yawast 0.4.0.beta3 → 0.4.0.beta4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: c657b676e6fb2fab6ddf48ac8c7b9a8a8606e1b7
-  data.tar.gz: 24071878a0ea703638f5ce1587524505489a9cfb
+  metadata.gz: 578aea8ce34d6fd6603ffcffb70f4dfbee7a911d
+  data.tar.gz: 09ee59b7fbdd5fd51d222d92fd67752086eed664
 SHA512:
-  metadata.gz: df6f61d22b221f9dccaff5ef22fdc0708793034368d1101762fdb41338c8a5472fd1ba81cf2ec746a3c76521e5a9ae288e4b39c5196426ca66d59d580eb1cb70
-  data.tar.gz: 571fff42d3a0a67c5c1c8ec7a1d30994e91a73ba1a186f150b120a7f3edb83149a591ca631377cb69f49b1e590dd5de30a19bc2c9fc0e7d021b847e59a33c9a9
+  metadata.gz: 03ef71cdaf26cc2845c29c8667ec51af7a04ec77abfa6be96a91afb987b022eebc07d36b159b42f2ad69dfdb09c6c749a3f88d6158cf6ca1a29de3b094f374e5
+  data.tar.gz: 01e4313f8ee9d155d9c5a0470dbe956e5c6f83ae986fa6762a73d19462f3ba76fc997b91f72b7c59e76366ed840f00e7872871c6f24ff29d9f7cbed6a8cd180a

data/CHANGELOG.md

@@ -2,7 +2,11 @@
 
 * [#66](https://github.com/adamcaudill/yawast/issues/66) - Thread directory search for better performance
 * [#67](https://github.com/adamcaudill/yawast/issues/67) - Make "Found Redirect" optional
+* [#69](https://github.com/adamcaudill/yawast/issues/69) - False positives on non-standard 404 handling
+* [#73](https://github.com/adamcaudill/yawast/issues/73) - Use `--internalssl` when host is an IP address
 * [#65](https://github.com/adamcaudill/yawast/issues/65) - Bug: Output redirection doesn't work correctly
+* [#70](https://github.com/adamcaudill/yawast/issues/70) - Bug: Handle scans of IP addresses
+* [#72](https://github.com/adamcaudill/yawast/issues/72) - Bug: internalssl & Scanning IPs Fails
 
 ## 0.3.0 - 2016-09-15
 

data/lib/scanner/cert.rb

@@ -83,7 +83,7 @@ module Yawast
           if cert.nil?
             raise 'No certificate received.'
           else
-            @results.push "#{domain}: Issuer: '#{cert.issuer.common_name}' / '#{cert.issuer.organization}' Serial: #{cert.serial}"
+            @results.push "#{domain}: Issuer: '#{cert.issuer.common_name}' / '#{cert.issuer.organization}' Subject: '#{cert.subject}' Serial: #{cert.serial}"
           end
         rescue
           unless domain.start_with? 'www.'

data/lib/scanner/core.rb

@@ -48,14 +48,7 @@ module Yawast
             Yawast::Scanner::Apache.check_all(@uri, head)
             Yawast::Scanner::Iis.check_all(@uri, head)
 
-            Yawast::Scanner::ObjectPresence.check_source_control(@uri)
-            Yawast::Scanner::ObjectPresence.check_sitemap(@uri)
-            Yawast::Scanner::ObjectPresence.check_cross_domain(@uri)
-            Yawast::Scanner::ObjectPresence.check_wsftp_log(@uri)
-            Yawast::Scanner::ObjectPresence.check_trace_axd(@uri)
-            Yawast::Scanner::ObjectPresence.check_elmah_axd(@uri)
-            Yawast::Scanner::ObjectPresence.check_readme_html(@uri)
-            Yawast::Scanner::ObjectPresence.check_release_notes_txt(@uri)
+            Yawast::Scanner::Plugins::Http::FilePresence.check_all @uri
 
             Yawast::Scanner::Generic.check_propfind(@uri)
             Yawast::Scanner::Generic.check_options(@uri)
@@ -110,7 +103,7 @@ module Yawast
         if @uri.scheme == 'https' && !options.nossl
           head = Yawast::Shared::Http.head(@uri) if head == nil
 
