wg-metasploit_data_models 4.1.4.01 → 4.1.4.02

data/app/models/mdm/web_form.rb

@@ -0,0 +1,53 @@
+# A filled-in form on a {#web_site}.
+class Mdm::WebForm < ApplicationRecord
+  
+  #
+  # Associations
+  #
+
+  # {Mdm::WebSite Web site} on which this form is.
+  belongs_to :web_site,
+             class_name: 'Mdm::WebSite',
+             inverse_of: :web_forms
+
+  #
+  # Attributes
+  #
+
+  # @!attribute created_at
+  #   When this web form was created.
+  #
+  #   @return [DateTime]
+
+  # @!attribute method
+  #   HTTP method (or verb) used to submitted this form, such as GET or POST.
+  #
+  #   @return [String]
+
+  # @!attribute path
+  #   Path portion of URL to which this form was submitted.
+  #
+  #   @return [String]
+
+  # @!attribute query
+  #   URL query that submitted for this form.
+  #
+  #   @return [String]
+
+  # @!attribute updated_at
+  #   The last time this web form was updated.
+  #
+  #   @return [DateTime]
+
+  #
+  # Serializations
+  #
+
+  # Parameters submitted in this form.
+  #
+  # @return [Array<Array(String, String)>>]
+  serialize :params, MetasploitDataModels::Base64Serializer.new
+
+  Metasploit::Concern.run(self)
+end
+

data/app/models/mdm/web_page.rb

@@ -0,0 +1,92 @@
+# Web page requested from a {#web_site}.
+class Mdm::WebPage < ApplicationRecord
+  
+  #
+  # Associations
+  #
+
+  # Mdm::WebSite Web site} from which this page was requested.
+  belongs_to :web_site,
+             class_name: 'Mdm::WebSite',
+             inverse_of: :web_pages
+
+  #
+  # Attributes
+  #
+
+  # @!attribute auth
+  #   Credentials sent to server to authenticate to web site to allow access to this web page.
+  #
+  #   @return [String]
+
+  # @!attribute body
+  #   Body of response from server.
+  #
+  #   @return [String]
+
+  # @!attribute code
+  #   HTTP Status code return from {#web_site} when requesting this web page.
+  #
+  #   @return [Integer]
+
+  # @!attribute cookie
+  #   Cookies derived from {#headers}.
+  #
+  #   @return [String]
+
+  # @!attribute created_at
+  #   When this web page was created.
+  #
+  #   @return [DateTime]
+
+  # @!attribute ctype
+  #   The content type derived from the {#headers} of the returned web page.
+  #
+  #   @return [String]
+
+  # @!attribute location
+  #   Location derived from {#headers}.
+
+  #   @return [String]
+
+  # @!attribute mtime
+  #   The last modified time of the web page derived from the {#headers}.
+  #
+  #   @return [DateTime]
+
+  # @!attribute path
+  #   Path portion of URL that was used to access this web page.
+  #
+  #   @return [String]
+
+  # @!attribute query
+  #   Query portion of URLthat was used to access this web page.
+  #
+  #   @return [String]
+
+  # @!attribute request
+  #   Request sent to server to cause this web page to be returned.
+  #
+  #   @return [String]
+
+  # @!attribute updated_at
+  #   The last time this web page was updated.
+  #
+  #   @return [DateTime]
+
+  #
+  # Serializations
+  #
+
+  # Headers sent from server.
+  #
+  # @return [Hash{String => String}]
+  serialize :headers, MetasploitDataModels::Base64Serializer.new
+
+  # Cookies sent from server.
+  #
+  # @return [Hash{String => String}]
+  serialize :cookie
+  Metasploit::Concern.run(self)
+end
+

