watobo 0.9.8.677

data/modules/active/discovery/fileextensions.rb

@@ -0,0 +1,151 @@
+# .
+# fileextensions.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  module Modules
+    module Active
+      module Discovery
+        
+        
+        class Fileextensions < Watobo::ActiveCheck
+          
+          def initialize(session_name=nil, prefs={})
+          #  @project = project
+            super(session_name, prefs)
+            
+            @info.update(
+                         :check_name => 'FileExtensions',    # name of check which briefly describes functionality, will be used for tree and progress views
+            :description => "Checks for temporary- or backup-files",   # description of checkfunction
+            :author => "Andreas Schmidt", # author of check
+            :version => "0.9"   # check version
+            )
+            
+            @finding.update(
+                            :threat => 'Temporary- or backup files may contain sensitive information, e.g. source-code or username/password.',        # thread of vulnerability, e.g. loss of information
+            :class => "File Extension",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+            :rating => VULN_RATING_HIGH,
+            :type => FINDING_TYPE_VULN         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN 
+            )
+            
+            
+            
+            #  @tested_directories = Hash.new
+            @fext = %w( php asp aspx jsp cfm shtm htm html shml )
+            @prefixes = [ "", "~", "_"]
+            @suffixes = [ "tmp", "bak", "tgz", "tar.gz", "tar", "gz", "zip", "bz2", "old"]
+          end
+          
+          def reset()
+            
+          end
+          
+          def generateChecks(chat)
+            
+            begin
+              file = chat.request.file
+              #e = dummy.split('?').first
+              
+              if file != "" and file =~ /\.(#{@fext.join("|")})$/ then
+             
+                @prefixes.each do |pref|
+                  @suffixes.each do |suf|
+                    
+                    #sleep(1)
+                    checker = proc{
+                      test_request = nil
+                      test_response = nil
+                      new_file = pref + file.gsub(/\.\w{1,4}$/, ".#{suf}")
+                    #  puts new_file
+                      # !!! ATTENTION !!!
+                      # MAKE COPY BEFORE MODIFIYING REQUEST 
+                      test_request = chat.copyRequest
+                      
+                      test_request.replaceFileExt(new_file)
+                      # result_request, result_response = doRequest(test_request, :default => true)
+                      #   puts test_request.first
+                      
+                      status, test_request, test_response = fileExists?(test_request, :default => true)
+                      # puts new_e + " : " + test_response.status
+                      if status == true then                     
+                        puts "GOTCHA - #{self.class}!!!\n+ #{test_request.first}\n"
+                        #test_chat = Chat.new(test_request, test_response, chat.id)
+                        addFinding( test_request, test_response,
+                                   :check_pattern => "#{new_file}",
+                                   :test_item => file,
+                        :proof_pattern => "#{test_response.status}",
+                        :chat => chat,
+                        :title => "#{new_file}"
+                        #:debug => true
+                        )                        
+                      end
+                      [ test_request, test_response ] 
+                    }
+                    yield checker
+                    
+                    checker = proc{
+                      test_request = nil
+                      test_response = nil
+                      new_file = pref + file + ".#{suf}"
+                      
+                      # !!! ATTENTION !!!
+                      # MAKE COPY BEFORE MODIFIYING REQUEST 
+                      test_request = chat.copyRequest
+                      
+                      test_request.replaceFileExt(new_file)
+                      # result_request, result_response = doRequest(test_request, :default => true)
+                      
+                      
+                      status, test_request, test_response = fileExists?(test_request, :default => true)
+                      # puts new_e + " : " + test_response.status
+                      
+                      if status == true then                     
+                        #  puts "\n+ #{test_request.first}\n"
+                       # test_chat = Chat.new(test_request, test_response, chat.id)
+                        addFinding( test_request, test_response,
+                                   :check_pattern => "#{new_file}",
+                                   :test_item => file,
+                        :proof_pattern => "#{test_response.status}",
+                        :chat => chat,
+                        :title => "#{new_file}"
+                        #:debug => true
+                        )                        
+                      end
+                      [ test_request, test_response ] 
+                    }
+                    yield checker
+                    
+                  end    
+                end      
+              end
+            rescue => bang
+              
+              puts "ERROR!! #{Module.nesting[0].name} "
+              puts "chatid: #{chat.id}"
+              puts bang
+              puts 
+              
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/modules/active/discovery/http_methods.rb

