watobo 0.9.8.677

data/lib/watobo/utils/secure_eval.rb

@@ -0,0 +1,57 @@
+# .
+# secure_eval.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  module Utils
+    
+    def Utils.secure_eval(exp)
+      result = nil
+      t = Thread.new(exp) { |e|
+        e.untaint
+     #   $SAFE = 3
+        $SAFE = 4 # does not work here
+        begin
+          
+         result = eval(e)
+         
+      
+        rescue SyntaxError => bang
+          puts bang
+      puts bang.backtrace if $DEBUG
+        rescue LocalJumpError => bang
+          puts bang
+      puts bang.backtrace if $DEBUG
+        rescue SecurityError => bang
+          puts "WARNING: Desired functionality forbidden. it may harm your system!"
+          puts bang.backtrace if $DEBUG
+        rescue => bang
+          puts bang
+          puts bang.backtrace if $DEBUG
+          
+        end
+      }
+      t.join
+      return result
+     
+    end
+    
+  end
+end

data/lib/watobo/utils/text2request.rb

@@ -0,0 +1,96 @@
+# .
+# text2request.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  module Utils
+    def Utils.text2request(text)
+        result = []
+        if text =~ /\n\n/
+          dummy = text.split(/\n\n/)
+          header = dummy.shift.split(/\n/)
+          body = dummy.join("\n\n")
+        else
+          header = text.split(/\n/)
+          body = nil
+        end
+        
+        header.each do |h|
+          result.push "#{h}\r\n"
+        end
+        
+        result.extend Watobo::Mixin::Parser::Url
+        result.extend Watobo::Mixin::Parser::Web10
+        result.extend Watobo::Mixin::Shaper::Web10
+        
+        ct = result.content_type
+        # last line is without "\r\n" if text has a body
+        if ct =~ /multipart\/form/ and body then
+          #Content-Type: multipart/form-data; boundary=---------------------------3035221901842
+          if ct =~ /boundary=([\-\w]+)/
+            boundary = $1.strip
+            chunks = body.split(boundary)
+            e = chunks.pop # remove "--" 
+            new_body = []
+            chunks.each do |c|
+              new_chunk = ''
+              c.gsub!(/[\-]+$/,'')
+              next if c.nil?
+              next if c.strip.empty?
+              c.strip!
+              if c =~ /\n\n/
+                ctmp = c.split(/\n\n/)
+                cheader = ctmp.shift.split(/\n/)
+                cbody = ctmp.join("\n\n")
+              else
+                cheader = c.split(/\n/)
+                cbody = nil
+              end
+              new_chunk = cheader.join("\r\n")
+              new_chunk +=  "\r\n\r\n"
+              new_chunk += cbody.strip + "\r\n" if cbody
+              
+              # puts cbody
+              new_body.push new_chunk
+              
+            end
+            body = "--#{boundary}\r\n"
+            body += new_body.join("--#{boundary}\r\n")
+            body += "--#{boundary}--"
+          end
+          #  body.gsub!(/\n/, "\r\n") if body
+          
+        end
+        
+        if body then
+          result.push "\r\n"
+          result.push body.strip
+        end
+        
+        
+        return result
+      
+    end
+  end
+end
+
+if __FILE__ == $0
+  # TODO Generated stub
+end

data/lib/watobo/utils.rb

@@ -0,0 +1,32 @@
+# .
+# utils.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  module Utils
+    utils_path = File.expand_path(File.join(File.dirname(__FILE__), "utils"))
+    #puts "* loading utils #{utils_path}"
+    Dir.glob("#{utils_path}/*.rb").each do |cf|
+      puts "+ #{File.basename(cf)}" if $DEBUG
+      require File.join("watobo","utils", File.basename(cf))
+
+    end
+  end
+end

data/lib/watobo.rb

@@ -0,0 +1,76 @@
+# .
+# watobo.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+require 'rubygems'
+require 'yaml'
+require 'thread'
+require 'socket'
+require 'timeout'
+require 'openssl'
+require 'optparse'
+require 'digest/md5'
+require 'zlib'
+require 'base64'
+require 'cgi'
+require 'pathname'
+
+require 'watobo/constants'
+require 'watobo/utils'
+require 'watobo/mixins'
+require 'watobo/config'
+require 'watobo/defaults'
+require 'watobo/core'
+require 'watobo/externals'
+require 'watobo/adapters'
+require 'watobo/framework'
+
+module Watobo
+
+  VERSION = "0.9.8.677"
+
+  def self.base_directory
+    @base_directory ||= ""
+    @base_directory = File.expand_path(File.join(File.dirname(__FILE__),".."))
+  end
+
+  def self.plugin_path
+    @plugin_directory ||= ""
+    @plugin_directory = File.join(base_directory, "plugins")
+  end
+
+  def self.active_module_path
+    @active_module_path = ""
+    @active_path = File.join(base_directory, "modules", "active")
+  end
+  
+  def self.passive_module_path
+    @passive_module_path = ""
+    @passive_path = File.join(base_directory, "modules", "passive")
+  end
+
+  def self.version
+    Watobo::VERSION
+  end
+end
+
+puts "* init framework ..."
+Watobo.init_framework
+

