watobo 0.9.20 → 0.9.21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (51) hide show
  1. data/CHANGELOG.md +54 -2
  2. data/README.md +1 -1
  3. data/config/scanner.yml +1 -0
  4. data/custom-views/prettify-json.rb +19 -0
  5. data/lib/watobo/adapters/file/marshal_store.rb +297 -0
  6. data/lib/watobo/adapters.rb +2 -1
  7. data/lib/watobo/core/active_check.rb +4 -0
  8. data/lib/watobo/core/chat.rb +8 -0
  9. data/lib/watobo/core/chats.rb +2 -1
  10. data/lib/watobo/core/cookie.rb +3 -3
  11. data/lib/watobo/core/finding.rb +7 -0
  12. data/lib/watobo/core/request.rb +3 -3
  13. data/lib/watobo/core/session.rb +6 -2
  14. data/lib/watobo/framework/init_modules.rb +18 -16
  15. data/lib/watobo/gui/conversation_table.rb +13 -16
  16. data/lib/watobo/gui/conversation_table_ctrl2.rb +1 -0
  17. data/lib/watobo/gui/custom_viewer.rb +101 -76
  18. data/lib/watobo/gui/define_scope_frame.rb +44 -10
  19. data/lib/watobo/gui/edit_scope_dialog.rb +1 -1
  20. data/lib/watobo/gui/fuzzer_gui.rb +61 -23
  21. data/lib/watobo/gui/main_window.rb +1 -1
  22. data/lib/watobo/gui/scanner_settings_dialog.rb +15 -0
  23. data/lib/watobo/http/data/json.rb +6 -0
  24. data/lib/watobo/interceptor/html/favicon.ico +0 -0
  25. data/lib/watobo/interceptor/html/index.html +13 -0
  26. data/lib/watobo/interceptor/proxy.rb +70 -18
  27. data/lib/watobo/mixins/httpparser.rb +26 -16
  28. data/lib/watobo/mixins/shapers.rb +49 -5
  29. data/lib/watobo/mixins/transcoders.rb +8 -8
  30. data/lib/watobo/sockets/connection.rb +1 -1
  31. data/lib/watobo/utils/load_chat.rb +62 -0
  32. data/lib/watobo/utils/response_hash.rb +3 -3
  33. data/lib/watobo.rb +1 -1
  34. data/modules/active/cq5/cq5_default_selectors.rb +116 -0
  35. data/modules/active/cq5/cqp_user_enumeration.rb +134 -0
  36. data/modules/active/struts2/include_params_ognl.rb +1 -1
  37. data/modules/active/xml/xml_xxe.rb +6 -1
  38. data/modules/passive/disclosure_domino.rb +1 -1
  39. data/modules/passive/in_script_parameter.rb +9 -4
  40. data/plugins/aem/aem.rb +21 -0
  41. data/plugins/aem/gui/main.rb +128 -0
  42. data/plugins/aem/gui/tree_view.rb +180 -0
  43. data/plugins/aem/icons/aem.ico +0 -0
  44. data/plugins/aem/lib/agent.rb +140 -0
  45. data/plugins/aem/lib/dispatcher.rb +53 -0
  46. data/plugins/aem/lib/engine.rb +187 -0
  47. data/plugins/filefinder/dbs/cq5.db +23 -0
  48. data/plugins/filefinder/dbs/subs-big.lst +44 -44
  49. data/plugins/filefinder/filefinder.rb +4 -4
  50. data/plugins/sqlmap/lib/sqlmap_ctrl.rb +11 -10
  51. metadata +16 -2
@@ -0,0 +1,53 @@
1
+ #.
2
+ # dispatcher.rb
3
+ #.
4
+ # Copyright 2014 by siberas, http://www.siberas.de
5
+ # This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
6
+ # WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
7
+ # WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
8
+ # You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
9
+
10
+ # @private
11
+ module Watobo#:nodoc: all
12
+ module Plugin
13
+ class CQ5
14
+ class Dispatcher
15
+
16
+ def stop
17
+ @t_disp.kill unless @t_disp.nil?
