yawast 0.7.0.beta2 → 0.7.0.beta3

data/lib/scanner/vuln_scan.rb

@@ -6,21 +6,34 @@ module Yawast
       def self.scan(uri, options, head)
         puts 'Performing vulnerability scan (this will take a while)...'
 
-        # server specific checks
-        Yawast::Scanner::Plugins::Servers::Apache.check_all(uri)
-        Yawast::Scanner::Plugins::Servers::Iis.check_all(uri, head)
+        if options.spider
+          links = Yawast::Scanner::Plugins::Spider::Spider.spider(uri)
+        else
+          puts 'Building site map...'
+          links = Yawast::Scanner::Plugins::Spider::Spider.spider(uri, true)
+        end
 
         # checks for interesting files
         Yawast::Scanner::Plugins::Http::FilePresence.check_all uri, options.files
 
+        # server specific checks
+        Yawast::Scanner::Plugins::Servers::Apache.check_all(uri, links)
+        Yawast::Scanner::Plugins::Servers::Nginx.check_all(uri)
+        Yawast::Scanner::Plugins::Servers::Iis.check_all(uri, head)
+
         # generic header checks
         Yawast::Scanner::Plugins::Http::Generic.check_propfind(uri)
         Yawast::Scanner::Plugins::Http::Generic.check_options(uri)
         Yawast::Scanner::Plugins::Http::Generic.check_trace(uri)
 
         # check for issues with the password reset form
-        Yawast::Scanner::Plugins::Applications::Generic::PasswordReset.setup
-        Yawast::Scanner::Plugins::Applications::Generic::PasswordReset.check_resp_user_enum
+        unless Yawast.options.pass_reset_page.nil?
+          Yawast::Scanner::Plugins::Applications::Generic::PasswordReset.setup
+          Yawast::Scanner::Plugins::Applications::Generic::PasswordReset.check_resp_user_enum
+        end
+
+        # check for framework specific issues
+        Yawast::Scanner::Plugins::Applications::Framework::Rails.check_all uri, links
       end
     end
   end

data/lib/shared/http.rb

@@ -2,7 +2,6 @@
 
 require 'securerandom'
 require 'json'
-require 'oj'
 
 module Yawast
   module Shared
@@ -38,6 +37,7 @@ module Yawast
 
       def self.get_with_code(uri, headers = nil)
         body = ''
+        code = nil
 
         begin
           req = get_http(uri)
@@ -45,8 +45,6 @@ module Yawast
           res = req.request_get(uri, get_headers(headers))
           body = res.read_body
           code = res.code
-
-          Yawast::Shared::Output.log_json 'debug', 'http_get', uri, Oj.dump(res, Oj.default_options)
         rescue # rubocop:disable Style/RescueStandardError, Lint/HandleExceptions
           # do nothing for now
         end
@@ -93,8 +91,6 @@ module Yawast
         req.use_ssl = uri.scheme == 'https'
         res = req.head(uri, get_headers)
 
-        Yawast::Shared::Output.log_json 'debug', 'http_get_status_code', uri, Oj.dump(res, Oj.default_options)
-
         res.code
       end
 

data/lib/shared/output.rb

@@ -67,7 +67,7 @@ module Yawast
 
         target = get_target super_parent, parent
 
-        target[key] = JSON.parse(json_block)
+        target[key] = escape_hash(JSON.parse(json_block))
       end
 
       def self.log_hash(super_parent = nil, parent = nil, key, hash)
@@ -75,7 +75,7 @@ module Yawast
 
         target = get_target super_parent, parent
 
-        target[key] = hash
+        target[key] = escape_hash hash
       end
 
       def self.encode_utf8(str)
@@ -111,13 +111,16 @@ module Yawast
       end
 
       def self.escape_hash(hash)
-        hash.each_pair do |k,v|
+        hash.each_pair do |k, v|
           if v.is_a?(Hash)
             escape_hash(v)
-          else
-            if v.is_a?(String)
-              hash[k] = Base64.encode64 v unless v.valid_encoding?
-            end
+          elsif v.is_a?(String)
+            # first, attempt to force utf-8
+            v = encode_utf8 v
+            hash[k] = v
+
+            # if needed, Base64 encode to ensure that we can produce the JSON output
+            hash[k] = Base64.encode64 v unless v.valid_encoding?
           end
         end
       end

data/lib/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Yawast
-  VERSION = '0.7.0.beta2'
+  VERSION = '0.7.0.beta3'
 end

data/test/data/dir.txt

@@ -0,0 +1,9 @@
+Volume in drive C has no label.
+Volume Serial Number is B86A-EF32
+
+Directory of C:\test
+
+11/30/2004  01:40 PM <DIR>  .
+11/30/2004  01:40 PM <DIR> ..
+11/30/2004  11:05 AM 0 T97B4~1.TXT t.txt2
+11/30/2004  01:16 PM 0 t97.txt