data/app/models/mdm/web_site.rb

@@ -0,0 +1,113 @@
+# A Web Site running on a {#service}.
+class Mdm::WebSite < ApplicationRecord
+  
+  #
+  # Associations
+  #
+
+  # The service on which this web site is running.
+  belongs_to :service,
+             class_name: 'Mdm::Service',
+             foreign_key: 'service_id',
+             inverse_of: :web_sites
+
+  # Filled-in forms within this web site.
+  has_many :web_forms,
+           class_name: 'Mdm::WebForm',
+           dependent: :destroy,
+           inverse_of: :web_site
+
+  # Web pages found on this web site.
+  has_many :web_pages,
+           class_name: 'Mdm::WebPage',
+           dependent: :destroy,
+           inverse_of: :web_site
+
+  # Vulnerabilities found on this web site.
+  has_many :web_vulns,
+           class_name: 'Mdm::WebVuln',
+           dependent: :destroy,
+           inverse_of: :web_site
+
+  #
+  # Attributes
+  #
+
+  # @!attribute [rw] comments
+  #   User entered comments about this web site.
+  #
+  #   @return [String]
+
+  # @!attribute [rw] created_at
+  #   When this web site was created.
+  #
+  #   @return [DateTime]
+
+  # @!attribute [rw] updated_at
+  #   The last time this web site was updated.
+  #
+  #   @return [DateTime]
+
+  # @!attribute [rw] vhost
+  #   The virtual host for the web site in case `service.host.name` or `service.host.address` is no the host for this
+  #   web site.
+  #
+  #   @return [String]
+
+  #
+  # Serializations
+  #
+
+  # @!attribute [rw] options
+  #   @todo Determine format and purpose of Mdm::WebSite#options.
+  serialize :options, ::MetasploitDataModels::Base64Serializer.new
+
+  #
+  # Instance Methods
+  #
+
+  # Number of {#web_forms}.
+  #
+  # @return [Integer]
+  def form_count
+    web_forms.size
+  end
+
+  # Number of {#web_pages}.
+  #
+  # @return [Integer]
+  def page_count
+    web_pages.size
+  end
+
+  # Converts this web site to its URL, including scheme, host and port.
+  #
+  # @param ignore_vhost [Boolean] if `false` use {#vhost} for host portion of URL.  If `true` use {Mdm::Host#address} of
+  #   {Mdm::Service#host} of {#service} for host portion of URL.
+  # @return [String] <scheme>://<host>[:<port>]
+  def to_url(ignore_vhost=false)
+    proto = self.service.name == "https" ? "https" : "http"
+    host = ignore_vhost ? self.service.host.address.to_s : self.vhost
+    port = self.service.port
+
+    if Rex::Socket.is_ipv6?(host)
+      host = "[#{host}]"
+    end
+
+    url = "#{proto}://#{host}"
+    if not ((proto == "http" and port == 80) or (proto == "https" and port == 443))
+      url += ":#{port}"
+    end
+    url
+  end
+
+  # Number of {#web_vulns}.
+  #
+  # @return [Integer]
+  def vuln_count
+    web_vulns.size
+  end
+
+  Metasploit::Concern.run(self)
+end
+