-          if options.internalssl
+          if options.internalssl || IPAddress.valid?(uri.host)
             Yawast::Scanner::Ssl.info(uri, !options.nociphers, options.tdessessioncount)
           else
             Yawast::Scanner::SslLabs.info(@uri, options.tdessessioncount)

data/lib/scanner/plugins/http/file_presence.rb

@@ -0,0 +1,90 @@
+require 'securerandom'
+
+module Yawast
+  module Scanner
+    module Plugins
+      module Http
+        class FilePresence
+          def self.check_path(uri, path, vuln)
+            #note: this only checks directly at the root, I'm not sure if this is what we want
+            # should probably be relative to what's passed in, instead of overriding the path.
+            check = uri.copy
+            check.path = "#{path}"
+            code = Yawast::Shared::Http.get_status_code(check)
+
+            if code == "200"
+              msg = "'#{path}' found: #{check}"
+
+              if vuln
+                Yawast::Utilities.puts_vuln msg
+              else
+                Yawast::Utilities.puts_warn msg
+              end
+
+              puts ''
+            end
+          end
+
+          def self.check_all(uri)
+            #first, we need to see if the site responds to 404 in a reasonable way
+            fake_uri = uri.copy
+            fake_uri.path = "/#{SecureRandom.hex}/"
+            if Yawast::Shared::Http.get_status_code(fake_uri) != '404'
+              #crazy 404 handling
+              puts 'Site does not respond properly to non-existent file requests; skipping some checks.'
+
+              return
+            end
+
+            check_source_control uri
+            check_cross_domain uri
+            check_sitemap uri
+            check_wsftp_log uri
+            check_trace_axd uri
+            check_elmah_axd uri
+            check_readme_html uri
+            check_release_notes_txt uri
+          end
+
+          def self.check_source_control(uri)
+            check_path(uri, '/.git/', true)
+            check_path(uri, '/.hg/', true)
+            check_path(uri, '/.svn/', true)
+            check_path(uri, '/.bzr/', true)
+          end
+
+          def self.check_cross_domain(uri)
+            check_path(uri, '/crossdomain.xml', false)
+            check_path(uri, '/clientaccesspolicy.xml', false)
+          end
+
+          def self.check_sitemap(uri)
+            check_path(uri, '/sitemap.xml', false)
+          end
+
+          def self.check_wsftp_log(uri)
+            #check both upper and lower, as they are both seen in the wild
+            check_path(uri, '/WS_FTP.LOG', false)
+            check_path(uri, '/ws_ftp.log', false)
+          end
+
+          def self.check_trace_axd(uri)
+            check_path(uri, '/Trace.axd', false)
+          end
+
+          def self.check_elmah_axd(uri)
+            check_path(uri, '/elmah.axd', false)
+          end
+
+          def self.check_readme_html(uri)
+            check_path(uri, '/readme.html', false)
+          end
+
+          def self.check_release_notes_txt(uri)
+            check_path(uri, '/RELEASE-NOTES.txt', false)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/scanner/ssl.rb

@@ -108,7 +108,12 @@ module Yawast
         puts 'Supported Ciphers (based on your OpenSSL version):'
 
         dns = Resolv::DNS.new()
-        ip = dns.getaddresses(uri.host)[0]
+
+        if IPAddress.valid? uri.host
+          ip = IPAddress.parse uri.host
+        else
+          ip = dns.getaddresses(uri.host)[0]
+        end
 
         #find all versions that don't include '_server' or '_client'
         versions = OpenSSL::SSL::SSLContext::METHODS.find_all { |v| !v.to_s.include?('_client') && !v.to_s.include?('_server')}
@@ -145,7 +150,8 @@ module Yawast
               rescue OpenSSL::SSL::SSLError => e
                 unless e.message.include?('alert handshake failure') ||
                     e.message.include?('no ciphers available') ||
-                    e.message.include?('wrong version number')
+                    e.message.include?('wrong version number') ||
+                    e.message.include?('alert protocol version')
                   Yawast::Utilities.puts_error "\t\tVersion: #{ssl.ssl_version.ljust(7)}\tBits: #{cipher[2]}\tCipher: #{cipher[0]}\t(Supported But Failed)"
                 end
               rescue => e

data/lib/shared/uri.rb

@@ -1,3 +1,5 @@
+require 'ipaddress'
+
 module Yawast
   module Shared
     class Uri
@@ -21,7 +23,14 @@ module Yawast
           dns = Resolv::DNS.new
           dns.getaddress(uri.host)
         rescue => e
-          raise ArgumentError.new("Invalid URL (#{e.message})") unless uri.host == 'localhost'
+          if uri.host == 'localhost'
+            #do nothing, in this case, we just don't care.
+          elsif IPAddress.valid? uri.host
+            #in this case the host name is actually a IP, let it go through.
+          else
+            #we've passed all the exceptions, if we are here, it's a problem
+            raise ArgumentError.new("Invalid URL (#{e.message})")
+          end
         end
 
         return uri

data/lib/version.rb

@@ -1,3 +1,3 @@
 module Yawast
-  VERSION = '0.4.0.beta3'
+  VERSION = '0.4.0.beta4'
 end

data/test/test_object_presence.rb

@@ -12,7 +12,7 @@ class TestScannerApacheServerStatus < Minitest::Test
 
     override_stdout
     uri = Yawast::Commands::Utils.extract_uri(["http://localhost:#{port}"])
-    Yawast::Scanner::ObjectPresence.check_readme_html uri
+    Yawast::Scanner::Plugins::Http::FilePresence.check_readme_html uri
 
     assert stdout_value.include?('\'/readme.html\' found:'), 'readme.html page warning not found'
 