data/test/data/etc_passwd.txt

@@ -0,0 +1,16 @@
+root:x:0:0:root:/root:/bin/bash
+bin:x:1:1:bin:/bin:/sbin/nologin
+daemon:x:2:2:daemon:/sbin:/sbin/nologin
+adm:x:3:4:adm:/var/adm:/sbin/nologin
+lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
+sync:x:5:0:sync:/sbin:/bin/sync
+shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
+halt:x:7:0:halt:/sbin:/sbin/halt
+mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
+news:x:9:13:news:/etc/news:
+uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
+operator:x:11:0:operator:/root:/sbin/nologin
+games:x:12:100:games:/usr/games:/sbin/nologin
+gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
+ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
+nobody:x:99:99:Nobody:/:/sbin/nologin

data/test/data/nginx_status_page.txt

@@ -0,0 +1,4 @@
+Active connections: 24
+server accepts handled requests
+ 6347476 6347476 11266177
+Reading: 0 Writing: 1 Waiting: 23

data/test/test_app_fw_rails.rb

@@ -0,0 +1,28 @@
+require File.dirname(__FILE__) + '/../lib/yawast'
+require File.dirname(__FILE__) + '/base'
+
+class TestScannerApache < Minitest::Test
+  include TestBase
+
+  def test_check_cve_2019_5418
+    override_stdout
+
+    port = rand(60000) + 1024 # pick a random port number
+    server = start_web_server File.dirname(__FILE__) + '/data/etc_passwd.txt', '', port
+    uri = Yawast::Commands::Utils.extract_uri(["http://localhost:#{port}"])
+
+    error = nil
+    begin
+      Yawast::Scanner::Plugins::Applications::Framework::Rails.check_cve_2019_5418 [uri.to_s]
+    rescue => e
+      error = e.message
+    end
+
+    assert !stdout_value.include?('[W]'), "Unexpected finding: #{stdout_value}"
+    assert error == nil, "Unexpected error: #{error}"
+
+    restore_stdout
+
+    server.exit
+  end
+end

data/test/test_scan_apache.rb

@@ -26,6 +26,29 @@ class TestScannerApache < Minitest::Test
     server.exit
   end
 
+  def test_check_tomcat_2019_0232
+    override_stdout
+
+    port = rand(60000) + 1024 # pick a random port number
+    server = start_web_server File.dirname(__FILE__) + '/data/apache_server_info.txt', '/cgi-bin/test.bat', port
+    uri = URI.parse "http://localhost:#{port}/cgi-bin/test.bat"
+    links = [uri.to_s]
+
+    error = nil
+    begin
+      Yawast::Scanner::Plugins::Servers::Apache.check_cve_2019_0232 links
+    rescue => e
+      error = e.message
+    end
+
+    assert !stdout_value.include?('[V]'), "Unexpected finding: #{stdout_value}"
+    assert error == nil, "Unexpected error: #{error}"
+
+    restore_stdout
+
+    server.exit
+  end
+
   def test_check_struts2_samples
     override_stdout
 

data/test/test_scan_nginx.rb

@@ -0,0 +1,33 @@
+require File.dirname(__FILE__) + '/../lib/yawast'
+require File.dirname(__FILE__) + '/base'
+
+class TestScannerNginx < Minitest::Test
+  include TestBase
+
+  def test_nginx_basic_banner
+    server = 'nginx/1.8.1'
+
+    override_stdout
+    Yawast::Scanner::Plugins::Servers::Nginx.check_banner server
+
+    assert stdout_value.include?("nginx Version: #{server}"), "Unexpected banner: #{stdout_value}"
+
+    restore_stdout
+  end
+
+  def test_nginx_status_present
+    port = rand(60000) + 1024 # pick a random port number
+    server = start_web_server File.dirname(__FILE__) + '/data/nginx_status_page.txt', 'status', port
+
+    override_stdout
+    uri = Yawast::Commands::Utils.extract_uri(["http://localhost:#{port}"])
+
+    Yawast::Shared::Http.setup nil, nil
+    Yawast::Scanner::Plugins::Servers::Nginx.check_status_page uri
+
+    assert stdout_value.include?('Nginx status page found'), 'Nginx Status page warning not found'
+
+    server.exit
+    restore_stdout
+  end
+end

