yawast 0.7.0.beta2 → 0.7.0.beta3

data/lib/scanner/plugins/dns/caa.rb

@@ -28,7 +28,7 @@ module Yawast
             if @records.zero?
               Yawast::Shared::Output.log_hash 'vulnerabilities',
                                               'missing_caa_records',
-                                              {vulnerable: true}
+                                              {vulnerable: true, record_count: 0}
 
               puts
               Yawast::Utilities.puts_vuln 'DNS CAA: No records found.'

data/lib/scanner/plugins/http/generic.rb

@@ -17,12 +17,17 @@ module Yawast
                 puts "\t\t\"curl -X PROPFIND #{uri}\""
 
                 puts ''
-              end
 
-              Yawast::Shared::Output.log_value 'http', 'propfind', 'raw', res.body
-              Yawast::Shared::Output.log_value 'http', 'propfind', 'code', res.code
-              Yawast::Shared::Output.log_value 'http', 'propfind', 'content-type', res['Content-Type']
-              Yawast::Shared::Output.log_value 'http', 'propfind', 'length', res.body.length
+                Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                                'http_propfind_enabled',
+                                                {vulnerable: true, body: res.body, code: res.code,
+                                                 content_type: res['Content-Type'], length: res.body.length}
+              else
+                Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                                'http_propfind_enabled',
+                                                {vulnerable: false, body: res.body, code: res.code,
+                                                 content_type: res['Content-Type'], length: res.body.length}
+              end
             end
           end
 
@@ -38,10 +43,15 @@ module Yawast
                 puts "\t\t\"curl -X TRACE #{uri}\""
 
                 puts ''
-              end
 
-              Yawast::Shared::Output.log_value 'http', 'trace', 'raw', res.body
-              Yawast::Shared::Output.log_value 'http', 'trace', 'code', res.code
+                Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                                'http_trace_enabled',
+                                                {vulnerable: true, body: res.body, code: res.code}
+              else
+                Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                                'http_trace_enabled',
+                                                {vulnerable: false, body: res.body, code: res.code}
+              end
             end
           end
 

data/lib/scanner/plugins/servers/apache.rb

@@ -9,6 +9,16 @@ module Yawast
       module Servers
         class Apache
           def self.check_banner(banner)
+            Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                            'apache_openssl_version_exposed',
+                                            {vulnerable: false, version: nil}
+            Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                            'apache_httpd_version_exposed',
+                                            {vulnerable: false, version: nil}
+            Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                            'apache_httpd_modules_exposed',
+                                            {vulnerable: false, modules: nil}
+
             # don't bother if this doesn't look like Apache
             return unless banner.include? 'Apache'
             @apache = true
@@ -26,23 +36,33 @@ module Yawast
             # print the server info no matter what we do next
             Yawast::Utilities.puts_info "Apache Server: #{server}"
             modules.delete_at 0
+            Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                            'apache_httpd_version_exposed',
+                                            {vulnerable: true, version: server}
 
             if modules.count.positive?
               Yawast::Utilities.puts_warn 'Apache Server: Module listing enabled'
               modules.each { |mod| Yawast::Utilities.puts_warn "\t\t#{mod}" }
               puts ''
+              Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                              'apache_httpd_modules_exposed',
+                                              {vulnerable: true, modules: banner}
 
               # check for special items
               modules.each do |mod|
                 if mod.include? 'OpenSSL'
                   Yawast::Utilities.puts_warn "OpenSSL Version Disclosure: #{mod}"
                   puts ''
+
+                  Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                                  'apache_openssl_version_exposed',
+                                                  {vulnerable: true, version: mod}
                 end
               end
             end
           end
 