@@ -0,0 +1,135 @@
+# .
+# http_methods.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  module Modules
+    module Active
+      module Discovery
+        
+        
+        class Http_methods < Watobo::ActiveCheck
+           @@tested_directories = []
+          def initialize(project, prefs={})
+            @project = project
+            super(project, prefs)
+            
+            @info.update(
+                         :check_name => 'HTTP Methods',    # name of check which briefly describes functionality, will be used for tree and progress views
+            :description => "Checks for supported HTTP Methods.",   # description of checkfunction
+            :author => "Andreas Schmidt", # author of check
+            :version => "0.9"   # check version
+            )
+            
+            @finding.update(
+                            :threat => 'Some HTTP methods can be exploited by an attacker to compromise the system.',        # thread of vulnerability, e.g. loss of information
+            :class => "HTTP Methods",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+            :type => FINDING_TYPE_HINT         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN 
+            )
+            
+            
+            
+           
+            
+            @dummy_element = "WATOBO"
+            
+            @not_allowed_response = [ "UNAUTHORIZED", "NOT IMPLEMENTED", "NOT ALLOWED", "NOT SUPPORTED", "FORBIDDEN", "BAD REQUEST", "302"]
+            
+            @test_methods = %w[ PROPFIND PROPPATCH COPY UNLOCK MKCOL ] + # web_dav_methods - DELETE is too dangerous here
+                          %w[ OPTIONS TRACE ]+ # common but unwanted methods
+                          %w[ TRACK DEBUG ] +             # IIS methods 
+                          %w[ CHECKOUT SHOWMETHOD LINK CHECKIN TEXTSEARCH SPACEJUMP SEARCH REPLY]+ # http://www.w3.org/Protocols/HTTP/Methods.html
+                          %w[ VERSION_CONTROL CHECKIN UNCHECKOUT PATCH ] # eclipse_methods
+            @test_methods = %w[ TRACE ]
+          end
+          
+          def reset()
+            @@tested_directories.clear
+          end
+          
+          def generateChecks(chat)
+            
+            begin
+               unless @@tested_directories.include?(chat.request.dir) then
+                @@tested_directories.push chat.request.dir
+                @test_methods.each do |method|
+                  #sleep(1)
+                  checker = proc{
+                  begin
+                    test_request = nil
+                    test_response = nil
+                    test_method = "#{method}"
+                    # !!! ATTENTION !!!
+                    # MAKE COPY BEFORE MODIFIYING REQUEST 
+                   
+                    test_request = chat.copyRequest
+                   
+                    test_request.replaceMethod(test_method)
+                   
+                    result_request, result_response = doRequest(test_request, :default => true)
+                    is_vuln = true
+                    if result_response.status then
+                      
+                      @not_allowed_response.each do |nar|
+                        if result_response.status =~ /#{nar}/i then 
+                          is_vuln = false                        
+                        end
+                      end
+                      
+                      if is_vuln == true then
+                        addFinding( result_request, result_response,
+                                   :check_pattern => "#{test_method}",
+                        :proof_pattern => "#{result_response.status}",
+                        :test_item => chat.request.dir,
+                        :chat => chat,
+                        :title => "#{test_method}"
+                        #:debug => true
+                        )
+                      end
+                    end
+                    [ result_request, result_response ] 
+                  rescue => bang
+                    puts bang
+                    puts bang.backtrace if $DEBUG
+                    [ nil, nil ]
+                    end
+                  }
+                  yield checker
+                end    
+                
+                
+              end
+              
+            end            
+          rescue => bang
+            
+            puts "ERROR!! #{Module.nesting[0].name} "
+            puts "chatid: #{chat.id}"
+            puts bang
+            puts 
+            
+          end
+          
+        end
+        
+      end
+    end
+  end
+end