data/yawast.gemspec

@@ -22,7 +22,6 @@ Gem::Specification.new do |s|
   s.add_runtime_dependency 'ipaddr_extensions', '~> 1.0'
   s.add_runtime_dependency 'ipaddress', '~> 0.8'
   s.add_runtime_dependency 'nokogiri', '~> 1.8'
-  s.add_runtime_dependency 'oj', '~> 3.6'
   s.add_runtime_dependency 'openssl-extensions', '~> 1.2'
   s.add_runtime_dependency 'public_suffix', '~> 2.0'
   s.add_runtime_dependency 'selenium-webdriver', '~> 3.141'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: yawast
 version: !ruby/object:Gem::Version
-  version: 0.7.0.beta2
+  version: 0.7.0.beta3
 platform: ruby
 authors:
 - Adam Caudill
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-03-14 00:00:00.000000000 Z
+date: 2019-04-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: colorize
@@ -136,20 +136,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.8'
-- !ruby/object:Gem::Dependency
-  name: oj
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.6'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.6'
 - !ruby/object:Gem::Dependency
   name: openssl-extensions
   requirement: !ruby/object:Gem::Requirement
@@ -239,6 +225,7 @@ files:
 - lib/scanner/core.rb
 - lib/scanner/generic.rb
 - lib/scanner/plugins/applications/cms/generic.rb
+- lib/scanner/plugins/applications/framework/rails.rb
 - lib/scanner/plugins/applications/generic/password_reset.rb
 - lib/scanner/plugins/dns/caa.rb
 - lib/scanner/plugins/dns/generic.rb
@@ -271,9 +258,12 @@ files:
 - test/data/apache_server_status.txt
 - test/data/cms_none_body.txt
 - test/data/cms_wordpress_body.txt
+- test/data/dir.txt
+- test/data/etc_passwd.txt
 - test/data/hsts_disabled_server_header.txt
 - test/data/hsts_server_header.txt
 - test/data/iis_server_header.txt
+- test/data/nginx_status_page.txt
 - test/data/ssl_labs_analyze_data.json
 - test/data/ssl_labs_analyze_data_activationservice1_installshield_com.json
 - test/data/ssl_labs_analyze_data_cam_hmhreservations_com.json
@@ -284,6 +274,7 @@ files:
 - test/data/ssl_labs_info.json
 - test/data/tomcat_release_notes.txt
 - test/data/wordpress_readme_html.txt
+- test/test_app_fw_rails.rb
 - test/test_cmd_util.rb
 - test/test_directory_search.rb
 - test/test_helper.rb
@@ -296,7 +287,7 @@ files:
 - test/test_scan_cms.rb
 - test/test_scan_dns.rb
 - test/test_scan_iis_headers.rb
-- test/test_scan_nginx_banner.rb
+- test/test_scan_nginx.rb
 - test/test_shared_http.rb
 - test/test_shared_util.rb
 - test/test_ssl.rb
@@ -336,9 +327,12 @@ test_files:
 - test/data/apache_server_status.txt
 - test/data/cms_none_body.txt
 - test/data/cms_wordpress_body.txt
+- test/data/dir.txt
+- test/data/etc_passwd.txt
 - test/data/hsts_disabled_server_header.txt
 - test/data/hsts_server_header.txt
 - test/data/iis_server_header.txt
+- test/data/nginx_status_page.txt
 - test/data/ssl_labs_analyze_data.json
 - test/data/ssl_labs_analyze_data_activationservice1_installshield_com.json
 - test/data/ssl_labs_analyze_data_cam_hmhreservations_com.json
@@ -349,6 +343,7 @@ test_files:
 - test/data/ssl_labs_info.json
 - test/data/tomcat_release_notes.txt
 - test/data/wordpress_readme_html.txt
+- test/test_app_fw_rails.rb
 - test/test_cmd_util.rb
 - test/test_directory_search.rb
 - test/test_helper.rb
@@ -361,7 +356,7 @@ test_files:
 - test/test_scan_cms.rb
 - test/test_scan_dns.rb
 - test/test_scan_iis_headers.rb
-- test/test_scan_nginx_banner.rb
+- test/test_scan_nginx.rb
 - test/test_shared_http.rb
 - test/test_shared_util.rb
 - test/test_ssl.rb

data/test/test_scan_nginx_banner.rb

@@ -1,17 +0,0 @@
-require File.dirname(__FILE__) + '/../lib/yawast'
-require File.dirname(__FILE__) + '/base'
-
-class TestScannerNginxHeaders < Minitest::Test
-  include TestBase
-
-  def test_nginx_basic_banner
-    server = 'nginx/1.8.1'
-
-    override_stdout
-    Yawast::Scanner::Plugins::Servers::Nginx.check_banner server
-
-    assert stdout_value.include?("nginx Version: #{server}"), "Unexpected banner: #{stdout_value}"
-
-    restore_stdout
-  end
-end