Changeset 152


Ignore:
Timestamp:
08/13/2009 07:37:44 PM (4 years ago)
Author:
deity
Message:

Various changes to move to nfetch

Location:
trunk
Files:
17 edited

Legend:

Unmodified
Added
Removed

  • trunk/docs/CHANGES.txt

    r150 r152  
     12009-08-13 plugins/* 
     2        - Various fixes to use nfetch and fix proxy use 
    132009-08-12 plugins/nikto_core 
    24        - New fetch (nfetch) sub added which uses a local request/result hash. 

  • trunk/plugins/db_tests

    r132 r152  
    35913591"003589","0","b","/cgi-bin/webcgi/about","GET","/cgi/locale/about_en.xsl","","","","","Host seems to be a Dell Remote Access Controller (RAC).","","" 
    35923592"003590","0","b","/webservices/IlaWebServices","GET","200","","","","","Host has the Oracle iLearning environment installed.","","" 
     3593"003591","0","a","/SoundBridgeStatus.html","GET","200","SoundBridge is running software version","","","","Host is running the SoundBridge web server which doesn't support identification.","","" 

  • trunk/plugins/nikto_apache_expect_xss.plugin

    r150 r152  
    4242   my ($mark) = @_; 
    4343   my %headers=('Expect', '<script>alert(xss)</script>'); 
    44    (my $RES, $CONTENT) = nfetch("/", "GET", "", \%headers); 
     44   (my $RES, $CONTENT) = nfetch($mark,"/", "GET", "", \%headers); 
    4545 
    4646   if ($CONTENT =~ /<script>alert\(xss\)<\/script>/) 

  • trunk/plugins/nikto_apacheusers.plugin

    r150 r152  
    4141{ 
    4242   my ($mark) = @_; 
    43    (my $RES, $CONTENT) = nfetch("/~root", "GET"); 
     43   (my $RES, $CONTENT) = nfetch($mark,"/~root", "GET"); 
    4444 
    4545   $CONTENT = char_escape($CONTENT); 
    4646   if ($CONTENT =~ /forbidden/i)    # good on "root" 
    4747   { 
    48       (my $RES, $CONTENT) = nfetch("/~" . LW2::utils_randstr(8), "GET"); 
     48      (my $RES, $CONTENT) = nfetch($mark,"/~" . LW2::utils_randstr(8), "GET"); 
    4949 
    5050      $CONTENT = char_escape($CONTENT); 

  • trunk/plugins/nikto_cgi.plugin

    r150 r152  
    6565      foreach $possiblecgidir (@CFGCGI) 
    6666      { 
    67          ($res, $CONTENT)=nfetch($possiblecgidir,"GET"); 
     67         ($res, $CONTENT)=nfetch($mark,$possiblecgidir,"GET"); 
    6868         nprint("Checked for CGI dir\t$possiblecgidir\tgot:$res","d"); 
    6969         if (content_present($res) eq TRUE) 

