watobo 0.9.20 → 0.9.21

Sign up to get free protection for your applications and to get access to all the features.
Files changed (51) hide show
  1. data/CHANGELOG.md +54 -2
  2. data/README.md +1 -1
  3. data/config/scanner.yml +1 -0
  4. data/custom-views/prettify-json.rb +19 -0
  5. data/lib/watobo/adapters/file/marshal_store.rb +297 -0
  6. data/lib/watobo/adapters.rb +2 -1
  7. data/lib/watobo/core/active_check.rb +4 -0
  8. data/lib/watobo/core/chat.rb +8 -0
  9. data/lib/watobo/core/chats.rb +2 -1
  10. data/lib/watobo/core/cookie.rb +3 -3
  11. data/lib/watobo/core/finding.rb +7 -0
  12. data/lib/watobo/core/request.rb +3 -3
  13. data/lib/watobo/core/session.rb +6 -2
  14. data/lib/watobo/framework/init_modules.rb +18 -16
  15. data/lib/watobo/gui/conversation_table.rb +13 -16
  16. data/lib/watobo/gui/conversation_table_ctrl2.rb +1 -0
  17. data/lib/watobo/gui/custom_viewer.rb +101 -76
  18. data/lib/watobo/gui/define_scope_frame.rb +44 -10
  19. data/lib/watobo/gui/edit_scope_dialog.rb +1 -1
  20. data/lib/watobo/gui/fuzzer_gui.rb +61 -23
  21. data/lib/watobo/gui/main_window.rb +1 -1
  22. data/lib/watobo/gui/scanner_settings_dialog.rb +15 -0
  23. data/lib/watobo/http/data/json.rb +6 -0
  24. data/lib/watobo/interceptor/html/favicon.ico +0 -0
  25. data/lib/watobo/interceptor/html/index.html +13 -0
  26. data/lib/watobo/interceptor/proxy.rb +70 -18
  27. data/lib/watobo/mixins/httpparser.rb +26 -16
  28. data/lib/watobo/mixins/shapers.rb +49 -5
  29. data/lib/watobo/mixins/transcoders.rb +8 -8
  30. data/lib/watobo/sockets/connection.rb +1 -1
  31. data/lib/watobo/utils/load_chat.rb +62 -0
  32. data/lib/watobo/utils/response_hash.rb +3 -3
  33. data/lib/watobo.rb +1 -1
  34. data/modules/active/cq5/cq5_default_selectors.rb +116 -0
  35. data/modules/active/cq5/cqp_user_enumeration.rb +134 -0
  36. data/modules/active/struts2/include_params_ognl.rb +1 -1
  37. data/modules/active/xml/xml_xxe.rb +6 -1
  38. data/modules/passive/disclosure_domino.rb +1 -1
  39. data/modules/passive/in_script_parameter.rb +9 -4
  40. data/plugins/aem/aem.rb +21 -0
  41. data/plugins/aem/gui/main.rb +128 -0
  42. data/plugins/aem/gui/tree_view.rb +180 -0
  43. data/plugins/aem/icons/aem.ico +0 -0
  44. data/plugins/aem/lib/agent.rb +140 -0
  45. data/plugins/aem/lib/dispatcher.rb +53 -0
  46. data/plugins/aem/lib/engine.rb +187 -0
  47. data/plugins/filefinder/dbs/cq5.db +23 -0
  48. data/plugins/filefinder/dbs/subs-big.lst +44 -44
  49. data/plugins/filefinder/filefinder.rb +4 -4
  50. data/plugins/sqlmap/lib/sqlmap_ctrl.rb +11 -10
  51. metadata +16 -2
@@ -0,0 +1,53 @@
1
+ #.
2
+ # dispatcher.rb
3
+ #.
4
+ # Copyright 2014 by siberas, http://www.siberas.de
5
+ # This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
6
+ # WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
7
+ # WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
8
+ # You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
9
+
10
+ # @private
11
+ module Watobo#:nodoc: all
12
+ module Plugin
13
+ class CQ5
14
+ class Dispatcher
15
+
16
+ def stop
17
+ @t_disp.kill unless @t_disp.nil?