data/modules/active/domino/domino_db.lst

@@ -0,0 +1,164 @@
+AgentRunner.nsf
+DEASAppDesign.nsf
+DEASLog01.nsf
+DEASLog02.nsf
+DEASLog03.nsf
+DEASLog04.nsf
+DEASLog05.nsf
+DEASLog.nsf
+DEESAdmin.nsf
+Forms5.nsf
+SchedulerTr.nsf
+account.nsf
+accounts.nsf
+admin4.nsf
+admin5.nsf
+adminisist.nsf
+admin.nsf
+agentrunner.nsf
+alog.nsf
+billing.nsf
+bookmark.nsf
+books.nsf
+busytime.nsf
+calendar.nsf
+catalog.nsf
+cersvr.nsf
+certa.nsf
+certlog.nsf
+certsrv.nsf
+chatlog.nsf
+clbusy.nsf
+cldbdir.nsf
+clusta4.nsf
+collect4.nsf
+cpa.nsf
+customerdata.nsf
+da.nsf
+database.nsf
+dba4.nsf
+db.nsf
+dclf.nsf
+decsadm.nsf
+decsdoc.nsf
+decslog.nsf
+default.nsf
+dirassist.nsf
+doladmin.nsf
+domadmin.nsf
+domcfg.nsf
+domguide.nsf
+domino.nsf
+domlog.nsf
+dspug.nsf
+event.nsf
+events4.nsf
+events5.nsf
+events.nsf
+faqw46.nsf
+framew46.nsf
+group.nsf
+groups.nsf
+help4.nsf
+helpadmin.nsf
+helpadmn.nsf
+helplt4.nsf
+hidden.nsf
+homepage.nsf
+internet.nsf
+javapg.nsf
+jotter.nsf
+kbccv11.nsf
+kbnv11.nsf
+kbssvv11.nsf
+lccon.nsf
+lcon.nsf
+ldap.nsf
+leiadm.nsf
+leilog.nsf
+leivlt.nsf
+log4a.nsf
+loga4.nsf
+log.nsf
+lsxlc.nsf
+mab.nsf
+mailw46.nsf
+main.nsf
+migrate.nsf
+msdwda.nsf
+mtatbls.nsf
+mtstore.nsf
+names.nsf
+nd000000.nsf
+nd000001.nsf
+nd000002.nsf
+nd000003.nsf
+nd000004.nsf
+nntppost.nsf
+notes.nsf
+.nsf
+ntsync45.nsf
+ntsync4.nsf
+pagesw46.nsf
+perweb.nsf
+private.nsf
+products.nsf
+public.nsf
+qpadmin.nsf
+qstart50.nsf
+qstart.nsf
+readmec.nsf
+readme.nsf
+readmes.nsf
+reports.nsf
+schema50.nsf
+secret.nsf
+secure.nsf
+setup.nsf
+setupweb.nsf
+siregw46.nsf
+site1w46.nsf
+site2w46.nsf
+site3w46.nsf
+smbcfg.nsf
+smconf.nsf
+smency.nsf
+smhelp.nsf
+smmsg.nsf
+smquar.nsf
+smsolar.nsf
+smtime.nsf
+smtpibwq.nsf
+smtp.nsf
+smtpobwq.nsf
+smtptbls.nsf
+smvlog.nsf
+software.nsf
+srvinst.nsf
+statmail.nsf
+statrep.nsf
+stats217.nsf
+stats572.nsf
+stats675.nsf
+stats988.nsf
+stauths.nsf
+stautht.nsf
+stconfig.nsf
+stconf.nsf
+stdnaset.nsf
+stdomino.nsf
+stlog.nsf
+streg.nsf
+stsrc.nsf
+test.nsf
+today.nsf
+user.nsf
+userreg.nsf
+users.nsf
+vpuserinfo.nsf
+webadmin.nsf
+web.nsf
+webuser.nsf
+welcome.nsf
+wksinst.nsf
+wwsample.nsf