18
+ end
19
+
20
+ def run
21
+ @known_urls = []
22
+ puts Watobo::Plugin::CQ5.ignore_patterns
23
+ @t_disp = Thread.new{
24
+ loop do
25
+ new_item = @dqueue.deq
26
+ unless @known_urls.include?( new_item[:url] )
27
+ @known_urls << new_item[:url]
28
+ if Watobo::Plugin::CQ5.ignore_patterns.empty?
29
+ # puts "* no ignore patterns defined"
30
+ @wqueue << new_item
31
+ elsif Watobo::Plugin::CQ5.ignore_patterns.select{|ip| new_item[:url] =~ /#{ip}/i }.empty?
32
+ @wqueue << new_item
33
+ end
34
+
35
+ @rqueue << new_item
36
+ else
37
+ puts "[DUPLICATED] >> #{new_item[:url]}"
38
+ end
39
+
40
+ end
41
+ }
42
+ end
43
+
44
+ def initialize(disp_queue, work_queue, result_queue)
45
+ @dqueue = disp_queue
46
+ @wqueue = work_queue
47
+ @rqueue = result_queue
48
+ @t_disp = nil
49
+ end
50
+ end
51
+ end
52
+ end
53
+ end
@@ -0,0 +1,187 @@
1
+ #.
2
+ # engine.rb
3
+ #.
4
+ # Copyright 2014 by siberas, http://www.siberas.de
5
+ # This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
6
+ # WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
7
+ # WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
8
+ # You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
9
+
10
+ # @private
11
+ module Watobo#:nodoc: all
12
+ module Plugin
13
+ class CQ5
14
+ @max_agents = 10
15
+ @disp_queue = Queue.new
16
+ @work_queue = Queue.new
17
+ @gui_queue = Queue.new
18
+
19
+ @agents = []
20
+ @use_relative_path = false
21
+
22
+
23
+ def self.reset
24
+ @disp_queue.clear
25
+ @work_queue.clear
26
+ @agents.map {|a| a.stop }
27
+ @agents = []
28
+ end
29
+
30
+ def self.ignore_patterns=(ipats)
31
+ @ignore_patterns = ipats
32
+ end
33
+
34
+ def self.ignore_patterns
35
+ @ignore_patterns
36
+ end
37
+
38
+
39
+ def self.use_relative_path=(urp)
40
+ @use_relative_path = urp
41
+ end
42
+
43
+ def self.queue_size
44
+ @work_queue.size
45
+ end
46
+
47
+ def self.status
48
+
49
+ end
50
+
51
+ def self.running?
52
+ @work_queue.size == 0 &&
53
+ @work_queue.num_waiting == @max_agents
54
+ end
55
+
56
+ def self.stop
57
+ @agents.map {|a| a.stop }
58
+ end
59
+
60
+ def self.run(start_path, gui_queue=nil)
61
+ @agents = []
62
+ puts "\nCQ5 Engine running on #{start_path}"
63
+ @dispatcher = Dispatcher.new( @disp_queue, @work_queue, gui_queue )
64
+ @dispatcher.run
65
+
66
+ vr = find_valid_request(start_path)
67
+ unless vr.nil?
68
+ puts "Baseline Request: " + vr.url.to_s
69
+
70
+ @max_agents.times do
71
+ puts " * Start Agent"
72
+ a = Agent.new( vr.copy, @work_queue, @disp_queue )
73
+ @agents << a
74
+ a.run
75
+ end
76
+
77
+
78
+ else
79
+ return false
80
+ end
81
+
82
+
83
+ end
84
+
85
+ def self.get_user_info
86
+ # https://mysite/cqa/libs/cq/security/userinfo.json?cq_ck=1427468388796
87
+ end
88
+
89
+ def self.find_valid_request(start_path)
90
+ # create a dummy agent to make test requests
91
+ agent = Agent.new nil, nil, nil
92
+ checked = []
93
+ #puts start_path.class
94
+ valid_request = nil
95
+
96
+ Watobo::Chats.to_a.reverse.each do |chat|
97
+ next unless chat.request.method_get?