data/modules/active/Apache/mod_status.rb

@@ -0,0 +1,123 @@
+# .
+# mod_status.rb
+#
+# Copyright 2010 by it.sec, http://www.www.it-sec.de
+#
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+#
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+#
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  module Modules
+    module Active
+      module Apache
+        class Mod_status < Watobo::ActiveCheck
+          def reset()
+            #@checked_dirs.clear
+          end
+
+          def initialize(project, prefs={})
+            super(project, prefs)
+
+            @info.update(
+            :check_name  => 'Server-Status page',    # name of check which briefly describes functionality, will be used for tree and progress views
+            :description => "Check for status page created by mod_status",   # description of checkfunction
+            :author      => "Hans-Martin Muench", # author of check
+            :check_group => AC_GROUP_APACHE,
+            :version     => "0.1"   # check version
+            )
+
+            @finding.update(
+            :class        => "Information disclosure",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+            :type         => FINDING_TYPE_HINT,           # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN
+            :measure	     => "Disable the mod_status module or restrict the access to the status page",
+            :threat	     => "The result page of the mod-status module is accessible without authentication. This page contains information about the server activity and performance"
+            )
+
+            @status_checks = ['/server-status/', '/server_status/', '/serverstatus/', '/mod-status/', '/mod_status/', '/modstatus', 'status']
+
+            @checked_sites = Hash.new
+          end
+
+          def generateChecks(chat)
+            if not @checked_sites.has_key?(chat.request.site)
+              @checked_sites[chat.request.site] = :checked
+              @status_checks.each do |status_path|
+                checker = proc {
+
+                  test_request = nil
+                  test_response = nil
+
+                  # IMPORTANT!!!
+                  # use copyRequest(chat) for cloning the original request
+                  test = chat.copyRequest
+                  test.setDir(status_path)
+
+                  status, test_request, test_response = fileExists?(test, :default => true)
+
+                  if test_response.status =~ /200/ and test_response.join =~ /Apache Server Status for/ then
+
+                    addFinding( test_request, test_response,
+                    :check_pattern => "#{status_path}",
+                    :proof_pattern => "Apache Server Status for",
+                    :test_item => status_path,
+                    :chat => chat,
+                    :title => "[Server] - Server-Status page",
+                    :rating => VULN_RATING_LOW
+                    )
+
+                  elsif test_response.status =~ /403/ then
+
+                    addFinding( test_request, test_response,
+                    :threat  => "Mod-status is installed but access is denied",
+                    :measure      => "Disable the mod_status module if not needed",
+                    :check_pattern => "#{status_path}",
+                    :proof_pattern => "403 Forbidden",
+                    :test_item => status_path,
+                    :type    => FINDING_TYPE_INFO,
+                    :class => "Information",
+                    :chat => chat,
+                    :title => "[Server] - Server-Status page",
+                    :rating => VULN_RATING_LOW
+                    )
+
+                  elsif test_response.status =~ /401/ then
+
+                    addFinding( test_request, test_response,
+                    :threat  => "Mod-status is installed but access is password protected",
+                    :measure      => "Disable the mod_status module if not needed",
+                    :check_pattern => "#{status_path}",
+                    :proof_pattern => "401 Unauthorized",
+                    :test_item => status_path,
+                    :type    => FINDING_TYPE_HINT,
+                    :class => "Information",
+                    :chat => chat,
+                    :title => "[Server] - Server-Status page",
+                    :rating => VULN_RATING_LOW
+                    )
+
+                  end
+
+                  [ test_request, test_response ]
+                }
+                yield checker
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/modules/active/Flash/crossdomain.rb