data/modules/active/domino/domino_db.rb

@@ -0,0 +1,128 @@
+# .
+# domino_db.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+require 'digest/md5'
+require 'digest/sha1'
+
+module Watobo
+  module Modules
+    module Active
+      module Domino
+        
+        
+        class Domino_db < Watobo::ActiveCheck
+          
+          def initialize(project, prefs={})
+            super(project, prefs)
+            
+            @info.update(
+                         :check_name => 'Lotus Domino DB Enumeration',    # name of check which briefly describes functionality, will be used for tree and progress views
+            :description => "Enumeration of well known Domino DBs.",   # description of checkfunction
+            :author => "Andreas Schmidt", # author of check
+            :check_group => AC_GROUP_DOMINO,
+            :version => "0.9"   # check version
+            )
+            
+            @finding.update(
+                            :threat => 'Information Disclosure and/or modifying of databases.',        # thread of vulnerability, e.g. loss of information
+            :class => "Lotus Domino: Default Database",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+            :type => FINDING_TYPE_HINT         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN 
+            )
+            
+            
+            @domino_dbs = []
+            
+            filename = "domino_db.lst"            
+            path = File.dirname(__FILE__)            
+            db_file = File.join(path, filename)
+            
+            begin
+              fh = open(db_file,"r")  
+              fh.each_line do |dbname|
+                @domino_dbs.push dbname.strip
+              end
+            #  puts "* #{@domino_dbs.length} Lotus Domino DB Names loaded"
+            rescue => bang
+              puts "!!! ERROR: Problems import Domino DB List"
+              puts "File:"
+              puts "#{db_file}"
+              puts bang
+            end
+          end
+          
+          def generateChecks(chat)            
+            begin              
+              if chat.request.url =~ /(.*)\/\w*\.nsf/ then
+                @domino_dbs.each do |db|
+                  checker = proc{
+                    test_request = nil
+                    test_response = nil
+                    test = chat.copyRequest
+                    line = test.shift
+                    line.gsub!(/(\w*\.nsf.*) (HTTP\/.*)/, "#{db} \\2")
+                    puts line
+                    test.unshift line
+                    
+                    test_request,test_response = doRequest(test,:default => true)
+                    
+                    
+                    if test_response.status =~ /ok/i then
+                     # test_chat = Chat.new(test, test_response, chat.id)
+                      if test_response.join =~ /(names\.nsf\?Login)/ # if default db found, check for content
+                        addFinding( test_request,test_response,
+                        :test_item => chat.request.url,
+                                   :check_pattern => "#{db}",
+                        :proof_pattern => "#{test_response.status}", 
+                        :chat=>chat,
+                        :title => db
+                        )
+                      else
+                        addFinding(test_request,test_response,
+                                   :check_pattern => "#{db}",
+                        :proof_pattern => "#{test_response.status}",
+                        :test_item => chat.request.url,
+                        :class => "Lotus Domino: Unprotected Default DB",
+                        :type => FINDING_TYPE_VULN,
+                        :chat => chat,
+                        :rating => VULN_RATING_HIGH,
+                        :title => db
+                        )
+                        [ test_request, test_response ]
+                      end
+                    end
+                  }
+                  yield checker
+                end
+              end            
+            rescue => bang
+              puts bang
+              puts "ERROR!! #{Module.nesting[0].name}"
+              raise
+              
+            end
+          end
+          
+        end
+        # --> eo namespace    
+      end
+    end
+  end
+end