data/app/models/mdm/web_vuln.rb

@@ -0,0 +1,193 @@
+# A Web Vulnerability found during a web scan or web audit.
+#
+# If you need to modify Mdm::WebVuln you can use ActiveSupport.on_load(:mdm_web_vuln) inside an initializer so that
+# your patches are reloaded on each request in development mode for your Rails application.
+#
+# @example extending Mdm::WebVuln
+#   # config/initializers/mdm_web_vuln.rb
+#   ActiveSupport.on_load(:mdm_web_vuln) do
+#     def confidence_percentage
+#       "#{confidence}%"
+#     end
+#   end
+class Mdm::WebVuln < ApplicationRecord
+  
+  #
+  # CONSTANTS
+  #
+
+  # A percentage {#confidence} that the vulnerability is real and not a false positive.
+  CONFIDENCE_RANGE = 0 .. 100
+
+  # Default value for {#params}
+  DEFAULT_PARAMS = []
+
+  # Allowed {#method methods}.
+  METHODS = [
+      'GET',
+      # XXX I don't know why PATH is a valid method when it's not an HTTP Method/Verb
+      'PATH',
+      'POST'
+  ]
+
+  # {#risk Risk} is rated on a scale from 0 (least risky) to 5 (most risky).
+  RISK_RANGE = 0 .. 5
+
+  #
+  # Associations
+  #
+
+  belongs_to :web_site,
+             class_name: 'Mdm::WebSite',
+             inverse_of: :web_vulns
+
+  #
+  # Attributes
+  #
+
+  # @!attribute [rw] blame
+  #   Who to blame for the vulnerability
+  #
+  #   @return [String]
+
+  # @!attribute [rw] category
+  #   Category of this vulnerability.
+  #
+  #   @return [String]
+
+  # @!attribute [rw] confidence
+  #   Percentage confidence scanner or auditor has that this vulnerability is not a false positive
+  #
+  #   @return [Integer] 1% to 100%
+
+  # @!attribute [rw] description
+  #   Description of the vulnerability
+  #
+  #   @return [String, nil]
+
+  # @!attribute [rw] method
+  #   HTTP Methods for request that found vulnerability.  'PATH' is also allowed even though it is not an HTTP Method.
+  #
+  #   @return [String]
+  #   @see METHODS
+
+  # @!attribute [rw] name
+  #   Name of the vulnerability
+  #
+  #   @return [String]
+
+  # @!attribute [rw] path
+  #   Path portion of URL
+  #
+  #   @return [String]
+
+  # @!attribute [rw] payload
+  #   Web audit payload that gets executed by the remote server.  Used for code injection vulnerabilities.
+  #
+  #   @return [String, nil]
+
+  # @!attribute [rw] pname
+  #   Name of parameter that demonstrates vulnerability
+  #
+  #   @return [String]
+
+  # @!attribute [rw] proof
+  #   String that proves vulnerability, such as a code snippet, etc.
+  #
+  #   @return [String]
+
+  # @!attribute [rw] query
+  #   The GET query.
+  #
+  #   @return [String]
+
+  # @!attribute [rw] request
+  #
+  #   @return [String]
+
+  # @!attribute [rw] risk
+  #   {RISK_RANGE Risk} of leaving this vulnerability unpatched.
+  #
+  #   @return [Integer]
+
+  #
+  # Validations
+  #
+
+  validates :category, :presence => true
+  validates :confidence,
+            :inclusion => {
+                :in => CONFIDENCE_RANGE
+            }
+  validates :method,
+            :inclusion => {
+                :in => METHODS
+            }
+  validates :name, :presence => true
+  validates :params, :parameters => true
+  validates :path, :presence => true
+  validates :proof, :presence => true
+  validates :risk,
+            :inclusion => {
+                :in => RISK_RANGE
+            }
+  validates :web_site, :presence => true
+
+  #
+  # Serializations
+  #
+
+  # @!attribute [rw] params
+  #   Parameters sent as part of request
+  #
+  #   @return [Array<Array(String, String)>] Array of parameter key value pairs
+  serialize :params, MetasploitDataModels::Base64Serializer.new(:default => DEFAULT_PARAMS)
+
+  #
+  # Methods
+  #
+
+  # Parameters sent as part of request.
+  #
+  # @return [Array<Array<(String, String)>>]
+  def params
+    normalize_params(
+        read_attribute(:params)
+    )
+  end
+
+  # Set parameters sent as part of request.
+  #
+  # @param params [Array<Array<(String, String)>>, nil] Array of parameter key value pairs
+  # @return [void]
+  def params=(params)
+    write_attribute(
+        :params,
+        normalize_params(params)
+    )
+  end
+
+  private
+
+  # Creates a duplicate of {DEFAULT_PARAMS} that is safe to modify.
+  #
+  # @return [Array] an empty array
+  def default_params
+    DEFAULT_PARAMS.dup
+  end
+
+  # Returns either the given params or {DEFAULT_PARAMS} if params is `nil`
+  #
+  # @param [Array<Array<(String, String)>>, nil] params
+  # @return [Array<<Array<(String, String)>>] params if not `nil`
+  # @return [nil] if params is `nil`
+  def normalize_params(params)
+    params || default_params
+  end
+
+  # switch back to public for load hooks
+  public
+
+  Metasploit::Concern.run(self)
+end
+

