source: trunk/plugins/nikto_subdomain.plugin @ 486

#VERSION,2.00
# $Id$ 
###############################################################################
#  Copyright (C) 2004 CIRT, Inc.
#
#  This program is free software; you can redistribute it and/or
#  modify it under the terms of the GNU General Public License
#  as published by the Free Software Foundation; version 2
#  of the License only.
#
#  This program is distributed in the hope that it will be useful,
#  but WITHOUT ANY WARRANTY; without even the implied warranty of
#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#  GNU General Public License for more details.
#
#  You should have received a copy of the GNU General Public License
#  along with this program; if not, write to the Free Software
#  Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
###############################################################################
# PURPOSE:
# Look for subdomains
###############################################################################
sub nikto_subdomain_init {
    my $id = { name        => "subdomain",
               full_name   => "Sub-domain forcer",
               author      => "Ryan Dewhurst",
               description => "Attempts to bruteforce commonly known sub-domains",
               hooks       => {
                                 scan => {
                                    method => \&nikto_subdomain,
                                    weight => 20,
                                 },
                              },
               copyright   => "2009 Ryan Dewhurst"
               };

    return $id;
}

sub nikto_subdomain {
    my ($mark) = @_;
    my $dbarray = init_db("db_subdomains");

    # Record the host for future use
    my $host = $mark->{'hostname'};

    # Check whether the host is an IP address
    if (index($host, '.') < 0 || $host =~ /^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*$/) {

        # Host is an IP address, don't bother!
        nprint("Host supply to subdomain is an IP address or an unqualified hostname; skipping",
               "v");
        return;
    }

    # Check if the start of the domain is "www"
    if ($host =~ /^www\./) {

        # Remove the www.
        $host =~ s/^www\.//;
    }

    my $nocache_enabled = 0;
    if ($CLI{'nocache'}) { $nocache_enabled = 1; }
    $CLI{'nocache'} = 1;

    foreach my $item (@$dbarray) {

        # Use nfetch to minimize extra code
        # First we need to mangle the host.
        my $newhost = $item->{'subdomain'} . "." . $host;
        $mark->{'hostname'} = $newhost;
        my ($result, $content, $error) = nfetch($mark, "/", "GET", "", "subdomain");

        if ($error eq "") {
            add_vulnerability($mark, "Subdomain $item->{'subdomain'} found", $item->{'nikto_id'},
                              0);
        }    # End if

    }    # End foreach
    if (!$nocache_enabled) { undef $CLI{'nocache'}; }
}    # End sub

1;