-          def self.check_all(uri)
+          def self.check_all(uri, links = nil)
             # run all the defined checks
             check_server_status(uri.copy)
             check_server_info(uri.copy)
@@ -50,6 +70,10 @@ module Yawast
             check_tomcat_version(uri.copy)
             check_tomcat_put_rce(uri.copy)
             check_struts2_samples(uri.copy)
+
+            unless links.nil?
+              check_cve_2019_0232(links)
+            end
           end
 
           def self.check_server_status(uri)
@@ -61,6 +85,10 @@ module Yawast
           end
 
           def self.check_tomcat_version(uri)
+            Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                            'apache_tomcat_version_exposed',
+                                            {vulnerable: false, version: nil, body: nil}
+
             begin
               req = Yawast::Shared::Http.get_http(uri)
               req.use_ssl = uri.scheme == 'https'
@@ -73,11 +101,17 @@ module Yawast
 
                 if !version.nil? && !version[0].nil?
                   Yawast::Utilities.puts_warn "Apache Tomcat Version Found: #{version[0]}"
-                  Yawast::Shared::Output.log_value 'apache', 'tomcat_version', version[0]
+                  Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                                  'apache_tomcat_version_exposed',
+                                                  {vulnerable: true, version: version[0], body: res.body}
 
                   puts "\t\t\"curl -X XYZ #{uri}\""
 
                   puts ''
+                else
+                  Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                                  'apache_tomcat_version_exposed',
+                                                  {vulnerable: false, version: nil, body: res.body}
                 end
               end
             end
@@ -89,6 +123,13 @@ module Yawast
           end
 
           def self.check_tomcat_manager_paths(uri, base_path, manager)
+            Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                            'apache_tomcat_manager_exposed',
+                                            {vulnerable: false, uri: nil}
+            Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                            'apache_tomcat_host_manager_exposed',
+                                            {vulnerable: false, uri: nil}
+
             uri.path = "/#{base_path}/html"
             uri.query = '' unless uri.query.nil?
 
@@ -97,7 +138,9 @@ module Yawast
             if ret.include? '<tt>conf/tomcat-users.xml</tt>'
               # this will get Tomcat 7+
               Yawast::Utilities.puts_warn "Apache Tomcat #{manager} page found: #{uri}"
-              Yawast::Shared::Output.log_value 'apache', 'tomcat_mgr', manager, uri
+              Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                              'apache_tomcat_manager_exposed',
+                                              {vulnerable: true, uri: uri}
               check_tomcat_manager_passwords uri, manager
 
               puts ''
@@ -109,7 +152,9 @@ module Yawast
 
               if ret.include? '<tt>conf/tomcat-users.xml</tt>'
                 Yawast::Utilities.puts_warn "Apache Tomcat #{manager} page found: #{uri}"
-                Yawast::Shared::Output.log_value 'apache', 'tomcat_mgr', manager, uri
+                Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                                'apache_tomcat_host_manager_exposed',
+                                                {vulnerable: true, uri: uri}
                 check_tomcat_manager_passwords uri, manager
 
                 puts ''
@@ -118,6 +163,9 @@ module Yawast
           end
 
           def self.check_tomcat_manager_passwords(uri, manager)
+            Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                            'apache_tomcat_manager_weak_pass',
+                                            {vulnerable: false, uri: nil, credentials: nil}
             # check for known passwords
             check_tomcat_manager_pwd_check uri, manager, 'tomcat:tomcat'
             check_tomcat_manager_pwd_check uri, manager, 'tomcat:password'
@@ -133,7 +181,9 @@ module Yawast
                ret.include?('<font size="+2">Tomcat Virtual Host Manager</font>')
               Yawast::Utilities.puts_vuln "Apache Tomcat #{manager} weak password: #{credentials}"
 
-              Yawast::Shared::Output.log_value 'apache', 'tomcat_mgr_pwd', uri, credentials
+              Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                              'apache_tomcat_manager_weak_pass',
+                                              {vulnerable: true, uri: uri, credentials: credentials}
             end
           end
 
@@ -142,13 +192,9 @@ module Yawast
             uri.path = "/#{SecureRandom.hex}.jsp/"
             uri.query = '' unless uri.query.nil?
 