98
+ url = chat.request.url.to_s
99
+ # url.gsub!(chat.request.site, chat.request.host)
100
+ path = chat.request.path
101
+
102
+ # next if checked.include? path
103
+
104
+ checked << path
105
+ # puts path.class
106
+ # puts url.class
107
+ # puts start_path
108
+ # puts url
109
+
110
+ pattern = Regexp.quote(start_path)
111
+ pattern = start_path
112
+ #puts pattern
113
+
114
+ #puts "---\n"
115
+
116
+ if url =~ /#{pattern}/
117
+ test = chat.copyRequest
118
+ test.replaceFileExt('.pages.json')
119
+
120
+
121
+ puts "* [#{chat.id}] " + test.url.to_s
122
+
123
+ request, response = agent.doRequest test
124
+
125
+ # puts response
126
+
127
+ unless response.content_type =~ /json/i
128
+ puts "! .pages.json is filtered !"
129
+ next
130
+ end
131
+ ntpages = JSON.parse response.body.to_s
132
+ if ntpages['pages']
133
+ valid_request = test
134
+
135
+ ntpages['pages'].each do |p|
136
+ # check if escapedPath is absolut or relativ
137
+ # if we find directory separator '/' we assume it's absolute
138
+ ep = p['escapedPath'].gsub(/^\//,'').strip
139
+ puts "EscapedPath: #{ep}"
140
+
141
+ # find the home directory of the application
142
+ ep_dirs = ep.split('/')
143
+
144
+ puts "EscapedPath-Dirs (#{ep_dirs.length}): " + ep_dirs.join("\n")
145
+ # request dir
146
+ r_dir = "#{test.dir}"
147
+ puts "Test-Request-Dir: " + r_dir
148
+ puts "Check for #{ep_dirs[0]}, #{ep_dirs[1]}"
149
+ # find offset of first escapePath directory
150
+ i = r_dir.index( ep_dirs.first )
151
+ puts "Index: #{i}"
152
+ base_dir = r_dir
153
+ puts base_dir
154
+ unless i.nil?
155
+ if i > 0
156
+ base_dir = r_dir[0..i-1]
157
+ else
158
+ base_dir = ''
159
+ end
160
+ end
161
+
162
+ puts "Base-Dir: #{base_dir}"
163
+ test.setDir base_dir
164
+
165
+ item = {
166
+ #:url => base_url.gsub(/\/$/,'') + p['escapedPath'],
167
+ :url => start_path,
168
+ :page_info => p,
169
+ :file_info => nil,
170
+ :status => nil
171
+ }
172
+
173
+
174
+ @disp_queue << item
175
+
176
+ end
177
+ #test.replaceFileExt('')
178
+ return valid_request
179
+ end
180
+ end
181
+ end
182
+ nil
183
+ end
184
+
185
+ end
186
+ end
187
+ end
@@ -0,0 +1,23 @@
1
+ system/console # [Felix Web Console]
2
+ system/console/components
3
+ system/admin # [CQSE; servlet engine]
4
+ system/sling/cqform/defaultlogin.html
5
+ crx/de/index.jsp # [CRX Web Console]
6
+ crx/ # [CRX Web Console]
7
+
8
+ etc/packages.html
9
+ content/geometrixx
10
+ libs/cq/core/content/login.html
11
+ libs/cq/core/content/welcome.html
12
+ libs/granite/ui/content/dumplibs.html
13
+
14
+
15
+ # jackrabbits
16
+ populate.jsp
17
+ search.jsp
18
+ repository/default
19
+ rmi
20
+ repository.xml
21
+ etc/packages
22
+ etc/replication
23
+
@@ -627,7 +627,7 @@ accarticles
627
627
  acceso
628
628
  access
629
629
  accesscode7
630
- accessibility
630
+ accessibility
631