18
+ end
19
+
20
+ def run
21
+ @known_urls = []
22
+ puts Watobo::Plugin::CQ5.ignore_patterns
23
+ @t_disp = Thread.new{
24
+ loop do
25
+ new_item = @dqueue.deq
26
+ unless @known_urls.include?( new_item[:url] )
27
+ @known_urls << new_item[:url]
28
+ if Watobo::Plugin::CQ5.ignore_patterns.empty?
29
+ # puts "* no ignore patterns defined"
30
+ @wqueue << new_item
31
+ elsif Watobo::Plugin::CQ5.ignore_patterns.select{|ip| new_item[:url] =~ /#{ip}/i }.empty?
32
+ @wqueue << new_item
33
+ end
34
+
35
+ @rqueue << new_item
36
+ else
37
+ puts "[DUPLICATED] >> #{new_item[:url]}"
38
+ end
39
+
40
+ end
41
+ }
42
+ end
43
+
44
+ def initialize(disp_queue, work_queue, result_queue)
45
+ @dqueue = disp_queue
46
+ @wqueue = work_queue
47
+ @rqueue = result_queue
48
+ @t_disp = nil
49
+ end
50
+ end
51
+ end
52
+ end
53
+ end
@@ -0,0 +1,187 @@
1
+ #.
2
+ # engine.rb
3
+ #.
4
+ # Copyright 2014 by siberas, http://www.siberas.de
5
+ # This file is part of WATOBO (Web Application Tool Box) http://watobo.sourceforge.com
6
+ # WATOBO is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License.
7
+ # WATOBO is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
8
+ # You should have received a copy of the GNU General Public License along with WATOBO; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
9
+
10
+ # @private
11
+ module Watobo#:nodoc: all
12
+ module Plugin
13
+ class CQ5
14
+ @max_agents = 10
15
+ @disp_queue = Queue.new
16
+ @work_queue = Queue.new
17
+ @gui_queue = Queue.new
18
+
19
+ @agents = []
20
+ @use_relative_path = false
21
+
22
+
23
+ def self.reset
24
+ @disp_queue.clear
25
+ @work_queue.clear
26
+ @agents.map {|a| a.stop }
27
+ @agents = []
28
+ end
29
+
30
+ def self.ignore_patterns=(ipats)
31
+ @ignore_patterns = ipats
32
+ end
33
+
34
+ def self.ignore_patterns
35
+ @ignore_patterns
36
+ end
37
+
38
+
39
+ def self.use_relative_path=(urp)
40
+ @use_relative_path = urp
41
+ end
42
+
43
+ def self.queue_size
44
+ @work_queue.size
45
+ end
46
+
47
+ def self.status
48
+
49
+ end
50
+
51
+ def self.running?
52
+ @work_queue.size == 0 &&
53
+ @work_queue.num_waiting == @max_agents
54
+ end
55
+
56
+ def self.stop
57
+ @agents.map {|a| a.stop }
58
+ end
59
+
60
+ def self.run(start_path, gui_queue=nil)
61
+ @agents = []
62
+ puts "\nCQ5 Engine running on #{start_path}"
63
+ @dispatcher = Dispatcher.new( @disp_queue, @work_queue, gui_queue )
64
+ @dispatcher.run
65
+
66
+ vr = find_valid_request(start_path)
67
+ unless vr.nil?
