watobo 0.9.8.677

data/plugins/sslchecker/gui/cipher_table.rb

@@ -0,0 +1,260 @@
+# .
+# cipher_table.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  module Plugin
+    module Sslchecker
+      module Gui
+        
+        class CipherTableController < FXHorizontalFrame
+          def subscribe(event, &callback)
+            (@event_dispatcher_listeners[event] ||= []) << callback
+          end
+
+          def clearEvents(event)
+            @event_dispatcher_listener[event].clear
+          end
+
+          def notify(event, *args)
+            if @event_dispatcher_listeners[event]
+              @event_dispatcher_listeners[event].each do |m|
+                m.call(*args) if m.respond_to? :call
+              end
+            end
+          end
+
+          def initialize(owner, opts)
+            super(owner,opts)
+            @event_dispatcher_listeners = Hash.new
+            @good_cb = FXCheckButton.new(self, "good", nil, 0, ICON_BEFORE_TEXT|LAYOUT_SIDE_LEFT)
+            @good_cb.connect(SEL_COMMAND) { update_table }
+            @good_cb.checkState = true
+            @bad_cb = FXCheckButton.new(self, "bad", nil, 0, ICON_BEFORE_TEXT|LAYOUT_SIDE_LEFT)
+            @bad_cb.connect(SEL_COMMAND) { update_table }
+            @bad_cb.checkState = true
+            @na_cb = FXCheckButton.new(self, "n/a", nil, 0, ICON_BEFORE_TEXT|LAYOUT_SIDE_LEFT)
+            @na_cb.connect(SEL_COMMAND) { update_table }
+            @na_cb.checkState = true
+            FXButton.new(self, "copy").connect(SEL_COMMAND) { notify(:copy_table) }
+         #   FXButton.new(self, "clear").connect(SEL_COMMAND) { notify(:clear_ciphers) }
+
+          end
+
+          def update_table
+            show_prefs = CipherTable::CTF_NONE
+            show_prefs = show_prefs | CipherTable::CTF_BAD if @bad_cb.checked?
+            show_prefs = show_prefs | CipherTable::CTF_GOOD if @good_cb.checked?
+            show_prefs = show_prefs | CipherTable::CTF_NA if @na_cb.checked?
+            notify(:apply_filter, show_prefs)
+          end
+        end
+
+        class CipherTable < FXTable
+          CTF_NONE = 0x00
+          CTF_GOOD = 0x01
+          CTF_BAD = 0x02
+          CTF_NA = 0x04
+          CTF_ALL = 0x07
+
+          attr :ciphers
+          attr_accessor :min_bit_length
+          attr_accessor :filter
+          
+          # this returns a comma seperated list of the table [string] 
+          def to_csv
+            csv = ""
+           self.each_row do |c,b,r|
+              csv << c.text.strip << ";"
+              csv << b.text.strip << ";"
+              csv << r.text.strip
+              csv << "\n"
+            end
+            csv
+          end
+
+          def setNewFont(font_type=nil, size=nil)
+            begin
+              new_size = size.nil? ? GUI_REGULAR_FONT_SIZE : size
+              new_font_type = font_type.nil? ? "helvetica" : font_type
+              new_font = FXFont.new(getApp(), new_font_type, new_size)
+              new_font.create
+
+              self.font = new_font
+              self.rowHeader.font = new_font
+              self.defRowHeight = new_size+10
+
+              updateTable()
+
+            rescue => bang
+              puts bang
+              puts bang.backtrace if $DEBUG
+            end
+          end
+
+          def add_cipher( cipher )
+
+            [ :name, :bits, :result ].each do |k|
+              return false unless cipher.has_key? k
+            end
+
+            @ciphers.push cipher
+            add_cipher_row(cipher)
+
+            true
+          end
+
+         def show_all
+            @filter = CTF_ALL
+          end
+
+          def update_table
+          #  puts "update table: #{filter}"
+            self.clearItems
+            initColumns
+            @ciphers.each do |c|
+              add_cipher_row c
+            end
+          end
+
+          def clear_ciphers
+            self.clearItems
+            initColumns
+            @ciphers.clear
+          end
+
+          def initialize(owner, opts)