631
  accesssoftware
632
632
  acchimuitepie
633
633
  accidentalblogger
@@ -1709,7 +1709,7 @@ analysis
1709
1709
  analytics
1710
1710
  analytics-fr
1711
1711
  analytics-ja
1712
- analyzer
1712
+ analyzer
1713
1713
  anan
1714
1714
  a-nanan
1715
1715
  anandchowdhary
@@ -1814,8 +1814,8 @@ aneraida
1814
1814
  anergoidimosiografoi
1815
1815
  anestintherocks
1816
1816
  a-new-life-downunder
1817
- angebot
1818
- angebote
1817
+ angebot
1818
+ angebote
1819
1819
  angelacarson
1820
1820
  angela-mommytimeout
1821
1821
  angelandblume
@@ -2015,7 +2015,7 @@ anxietyandpanicattacksgone
2015
2015
  anxietydisorderssymptoms
2016
2016
  anythingbeautiful
2017
2017
  anythingforvijay
2018
- anytimepc-client
2018
+ anytimepc-client
2019
2019
  anzfansub
2020
2020
  ao
2021
2021
  aojvojmovie
@@ -2758,7 +2758,7 @@ avaranda
2758
2758
  avareavisual
2759
2759
  avargal-unmaigal
2760
2760
  avarulia
2761
- avatar
2761
+ avatar
2762
2762
  avatarblog
2763
2763
  avatarkun
2764
2764
  avatarwatch
@@ -3543,7 +3543,7 @@ bestwall4u
3543
3543
  bestwallpapersfordesktop
3544
3544
  beta
3545
3545
  betakon
3546
- beta.news
3546
+ beta.news
3547
3547
  betcatalog
3548
3548
  bet-gr
3549
3549
  betgreece
@@ -6014,7 +6014,7 @@ commodity
6014
6014
  commoncts
6015
6015
  commonground-debrasvintagedesigns
6016
6016
  commonpeoplecommonvoice
6017
- communaltv
6017
+ communaltv
6018
6018
  communaute
6019
6019
  communication-business
6020
6020
  communicationresponsable
@@ -6132,7 +6132,7 @@ consiglioregionale
6132
6132
  consola
6133
6133
  console
6134
6134
  conspiraciones1040
6135
- constituency
6135
+ constituency
6136
6136
  constitutionalism
6137
6137
  constructeam
6138
6138
  constructor
@@ -7771,7 +7771,7 @@ directory-italia
7771
7771
  directsalessuccess
7772
7772
  directv
7773
7773
  directvb
7774
- direkt
7774
+ direkt
7775
7775
  direktori-indonesia
7776
7776
  direttacalciostreaming
7777
7777
  dirittodipolemica
@@ -8934,7 +8934,7 @@ email
8934
8934
  email-data-recovery
8935
8935
  emailmarketingtipps
8936
8936
  emailmarketingtips4u
8937
- emailupgrade
8937
+ emailupgrade
8938
8938
  emam-hoosein
8939
8939
  emamhossein
8940
8940
  emanuele-secco
@@ -9441,7 +9441,7 @@ exercices
9441
9441
  exercices-cours
9442
9442
  exijamosloimposible
9443
9443
  existenciaconsciente
9444
- existing
9444
+ existing
9445
9445
  exito
9446
9446
  exitoasegurado
9447
9447
  exkommuniziert
@@ -12392,7 +12392,7 @@ helpanimal
12392
12392
  helpbiotech
12393
12393
  helpdesk
12394
12394
  helper
12395
- helpforum
12395
+ helpforum
12396
12396
  helpfulinformationfornewbies
12397
12397
  help-html-css
12398
12398
  helponline
@@ -13440,8 +13440,8 @@ incredibleindiatravel
13440
13440
  indah2159
13441
13441
  indeed
13442
13442
  independent
13443
- indepth
13444
- indepth.news
13443
+ indepth
13444
