watobo 0.9.8.677

data/lib/watobo/utils/copy_object.rb

@@ -0,0 +1,29 @@
+# .
+# copy_object.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  module Utils
+    def Utils.copyObject(object)
+       copy = secure_eval(YAML.load(YAML.dump(object.inspect)))
+        return copy
+    end
+  end
+end

data/lib/watobo/utils/crypto.rb

@@ -0,0 +1,74 @@
+# .
+# crypto.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+require 'openssl'
+require 'digest/sha1'
+require 'base64'
+
+# Thanks to : http://rails.brentsowers.com/2007/12/aes-encryption-and-decryption-in-ruby.html
+module Watobo
+module Crypto
+  
+  def Crypto.encryptPassword(plain_password, secret)
+    Base64.encode64(Crypto.encrypt(plain_password, secret)).strip
+  end
+  
+  def Crypto.decryptPassword(b64_encrypted_password, secret)
+    ep = Base64.decode64(b64_encrypted_password)
+    decrypt(ep, secret)
+    end
+    
+    
+  def Crypto.decrypt(encrypted_data, pass, iv=nil, cipher_type="AES-256-CBC")
+    aes = OpenSSL::Cipher::Cipher.new(cipher_type)
+    aes.decrypt
+    aes.key = Digest::SHA256.digest(pass)
+    aes.iv = iv if iv != nil
+    aes.update(encrypted_data) + aes.final  
+  end  
+   
+  def Crypto.encrypt(data, pass, iv=nil, cipher_type="AES-256-CBC")
+    aes = OpenSSL::Cipher::Cipher.new(cipher_type)
+    aes.encrypt
+    aes.key = Digest::SHA256.digest(pass)
+    aes.iv = iv if iv != nil
+    aes.update(data) + aes.final      
+  end
+end
+end
+
+if __FILE__ == $0
+  # TODO Generated stub
+ # cipher = "AES-256-CBC"
+  pass = "password"
+  #iv = nil
+  
+  plaintext = "S3cr3t"
+  1000.times do |i|
+  plaintext += (rand(65)+35).chr + "OK"
+  encrypted = Crypto.encrypt(plaintext, pass)
+  puts encrypted
+  
+  puts "* now decrypt again"
+  plain = Crypto.decrypt(Base64.decode64(encrypted), pass)
+  puts plain
+  end
+end

data/lib/watobo/utils/expand_range.rb

@@ -0,0 +1,45 @@
+# .
+# expand_range.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  module Utils
+    # expand range creates an array out of 
+    def self.expand_range(pattern)
+      vals = pattern.split(",")
+
+      result = []
+      vals.each do |v|
+        v.strip!
+        if v =~ /^(\d+)$/ then
+          result.push $1.to_i
+        elsif v =~ /^(\d+)-(\d+)$/
+          start = $1
+          stop = $2
+          dummy = (start..stop).to_a
+          result.concat dummy
+        end
+      end
+      result.uniq!
+      return result
+    end
+
+  end
+end

data/lib/watobo/utils/file_management.rb

@@ -0,0 +1,73 @@
+# .
+# file_management.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  module Utils
+    # e.g, save_settings("test-settings.test", 0, "@saved_settings", @saved_settings) 
+    
+    def Utils.save_settings(file, settings)
+      begin
+        if settings.is_a? Hash
+          File.open(file, "w") { |fh|
+            YAML.dump(settings, fh)
+          }
+          return true
+        else
+          return false
+        end
+      rescue => bang
+        puts bang
+        puts bang.backtrace if $DEBUG
+      end
+      return false
+    end
+    
+    def Utils.loadSettings(file)
+      
+      if File.exists?(file) then
+        # exp = File.open(file).read
+        # settings = secure_eval(exp)
+        settings = nil
+        File.open(file,"r") { |fh|
+          settings = YAML.load(fh)
+        }
+        return settings
+      end
+    end 
+    
+    def Utils.saveChat(chat, filename)
+      chat_data = {
+        :request => chat.request.map{|x| x.inspect},
+        :response => chat.response.map{|x| x.inspect},
+      }
+      
+      chat_data.update(chat.settings)                
+      if File.exists?(filename) then
+        puts "Updating #{filename}"
+        File.open(filename, "w") { |fh| 
+          YAML.dump(chat_data, fh)
+        }
+        chat.file = filename
+      end
+    end
+    
+  end
+end