+            super(owner, :opts => TABLE_COL_SIZABLE|TABLE_ROW_SIZABLE|LAYOUT_FILL_X|LAYOUT_FILL_Y|TABLE_READONLY|LAYOUT_SIDE_TOP, :padding => 2)
+            @ciphers = []
+            @min_bit_length = 128
+
+            @columns = Hash.new
+            @columns[:cipher] = { :label => "Cipher", :pos => 0, :width => 250 }
+            @columns[:bits] = { :label => "Bits", :pos => 1, :width => 100 }
+            @columns[:result] = { :label => "Result", :pos => 2, :width => 50 }
+
+            @filter = CTF_ALL
+
+            init_icons
+            initColumns()
+            adjustCellWidth
+          end
+
+          private
+
+          def init_icons
+            begin
+              path = File.expand_path(File.join(File.dirname(__FILE__), "..", "icons" ))
+              file = "green_16x16.ico"
+              icon_file = File.join(path, file)
+              # puts icon_file
+
+              @icon_ok = Watobo::Gui.load_icon(icon_file)
+
+              file = "red_16x16.ico"
+              icon_file = File.join(path, file)
+              @icon_bad = Watobo::Gui.load_icon(icon_file)
+
+              file = "grey_16x16.ico"
+              icon_file = File.join(path, file)
+              @icon_na = Watobo::Gui.load_icon(icon_file)
+            rescue => bang
+              puts bang
+              puts bang.backtrace
+            end
+          end
+
+          def initColumns()
+            self.setTableSize(0, @columns.length)
+            self.visibleRows = 20
+            self.visibleColumns = @columns.length
+
+            @columns.each do |key, opts|
+              self.setColumnText( opts[:pos], opts[:label] )
+            #self.setColumnIcon(@col_order.index(TABLE_COL_SSL), TBL_ICON_LOCK)# puts self.getItem(@col_order.index(col), 0  ).class.to_s
+            end
+            
+            adjustCellWidth
+
+          end
+
+          def adjustCellWidth()
+            begin
+              self.rowHeader.width = 0
+              @columns.each_value do |opts|
+                self.setColumnWidth( opts[:pos], opts[:width] )
+              end
+            rescue => bang
+              puts bang
+              puts bang.backtrace
+              puts "!!!ERROR: adjustCellWidth"
+            end
+
+          end
+
+          def add_cipher_row(cipher)
+            add_cipher = @filter == CTF_ALL ? true : false
+
+            if cipher[:result] == false
+              # @result_viewer.appendStyledText("checked: #{cipher} - #{bits} - #{result}\n",0)
+              text = "N/A"
+              icon = @icon_na
+              add_cipher = true if ( @filter & CTF_NA > 0 )
+
+            elsif cipher[:bits].to_i < @min_bit_length
+              # @result_viewer.appendStyledText("checked: #{cipher} - #{bits} - #{result}\n",2)
+              text = "BAD"
+              icon = @icon_bad
+              add_cipher = true if ( @filter & CTF_BAD > 0 )
+            else
+              text = "OK"
+              icon = @icon_ok
+              add_cipher = true if ( @filter & CTF_GOOD > 0 )
+            # @result_viewer.appendStyledText("checked: #{cipher} - #{bits} - #{result}\n",1)
+            end
+
+            if add_cipher
+              lastRowIndex = self.getNumRows
+              self.appendRows(1)
+
+              index = @columns[:cipher][:pos]
+              self.setItemText(lastRowIndex, index, cipher[:name])
+              self.getItem(lastRowIndex, index).justify = FXTableItem::LEFT
+
+              index = @columns[:bits][:pos]
+              self.setItemText(lastRowIndex, index, cipher[:bits].to_s)
+              self.getItem(lastRowIndex,index).justify = FXTableItem::LEFT
+
+              index = @columns[:result][:pos]
+              
+              
+              self.setItemIcon(lastRowIndex, index, icon)
+              self.setItemIconPosition(lastRowIndex, index, FXTableItem::BEFORE)
+              self.setItemText(lastRowIndex, index, text)
+              self.getItem(lastRowIndex,index).justify = FXTableItem::LEFT
+            end
+          end
+
+        end
+
+      end
+    end
+  end
+end

data/plugins/sslchecker/gui/gui.rb

@@ -0,0 +1,245 @@
+# .