@@ -26,7 +26,7 @@ class TestScannerApacheServerStatus < Minitest::Test
 
     override_stdout
     uri = Yawast::Commands::Utils.extract_uri(["http://localhost:#{port}"])
-    Yawast::Scanner::ObjectPresence.check_release_notes_txt uri
+    Yawast::Scanner::Plugins::Http::FilePresence.check_release_notes_txt uri
 
     assert stdout_value.include?('\'/RELEASE-NOTES.txt\' found:'), 'RELEASE-NOTES.txt page warning not found'
 

data/yawast.gemspec

@@ -19,6 +19,7 @@ Gem::Specification.new do |s|
   s.add_runtime_dependency 'openssl-extensions', '~> 1.2'
   s.add_runtime_dependency 'colorize', '~> 0.8'
   s.add_runtime_dependency 'ipaddr_extensions', '~> 1.0'
+  s.add_runtime_dependency 'ipaddress', '~> 0.8'
 
   s.bindir            = 'bin'
   s.files             = `git ls-files`.split("\n")

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: yawast
 version: !ruby/object:Gem::Version
-  version: 0.4.0.beta3
+  version: 0.4.0.beta4
 platform: ruby
 authors:
 - Adam Caudill
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-09-22 00:00:00.000000000 Z
+date: 2016-10-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ssllabs
@@ -94,6 +94,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: ipaddress
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.8'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.8'
 description: YAWAST is an application meant to simplify initial analysis and information
   gathering for penetration testers and security auditors.
 email: adam@adamcaudill.com
@@ -124,9 +138,9 @@ files:
 - lib/scanner/generic.rb
 - lib/scanner/iis.rb
 - lib/scanner/nginx.rb
-- lib/scanner/obj_presence.rb
 - lib/scanner/php.rb
 - lib/scanner/plugins/http/directory_search.rb
+- lib/scanner/plugins/http/file_presence.rb
 - lib/scanner/ssl.rb
 - lib/scanner/ssl_labs.rb
 - lib/shared/http.rb

data/lib/scanner/obj_presence.rb

@@ -1,63 +0,0 @@
-module Yawast
-  module Scanner
-    class ObjectPresence
-      def self.check_source_control(uri)
-        check_path(uri, '/.git/', true)
-        check_path(uri, '/.hg/', true)
-        check_path(uri, '/.svn/', true)
-        check_path(uri, '/.bzr/', true)
-      end
-
-      def self.check_cross_domain(uri)
-        check_path(uri, '/crossdomain.xml', false)
-        check_path(uri, '/clientaccesspolicy.xml', false)
-      end
-
-      def self.check_sitemap(uri)
-        check_path(uri, '/sitemap.xml', false)
-      end
-
-      def self.check_wsftp_log(uri)
-        #check both upper and lower, as they are both seen in the wild
-        check_path(uri, '/WS_FTP.LOG', false)
-        check_path(uri, '/ws_ftp.log', false)
-      end
-
-      def self.check_trace_axd(uri)
-        check_path(uri, '/Trace.axd', false)
-      end
-
-      def self.check_elmah_axd(uri)
-        check_path(uri, '/elmah.axd', false)
-      end
-
-      def self.check_readme_html(uri)
-        check_path(uri, '/readme.html', false)
-      end
-
-      def self.check_release_notes_txt(uri)
-        check_path(uri, '/RELEASE-NOTES.txt', false)
-      end
-
-      def self.check_path(uri, path, vuln)
-        #note: this only checks directly at the root, I'm not sure if this is what we want
-        # should probably be relative to what's passed in, instead of overriding the path.
-        check = uri.copy
-        check.path = "#{path}"
-        code = Yawast::Shared::Http.get_status_code(check)
-
-        if code == "200"
-          msg = "'#{path}' found: #{check}"
-
-          if vuln
-            Yawast::Utilities.puts_vuln msg
-          else
-            Yawast::Utilities.puts_warn msg
-          end
-
-          puts ''
-        end
-      end
-    end
-  end
-end