data/lib/watobo/utils/load_chat.rb

@@ -0,0 +1,219 @@
+# .
+# load_chat.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  module Utils
+    
+    # loadChat returns a chat object imported from a yaml file
+    def Utils.loadChatYAML(file)
+      begin
+        if File.exists?(file) then
+          # p file
+          cdata  = YAML.load(File.open(file,"rb").read)
+          return nil unless cdata
+          # need to restore CRLF
+          cdata[:request].map!{|l| 
+            if l =~ /^\"/ then
+              x = secure_eval(l)
+            else
+              x = l.strip + "\r\n"
+              x = l if l == cdata[:request].last
+            end
+            
+            x
+          }
+          
+          cdata[:response].map!{|l| 
+            if l =~ /^\"/ then
+              x = secure_eval(l)
+            else
+              x = l.strip + "\r\n"
+              x = l if l == cdata[:response].last
+            end   
+            
+            x
+          }
+          # puts cdata
+          # puts cdata.class
+          
+          settings = Hash.new
+          settings.update cdata
+          settings.delete(:response)
+          settings.delete(:request)
+          
+          chat = Watobo::Chat.new(cdata[:request], cdata[:response], settings)
+          chat.file = file
+          
+          return chat
+          
+        else
+          puts "* file #{file} not found"
+          return nil
+        end
+      rescue => bang
+        puts "! could not load chat from file #{file}"
+        puts cdata
+        #puts bang
+        #puts bang.backtrace if $DEBUG
+      end
+    end
+    
+    
+    def Utils.loadFindingYAML(file)
+     # puts file
+      if File.exists?(file) then
+        begin
+        fdata  = YAML.load(File.open(file,"rb").read)
+        # need to restore CRLF
+        return nil unless fdata
+        fdata[:request].map!{|l| 
+          if l =~ /^\"/ then
+            x = secure_eval(l)
+          else
+            x = l.strip + "\r\n"
+            x = l if l == fdata[:request].last
+          end
+          x
+        }
+        
+        fdata[:response].map!{|l|
+          if l =~ /^\"/ then
+            x = secure_eval(l)
+          else
+            x = l.strip + "\r\n"
+            x = l if l == fdata[:response].last
+          end
+          x
+        }
+        finding = Watobo::Finding.new(fdata[:request], fdata[:response], fdata[:details])
+        
+        return finding
+      rescue => bang
+        puts bang
+        puts "could not load finding #{file}"
+        return nil
+        end
+      else
+        #   puts "* file #{file} not found"
+        return nil
+      end
+    end
+    
+    def Utils.loadChat(path, id, request_pattern, response_pattern)
+      chat = nil
+      req_file = File.join(path, "#{id}#{request_pattern}")
+      res_file = File.join(path, "#{id}#{response_pattern}")
+      #   puts "* load chat (request): #{req_file}"
+      #   puts "* load chat (response): #{res_file}"
+      request = []
+      if File.exists?(req_file) then
+        fh = File.open(req_file,"rb")
+        fh.each do |line|  
+          request.push line
+        end
+      else
+        # puts "!! File not found (#{req_file})"
+        return nil,nil
+      end
+      
+      response = []
+      # print "."
+      # first only read header as array
+      content_length = 0
+      response_is_gzipped = false
+      content_is_chunked = false
+      max_response_size = 50000
+      
+      if File.exists?(res_file) then
+        begin
+          
+          resFH = open(res_file, "rb")
+          
+          loop do
+            l = resFH.readline
+            if l =~ /Content-Length.* (\d*)/ then
+              content_length = $1.to_i
+              #puts "Content-Length is #{content_length}"
+            end
+            if l =~ /Content-Encoding.*gzip/ then
+              response_is_gzipped = true
+            end
+            if l=~ /Transfer-Encoding.*chunked/i then
+              content_is_chunked = true
+            end
+            response.push(l)
+            # break if l.length < 3 # end of header
+            break if l =~ /^\r\n$/ # end of header
+          end    
+          
+          if content_is_chunked then
+            # read rest of file
+            response.push "\r\n"
+            response.push resFH.read
+            #content_length = dummy.chomp.hex
+            return request, response
+          end
+        rescue => bang
+          puts "Could not read Header from file #{res_file}"
+        end
+        # now read response body
+        begin
+          if response_is_gzipped and content_length > 0 then            
+            gziped = resFH.read(content_length)
+            begin
+              gz = Zlib::GzipReader.new( StringIO.new( gziped ) )
+              data = gz.read
+              if data.length > max_response_size then
+                data = data[0..max_response_size]
+                puts "!!! chat file (#{res_file}: Response too long"
+                # puts data
+              end
+              response.push data
+            rescue => bang
+              puts "ERROR: GZIP with file #{res_file}"
+              puts bang
+              #resFH.each do |l|
+              #  response.push(l) if response.join.length < @max_response_size
+              #end
+            end
+            return request, response
+          end
+          
+          #resFH.each do |l|
+          #  response.push(l) if response.join.length < max_response_size
+          #end
+          rest = resFH.read
+          response.push(rest)
+          
+          return request, response
+        rescue EOFError => bang
+          return request, response
+        rescue => bang
+          puts "!!! Error: Could not read response file #{res_file}"
+          puts bang
+        end
+        
+      end
+    end
+    
+    
+  end
+end

