watobo 0.9.19 → 0.9.20

data/modules/passive/filename_as_parameter.rb

@@ -1,24 +1,12 @@
-# .
+#.
 # filename_as_parameter.rb
-# 
-# Copyright 2013 by siberas, http://www.siberas.de
-# 
-# This file is part of WATOBO (Web Application Tool Box)
-#        http://watobo.sourceforge.com
-# 
-# WATOBO is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation version 2 of the License.
-# 
-# WATOBO is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-# 
-# You should have received a copy of the GNU General Public License
-# along with WATOBO; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-# .
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
 # @private 
 module Watobo#:nodoc: all
   module Modules

data/modules/passive/form_spotter.rb

@@ -1,24 +1,12 @@
-# .
+#.
 # form_spotter.rb
-# 
-# Copyright 2013 by siberas, http://www.siberas.de
-# 
-# This file is part of WATOBO (Web Application Tool Box)
-#        http://watobo.sourceforge.com
-# 
-# WATOBO is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation version 2 of the License.
-# 
-# WATOBO is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-# 
-# You should have received a copy of the GNU General Public License
-# along with WATOBO; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-# .
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
 # @private 
 module Watobo#:nodoc: all
   module Modules
@@ -57,10 +45,16 @@ module Watobo#:nodoc: all
               next if action.nil?
               title = action.strip.empty? ? "[none]" : "#{action}"
             #  puts "!FOUND FORM #{action}"
+            
+              # create fingerprint to reduce double entries
+              fp = title
+              fp << chat.request.site
+              
               addFinding(  
                          :proof_pattern => "<form[^>]*#{Regexp.quote(action)}[^>]*>", 
               :title => title,
-              :chat => chat
+              :chat => chat,
+              :fid => Digest::MD5.hexdigest(fp) 
               )  
 
             end

data/modules/passive/hidden_fields.rb

@@ -1,73 +1,67 @@
-# .
+#.
 # hidden_fields.rb
-# 
-# Copyright 2013 by siberas, http://www.siberas.de
-# 
-# This file is part of WATOBO (Web Application Tool Box)
-#        http://watobo.sourceforge.com
-# 
-# WATOBO is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation version 2 of the License.
-# 
-# WATOBO is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-# 
-# You should have received a copy of the GNU General Public License
-# along with WATOBO; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-# .
-# @private 
-module Watobo#:nodoc: all
-  module Modules
-    module Passive
-      
-      
-      class Hidden_fields < Watobo::PassiveCheck
-        def initialize(project)
-         @project = project
-          super(project)
-          
-          @info.update(
-                        :check_name => 'Hidden Fields',    # name of check which briefly describes functionality, will be used for tree and progress views
-          :description => "Detects all hidden fields",   # description of checkfunction
-          :author => "Andreas Schmidt", # author of check
-          :version => "1.0"   # check version
-          )
-          
-          @finding.update(
-                          :threat => 'Hidden field parameters sometimes are accepted as input variables.',        # thread of vulnerability, e.g. loss of information
-          :class => "Hidden Fields",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
-          :type => FINDING_TYPE_INFO,         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN
-          :measure => "N/A" 
-          )
-         
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 
-        end
-        
-        def do_test(chat)
-          begin
-            
-            if chat.response.content_type =~ /(text|script)/ and chat.response.status !~ /404/ and chat.response.has_body? then
-              doc = Nokogiri::HTML(chat.response.body)
+# @private 
+module Watobo#:nodoc: all
+  module Modules
+    module Passive
+      
+      
+      class Hidden_fields < Watobo::PassiveCheck
+        def initialize(project)
+         @project = project
+          super(project)
+          
+          @info.update(
+                        :check_name => 'Hidden Fields',    # name of check which briefly describes functionality, will be used for tree and progress views
+          :description => "Detects all hidden fields",   # description of checkfunction
+          :author => "Andreas Schmidt", # author of check
+          :version => "1.0"   # check version
+          )
+          
+          @finding.update(
+                          :threat => 'Hidden field parameters sometimes are accepted as input variables.',        # thread of vulnerability, e.g. loss of information
+          :class => "Hidden Fields",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+          :type => FINDING_TYPE_INFO,         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN
+          :measure => "N/A" 
+          )
+         
+
+        end
+        
+        def do_test(chat)
+          begin
+            
+            if chat.response.content_type =~ /(text|script)/ and chat.response.status !~ /404/ and chat.response.has_body? then
+              doc = Nokogiri::HTML(chat.response.body)
               doc.xpath('//input[@type="hidden"]').each do |i|
-                          addFinding(  
-                                       :proof_pattern => 'input.*=.{1,3}hidden', 
-                                       :title => "#{i[:name]}",
-                                       :chat => chat
-                          )  
-              end
-            end
-          rescue => bang
-            #  raise
-            puts "ERROR!! #{Module.nesting[0].name}"
-            puts bang
-            puts bang.backtrace if $DEBUG
-          end
-        end
-      end
-    end
-  end
-end
+                pp = "<input[^<]+name=.#{i[:name]}[^<]+/?>"
+                #pp = Regexp.quote(tag)
+                # nokogiri only uses double quotes
+                #pp.gsub!(/['"]/,".")
+                # also nokogiro removes trailing /
+                #pp.gsub!(/>$/, "/?>")
+                addFinding(  
+                           :proof_pattern => pp, 
+                           :title => "#{i[:name]}",
+                           :chat => chat
+                          )  
+              end
+            end
+          rescue => bang
+            #  raise
+            puts "ERROR!! #{Module.nesting[0].name}"
+            puts bang
+            puts bang.backtrace if $DEBUG
+          end
+        end
+      end
+    end
+  end
+end