+ indepth.news
13445
13445
  index
13446
13446
  indeximobiliar
13447
13447
  india
@@ -13728,8 +13728,8 @@ intellibriefs
13728
13728
  intelligencenews
13729
13729
  intellogist
13730
13730
  intendanceeducation
13731
- interactive
13732
- interactive.news
13731
+ interactive
13732
+ interactive.news
13733
13733
  intercambiobr
13734
13734
  interdenigran
13735
13735
  interesniy
@@ -13829,7 +13829,7 @@ ipad2appdevelopment
13829
13829
  ipadapplicationdevelopmentindia
13830
13830
  ipad-clips
13831
13831
  ipadian
13832
- ipad-live-1
13832
+ ipad-live-1
13833
13833
  ipa-twitbird
13834
13834
  ipayables
13835
13835
  ipc498a
@@ -17263,7 +17263,7 @@ madokhtarha
17263
17263
  madonapicture
17264
17264
  madonnalicious
17265
17265
  madonnascrapbook
17266
- madrid
17266
+ madrid
17267
17267
  madridfeelings
17268
17268
  madsmemories
17269
17269
  madurobom
@@ -18621,7 +18621,7 @@ mlokcool
18621
18621
  mlovesm
18622
18622
  mm
18623
18623
  mm938
18624
- mmail
18624
+ mmail
18625
18625
  mmaster-official
18626
18626
  mmavs
18627
18627
  mmcc
@@ -19524,7 +19524,7 @@ myoccupylaarrest
19524
19524
  myohmyohmy
19525
19525
  myonecent
19526
19526
  myoptimalhealthresource
19527
- myowa
19527
+ myowa
19528
19528
  myownprivatelockerroom
19529
19529
  myp2p95
19530
19530
  mypanathinaikos
@@ -19561,7 +19561,7 @@ mysillypointofview
19561
19561
  mysimplelittlepleasures
19562
19562
  mysims3blog
19563
19563
  mysisterismybestfriend
19564
- mysky
19564
+ mysky
19565
19565
  myslhometv
19566
19566
  my-sliit
19567
19567
  myspace-ss
@@ -20806,7 +20806,7 @@ officemind
20806
20806
  offices
20807
20807
  officiallyawesome
20808
20808
  officialmagicpg
20809
- offline
20809
+ offline
20810
20810
  offonatangent
20811
20811
  offset
20812
20812
  offshore-software-application-develop
@@ -22784,7 +22784,7 @@ prefeituradesaire
22784
22784
  preferiticataldi
22785
22785
  prefiro-o-silencio
22786
22786
  prekandksharing
22787
- prelife
22787
+ prelife
22788
22788
  premascookbook
22789
22789
  premiercritic
22790
22790
  premierleaguefantasy
@@ -24623,10 +24623,10 @@ santymenor
24623
24623
  santyweb
24624
24624
  sanvishblue
24625
24625
  sanye
24626
- sap
24626
+ sap
24627
24627
  sap201110
24628
24628
  sapbeginnersblog
24629
- sap-hr
24629
+ sap-hr
24630
24630
  sapogratis
24631
24631
  sa-pol2010
24632
24632
  saporiericette
@@ -24634,7 +24634,7 @@ saporiesaporifantasie
24634
24634
  sappholovergirl
24635
24635
  sappoll
24636
24636
  sappynuts
24637
- saprouter
24637
+ saprouter
24638
24638
  sapstaff2
24639
24639
  saptraininginstitutes
24640
24640
  saptuari
@@ -24964,7 +24964,7 @@ secterfisherman
24964
24964
  secure
24965
24965
  secure1064
24966
24966
  secured
24967
- securepackages
24967
+ securepackages
24968
24968
  securid
24969
24969
  securite-informatique
24970
24970
  securite-routiere