  • trunk/plugins/nikto_core.plugin

    r151 r152  
    11071107{ 
    11081108   my ($mark) = @_; 
     1109   my %headers; 
    11091110    
    1110    (my $RES, $CONTENT) = fetch("/","HEAD"); 
    1111  
    1112    return $result{'server'}; 
     1111   (my $res, $content) = nfetch($mark,"/","GET","",\%headers); 
     1112 
     1113   return $headers{server}; 
    11131114} 
    11141115############################################################################### 
    11151116sub port_check 
    11161117{ 
    1117    my ($ip, $port) = @_; 
    1118    my %request; 
    1119  
    1120    LW2::http_init_request(\%request); 
    1121    $request{'User-Agent'} = $NIKTO{useragent}; 
    1122    $request{'whisker'}->{'retry'} = 0; 
    1123    $request{'whisker'}->{'uri'}="/"; 
     1118   my ($hostname, $ip, $port) = @_; 
     1119   my %mark, %headers; 
     1120    
     1121   $mark{hostname}=$hostname; 
     1122   $mark{ip}=$ip; 
     1123   $mark{port}=$port; 
     1124   $mark{ssl}=0; 
     1125    
     1126   if (defined $CLI{vhost}) { $mark{vhost} = $CLI{vhost} }; 
    11241127 
    11251128   # test for proxy 
    11261129   proxy_check() unless $PROXYCHECKED; 
     1130   setup_hash(\%request,\%mark); 
    11271131 
    11281132   my @checktypes=('HTTP', 'HTTPS'); 
    … …  
    11361140      { 
    11371141         nprint("- Checking for $checkssl on port $ip:$port, using $method","v"); 
    1138          $request{'whisker'}->{'host'} = $ip; 
    1139          $request{'whisker'}->{'ssl'}=($checkssl eq "HTTP")?0:1; 
    1140          $request{'whisker'}->{'port'}= $port; 
    1141          $request{'whisker'}->{'http_eol'}=$http_eol; 
    1142          dump_var("Request Hash", \%request); 
    1143          LW2::http_close(\%request);  # force-close any old connections 
    1144          LW2::http_fixup_request(\%request); 
    1145          if ($CLI{pause} > 0) { sleep $CLI{pause}; } 
    1146  
    1147          my $res=LW2::http_do_request_timeout(\%request,\%result); 
    1148          if (!$res)  
     1142          
     1143         $mark{ssl}=($checkssl eq "HTTP")?0:1; 
     1144         my ($res, $content)=nfetch(\%mark, "/", $method, "", \%headers); 
     1145 
     1146         if ($res)  
    11491147         {  
    11501148            # this will fix for some Apaches that are smart enough to answer non ssl reqs on an ssl server 
    1151             if (defined $result{'whisker'}{'data'} && $result{'whisker'}->{'data'} =~ /speaking plain HTTP to an SSL/)  
     1149            if (defined $content && 
     1150                $content =~ /speaking plain HTTP to an SSL/)  
    11521151            { 
    11531152               dump_var("Result Hash", \%result); 
    11541153               next; 
    11551154            } 
    1156             nprint("- $checkssl Server found: $ip:$port \t$result{'server'}","d");  
    1157             dump_var("Result Hash", \%result); 
    1158             return $request{'whisker'}->{'ssl'}+1; 
    1159          } 
    1160          else 
    1161          { 
    1162             dump_var("Result Hash", \%result); 
     1155            nprint("- $checkssl Server found: $ip:$port \t$headers{server}","d");  
     1156            return $mark{ssl}+1; 
    11631157         } 
    11641158      } 
    … …  
    15361530         my $uridir=$request{whisker}->{uri}; 
    15371531         $uridir =~ s#/[^/]*$#/#g; 
    1538          add_vulnerability($mark,"Blank credentials found at $uridir, $REALMS{$REALM}{realm}: $REALMS{$REALM}{msg}", $REALMS{$REALM}{tid},0,"GET",$uridir,\%result);  
     1532         add_vulnerability($mark,"Blank credentials found at $uridir ($request{whisker}->{uri}), $REALMS{$REALM}{realm}: $REALMS{$REALM}{msg}", $REALMS{$REALM}{tid},0,"GET",$uridir,\%result);  
    15391533      } 
    15401534      else 
    … …  
    15651559               my $uridir=$request{whisker}->{uri}; 
    15661560               $uridir =~ s#/[^/]*$#/#g; 
    1567                add_vulnerability($mark,"Default account found for '$realm' at $uridir (ID '$REALMS{$REALM}{id}', PW '$REALMS{$REALM}{pw}'). $REALMS{$REALM}{msg}",$REALMS{$REALM}{tid},0,"GET",$uridir,\%result); 
     1561               add_vulnerability($mark,"Default account found for '$realm' at $uridir ($request{whisker}->{uri}) (ID '$REALMS{$REALM}{id}', PW '$REALMS{$REALM}{pw}'). $REALMS{$REALM}{msg}",$REALMS{$REALM}{tid},0,"GET",$uridir,\%result); 
    15681562               $REALMS{$REALM}{checked}=1; 
    15691563            } 
    … …  
    16821676sub proxy_check 
    16831677{ 
    1684  $request{'whisker'}->{'method'}="HEAD"; 
     1678 $request{'whisker'}->{'method'}="GET"; 
    16851679 $request{'whisker'}->{'uri'}="/"; 
     1680 $request{'whisker'}->{host}="www.cirt.net"; 
    16861681 
    16871682 if (defined $request{'whisker'}->{'proxy_host'})  # proxy is set up 
    … …  
    18711866sub setup_hash 
    18721867{ 
    1873    my ($reqhash) = @_; 
     1868   my ($reqhash,$mark) = @_; 
    18741869 
    18751870   # Do the standard set up for the hash  
    … …  
    18841879   $reqhash->{User-Agent}=$NIKTO{useragent}; 
    18851880   $reqhash->{whisker}->{retry}=0; 
    1886  
     1881   $reqhash->{whisker}->{host} = $mark->{hostname} || $mark->{ip}; 
     1882   if ($mark->{vhost}) 
     1883   { 
     1884      $request{Host} = $mark->{vhost}; 
     1885   } 
     1886   $request->{whisker}->{port}    = $mark->{port}; 
     1887   $request->{whisker}->{ssl}     = $mark->{ssl}; 
     1888    
     1889   # Proxy stuff 
     1890   if ($PROXYCHECKED && defined $NIKTOCONFIG{PROXYHOST} && 
     1891       defined $CLI{useproxy}) 
     1892   { 
     1893      $reqhash->{'whisker'}->{'proxy_host'}=$NIKTOCONFIG{PROXYHOST}; 
     1894      $reqhash->{'whisker'}->{'proxy_port'}=$NIKTOCONFIG{PROXYPORT}; 
     1895      LW2::auth_set("proxy-basic",$reqhash,$NIKTOCONFIG{PROXYUSER}, 
     1896                    $NIKTOCONFIG{PROXYPASS});   # set auth 
     1897   } 
     1898    
    18871899   return $reqhash; 
    18881900} 
    … …  
    18901902sub nfetch 
    18911903{ 
    1892    my ($uri, $method, $data, $headers, $noclean) = @_; 
     1904   my ($mark, $uri, $method, $data, $headers, $noclean) = @_; 
    18931905   if ($CLI{pause} > 0) { sleep $CLI{pause}; } 
    18941906 
    18951907   my %request, %result; 
    1896    setup_hash(\%request); 
     1908   setup_hash(\%request, $mark); 
    18971909  
    18981910   $request{whisker}->{uri} = $uri; 
    … …  
    19251937   # Cache 
    19261938   if (defined $CACHE{$uri} && !defined $CLI{nocache} && 
    1927      $CACHE{$uri}{method} eq $method) 
     1939       $CACHE{$uri}{method} eq $method && $CACHE{$uri}{mark} eq $mark) 
    19281940   { 
    19291941      # Get from cache 
    1930       nprint("- Retrieving $request{whisker}->{uri} from cache.","v"); 
    1931       $result{whisker}->{code}=$CACHE{$request{whisker}->{uri}}{res}; 
    1932       $result{whisker}->{data}=$CACHE{$request{whisker}->{uri}}{content}; 
     1942      nprint("- Retrieving $uri from cache.","v"); 
     1943      $result{whisker}->{code}=$CACHE{$uri}{res}; 
     1944      $result{whisker}->{data}=$CACHE{$uri}{content}; 
    19331945   } 
    19341946   else 
    … …  
    19381950      unless (defined $CLI{nocache}) 
    19391951      { 
    1940          $CACHE{$request{whisker}->{uri}}{method}=$result{whisker}->{method}; 
    1941          $CACHE{$request{whisker}->{uri}}{res}=$result{whisker}->{code}; 
    1942          $CACHE{$request{whisker}->{uri}}{content}=$result{whisker}->{data}; 
     1952         $CACHE{$uri}{method}=$result{whisker}->{method}; 
     1953         $CACHE{$uri}{res}=$result{whisker}->{code}; 
     1954         $CACHE{$uri}{content}=$result{whisker}->{data}; 
     1955         $CACHE{$uri}{mark}=$mark; 
    19431956      } 
    19441957      if ($OUTPUT{debug}) 