68
+ puts "Baseline Request: " + vr.url.to_s
69
+
70
+ @max_agents.times do
71
+ puts " * Start Agent"
72
+ a = Agent.new( vr.copy, @work_queue, @disp_queue )
73
+ @agents << a
74
+ a.run
75
+ end
76
+
77
+
78
+ else
79
+ return false
80
+ end
81
+
82
+
83
+ end
84
+
85
+ def self.get_user_info
86
+ # https://mysite/cqa/libs/cq/security/userinfo.json?cq_ck=1427468388796
87
+ end
88
+
89
+ def self.find_valid_request(start_path)
90
+ # create a dummy agent to make test requests
91
+ agent = Agent.new nil, nil, nil
92
+ checked = []
93
+ #puts start_path.class
94
+ valid_request = nil
95
+
96
+ Watobo::Chats.to_a.reverse.each do |chat|
97
+ next unless chat.request.method_get?
98
+ url = chat.request.url.to_s
99
+ # url.gsub!(chat.request.site, chat.request.host)
100
+ path = chat.request.path
101
+
102
+ # next if checked.include? path
103
+
104
+ checked << path
105
+ # puts path.class
106
+ # puts url.class
107
+ # puts start_path
108
+ # puts url
109
+
110
+ pattern = Regexp.quote(start_path)
111
+ pattern = start_path
112
+ #puts pattern
113
+
114
+ #puts "---\n"
115
+
116
+ if url =~ /#{pattern}/
117
+ test = chat.copyRequest
118
+ test.replaceFileExt('.pages.json')
119
+
120
+
121
+ puts "* [#{chat.id}] " + test.url.to_s
122
+
123
+ request, response = agent.doRequest test
124
+
125
+ # puts response
126
+
127
+ unless response.content_type =~ /json/i
128
+ puts "! .pages.json is filtered !"
129
+ next
130
+ end
131
+ ntpages = JSON.parse response.body.to_s
132
+ if ntpages['pages']
133
+ valid_request = test
134
+
135
+ ntpages['pages'].each do |p|
136
+ # check if escapedPath is absolut or relativ
137
+ # if we find directory separator '/' we assume it's absolute
138
+ ep = p['escapedPath'].gsub(/^\//,'').strip
139
+ puts "EscapedPath: #{ep}"
140
+
141
+ # find the home directory of the application
142
+ ep_dirs = ep.split('/')
143
+
144
+ puts "EscapedPath-Dirs (#{ep_dirs.length}): " + ep_dirs.join("\n")
145
+ # request dir
146
+ r_dir = "#{test.dir}"
147
+ puts "Test-Request-Dir: " + r_dir
148
+ puts "Check for #{ep_dirs[0]}, #{ep_dirs[1]}"
149
+ # find offset of first escapePath directory
150
+ i = r_dir.index( ep_dirs.first )
151
+ puts "Index: #{i}"
152
+ base_dir = r_dir
153
+ puts base_dir
154
+ unless i.nil?
155
+ if i > 0
156
+ base_dir = r_dir[0..i-1]
157
+ else
158
+ base_dir = ''
159
+ end
160
+ end
161
+
162
+ puts "Base-Dir: #{base_dir}"
163
+ test.setDir base_dir
164
+
165
+ item = {
166
+ #:url => base_url.gsub(/\/$/,'') + p['escapedPath'],
167
+ :url => start_path,
168
+ :page_info => p,
169
+ :file_info => nil,
170
+ :status => nil
171
+ }
172
+
173
+
174
+ @disp_queue << item
175
+
176
+ end
177
+ #test.replaceFileExt('')
178
+ return valid_request
179
+ end
180
+ end
181
+ end
182
+ nil
183
+ end
184
+
185
+ end
186
+ end
187
+ end
@@ -0,0 +1,23 @@
1
+ system/console # [Felix Web Console]
2
+ system/console/components
3
+ system/admin # [CQSE; servlet engine]
4
+ system/sling/cqform/defaultlogin.html
5