data/app/models/mdm/wmap_request.rb

@@ -0,0 +1,101 @@
+# Request sent to a {Mdm::WmapTarget}.  WMAP is a plugin to metasploit-framework.
+class Mdm::WmapRequest < ApplicationRecord
+  #
+  #
+  # Attributes
+  #
+  #
+
+  # @!attribute address
+  #   IP address of {#host} to which this request was sent.
+  #
+  #   @return [String]
+
+  # @!attribute body
+  #   Body of this request.
+  #
+  #   @return [String]
+
+  # @!attribute created_at
+  #   When this request was created.
+  #
+  #   @return [DateTime]
+
+  # @!attribute headers
+  #   Headers sent as part of this request.
+  #
+  #   @return [String]
+
+  # @!attribute host
+  #   Name of host to which this request was sent.
+  #
+  #   @return [String]
+
+  # @!attribute meth
+  #   HTTP Method (or VERB) used for request.
+  #
+  #   @return [String]
+
+  # @!attribute path
+  #   Path portion of URL for this request.
+  #
+  #   @return [String]
+
+  # @!attribute port
+  #   Port at {#address} to which this request was sent.
+  #
+  #   @return [Integer]
+
+  # @!attribute query
+  #   Query portion of URL for this request.
+  #
+  #   @return [String]
+
+  # @!attribute ssl
+  #   Version of SSL to use.
+  #
+  #   @return [Integer]
+
+  # @!attribute updated_at
+  #   The last time this request was updated.
+  #
+  #   @return [DateTime]
+
+  #
+  # @!group Response
+  #
+
+  # @!attribute respcode
+  #   HTTP status code sent in response to this request from server.
+  #
+  #   @return [String]
+
+  # @!attribute resphead
+  #   Headers sent in response from server.
+  #
+  #   @return [String]
+
+  # @!attribute response
+  #   Response sent from server.
+  #
+  #   @return [String]
+
+  #
+  # @!endgroup
+  #
+
+  #
+  # Instance Methods
+  #
+
+  # @note Necessary to avoid coercion to an `IPAddr` object.
+  #
+  # The IP address for this request.
+  #
+  # @return [String]
+  def address
+    self[:address].to_s
+  end
+
+  Metasploit::Concern.run(self)
+end

data/app/models/mdm/wmap_target.rb

@@ -0,0 +1,56 @@
+# WMAP target. WMAP is a plugin to metasploit-framework.
+class Mdm::WmapTarget < ApplicationRecord
+  #
+  # Attributes
+  #
+
+  # @!attribute address
+  #   IP address of {#host}.
+  #
+  #   @return [String]
+
+  # @!attribute created_at
+  #   When this target was created.
+  #
+  #   @return [DateTime]
+
+  # @!attribute host
+  #   Name of this target.
+  #
+  #   @return [String]
+
+  # @!attribute port
+  #   Port on this target to send {Mdm::WmapRequest requests}.
+  #
+  #   @return [Integer]
+
+  # @!attribute selected
+  #   Whether this target should be sent requests.
+  #
+  #   @return [Integer]
+
+  # @!attribute ssl
+  #   Version of SSL to use when sending requests to this target.
+  #
+  #   @return [Integer]
+
+  # @!attribute updated_at
+  #   The last time this target was updated.
+  #
+  #   @return [DateTime]
+
+  #
+  # Instance Methods
+  #
+
+  # @note Necessary to avoid coercion to an `IPAddr` object.
+  #
+  # The IP address for this target.
+  #
+  # @return [String]
+  def address
+    self[:address].to_s
+  end
+
+  Metasploit::Concern.run(self)
+end