source: nikto-2.1.2/plugins/nikto_content_search.plugin @ 484

#VERSION,2.02
# $Id: nikto_content_search.plugin 483 2010-07-11 04:19:01Z sullo $
###############################################################################
#  Copyright (C) 2004 CIRT, Inc.
#
#  This program is free software; you can redistribute it and/or
#  modify it under the terms of the GNU General Public License
#  as published by the Free Software Foundation; version 2
#  of the License only.
#
#  This program is distributed in the hope that it will be useful,
#  but WITHOUT ANY WARRANTY; without even the implied warranty of
#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#  GNU General Public License for more details.
#
#  You should have received a copy of the GNU General Public License
#  along with this program; if not, write to the Free Software
#  Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
###############################################################################
# PURPOSE:
# Search content for known bad strings
###############################################################################
use vars qw/$CONTENTSEARCH %CSMATCHED/;

sub nikto_content_search_init {
    my $id = { name             => "content_search",
               full_name        => "Content Search",
               author           => "Sullo",
               description      => "Search resultant content for interesting strings",
               hooks       => {
                                 start => {
                                    method => \&nikto_content_search_load,
                                    weight => 1,
                                 },
                                 postfetch => {
                                    method => \&nikto_content_search,
                                    weight => 20,
                                 },
                              },                   
               copyright        => "2010 CIRT Inc"
               };

    return $id;
}

sub nikto_content_search_load {

    # Load up the database as soon as we can

    $CONTENTSEARCH = init_db("db_content_search");
    %CSMATCHED     = ();

    # to try and speed it up - precompile the regular expressions
    foreach my $testid (@$CONTENTSEARCH) {
        $testid->{'compiled'} = qr/$testid->{'matchstring'}/;
    }
}

sub nikto_content_search {
    my ($mark, $parameters, $request, $result) = @_;

    my $body   = $result->{'whisker'}->{'data'};
    my $file   = $result->{'whisker'}->{'uri'};
    my $method = $result->{'whisker'}->{'method'} || "GET";

    foreach my $testid (@$CONTENTSEARCH) {
        if ($body =~ $testid->{'compiled'}
            && !exists $CSMATCHED{ $mark->{'hostname'} }{$file}) {

            # Check whether we've already matched it
            my $outmessage = "$file: $testid->{'message'}";
            add_vulnerability($mark, $outmessage, $testid->{'nikto_id'}, $testid->{'osvdb'},
                              $method, $file);
            $CSMATCHED{ $mark->{'hostname'} }{$file} = 1;
        }
    }
    return $request, $result;
}

1;