+ crx/de/index.jsp # [CRX Web Console]
6
+ crx/ # [CRX Web Console]
7
+
8
+ etc/packages.html
9
+ content/geometrixx
10
+ libs/cq/core/content/login.html
11
+ libs/cq/core/content/welcome.html
12
+ libs/granite/ui/content/dumplibs.html
13
+
14
+
15
+ # jackrabbits
16
+ populate.jsp
17
+ search.jsp
18
+ repository/default
19
+ rmi
20
+ repository.xml
21
+ etc/packages
22
+ etc/replication
23
+
@@ -627,7 +627,7 @@ accarticles
627
627
  acceso
628
628
  access
629
629
  accesscode7
630
- accessibility
630
+ accessibility
631
631
  accesssoftware
632
632
  acchimuitepie
633
633
  accidentalblogger
@@ -1709,7 +1709,7 @@ analysis
1709
1709
  analytics
1710
1710
  analytics-fr
1711
1711
  analytics-ja
1712
- analyzer
1712
+ analyzer
1713
1713
  anan
1714
1714
  a-nanan
1715
1715
  anandchowdhary
@@ -1814,8 +1814,8 @@ aneraida
1814
1814
  anergoidimosiografoi
1815
1815
  anestintherocks
1816
1816
  a-new-life-downunder
1817
- angebot
1818
- angebote
1817
+ angebot
1818
+ angebote
1819
1819
  angelacarson
1820
1820
  angela-mommytimeout
1821
1821
  angelandblume
@@ -2015,7 +2015,7 @@ anxietyandpanicattacksgone
2015
2015
  anxietydisorderssymptoms
2016
2016
  anythingbeautiful
2017
2017
  anythingforvijay
2018
- anytimepc-client
2018
+ anytimepc-client
2019
2019
  anzfansub
2020
2020
  ao
2021
2021
  aojvojmovie
@@ -2758,7 +2758,7 @@ avaranda
2758
2758
  avareavisual
2759
2759
  avargal-unmaigal
2760
2760
  avarulia
2761
- avatar
2761
+ avatar
2762
2762
  avatarblog
2763
2763
  avatarkun
2764
2764
  avatarwatch
@@ -3543,7 +3543,7 @@ bestwall4u
3543
3543
  bestwallpapersfordesktop
3544
3544
  beta
3545
3545
  betakon
3546
- beta.news
3546
+ beta.news
3547
3547
  betcatalog
3548
3548
  bet-gr
3549
3549
  betgreece
@@ -6014,7 +6014,7 @@ commodity
6014
6014
  commoncts
6015
6015
  commonground-debrasvintagedesigns
6016
6016
  commonpeoplecommonvoice
6017
- communaltv
6017
+ communaltv
6018
6018
  communaute
6019
6019
  communication-business
6020
6020
  communicationresponsable
@@ -6132,7 +6132,7 @@ consiglioregionale
6132
6132
  consola
6133
6133
  console
6134
6134
  conspiraciones1040
6135
- constituency
6135
+ constituency
6136
6136
  constitutionalism
6137
6137
  constructeam
6138
6138
  constructor
@@ -7771,7 +7771,7 @@ directory-italia
7771
7771
  directsalessuccess
7772
7772
  directv
7773
7773
  directvb
7774
- direkt
7774
+ direkt
7775
7775
  direktori-indonesia
7776
7776
  direttacalciostreaming
7777
7777
  dirittodipolemica
@@ -8934,7 +8934,7 @@ email
8934
8934
  email-data-recovery
8935
8935
  emailmarketingtipps
8936
8936
  emailmarketingtips4u
8937
- emailupgrade
8937
+ emailupgrade
8938
8938
  emam-hoosein
8939
8939
  emamhossein
8940
8940
  emanuele-secco
@@ -9441,7 +9441,7 @@ exercices
9441
9441
  exercices-cours
9442
9442
  exijamosloimposible
9443
9443
  existenciaconsciente
9444
- existing
9444
+ existing
9445
9445
  exito
9446
9446
  exitoasegurado
9447
9447
  exkommuniziert
@@ -12392,7 +12392,7 @@ helpanimal
12392
12392
  helpbiotech
12393
12393
