watobo 0.9.8.677

data/lib/watobo/adapters/file/file_store.rb

@@ -0,0 +1,211 @@
+# .
+# file_store.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  class FileSessionStore < SessionStore
+    def num_chats
+      get_file_list(@conversation_path, "*-chat").length
+    end
+
+    def num_findings
+      get_file_list(@findings_path, "*-finding").length
+    end
+
+    def add_finding(finding)
+      finding_file = File.join("#{@findings_path}", "#{finding.id}-finding")
+      if not File.exists?(finding_file) then
+
+        finding_data = {
+          :request => finding.request.map{|x| x.inspect},
+          :response => finding.response.map{|x| x.inspect},
+          :details => Hash.new
+        }
+        finding_data[:details].update(finding.details)
+
+        if not File.exists?(finding_file) then
+          fh = File.new(finding_file, "w+b")
+          fh.print YAML.dump(finding_data)
+        fh.close
+        end
+      end
+
+    end
+    
+    def delete_finding(finding)
+      finding_file = File.join("#{@findings_path}", "#{finding.id}-finding")
+      File.delete finding_file if File.exist? finding_file
+      
+    end
+    
+    def update_finding(finding)
+      finding_file = File.join("#{@findings_path}", "#{finding.id}-finding")
+       finding_data = {
+          :request => finding.request.map{|x| x.inspect},
+          :response => finding.response.map{|x| x.inspect},
+          :details => Hash.new
+        }
+        finding_data[:details].update(finding.details)
+
+        if File.exists?(finding_file) then
+          fh = File.new(finding_file, "w+b")
+          fh.print YAML.dump(finding_data)
+          fh.close
+        end
+      
+    end
+
+    # add_scan_log
+    # adds a chat to a specific log store, e.g. if you want to log scan results.
+    # needs a scan_name (STRING) as its destination which will be created
+    # if the scan name does not exist.
+    def add_scan_log(chat, scan_name = nil)
+      begin
+        return false if scan_name.nil?
+        puts ">> scan_name"
+        path = File.join(@scanlog_path, scan_name)
+        
+        Dir.mkdir path unless File.exist? path
+        
+        log_file = File.join( path, "log_" + Time.now.to_f.to_s)
+
+        chat_data = {
+          :request => chat.request.map{|x| x.inspect},
+          :response => chat.response.map{|x| x.inspect},
+        }
+        puts log_file
+        chat_data.update(chat.settings)
+        File.open(log_file, "w") { |fh|
+          YAML.dump(chat_data, fh)
+        }
+      return true
+      rescue => bang
+        puts bang
+        puts bang.backtrace if $DEBUG
+      end
+      return false
+    end
+
+    def add_chat(chat)
+      chat_file = File.join("#{@conversation_path}", "#{chat.id}-chat")
+      chat_data = {
+        :request => chat.request.map{|x| x.inspect},
+        :response => chat.response.map{|x| x.inspect},
+      }
+
+      chat_data.update(chat.settings)
+      if not File.exists?(chat_file) then
+        File.open(chat_file, "w") { |fh|
+          YAML.dump(chat_data, fh)
+        }
+      chat.file = chat_file
+      end
+    end
+
+    def each_chat(&block)
+      get_file_list(@conversation_path, "*-chat").each do |fname|
+        chat = Watobo::Utils.loadChatYAML(fname)
+        next unless chat
+        yield chat if block_given?
+      end
+    end
+
+    def each_finding(&block)
+      get_file_list(@findings_path, "*-finding").each do |fname|
+        f = Watobo::Utils.loadFindingYAML(fname)
+        next unless f
+        yield f if block_given?
+      end
+    end
+
+    
+
+    def initialize(project_name, session_name)
+
+      wsp = Watobo.workspace_path
+      return false unless File.exist? wsp
+      puts "* using workspace path: #{wsp}"
+      project_path = File.join(wsp, project_name)
+      unless File.exist? project_path
+        puts "* create project path: #{project_path}"
+        Dir.mkdir(project_path)
+      end
+      session_path = File.join(project_path, session_name)
+
+      unless File.exist? session_path
+        puts "* create session path: #{session_path}"
+        Dir.mkdir(session_path)
+      end
+      sext = Watobo::Conf::General.session_settings_file_ext
+      puts "SEXT: #{sext}"
+      @session_file = File.join(session_path, session_name + sext)
+      @project_file = File.join(project_path, project_name + Watobo::Conf::General.project_settings_file_ext)
+
+      @conversation_path = File.expand_path(File.join(session_path, Watobo::Conf::Datastore.conversations))
+
+      @findings_path = File.expand_path(File.join(session_path, Watobo::Conf::Datastore.findings))
+      @log_path = File.expand_path(File.join(session_path, Watobo::Conf::Datastore.event_logs_dir))
+      @scanlog_path = File.expand_path(File.join(session_path, Watobo::Conf::Datastore.scan_logs_dir))
+
+      [ @conversation_path, @findings_path, @log_path, @scanlog_path ].each do |folder|
+        if not File.exists?(folder) then
+          puts "create path #{folder}"
+          begin
+            Dir.mkdir(folder)
+          rescue SystemCallError => bang
+            puts "!!!ERROR:"
+            puts bang
+          rescue => bang
+            puts "!!!ERROR:"
+            puts bang
+          end
+        end
+      end
+
+    #     @chat_files = get_file_list(@conversation_path, "*-chat")
+    #     @finding_files = get_file_list(@findings_path, "*-finding")
+    end
+
+    
+    def save_session_settings(session_settings)
+      
+    end
+    
+    def load_session_settings()
+      
+    end
+    
+    def save_project_settings(project_settings)
+      
+    end
+    
+    def load_project_settings()
+      
+    end
+    
+    private
+    
+    def get_file_list(path, pattern)
+      Dir["#{path}/#{pattern}"].sort_by{ |x| File.basename(x).sub(/[^0-9]*/,'').to_i }
+    end
+    
+  end
+
+end

