watobo 0.9.8.677

data/modules/passive/detect_one_time_tokens.rb

@@ -0,0 +1,86 @@
+# .
+# detect_one_time_tokens.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  module Modules
+    module Passive
+      
+      
+      class Detect_one_time_tokens < Watobo::PassiveCheck
+   
+        
+        def initialize(project)
+            @project = project
+          super(project)
+          begin
+           @info.update(
+            :check_name => 'Detect One-Time-Tokens',    # name of check which briefly describes functionality, will be used for tree and progress views
+            :description => "Detects parameters which are used as One-Time-Tokens to prevent CSRF-Attacks.",   # description of checkfunction
+            :author => "Andreas Schmidt", # author of check
+            :version => "0.9"   # check version
+            )
+            
+          @finding.update(
+            :threat => 'Informational',        # thread of vulnerability, e.g. loss of information
+            :class => "One-Time-Tokens",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+            :type => FINDING_TYPE_HINT         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN 
+          )
+          
+          
+          @pattern_list = []
+          @pattern_list << "csrf"
+              @pattern_list << "token"       
+            rescue => bang
+              puts bang
+              puts bang.backtrace if $DEBUG
+            end
+        end
+        
+        def do_test(chat)
+          begin
+            parm_names = chat.request.parm_names
+            
+            parm_names.each do |parm|
+            @pattern_list.each do |pat|
+              #puts "+check pattern #{pat}"
+              if  parm =~ /(#{pat})/i then
+               match = $1
+             #   puts match
+                addFinding(  
+                :check_pattern => "#{pat}",
+                :proof_pattern => "#{match}", 
+                :title => "[#{parm}] - #{chat.request.path}", 
+                :chat => chat
+                )
+               
+             end
+            end
+            end
+          rescue => bang
+            puts "ERROR!! #{Module.nesting[0].name}"
+            puts bang
+          end
+        end
+      end
+      
+    end
+  end
+end

data/modules/passive/dirindexing.rb

@@ -0,0 +1,81 @@
+# .
+# dirindexing.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+
+module Watobo
+  module Modules
+    module Passive
+      
+      
+      class Dirindexing < Watobo::PassiveCheck
+        
+        def initialize(project)
+          @project = project
+          super(project)
+          @info.update(
+                       :check_name => 'Directory Indexing',    # name of check which briefly describes functionality, will be used for tree and progress views
+          :description => "Detects if directory indexing is not disabled.",   # description of checkfunction
+          :author => "Andreas Schmidt", # author of check
+          :version => "0.9"   # check version
+          )
+          
+          @finding.update(
+                          :threat => 'May reveal sensitive information..',        # thread of vulnerability, e.g. loss of information
+          :class => "Directory Indexing",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+          :type => FINDING_TYPE_VULN,         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN
+          :rating => VULN_RATING_LOW 
+          )
+          
+          @tested_directories = []
+          
+          @pattern_list = []
+          @pattern_list << 'Parent Directory</a>'
+          @pattern_list << 'Directory Listing for'
+          @pattern_list << '<title>.*Folder Listing.*<\/title>'
+          @pattern_list << '<title>.*Index of /.*</title>'
+          
+          @pattern_list << '<table summary="Directory Listing" '
+          @pattern_list << 'Browsing directory'
+          @pattern_list << 'To Parent Directory'
+        end
+        
+        def do_test(chat)
+          begin
+            @pattern_list.each do |pat|
+              if  chat.response.body =~ /(#{pat})/i then
+                match = $1
+                addFinding(  
+                           :proof_pattern => "#{match}", 
+                :chat => chat,
+                :title => "/#{chat.request.path}"
+                )
+              end
+            end      
+          rescue => bang
+            puts "ERROR!! #{Module.nesting[0].name}"
+            puts bang
+          end
+        end
+      end
+      
+    end
+  end
+end