data/lib/watobo/utils/load_icon.rb

@@ -0,0 +1,47 @@
+# .
+# load_icon.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  module Utils
+    def loadIcon(app, filename)
+      begin
+        icon = nil
+        
+        File.open(filename, "rb") do |f| 
+          if filename.strip =~ /\.ico$/ then
+            icon = FXICOIcon.new(app, f.read)
+            #icon = FXICOIcon.new(getApp(), f.read)
+          elsif filename.strip =~ /\.png$/ then
+            icon = FXPNGIcon.new(app, f.read)
+          elsif filename.strip =~ /\.gif$/ then
+            icon = FXGIFIcon.new(app, f.read)
+          end
+          icon.create
+        end
+        
+        icon
+      rescue => bang
+        puts "Couldn't load icon: #{filename}"
+        puts bang
+      end
+    end
+  end
+end

data/lib/watobo/utils/print_debug.rb

@@ -0,0 +1,34 @@
+# .
+# print_debug.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  def self.print_debug(*m)
+    fl = m.shift
+    puts "#"
+    puts "# #{fl} #"
+    if m.length > 0
+      m.each do |l|
+        puts l
+      end
+      puts "# " + "-"*fl.length + " #"
+    end
+  end
+end

data/lib/watobo/utils/response_hash.rb

@@ -0,0 +1,143 @@
+# .
+# response_hash.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+require 'digest/md5'
+
+module Watobo
+  module Utils
+    def Utils.responseHash(request, response)
+      begin
+        if request.body and response.body then
+          #     request.extend Watobo::Mixin::Parser::Web10
+          #     request.extend Watobo::Mixin::Shaper::Web10
+
+          #     response.extend Watobo::Mixin::Parser::Web10
+          #     response.extend Watobo::Mixin::Shaper::Web10
+
+          body = response.body
+
+          # remove all parm/value pairs
+          request.get_parm_names.each do |p|
+            body.gsub!(/#{Regexp.quote(p)}/, '')
+            val = request.get_parm_value(p)
+            body.gsub!(/#{Regexp.quote(val)}/, '')
+          end
+          request.post_parm_names.each do |p|
+            body.gsub!(/#{Regexp.quote(p)}/, '')
+            val = request.post_parm_value(p)
+            body.gsub!(/#{Regexp.quote(val)}/, '')
+          end
+        # remove date format 01.02.2009
+        body.gsub!(/\d{1,2}\.\d{1,2}.\d{2,4}/, "")
+        # remove date format 02/2009
+        body.gsub!(/\d{1,2}(.\|\/)d{2,4}/, "")
+        #remove time
+        body.gsub!(/\d{1,2}:\d{1,2}(:\d{1,2})?/, '')
+
+        return body, Digest::MD5.hexdigest(body)
+
+        elsif response.body then
+        return body, Digest::MD5.hexdigest(response.body)
+        else
+        return nil
+        end
+      rescue => bang
+      puts bang
+      puts bang.backtrace if $DEBUG
+      end
+      return nil