-            Yawast::Shared::Output.log_value 'apache', 'cve_2017_12615', 'path', uri
-
             # we'll use this to verify that it actually worked
             check_value = SecureRandom.hex
 
-            Yawast::Shared::Output.log_value 'apache', 'cve_2017_12615', 'check_value', check_value
-
             # upload the JSP file
             req_data = "<% out.println(\"#{check_value}\");%>"
             Yawast::Shared::Http.put(uri, req_data)
@@ -157,13 +203,15 @@ module Yawast
             uri.path = uri.path.chomp('/')
             res = Yawast::Shared::Http.get(uri)
 
-            Yawast::Shared::Output.log_value 'apache', 'cve_2017_12615', 'body', res
-
             if res.include? check_value
               Yawast::Utilities.puts_vuln "Apache Tomcat PUT RCE (CVE-2017-12615): #{uri}"
-              Yawast::Shared::Output.log_value 'apache', 'cve_2017_12615', 'vulnerable', true
+              Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                              'apache_tomcat_cve_2017_12615',
+                                              {vulnerable: true, uri: uri, check_value: check_value, body: res}
             else
-              Yawast::Shared::Output.log_value 'apache', 'cve_2017_12615', 'vulnerable', false
+              Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                              'apache_tomcat_cve_2017_12615',
+                                              {vulnerable: false, uri: uri, check_value: check_value, body: res}
             end
           end
 
@@ -188,16 +236,66 @@ module Yawast
             end
           end
 
+          def self.check_cve_2019_0232(links)
+            Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                            'apache_tomcat_cve_2019_0232',
+                                            {vulnerable: false, uri: nil, body: nil}
+
+            # create a list of possible targets - this would be links that include "cgi-bin"
+            targets = []
+            links.each do |link|
+              targets.push link if link.include? '/cgi-bin/'
+            end
+
+            # check to see if we have any targets
+            unless targets.count.zero?
+              # we have targets
+              targets.each do |target|
+                # now, we need to build the URI we'll use
+                target = if target.include? '?'
+                           target + '&dir'
+                         else
+                           target + '?dir'
+                         end
+
+                # now, send the request and see if it includes "<DIR>"
+                target_uri = URI.parse target
+                body = Yawast::Shared::Http.get(target_uri)
+
+                if body.include? '<DIR>'
+                  # we have a hit
+
+                  Yawast::Utilities.puts_vuln "Apache Tomcat RCE (CVE-2019-0232): #{uri}"
+
+                  Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                                  'apache_tomcat_cve_2019_0232',
+                                                  {vulnerable: true, uri: target_uri, body: body}
+
+                  break
+                end
+              end
+            end
+          end
+
           def self.check_page_for_string(uri, path, search)
             uri.path = path
             uri.query = '' unless uri.query.nil?
 
-            ret = Yawast::Shared::Http.get(uri)
+            body = Yawast::Shared::Http.get(uri)
 
-            if ret.include? search
+            if body.include? search
               Yawast::Utilities.puts_vuln "#{search} page found: #{uri}"
               Yawast::Shared::Output.log_value 'apache', 'page_search', search, uri
+
+              Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                              "apache_#{path.tr('-', '_').tr('/', '')}_found",
+                                              {vulnerable: true, uri: uri, body: body}
+
               puts ''
+            else
+              Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                              "apache_#{path.tr('-', '_').chomp('/')}_found",
+                                              {vulnerable: false, uri: uri, body: body}
             end
           end
         end

data/lib/scanner/plugins/servers/generic.rb

@@ -6,6 +6,10 @@ module Yawast
       module Servers
         class Generic
           def self.check_banner_php(banner)
+            Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                            'php_version_exposed',
+                                            {vulnerable: false, version: nil}
+
             # don't bother if this doesn't include PHP
             return unless banner.include? 'PHP/'
 
@@ -15,6 +19,10 @@ module Yawast
               if mod.include? 'PHP/'
                 Yawast::Utilities.puts_warn "PHP Version: #{mod}"
                 puts ''
+
+                Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                                'php_version_exposed',
+                                                {vulnerable: true, version: mod}
               end
             end
           end

data/lib/scanner/plugins/servers/iis.rb

@@ -6,12 +6,20 @@ module Yawast
       module Servers
         class Iis
           def self.check_banner(banner)
+            Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                            'iis_version_exposed',
+                                            {vulnerable: false, version: nil}
+
             # don't bother if this doesn't include IIS
             return unless banner.include? 'Microsoft-IIS/'
             @iis = true
 