data/modules/passive/disclosure_emails.rb

@@ -0,0 +1,82 @@
+# .
+# disclosure_emails.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  module Modules
+    module Passive
+      
+      
+      class Disclosure_emails < Watobo::PassiveCheck
+        
+        def initialize(project)
+           @project = project
+          super(project)
+          
+          @info.update(
+            :check_name => 'Email Adresses',    # name of check which briefly describes functionality, will be used for tree and progress views
+            :description => "Collects email adresses.",   # description of checkfunction
+            :author => "Andreas Schmidt", # author of check
+            :version => "0.9"   # check version
+            )
+            
+          @finding.update(
+            :threat => 'email adresses can be used for social engineering attacks.',        # thread of vulnerability, e.g. loss of information
+            :class => "EMail Adresses",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+            :type => FINDING_TYPE_INFO         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN 
+          )
+          
+          valid = '[a-zA-Z\d\.+-]+'
+          @pattern = "#{valid}@#{valid}\\.(#{valid}){2}"
+          @mail_list = []
+        end
+        
+        def do_test(chat)
+          begin
+            #  puts "running module: #{Module.nesting[0].name}"
+            if chat.response.content_type =~ /text/ and not chat.response.content_type =~ /text.csv/ then
+            if chat.response.each do |line|
+                if line =~ /(#{@pattern})/ then
+                  match = $1
+                  if not @mail_list.include?(match) then
+                    @mail_list.push match
+                    addFinding( 
+                                         :proof_pattern => "#{match}", 
+                                         :chat => chat,
+                                         :title => match
+                                         )
+                                         end
+                end
+                
+              end
+            end
+            end
+          rescue => bang
+          #  raise
+            puts "ERROR!! #{self.class}"
+            puts bang
+            puts bang.backtrace if $DEBUG
+          end
+        end
+      end
+      
+    end
+  end
+end

data/modules/passive/disclosure_ipaddr.rb

@@ -0,0 +1,87 @@
+# .
+# disclosure_ipaddr.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+
+module Watobo
+  module Modules
+    module Passive
+      
+      class Disclosure_ipaddr < Watobo::PassiveCheck
+               
+        def initialize(project)
+          @project = project
+          super(project)
+          @info.update(
+            :check_name => 'IP Adress Disclosure',    # name of check which briefly describes functionality, will be used for tree and progress views
+            :description => 'Looks for (internal) IP adresses.',   # description of checkfunction
+            :author => "Andreas Schmidt", # author of check
+            :version => "0.9"   # check version
+          )
+          
+          @finding.update(
+            :threat => 'Internal information may be revealed, which could help an attacker to prepare further attacks',        # thread of vulnerability, e.g. loss of information
+            :class => "IP Adress Disclosure",# vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+            :type => FINDING_TYPE_INFO,         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN
+            :measure => "Remove all information which reveal internal information." 
+            )
+          
+          @pattern = '[^\d\.](\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})[^(\d\.)]+?'
+          @known_ips = []
+        end
+        
+        def do_test(chat)
+          begin
+            #  puts "running module: #{Module.nesting[0].name}"
+            if chat.response.content_type =~ /text/ then
+              if chat.response.each do |line|
+                  if line =~ /#{@pattern}/ then
+                    ip_addr = $1
+                    octets = ip_addr.split('.')
+                    isIP = true
+                    octets.each do |o|
+                      isIP = false if o.to_i > 255 
+                    end
+                    if isIP then
+                    title = "IP: #{ip_addr}"
+                    dummy = chat.request.site + ":" + ip_addr
+                    if not @known_ips.include?(dummy)
+                      addFinding( :proof_pattern => ip_addr, 
+                                  :chat => chat,
+                                  :title => title)  
+                      @known_ips.push dummy
+                    end
+                    end
+                  end
+                  
+                end
+              end
+            end
+          rescue => bang
+            #  raise
+            puts "ERROR!! #{Module.nesting[0].name}"
+            puts bang
+          end
+        end
+      end
+      
+    end
+  end
+end