+# gui.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  module Plugin
+    module Sslchecker
+      module Gui
+        
+        
+      class Main < Watobo::Plugin2
+
+        include Watobo::Constants
+        
+        def createChat(site)
+          chat = nil
+          url = "https://#{site}/"
+          request = []
+          request << "GET #{url} HTTP/1.1\r\n"
+          request << "Host: #{site}\r\n"
+          request << "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*\r\n"
+          request << "Accept-Language: de\r\n"
+          request << "Proxy-Connection: close\r\n"
+          request << "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)\r\n"
+          request << "\r\n"
+
+          chat = Watobo::Chat.new(request, [], :id => 0)
+
+          return chat
+        end
+
+        def onSiteSelect(sender, sel, item)
+          if sender.numItems > 0
+          @site = sender.getItemData(sender.currentItem)
+          else
+            unless sender.text.empty?
+            @site = sender.text.gsub(/^https?:\/\//,"").strip 
+            end
+          end
+         
+        end
+
+        def updateView()
+          #@project = project
+          @site = nil
+          @sites_combo.clearItems()
+          #@dir_combo.clearItems()
+          unless @project.nil? then
+            @project.listSites(:ssl => true).each do |site|
+            #puts "Site: #{site}"
+              @sites_combo.appendItem(site.slice(0..35), site)
+            end
+            if @sites_combo.numItems > 0
+            @sites_combo.setCurrentItem(0)
+            @site = @sites_combo.getItemData(0)
+            else
+            @log_viewer.log(LOG_INFO,"No SSL Sites available - you need to visit a SSL Site first!")
+            end
+          end
+
+        end
+
+        def start(sender, sel, item)
+          unless @site.nil?
+   @cipher_table.clear_ciphers
+
+            #puts "Site: #{site}"
+            #puts "Directory: #{@dir}"
+            chat = createChat(@site)
+            checklist = []
+            checklist.push @check
+            chatlist = []
+            chatlist.push chat
+            scan_prefs = @project.getScanPreferences
+            scanner = Watobo::Scanner2.new(chatlist, checklist, nil, scan_prefs)
+
+             @pbar.total = scanner.numTotalChecks
+               #@pbar.progress = 0
+               #@pbar.barColor = FXRGB(255,0,0)
+
+               scanner.subscribe(:progress) { |m|
+                           print "="
+                  @pbar.increment(1)
+               }
+            
+            #@pbar.total = @check.cipherlist.length
+            @pbar.progress = 0
+            @pbar.barColor = 'red'
+            unless @project.getCurrentProxy().nil?
+               @log_viewer.log(LOG_INFO,"!!! WARNING FORWARDING PROXY IS SET !!! - SSL-Check running against proxy may not make sense!")
+            end
+            @log_viewer.log LOG_INFO, "Scan started ..."
+            @scan_thread = Thread.new(scanner) { |scan|
+              begin
+
+                scan.run(:default => true)
+                @log_viewer.log LOG_INFO, "Scan finished."