  helpdesk
12394
12394
  helper
12395
- helpforum
12395
+ helpforum
12396
12396
  helpfulinformationfornewbies
12397
12397
  help-html-css
12398
12398
  helponline
@@ -13440,8 +13440,8 @@ incredibleindiatravel
13440
13440
  indah2159
13441
13441
  indeed
13442
13442
  independent
13443
- indepth
13444
- indepth.news
13443
+ indepth
13444
+ indepth.news
13445
13445
  index
13446
13446
  indeximobiliar
13447
13447
  india
@@ -13728,8 +13728,8 @@ intellibriefs
13728
13728
  intelligencenews
13729
13729
  intellogist
13730
13730
  intendanceeducation
13731
- interactive
13732
- interactive.news
13731
+ interactive
13732
+ interactive.news
13733
13733
  intercambiobr
13734
13734
  interdenigran
13735
13735
  interesniy
@@ -13829,7 +13829,7 @@ ipad2appdevelopment
13829
13829
  ipadapplicationdevelopmentindia
13830
13830
  ipad-clips
13831
13831
  ipadian
13832
- ipad-live-1
13832
+ ipad-live-1
13833
13833
  ipa-twitbird
13834
13834
  ipayables
13835
13835
  ipc498a
@@ -17263,7 +17263,7 @@ madokhtarha
17263
17263
  madonapicture
17264
17264
  madonnalicious
17265
17265
  madonnascrapbook
17266
- madrid
17266
+ madrid
17267
17267
  madridfeelings
17268
17268
  madsmemories
17269
17269
  madurobom
@@ -18621,7 +18621,7 @@ mlokcool
18621
18621
  mlovesm
18622
18622
  mm
18623
18623
  mm938
18624
- mmail
18624
+ mmail
18625
18625
  mmaster-official
18626
18626
  mmavs
18627
18627
  mmcc
@@ -19524,7 +19524,7 @@ myoccupylaarrest
19524
19524
  myohmyohmy
19525
19525
  myonecent
19526
19526
  myoptimalhealthresource
19527
- myowa
19527
+ myowa
19528
19528
  myownprivatelockerroom
19529
19529
  myp2p95
19530
19530
  mypanathinaikos
@@ -19561,7 +19561,7 @@ mysillypointofview
19561
19561
  mysimplelittlepleasures
19562
19562
  mysims3blog
19563
19563
  mysisterismybestfriend
19564
- mysky
19564
+ mysky
19565
19565
  myslhometv
19566
19566
  my-sliit
19567
19567
  myspace-ss
@@ -20806,7 +20806,7 @@ officemind
20806
20806
  offices
20807
20807
  officiallyawesome
20808
20808
  officialmagicpg
20809
- offline
20809
+ offline
20810
20810
  offonatangent
20811
20811
  offset
20812
20812
  offshore-software-application-develop
@@ -22784,7 +22784,7 @@ prefeituradesaire
22784
22784
  preferiticataldi
22785
22785
  prefiro-o-silencio
22786
22786
  prekandksharing
22787
- prelife
22787
+ prelife
22788
22788
  premascookbook
22789
22789
  premiercritic
22790
22790
  premierleaguefantasy
@@ -24623,10 +24623,10 @@ santymenor
24623
24623
  santyweb
24624
24624
  sanvishblue
24625
24625
  sanye
24626
- sap
24626
+ sap
24627
24627
  sap201110
24628
24628
  sapbeginnersblog
24629
- sap-hr
24629
+ sap-hr
24630
24630
  sapogratis
24631
24631
  sa-pol2010
24632
24632
  saporiericette
@@ -24634,7 +24634,7 @@ saporiesaporifantasie
24634
24634
  sappholovergirl
24635
24635
  sappoll
24636
24636
  sappynuts
24637
- saprouter
24637
+ saprouter
24638
24638
  sapstaff2
24639
24639
  saptraininginstitutes
24640
24640
  saptuari
@@ -24964,7 +24964,7 @@ secterfisherman
24964
24964
  secure
24965