data/lib/watobo/adapters/session_store.rb

@@ -0,0 +1,27 @@
+# .
+# session_store.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  class SessionStore
+    
+    # TODO: Define default methods here
+  end
+end

data/lib/watobo/adapters.rb

@@ -0,0 +1,26 @@
+# .
+# adapters.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+%w( data_store session_store ).each do |lib|
+  require "watobo/adapters/#{lib}"
+end
+
+require "watobo/adapters/file/file_store"

data/lib/watobo/config.rb

@@ -0,0 +1,143 @@
+# .
+# config.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  module Conf
+
+    @@settings = Hash.new
+    @count = 0
+    @@modules = []
+    def self.each(&b)
+      @@modules.each do |m|
+        yield m if block_given?
+      end
+      @@modules.length
+    end
+
+    def self.add(group, settings)
+      #   puts "* create new configuration for #{group}"
+
+      module_eval("module #{group}; @settings = #{settings} end")
+      m = const_get(group)
+      m.module_eval do
+        def self.to_file
+          n = self.to_s.gsub(/(Watobo)?::/, "/").gsub(/([A-Z])([A-Z][a-z])/, '\1_\2').gsub(/([a-z\d])([A-Z])/, '\1_\2').tr("-","_").downcase
+          n << ".yml"
+        end
+
+        def self.update(filename=nil, &b)
+          n = self.to_file
+          file = filename unless filename.nil?
+          file = File.join( Watobo::Conf::General.working_directory, n )
+          if File.exist? file
+            puts " [#{self}] update settings from file #{file}"
+            @settings.update YAML.load_file(file)
+            puts @settings.to_yaml
+            puts self.dump if $DEBUG
+          else
+            puts "! [#{self}] could not update settings from file #{file}" if $DEBUG
+          end
+        end
+
+        def self.set(settings)
+          return false unless settings.is_a? Hash
+          @settings = YAML.load(YAML.dump(settings))
+        end
+
+        def self.save(path=nil, &b)
+
+          n = self.to_file
+          p = Conf::General.working_directory
+          unless path.nil?
+            if File.exist? path
+              p = path
+            end
+          end 
+
+          file = File.join( p, n )
+
+          s = YAML.load(YAML.dump(@settings))
+          s.each_pair do |k,v|
+            yield k,v if block_given?
+          end
+
+          if File.exist?(File.dirname(file))
+            puts "* save config #{self} to: #{file}"
+            puts s.to_yaml
+            File.open(file, "w") { |fh|
+              YAML.dump(s, fh)
+            }
+          else
+            puts "Could not save file to #{File.dirname(file)}"
+          end
+        end
+
+        def self.respond_to?(f)
+          #  puts "* respond_to?"
+          # puts f
+          return true if @settings.has_key? f.to_sym
+          #  puts @settings.to_yaml
+          super
+        end
+
+        def self.dump
+          @settings
+        end
+
+        #@@settings = settings
+        def self.method_missing(name, *args, &block)
+          #  puts "* instance method missing (#{name})"
+          if name =~ /(.*)=$/
+          @settings.has_key? $1.to_sym || super
+          @settings[$1.to_sym] = args[0]
+          else
+          # puts @settings[name.to_sym]
+          @settings[name.to_sym]
+
+          end
+        end
+
+        def self.included(clazz)
+          puts "* #{self} gets included into #{clazz}"
+          @settings.each_key do |k|
+            puts "* add method for #{k}"
+
+            clazz.class_eval "
+            @@#{k} ||= #{self}.#{k}
+
+            def #{k}=(value)
+            @@#{k} = value
+            end
+
+            def #{k}
+            @@#{k}
+            end
+            "
+
+          end
+        end
+
+      end
+      @@modules << m
+    end
+
+  end
+end