data/modules/passive/filename_as_parameter.rb

@@ -0,0 +1,85 @@
+# .
+# filename_as_parameter.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  module Modules
+    module Passive
+      
+      
+      class Filename_as_parameter  < Watobo::PassiveCheck
+        
+        def initialize(project)
+          @project = project
+          super(project)
+          
+          @info.update(
+                        :check_name => 'Detect Filename Parameters',    # name of check which briefly describes functionality, will be used for tree and progress views
+          :description => "Detects parameters which sounds like 'filename', e.g. filename, fname.",   # description of checkfunction
+          :author => "Andreas Schmidt", # author of check
+          :version => "0.9"   # check version
+          )
+          
+          @finding.update(
+                          :threat => 'If filename parameters are not proper handled by the application an attacker may excecute malicious files or reveal sensitive information.',        # thread of vulnerability, e.g. loss of information
+          :class => "Filename Parameter",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+          :type => FINDING_TYPE_HINT         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN 
+          )
+          
+        
+          @possible_parm_names=%w[ (.*fname.*) (.*file.*) ]
+          @findings = []
+        end
+        
+        def do_test(chat)
+          begin
+            #  puts "running module: #{Module.nesting[0].name}"
+            all_parms = chat.request.parm_names
+            if all_parms
+              # puts all_parms
+              all_parms.each do |parm|
+                @possible_parm_names.each do |pattern|
+                  
+                  if parm =~ /#{pattern}/i
+                    match = $1
+                    if not @findings.include?(parm)
+                      @findings.push parm
+                      addFinding(
+                                 :check_pattern => match,
+                                 :chat=>chat
+                      )
+                    end
+                  end
+                  
+                  
+                end
+                
+              end
+            end
+          rescue => bang
+            puts "ERROR!! #{Module.nesting[0].name}"
+            puts bang
+          end
+        end
+        
+      end
+    end
+  end
+end

data/modules/passive/form_spotter.rb

@@ -0,0 +1,75 @@
+# .
+# form_spotter.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  module Modules
+    module Passive
+      
+      
+      class Form_spotter < Watobo::PassiveCheck
+        def initialize(project)
+          @project = project
+          super(project)
+          
+          @info.update(
+                       :check_name => 'Form Spotter',    # name of check which briefly describes functionality, will be used for tree and progress views
+          :description => "Detects all HTML-Forms",   # description of checkfunction
+          :author => "Andreas Schmidt", # author of check
+          :version => "0.9"   # check version
+          )
+          
+          @finding.update(
+                          :threat => 'Lists all HTML-Forms.',        # thread of vulnerability, e.g. loss of information
+          :class => "Forms",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+          :type => FINDING_TYPE_INFO,         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN
+          :measure => "Check if all forms are checked for vulnerabilities." 
+          )
+        end
+        
+        def do_test(chat)
+          begin
+            #  puts "running module: #{Module.nesting[0].name}"
+            return true unless chat.response.content_type =~ /(text|script)/
+            return true if chat.response.body.nil?
+            off = chat.response.body.index(/<form/i, 0)
+            until off.nil?
+              action = chat.response.body[off..-1] =~ /<form [^<\/form]*action="([^"]*)"/i ? $1 : "undefined" 
+            #  puts "!FOUND FORM #{action}"
+              addFinding(  
+                         :proof_pattern => "<form [^>]*>", 
+              :title => "#{action}",
+              :chat => chat
+              )  
+              off = chat.response.body.index(/<form/i, off+1)
+            end
+          rescue => bang
+            #  raise
+            puts "ERROR!! #{Module.nesting[0].name}"
+            puts bang
+            puts bang.backtrace if $DEBUG
+          end
+          return false
+        end
+      end
+      
+    end
+  end
+end