data/modules/passive/hotspots.rb

@@ -1,24 +1,12 @@
-# .
+#.
 # hotspots.rb
-# 
-# Copyright 2013 by siberas, http://www.siberas.de
-# 
-# This file is part of WATOBO (Web Application Tool Box)
-#        http://watobo.sourceforge.com
-# 
-# WATOBO is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation version 2 of the License.
-# 
-# WATOBO is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-# 
-# You should have received a copy of the GNU General Public License
-# along with WATOBO; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-# .
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
 # @private 
 module Watobo#:nodoc: all
   module Modules
@@ -58,8 +46,11 @@ module Watobo#:nodoc: all
             return false unless chat.response.has_body?
             if chat.response.content_type =~ /(text|script)/ and chat.response.status !~ /404/ then
              
-              body = chat.response.body.unpack("C*").pack("C*")
-                body.split(/\n/).each do |line|
+              #body = chat.response.body.unpack("C*").pack("C*")
+              body = chat.response.body_encoded
+              return false if body.nil?
+              
+              body.split(/\n/).each do |line|
                     @pattern_list.each do |ext|
                       if line =~ /([\w%\/\\\.:-]*\.#{ext})[^\w]/ then
                         match = $1

data/modules/passive/in_script_parameter.rb

@@ -1,24 +1,12 @@
-# .
+#.
 # in_script_parameter.rb
-# 
-# Copyright 2013 by siberas, http://www.siberas.de
-# 
-# This file is part of WATOBO (Web Application Tool Box)
-#        http://watobo.sourceforge.com
-# 
-# WATOBO is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation version 2 of the License.
-# 
-# WATOBO is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-# 
-# You should have received a copy of the GNU General Public License
-# along with WATOBO; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-# .
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
 require 'cgi'
 # @private 
 module Watobo#:nodoc: all
@@ -61,7 +49,8 @@ module Watobo#:nodoc: all
             
             parm_list = chat.request.parameters(:data, :url)
             return true if parm_list.empty?
-            body = chat.response.body.unpack("C*").pack("C*")
+            #body = chat.response.body.unpack("C*").pack("C*")
+            body = chat.response.body_encoded
             
             doc = Nokogiri::HTML(body)
             scripts = doc.css('script')
@@ -70,10 +59,12 @@ module Watobo#:nodoc: all
               next if parm.value.nil?
               next if parm.value.empty?
               next if parm.value.length <= minlen
+              pv = parm.value
+              s = chat.request.content_type =~ /(json|xml)/ ? pv : CGI.unescape(pv).unpack("C*").pack("C*")
                             