+
+    end
+
+    # smart hashes are necessary for blind sql injections tests
+    # SmartHash means that all dynamic information is removed from the response before creating the hash value.
+    # Dynamic information could be date&time as well as parameter names and theire valuse.
+    def Utils.smartHash(orig_request, request, response)
+      begin
+        if request and response.body then
+
+          body = response.body.dup
+          # remove possible chunk values
+          body.gsub!(/\r\n[0-9a-fA-F]+\r\n/,'')
+          # remove date format 01.02.2009
+          body.gsub!(/\d{1,2}\.\d{1,2}.\d{2,4}/, "")
+          # remove date format 02/2009
+          body.gsub!(/\d{1,2}(.\|\/)d{2,4}/, "")
+          #remove time
+          body.gsub!(/\d{1,2}:\d{1,2}(:\d{1,2})?/, '')
+          # remove all non-printables
+          body.gsub!(/[^[:print:]]/,'')
+
+          request.get_parm_names.each do |p|
+            body.gsub!(/#{Regexp.quote(p)}/, '')
+            body.gsub!(/#{Regexp.quote(CGI::unescape(p))}/, '')
+
+            val = request.get_parm_value(p)
+            body.gsub!(/#{Regexp.quote(val)}/, '')
+            body.gsub!(/#{Regexp.quote(CGI::unescape(val))}/, '')
+
+          end
+
+          request.post_parm_names.each do |p|
+            body.gsub!(/#{Regexp.quote(p)}/, '')
+            body.gsub!(/#{Regexp.quote(CGI::unescape(p))}/, '')
+
+            val = request.post_parm_value(p)
+            body.gsub!(/#{Regexp.quote(val)}/, '')
+            body.gsub!(/#{Regexp.quote(CGI::unescape(val))}/, '')
+          end
+
+          # remove all parm/value pairs
+          orig_request.get_parm_names.each do |p|
+            body.gsub!(/#{Regexp.quote(p)}/, '')
+            body.gsub!(/#{Regexp.quote(CGI::unescape(p))}/, '')
+
+            val = orig_request.get_parm_value(p)
+            body.gsub!(/#{Regexp.quote(val)}/, '')
+            body.gsub!(/#{Regexp.quote(CGI::unescape(val))}/, '')
+          end
+
+          orig_request.post_parm_names.each do |p|
+            body.gsub!(/#{Regexp.quote(p)}/, '')
+            body.gsub!(/#{Regexp.quote(CGI::unescape(p))}/, '')
+
+            val = orig_request.post_parm_value(p)
+            body.gsub!(/#{Regexp.quote(val)}/, '')
+            body.gsub!(/#{Regexp.quote(CGI::unescape(val))}/, '')
+          end
+        return body, Digest::MD5.hexdigest(body)
+        else
+        puts "!!! SMART-HASH is NIL !!!!"
+        # puts request
+        # puts "----------------------"
+        # puts response.body
+        return nil
+        end
+      rescue => bang
+      puts bang
+      puts bang.backtrace if $DEBUG
+      return body, Digest::MD5.hexdigest(body||="")
+      end
+
+    end
+
+  end
+end