data/modules/passive/hotspots.rb

@@ -0,0 +1,86 @@
+# .
+# hotspots.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  module Modules
+    module Passive
+      
+      
+      class Hotspots < Watobo::PassiveCheck
+        def initialize(project)
+         @project = project
+          super(project)
+          
+          @info.update(
+                        :check_name => 'Active Content References',    # name of check which briefly describes functionality, will be used for tree and progress views
+          :description => "Detects all references to active content pages, e.g. php, asp.",   # description of checkfunction
+          :author => "Andreas Schmidt", # author of check
+          :version => "0.9"   # check version
+          )
+          
+          @finding.update(
+                          :threat => 'References to active content pages have been found. Sometimes old and/or vulnerable functions are revealed. With this information you can also estimate if all parts of the application are covered.',        # thread of vulnerability, e.g. loss of information
+          :class => "Hotspots",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+          :type => FINDING_TYPE_INFO,         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN
+          :measure => "Check if these references are only pointing to \"good\" functions." 
+          )
+         
+          
+        
+          @pattern_list = %w( php asp aspx jsp cgi )
+		  
+          @known_functions = []
+        end
+        
+        def do_test(chat)
+          begin
+            #  puts "running module: #{Module.nesting[0].name}"
+            if chat.response.content_type =~ /(text|script)/ and chat.response.status !~ /404/ then
+              if chat.response.each do |chunk|
+                  chunk.split(/\n/).each do |line|
+                    @pattern_list.each do |ext|
+                      if line =~ /([\w%\/\\\.:-]*\.#{ext})[^\w]/ then
+                        match = $1
+                        if not @known_functions.include?(match) then
+                          addFinding(  
+                                       :proof_pattern => match, 
+                                       :title => match,
+                                       :chat => chat
+                          )  
+                          @known_functions.push match
+                        end
+                      end                  
+                    end
+                  end
+                end
+              end
+            end
+          rescue => bang
+            #  raise
+            puts "ERROR!! #{Module.nesting[0].name}"
+            puts bang
+          end
+        end
+      end
+      
+    end
+  end
+end

data/modules/passive/in_script_parameter.rb

@@ -0,0 +1,92 @@
+# .
+# in_script_parameter.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+require 'cgi'
+module Watobo
+  module Modules
+    module Passive
+      
+      
+      class In_script_parameter < Watobo::PassiveCheck
+        
+        def initialize(project)
+          @project = project
+          super(project)
+          
+          @info.update(
+                       :check_name => 'Parameters in Script',    # name of check which briefly describes functionality, will be used for tree and progress views
+          :description => "Checks if parameter values are used within script-tags.",   # description of checkfunction
+          :author => "Andreas Schmidt", # author of check
+          :version => "0.9"   # check version
+          )
+          
+          @finding.update(
+                          :threat => 'Parameter value may be exploitable for XSS.',        # thread of vulnerability, e.g. loss of information
+          :class => "Script-Parameters",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+          :type => FINDING_TYPE_HINT         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN 
+          )
+          
+        end
+        
+        def showError(chatid, message)
+          puts "!!! Error"  
+          puts "Chat: [#{chatid}]"
+          puts message
+        end
+        
+        def do_test(chat)
+          begin
+            parm_values = []
+            minlen = 3
+            return true unless chat.response.content_type =~ /(text|script)/ 
+            chat.request.get_parm_names.each do |parm|              
+              pv = Regexp.quote(chat.request.get_parm_value(parm))
+              parm_values.push pv unless pv.strip.empty? or pv.strip.length < minlen
+            end
+            chat.request.post_parm_names.each do |parm|
+              pv = chat.request.post_parm_value(parm)
+              parm_values.push pv unless pv.strip.empty? or pv.strip.length < minlen
+            end
+            
+            parm_values.each do |parm_value|
+              
+              pattern = Regexp.quote(CGI::unescape(parm_value))
+              if chat.response.body =~ /<script[^<\/]*#{pattern}/i then
+               # puts "* Found: Parameter within script"
+                addFinding(
+                           :check_pattern => "#{parm_value}", 
+                :proof_pattern => "#{parm_value}",
+                :chat=>chat,
+                :title =>"[#{parm_value}] - #{chat.request.path}"
+                )
+                
+              end
+            end
+          rescue => bang
+            # raise
+            showError(chat.id, bang)
+          end
+        end
+        
+      end
+    end
+  end
+end