-              pattern = Regexp.quote(CGI.unescape(parm.value))
+              pattern = Regexp.quote( s )
               scripts.each do |script|
-              if script.text =~ /#{pattern}/i then
+              if script.text.unpack("C*").pack("C*") =~ /#{pattern}/i then
                # puts "* Found: Parameter within script"
                 addFinding(
                            :check_pattern => "#{parm.value}", 
@@ -88,7 +79,7 @@ module Watobo#:nodoc: all
           rescue => bang
             # raise
             showError(chat.id, bang)
-            #puts bang.backtrace
+            puts bang.backtrace
             
           end
         end

data/modules/passive/multiple_server_headers.rb

@@ -1,24 +1,12 @@
-# .
+#.
 # multiple_server_headers.rb
-# 
-# Copyright 2013 by siberas, http://www.siberas.de
-# 
-# This file is part of WATOBO (Web Application Tool Box)
-#        http://watobo.sourceforge.com
-# 
-# WATOBO is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation version 2 of the License.
-# 
-# WATOBO is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-# 
-# You should have received a copy of the GNU General Public License
-# along with WATOBO; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-# .
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
 # @private 
 module Watobo#:nodoc: all
   module Modules

data/modules/passive/possible_login.rb

@@ -1,24 +1,12 @@
-# .
+#.
 # possible_login.rb
-# 
-# Copyright 2013 by siberas, http://www.siberas.de
-# 
-# This file is part of WATOBO (Web Application Tool Box)
-#        http://watobo.sourceforge.com
-# 
-# WATOBO is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation version 2 of the License.
-# 
-# WATOBO is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-# 
-# You should have received a copy of the GNU General Public License
-# along with WATOBO; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-# .
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
 # @private 
 module Watobo#:nodoc: all
   module Modules
@@ -57,6 +45,7 @@ module Watobo#:nodoc: all
             # all_parms = chat.request.post_parms
             all_parms = chat.request.parameters(:data, :url)
             return true if all_parms.empty?
+            return false if chat.response.empty?
               # puts all_parms
             #  resource = "/" + chat.request.resource
               all_parms.each do |parm|
@@ -89,16 +78,16 @@ module Watobo#:nodoc: all
                     
                     # also check if session id has been redefined
                     puts "* check session managment"
-                    old_cookies = chat.request.cookies.select do |rc|
+                    old_cookies = chat.request.cookies.to_a.select do |rc|
                       cookie_old = true
                       chat.response.new_cookies do |nc|
                          cookie_old = false unless rc.value == nc.value
                          #puts ":#{rc} - #{nc.name} - #{cookie_old}"                        
                       end
-                      puts ":#{rc} >> #{cookie_old}"     
+                      #puts ":#{rc} >> #{cookie_old}"     
                       cookie_old
                     end
-                    puts "old cookies (#{old_cookies.length})"
+                    #puts "old cookies (#{old_cookies.length})"
                     old_cookies.map do |c|
                       addFinding(
                                  :class => "Session Managment",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...

data/modules/passive/redirect_url.rb

@@ -1,24 +1,12 @@
-# .
+#.
 # redirect_url.rb
-# 
-# Copyright 2013 by siberas, http://www.siberas.de
-# 
-# This file is part of WATOBO (Web Application Tool Box)
-#        http://watobo.sourceforge.com
-# 
-# WATOBO is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation version 2 of the License.
-# 
-# WATOBO is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-# 
-# You should have received a copy of the GNU General Public License
-# along with WATOBO; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-# .
+#.
+# Copyright 2014 by siberas, http://www.siberas.de
+# This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
+# WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
+# WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
 # @private 
 module Watobo#:nodoc: all
   module Modules
@@ -35,7 +23,7 @@ module Watobo#:nodoc: all
                         :check_name => 'Detect Redirect Parameters',    # name of check which briefly describes functionality, will be used for tree and progress views
           :description => "Checks parameters for suspicious names like 'url' or 'goto'.",   # description of checkfunction
           :author => "Andreas Schmidt", # author of check
-          :version => "0.9"   # check version
+          :version => "1.0"   # check version
           )
           
           @finding.update(
@@ -44,7 +32,7 @@ module Watobo#:nodoc: all
           :type => FINDING_TYPE_HINT         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN 
           )
           
-          @suspicious_names = ['url', 'extern', 'goto']
+          @suspicious_names = ['url', 'extern', 'goto', 'redirect', 'jump']
         end
         
         def do_test(chat)