+              rescue => bang
+              puts bang
+              puts bang.backtrace if $DEBUG
+              end
+            }
+
+          end
+        end
+
+        def initialize(owner, project)
+          super(owner, "SSL-Plugin", project, :opts => DECOR_ALL,:width=>800, :height=>600)
+
+          @plugin_name = "SSL-Checker"
+          @project = project
+          @site = nil
+          @dir = nil
+          @scan_thread = nil
+          
+          @results = []
+          @results_lock = Mutex.new
+          
+           @clipboard_text = ""
+        self.connect(SEL_CLIPBOARD_REQUEST) do
+        # setDNDData(FROM_CLIPBOARD, FXWindow.stringType, Fox.fxencodeStringData(@clipboard_text))
+          setDNDData(FROM_CLIPBOARD, FXWindow.stringType, @clipboard_text + "\x00" )
+        end
+          
+          load_icon(__FILE__)
+
+          mr_splitter = FXSplitter.new(self, LAYOUT_FILL_X|LAYOUT_FILL_Y|SPLITTER_VERTICAL|SPLITTER_REVERSED|SPLITTER_TRACKING)
+          # top = FXHorizontalFrame.new(mr_splitter, :opts => LAYOUT_FILL_X|LAYOUT_FILL_Y|LAYOUT_SIDE_BOTTOM)
+          top_frame = FXVerticalFrame.new(mr_splitter, :opts => LAYOUT_FILL_X|LAYOUT_FILL_Y|LAYOUT_FIX_HEIGHT|LAYOUT_BOTTOM,:height => 500)
+          top_splitter = FXSplitter.new(top_frame, LAYOUT_FILL_X|SPLITTER_HORIZONTAL|LAYOUT_FILL_Y|SPLITTER_TRACKING)
+          log_frame = FXVerticalFrame.new(mr_splitter, :opts => LAYOUT_FILL_X|LAYOUT_SIDE_BOTTOM,:height => 100)
+
+          @settings_frame = FXVerticalFrame.new(top_splitter, :opts => LAYOUT_FILL_Y)
+          result_frame = FXVerticalFrame.new(top_splitter, :opts => LAYOUT_FILL_X|LAYOUT_FILL_Y)
+          
+          @controller = CipherTableController.new(result_frame, :opts => LAYOUT_FILL_X)
+          @controller.subscribe(:apply_filter){ |f| @cipher_table.filter = f ; @cipher_table.update_table}
+          @controller.subscribe(:copy_table){
+             types = [ FXWindow.stringType ]
+                    if acquireClipboard(types)
+                    puts
+                    @clipboard_text = @cipher_table.to_csv
+                    end
+
+          }
+
+         frame = FXVerticalFrame.new(result_frame, LAYOUT_FILL_X|LAYOUT_FILL_Y|FRAME_SUNKEN|FRAME_THICK, :padding=>0)
+         @cipher_table = CipherTable.new(frame, :opts => LAYOUT_FILL_X|LAYOUT_FILL_Y)
+
+          FXLabel.new(@settings_frame, "Available Sites:")
+          @sites_combo = FXComboBox.new(@settings_frame, 5, nil, 0,
+          COMBOBOX_STATIC|FRAME_SUNKEN|FRAME_THICK|LAYOUT_SIDE_TOP|LAYOUT_FILL_X)
+          #@filterCombo.width =200
+
+          @sites_combo.numVisible = 20
+          @sites_combo.numColumns = 35
+          @sites_combo.editable = true
+          @sites_combo.connect(SEL_COMMAND, method(:onSiteSelect))
+          begin
+
+       
+            @pbar = FXProgressBar.new(@settings_frame, nil, 0, LAYOUT_FILL_X|FRAME_SUNKEN|FRAME_THICK|PROGRESSBAR_HORIZONTAL)
+            
+            @pbar.progress = 0
+            @pbar.total = 0
+            @pbar.barColor=0
+            @pbar.barColor = 'grey' #FXRGB(255,0,0)
+
+            button = FXButton.new(@settings_frame, "start")
+            button.connect(SEL_COMMAND, method(:start))
+
+            @check = Check.new(@project)
+
+            @check.subscribe(:cipher_checked) { |cipher, bits, result|
+              begin
+                @results_lock.synchronize do
+                @results << { :name => cipher, :bits => bits, :result => result}
+                end
+               #  FXApp.instance.forceRefresh
+              rescue => bang
+              puts bang
+              puts bang.backtrace if $DEBUG
+              end
+            #puts "#{@pbar.progress} of #{@pbar.total}"
+            #     logger
+
+            }
+
+            @check.subscribe(:new_finding) { |f|
+              @project.addFinding(f)
+            }
+
+            log_frame_header = FXHorizontalFrame.new(log_frame, :opts => LAYOUT_FILL_X)
+            FXLabel.new(log_frame_header, "Logs:" )
+
+            #log_text_frame = FXHorizontalFrame.new(bottom_frame, :opts => LAYOUT_FILL_X|FRAME_SUNKEN|LAYOUT_BOTTOM)
+            log_text_frame = FXVerticalFrame.new(log_frame, LAYOUT_FILL_X|LAYOUT_FILL_Y|FRAME_SUNKEN|FRAME_THICK, :padding=>0)
+            @log_viewer = LogViewer.new(log_text_frame, :opts => LAYOUT_FILL_X|LAYOUT_FILL_Y)
+
+            updateView()
+            add_update_timer(50)
+          rescue => bang
+          puts bang
+          puts bang.backtrace if $DEBUG
+          end
+
+        end
+        
+        private
+        
+        def add_update_timer(ms)
+         @update_timer = FXApp.instance.addTimeout( ms, :repeat => true) do
+          @results_lock.synchronize do
+          unless @results.empty?