             Yawast::Utilities.puts_warn "IIS Version: #{banner}"
             puts ''
+
+            Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                            'iis_version_exposed',
+                                            {vulnerable: true, version: banner}
           end
 
           def self.check_all(uri, head)
@@ -34,6 +42,14 @@ module Yawast
               if k.downcase == search
                 Yawast::Utilities.puts_warn "#{message} Version: #{v}"
                 puts ''
+
+                Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                                "asp_net_#{search.tr('-', '_')}_version_exposed",
+                                                {vulnerable: true, version: v}
+              else
+                Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                                "asp_net_#{search.tr('-', '_')}_version_exposed",
+                                                {vulnerable: false, version: nil}
               end
             end
           end
@@ -47,10 +63,17 @@ module Yawast
               headers['Accept'] = '*/*'
               res = req.request(Debug.new('/', headers))
 
-              Yawast::Utilities.puts_vuln 'ASP.NET Debugging Enabled' if res.code == 200
+              if res.code == 200
+                Yawast::Utilities.puts_vuln 'ASP.NET Debugging Enabled'
 
-              Yawast::Shared::Output.log_value 'http', 'asp_net_debug', 'raw', res.body
-              Yawast::Shared::Output.log_value 'http', 'asp_net_debug', 'code', res.code
+                Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                                'asp_net_debug_enabled',
+                                                {vulnerable: true, body: res.body, code: res.code}
+              else
+                Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                                'asp_net_debug_enabled',
+                                                {vulnerable: false, body: res.body, code: res.code}
+              end
             end
           end
         end

data/lib/scanner/plugins/servers/nginx.rb

@@ -6,11 +6,44 @@ module Yawast
       module Servers
         class Nginx
           def self.check_banner(banner)
+            Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                            'nginx_version_exposed',
+                                            {vulnerable: false, version: nil}
+
             # don't bother if this doesn't include nginx
             return unless banner.include? 'nginx/'
 
             Yawast::Utilities.puts_warn "nginx Version: #{banner}"
             puts ''
+
+            Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                            'nginx_version_exposed',
+                                            {vulnerable: true, version: banner}
+          end
+
+          def self.check_all(uri)
+            check_status_page uri.copy
+          end
+
+          def self.check_status_page(uri)
+            uri.path = '/status'
+            uri.query = '' unless uri.query.nil?
+
+            body = Yawast::Shared::Http.get(uri)
+
+            if body.include? 'Active connections:'
+              Yawast::Utilities.puts_vuln "Nginx status page found: #{uri}"
+
+              Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                              'nginx_status_found',
+                                              {vulnerable: true, uri: uri, body: body}
+
+              puts ''
+            else
+              Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                              'nginx_status_found',
+                                              {vulnerable: false, uri: uri, body: body}
+            end
           end
         end
       end

data/lib/scanner/plugins/servers/python.rb

@@ -6,11 +6,19 @@ module Yawast
       module Servers
         class Python
           def self.check_banner(banner)
+            Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                            'python_version_exposed',
+                                            {vulnerable: false, version: nil}
+
             # don't bother if this doesn't include Python
             return unless banner.include? 'Python/'
 
             Yawast::Utilities.puts_warn "Python Version: #{banner}"
             puts ''
+
+            Yawast::Shared::Output.log_hash 'vulnerabilities',
+                                            'python_version_exposed',
+                                            {vulnerable: true, version: banner}
           end
         end
       end

data/lib/scanner/plugins/spider/spider.rb

@@ -7,7 +7,7 @@ module Yawast
     module Plugins
       module Spider
         class Spider
-          def self.spider(uri)
+          def self.spider(uri, silent = false)
             @uri = uri.copy
 
             @workers = []
@@ -15,7 +15,7 @@ module Yawast
 
             @links = []
             @links.push @uri.to_s
-            puts 'Spidering site...'
+            puts 'Spidering site...' unless silent
             get_links @uri
 
             results = Thread.new do
@@ -23,7 +23,9 @@ module Yawast
                 while true
                   if @results.length.positive?
                     out = @results.pop(true)
-                    Yawast::Utilities.puts_info out
+
+                    Yawast::Utilities.puts_info out unless silent
+
                     Yawast::Shared::Output.log_append_value 'spider', 'get', out
                   end
                 end
@@ -36,6 +38,8 @@ module Yawast
             results.terminate
 
             puts
+
+            @links
           end
 
           def self.get_links(uri)