data/lib/watobo/constants.rb

@@ -0,0 +1,92 @@
+# .
+# constants.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+$debug_project = false
+$debug_active_check = false
+$debug_scanner = false
+
+
+module Watobo
+  module Constants    
+    CHAT_SOURCE_UNDEF = 0x00
+    CHAT_SOURCE_INTERCEPT = 0x01
+    CHAT_SOURCE_PROXY = 0x02
+    CHAT_SOURCE_MANUAL = 0x03
+    CHAT_SOURCE_FUZZER = 0x04
+    CHAT_SOURCE_MANUAL_SCAN = 0x05
+    CHAT_SOURCE_AUTO_SCAN = 0x06
+    
+    FINDING_TYPE_UNDEFINED = 0x00
+    FINDING_TYPE_INFO = 0x03
+    FINDING_TYPE_HINT = 0x01
+    FINDING_TYPE_VULN = 0x02
+    
+    VULN_RATING_UNDEFINED = 0x00
+    VULN_RATING_INFO = 0x01
+    VULN_RATING_LOW = 0x02
+    VULN_RATING_MEDIUM = 0x03
+    VULN_RATING_HIGH = 0x04
+    VULN_RATING_CRITICAL = 0x05
+    
+    # ActiveCheck Groups
+    AC_GROUP_GENERIC = "Generic"
+    AC_GROUP_SQL = "SQL-Injection"
+    AC_GROUP_XSS = "XSS"
+    AC_GROUP_ENUMERATION = "Enumeration"
+    AC_GROUP_FILE_INCLUSION = "File Inclusion"
+    
+    AC_GROUP_DOMINO = "Lotus Domino"
+    AC_GROUP_SAP = "SAP"
+    AC_GROUP_TYPO3 = "Typo3"
+    AC_GROUP_JOOMLA = "Joomla"
+    AC_GROUP_JBOSS = "JBoss AS"
+    AC_GROUP_FLASH = "Flash"
+    AC_GROUP_APACHE = "Apache"
+    
+    ICON_PATH = "icons"
+    
+    FIRST_TIME_FILE = "first_time_file"  
+    
+    # Transfer Encoding Types
+    TE_NONE = 0x00
+    TE_CHUNKED = 0x01
+    TE_COMPRESS = 0x02
+    TE_GZIP = 0x04
+    TE_DEFLATE = 0x08
+    TE_IDENTITY = 0x10
+    
+    # Log Level
+    LOG_INFO = 0x00
+    LOG_DEBUG = 0x01
+    
+    # Authentication Types
+    AUTH_TYPE_NONE =   0x00
+    AUTH_TYPE_BASIC =  0x01
+    AUTH_TYPE_DIGEST = 0x02
+    AUTH_TYPE_NTLM =   0x04
+    
+    GUI_SMALL_FONT_SIZE = 7
+    GUI_REGULAR_FONT_SIZE = 9
+    
+    DEFAULT_PORT_HTTP = 80
+    DEFAULT_PORT_HTTPS = 443
+  end
+end