+            @results.each do |r|
+            @cipher_table.add_cipher(r)
+          end
+        @results.clear
+        end
+    end
+    
+  end
+end
+      end
+      end
+      end
+      end
+      end

data/plugins/sslchecker/gui/sslchecker.rb

@@ -0,0 +1,26 @@
+# .
+# sslchecker.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+path = File.expand_path(File.dirname(__FILE__))
+
+require File.join(path, "..", "lib", "check.rb")
+require File.join(path, "cipher_table.rb")
+require File.join(path, "gui.rb")

data/plugins/sslchecker/lib/check.rb

@@ -0,0 +1,117 @@
+# .
+# check.rb
+# 
+# Copyright 2012 by siberas, http://www.siberas.de
+# 
+# This file is part of WATOBO (Web Application Tool Box)
+#        http://watobo.sourceforge.com
+# 
+# WATOBO is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation version 2 of the License.
+# 
+# WATOBO is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with WATOBO; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+# .
+module Watobo
+  module Plugin
+    module Sslchecker
+      class Check < Watobo::ActiveCheck
+        attr :cipherlist
+        def initialize(project)
+          super(project)
+
+          @result = Hash.new
+
+          @info.update(
+          :check_name => 'SSL-Checker',    # name of check which briefly describes functionality, will be used for tree and progress views
+          :description => "Test applikation for supportes SSL Ciphers.",   # description of checkfunction
+          :author => "Andreas Schmidt", # author of check
+          :version => "0.9"   # check version
+          )
+
+          @finding.update(
+          :threat => 'Attacks on weak encryption ciphers which may lead loss of privacy',        # thread of vulnerability, e.g. loss of information
+          :class => "SSL Ciphers",    # vulnerability class, e.g. Stored XSS, SQL-Injection, ...
+          :type => FINDING_TYPE_VULN,         # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN
+          :rating => VULN_RATING_LOW
+          )
+
+          ctx = OpenSSL::SSL::SSLContext.new()
+          @cipherlist = Array.new
+          ctx.ciphers="eNULL" # because ALL don't include Null-Ciphers!!!
+          ctx.ciphers.each do |c|
+            @cipherlist.push c[0]
+          end
+
+          ctx.ciphers="ALL"
+          ctx.ciphers.each do |c|
+            @cipherlist.push c[0]
+          end
+        end
+
+        def reset()
+          @result.clear
+        end
+
+        def generateChecks(chat)
+          begin
+            @cipherlist.each do |c|
+            checker = proc {
+
+              test_request = nil
+              test_response = nil
+              # !!! ATTENTION !!!
+              # MAKE COPY BEFORE MODIFIYING REQUEST
+              request = chat.copyRequest
+
+              
+                ctx = OpenSSL::SSL::SSLContext.new()
+                ctx.ciphers = c
+                cypher = ctx.ciphers.first
+                bits = cypher[2].to_i
+                algo = cypher[0]
+              
+                test_request, test_response = doRequest( request, :ssl_cipher => c )
+              
+                if test_request and test_response
+              
+                  notify( :cipher_checked, algo, bits, true)
+                  if bits < 128
+
+                  addFinding(  test_request, test_response,
+                  :test_item => "#{algo}#{bits}",
+                  #:proof_pattern => "#{match}",
+                  :chat => chat,
+                  :title => "[#{algo}] - #{bits} Bit"
+                  )
+                  end
+                else
+                notify(:cipher_checked, algo, bits, false)
+                #              puts "!!! ERROR: #{c}"
+                end
+              
+              [ test_request, test_response ]
+
+            }
+            yield checker
+            end
+          rescue => bang
+          puts "!error in module #{Module.nesting[0].name}"
+          puts bang
+          end
+        end
+      end
+
+      
+    end
+  end
+end
+
+