@@ -25017,7 +25017,7 @@ sejarahmelayu
25017
25017
  sekaratmutlak
25018
25018
  selariemas
25019
25019
  seleb-online
25020
- select
25020
+ select
25021
25021
  selectbacklinks
25022
25022
  selectcollection
25023
25023
  selectivepotential
@@ -25874,17 +25874,17 @@ skuterhijau
25874
25874
  skvnet
25875
25875
  skwillms
25876
25876
  sky
25877
- sky1
25878
- skyatlantic
25877
+ sky1
25878
+ skyatlantic
25879
25879
  skyboy
25880
- skygamesonline
25880
+ skygamesonline
25881
25881
  skyidol
25882
25882
  skylarinc
25883
25883
  skylar-smythe
25884
- skyliving
25884
+ skyliving
25885
25885
  skynet-jogja
25886
25886
  skypenumerology
25887
- skyplayer
25887
+ skyplayer
25888
25888
  skyrim-cover
25889
25889
  skytechxtreme
25890
25890
  skywalker
@@ -25941,7 +25941,7 @@ sm3na-mazika
25941
25941
  sma-b
25942
25942
  smaczny
25943
25943
  smaik1
25944
- smail
25944
+ smail
25945
25945
  smallatlarge
25946
25946
  smallblogsbiggiveaways
25947
25947
  smallcockrocks
@@ -26213,7 +26213,7 @@ song
26213
26213
  songcode
26214
26214
  songofstyle
26215
26215
  songqingjies
26216
- songs
26216
+ songs
26217
26217
  songsmasti
26218
26218
  songspitara
26219
26219
  songstopalbum
@@ -26406,7 +26406,7 @@ spideruploads
26406
26406
  spider-vein-treatment-knowledge
26407
26407
  spidi2
26408
26408
  spidnox
26409
- spiele
26409
+ spiele
26410
26410
  spigolaturesalentine
26411
26411
  spiketranslations
26412
26412
  spiltangles
@@ -26446,7 +26446,7 @@ sportsevents95
26446
26446
  sportsfitnesshut
26447
26447
  sportsgeeks
26448
26448
  sports-livez
26449
- sportsoffer
26449
+ sportsoffer
26450
26450
  sportsphotographytechniques
26451
26451
  sportsstarclub
26452
26452
  sportsstreamplus
@@ -26538,7 +26538,7 @@ stadmasr
26538
26538
  stafamp3
26539
26539
  staff
26540
26540
  stage
26541
- stagenews-offline
26541
+ stagenews-offline
26542
26542
  staging
26543
26543
  stakano
26544
26544
  stal
@@ -26573,8 +26573,8 @@ starlitskys
26573
26573
  starmageddon
26574
26574
  starones
26575
26575
  staroverov
26576
- stars
26577
- stars1
26576
+ stars
26577
+ stars1
26578
26578
  stars-au-naturel
26579
26579
  starsclassic
26580
26580
  starsnwa
@@ -26599,7 +26599,7 @@ stastnyblog
26599
26599
  stat
26600
26600
  statenallstars
26601
26601
  static
26602
- static.accessibility
26602
+ static.accessibility
26603
26603
  statistics
26604
26604
  stats
26605
26605
  statsperso
@@ -27757,7 +27757,7 @@ terunyblog
27757
27757
  tescovouchercodes
27758
27758
  tessareedshea
27759
27759
  test
27760
- test1
27760
+ test1
27761
27761
  test2k
27762
27762
  test-32f480o4ccaebd947cc9
27763
27763
  testbed
@@ -30197,7 +30197,7 @@ vnetd
30197
30197
  vnhacker
30198
30198
  vntim
30199
30199
  vnutravel
30200
- vod
30200
+ vod
30201
30201
  vodafone500
30202
30202
  vodafone-iphone
30203
30203
  vodmax