24965
  secure1064
24966
24966
  secured
24967
- securepackages
24967
+ securepackages
24968
24968
  securid
24969
24969
  securite-informatique
24970
24970
  securite-routiere
@@ -25017,7 +25017,7 @@ sejarahmelayu
25017
25017
  sekaratmutlak
25018
25018
  selariemas
25019
25019
  seleb-online
25020
- select
25020
+ select
25021
25021
  selectbacklinks
25022
25022
  selectcollection
25023
25023
  selectivepotential
@@ -25874,17 +25874,17 @@ skuterhijau
25874
25874
  skvnet
25875
25875
  skwillms
25876
25876
  sky
25877
- sky1
25878
- skyatlantic
25877
+ sky1
25878
+ skyatlantic
25879
25879
  skyboy
25880
- skygamesonline
25880
+ skygamesonline
25881
25881
  skyidol
25882
25882
  skylarinc
25883
25883
  skylar-smythe
25884
- skyliving
25884
+ skyliving
25885
25885
  skynet-jogja
25886
25886
  skypenumerology
25887
- skyplayer
25887
+ skyplayer
25888
25888
  skyrim-cover
25889
25889
  skytechxtreme
25890
25890
  skywalker
@@ -25941,7 +25941,7 @@ sm3na-mazika
25941
25941
  sma-b
25942
25942
  smaczny
25943
25943
  smaik1
25944
- smail
25944
+ smail
25945
25945
  smallatlarge
25946
25946
  smallblogsbiggiveaways
25947
25947
  smallcockrocks
@@ -26213,7 +26213,7 @@ song
26213
26213
  songcode
26214
26214
  songofstyle
26215
26215
  songqingjies
26216
- songs
26216
+ songs
26217
26217
  songsmasti
26218
26218
  songspitara
26219
26219
  songstopalbum
@@ -26406,7 +26406,7 @@ spideruploads
26406
26406
  spider-vein-treatment-knowledge
26407
26407
  spidi2
26408
26408
  spidnox
26409
- spiele
26409
+ spiele
26410
26410
  spigolaturesalentine
26411
26411
  spiketranslations
26412
26412
  spiltangles
@@ -26446,7 +26446,7 @@ sportsevents95
26446
26446
  sportsfitnesshut
26447
26447
  sportsgeeks
26448
26448
  sports-livez
26449
- sportsoffer
26449
+ sportsoffer
26450
26450
  sportsphotographytechniques
26451
26451
  sportsstarclub
26452
26452
  sportsstreamplus
@@ -26538,7 +26538,7 @@ stadmasr
26538
26538
  stafamp3
26539
26539
  staff
26540
26540
  stage
26541
- stagenews-offline
26541
+ stagenews-offline
26542
26542
  staging
26543
26543
  stakano
26544
26544
  stal
@@ -26573,8 +26573,8 @@ starlitskys
26573
26573
  starmageddon
26574
26574
  starones
26575
26575
  staroverov
26576
- stars
26577
- stars1
26576
+ stars
26577
+ stars1
26578
26578
  stars-au-naturel
26579
26579
  starsclassic
26580
26580
  starsnwa
@@ -26599,7 +26599,7 @@ stastnyblog
26599
26599
  stat
26600
26600
  statenallstars
26601
26601
  static
26602
- static.accessibility
26602
+ static.accessibility
26603
26603
  statistics
26604
26604
  stats
26605
26605
  statsperso
@@ -27757,7 +27757,7 @@ terunyblog
27757
27757
  tescovouchercodes
27758
27758
  tessareedshea
27759
27759
  test
27760
- test1
27760
+ test1
27761
27761
  test2k
27762
27762
  test-32f480o4ccaebd947cc9
27763
27763
  testbed
@@ -30197,7 +30197,7 @@ vnetd
30197
30197
  vnhacker
30198
30198
  vntim
30199
30199
  vnutravel
30200
- vod
30200
+ vod
30201
30201
  vodafone500
30202
30202
  vodafone-iphone
30203
30203
  vodmax