chat,
+                                :title => match
+                                )
+                  end
+                end                
+              end
+            end
+          rescue => bang
+          #  raise
+            puts "ERROR!! #{self.class}"
+            puts bang
+            puts bang.backtrace if $DEBUG
+          end
+        end
+      end
+      
+    end
+  end
+end

data/modules/passive/disclosure_emails.rb

@@ -1,24 +1,12 @@
-# .
+#.
 # disclosure_emails.rb
-# 
-# Copyright 2013 by siberas, http://www.siberas.de
-# 
-# This file is part of WATOBO (Web Application Tool Box)
-#        http://watobo.sourceforge.com
-# 
-# WATOBO is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation version 2 of the License.
-# 
-# WATOBO is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-# 
-# You should have received a copy of the GNU General Public License
-# along with WATOBO; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-# .
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
 # @private 
 module Watobo#:nodoc: all
   module Modules
@@ -55,7 +43,7 @@ module Watobo#:nodoc: all
             return false if chat.response.nil?
             return false unless chat.response.has_body?
             if chat.response.content_type =~ /text/ and not chat.response.content_type =~ /text.csv/ then
-              body = chat.response.body.unpack("C*").pack("C*")
+              body = chat.response.body_encoded
               body.scan(/#{@pattern}/) { |m|
                   match = m.first
                   unless @mail_list.include?(match) then

data/modules/passive/disclosure_ipaddr.rb

@@ -1,24 +1,12 @@
-# .
+#.
 # disclosure_ipaddr.rb
-# 
-# Copyright 2013 by siberas, http://www.siberas.de
-# 
-# This file is part of WATOBO (Web Application Tool Box)
-#        http://watobo.sourceforge.com
-# 
-# WATOBO is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation version 2 of the License.
-# 
-# WATOBO is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-# 
-# You should have received a copy of the GNU General Public License
-# along with WATOBO; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-# .
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
 
 # @private 
 module Watobo#:nodoc: all
@@ -54,8 +42,8 @@ module Watobo#:nodoc: all
             #  puts "running module: #{Module.nesting[0].name}"
             return false if chat.response.nil?
             return false unless chat.response.has_body?
-            if chat.response.content_type =~ /text/ then
-               body = chat.response.body.unpack("C*").pack("C*")
+            if chat.response.content_type =~ /(text|script)/ then
+               body = chat.response.body_encoded
                body.scan(/#{@pattern}/) { |match|
                   ip_addr = match.first
                   octets = ip_addr.split('.')
@@ -64,7 +52,11 @@ module Watobo#:nodoc: all
                       isIP = false if o.to_i > 255 
                   end
                   if isIP then
-                    title = "IP: #{ip_addr}"
+                    if ip_addr =~ /^10\./ or (ip_addr =~ /^192.168/) or ( octets[0] == "172" && (16..32).include?(octects[1].to_i) )
+                      title = "Private IP: #{ip_addr}"
+                    else
+                      title = "Public IP: #{ip_addr}"
+                    end
                     dummy = chat.request.site + ":" + ip_addr
                     if not @known_ips.include?(dummy)
                       addFinding( :proof_pattern => ip_addr,