@@ -0,0 +1,102 @@
+# .
+# crossdomain.rb
+#   
+# Copyright 2010 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  module Modules
+    module Active
+      module Flash 
+        
+        
+        class Crossdomain < Watobo::ActiveCheck
+          
+          def reset()
+            @checked_dirs.clear  
+          end
+          
+          def initialize(project, prefs={})
+            super(project, prefs)
+            @info.update(
+                        :check_name => 'Crossdomain Policy',    		# name of check which briefly describes functionality, will be used for tree and progress views
+            		:description => "Check for crossdomain.xml weaknesses", # description of checkfunction
+					:check_group => AC_GROUP_FLASH,
+            		:author => "Hans-Martin Muench", 			# author of check
+            		:version => "0.1"   					# check version
+            )
+            
+            
+            
+            @finding.update(
+                        :class => "Crossdomain.xml check",    			# vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+            		:type => FINDING_TYPE_VULN         			# FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN
+            )
+            
+            
+            @checked_dirs = Hash.new
+          end
+         
+ 
+          def generateChecks(chat)  
+          	directory = chat.request.dir
+               	if not @checked_dirs.has_key?(directory)                  
+                 	@checked_dirs[directory] = :checked
+                  	checker = proc {
+                     		test_request = nil
+                     		test_response = nil
+		     		path = directory + "/crossdomain.xml"                     
+
+		      		# IMPORTANT!!!
+                      		# use copyRequest(chat) for cloning the original request 
+                      		test = chat.copyRequest
+                      		test.setDir(path)
+                      		status, test_request, test_response = fileExists?(test, :default => true)
+	
+                      		if status == true 
+
+					# Do a simple match on the response to detect
+					# if we have <allow-access-from domain="*"/>
+					if test_response.join =~ /<allow-access-from\s+domain="\*"\s+/i then
+ 						
+						proof_pattern = $~
+
+                        			addFinding( test_request, test_response,
+                               				:check_pattern => "<allow-access-from\\s+domain=\"*\"\\s+",
+                               				:proof_pattern => proof_pattern.to_s,
+                               				:test_item => "test-item",
+                               				:chat => chat,
+                               				:title => "Badly configured crossdomain.xml",
+                               				:rating => VULN_RATING_CRITICAL,
+                               				:threat => "The current crossdomain.xml policy allows cross domain access from everywhere",
+                               				:measure => "Restrict the allowed hosts setting inside the policy", 
+                               				:class => "Flash security"
+                        			)
+                      			end
+				end
+                      		[ test_request, test_response ]
+
+                  	}
+                  	yield checker
+               	end # end ifnot
+	      end
+	    end # end proc
+          end  # end class
+        end # end module flash
+      end  # end Active
+    end # End modules

data/modules/active/directories/dirwalker.rb

@@ -0,0 +1,89 @@
+# .
+# dirwalker.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  module Modules
+    module Active
+      module Directories
+        
+        #class Dir_indexing < Watobo::Mixin::Session
+        class Dirwalker < Watobo::ActiveCheck
+          @@tested_directories = Hash.new
+          
+          def initialize(project, prefs={})
+            super(project, prefs)
+            
+            @info.update(
+                         :check_name => 'Directory Walker',    # name of check which briefly describes functionality, will be used for tree and progress views
+            :description => "Do request on each directory and run passive checks on result.",   # description of checkfunction
+            :author => "Andreas Schmidt", # author of check
+            :version => "1.0"   # check version
+            )
+            
+            
+          end
+          
+          def reset()
+            @@tested_directories.clear
+          end
+          
+          def generateChecks(chat)
+            
+            begin
+              path = chat.request.dir
+              if !@@tested_directories.has_key?(path) then
+                @@tested_directories[path] = true
+                checker = proc {
+                  begin
+                      test_request = nil
+                      test_response = nil
+                      # !!! ATTENTION !!!
+                      # MAKE COPY BEFORE MODIFIYING REQUEST 
+                      test = chat.copyRequest
+                      test.strip_path()
+                     # puts "!Dirwalker"
+                     # puts test.first
+                      # fire it up!
+                      test_request, test_response = doRequest(test, :default => true)
+                      #nc = Qchat.new(test_request, test_response, chat.id)
+                      #@project.runPassiveChecks(nc)
+                      [ test_request, test_response ]
+
+                  rescue => bang
+                    puts bang
+                    puts bang.backtrace if $DEBUG
+                  end
+                  [ nil, nil ]
+                  
+                }
+                yield checker
+              end
+            rescue => bang
+              puts "!error in module #{Module.nesting[0].name}"
+              puts bang
+            end
+          end
+          
+        end
+      end
+    end  
+  end
+end