  • trunk/plugins/nikto_dictionary_attack.plugin

    r150 r152  
    6565      my $dir=$_; 
    6666      if (($ctr % 100) == 0) { nprint("- Directory enumeration guess $ctr ($dir): /$dir/", "v"); } 
    67       (my $result, $content) = nfetch("/$dir/", "HEAD"); 
     67      (my $result, $content) = nfetch($mark,"/$dir/", "HEAD"); 
    6868      foreach my $found (split(/ /, $VARIABLES{"\@HTTPFOUND"})) 
    6969      { 

  • trunk/plugins/nikto_favicon.plugin

    r150 r152  
    4141{ 
    4242   my ($mark)=@_; 
    43    my ($RES, $CONTENT) = nfetch("/favicon.ico","GET"); 
     43   my ($RES, $CONTENT) = nfetch($mark,"/favicon.ico","GET"); 
    4444   my $dbarray = initialise_db("db_favicon"); 
    4545 

  • trunk/plugins/nikto_headers.plugin

    r151 r152  
    5252   foreach my $f (qw/\/index.php \/junk999.php \/ \/index.php3 \/ \/junk999.php3 \/index.cfm \/junk999.cfm \/index.asp \/junk999.asp \/index.aspx \/junk988.aspx/ ) 
    5353   { 
    54       (my $RES, $CONTENT) = nfetch($f, "GET", "", \%headers); 
     54      (my $RES, $CONTENT) = nfetch($mark,$f, "GET", "", \%headers); 
    5555      if (defined $headers{x-powered-by}) { $xpb{ $headers{x-powered-by} } = 1; } 
    5656   } 
    … …  
    147147    
    148148   # First let's hit something we know should return something 
    149    my ($res, $content)=nfetch("/","GET","",\%headers); 
     149   my ($res, $content)=nfetch($mark,"/","GET","",\%headers); 
    150150 
    151151   foreach my $header (@interesting_headers) 
    … …  
    189189   foreach my $f (qw/\/index.html \/index.htm \/robots.txt/) 
    190190   { 
    191       (my $RES, $CONTENT) = nfetch($f, "GET","", \%headers); 
     191      (my $RES, $CONTENT) = nfetch($mark,$f, "GET","", \%headers); 
    192192   } 
    193193    

  • trunk/plugins/nikto_httpoptions.plugin

    r150 r152  
    7979   # IIS Debug 
    8080 
    81    ($RES, $CONTENT) = nfetch("/","DEBUG",); 
     81   ($RES, $CONTENT) = nfetch($mark,"/","DEBUG",); 
    8282   if ($RES == 200)  
    8383   { 
    … …  
    8989      "Content-Length" => "0", 
    9090   ); 
    91    ($RES, $CONTENT) = nfetch("/","PROPFIND","",\%headers,1); 
     91   ($RES, $CONTENT) = nfetch($mark,"/","PROPFIND","",\%headers,1); 
    9292   if ($RES == 207) 
    9393   { 
    … …  
    111111      { 
    112112         $request{whisker}{version} = $version;  
    113          ($RES, $CONTENT) = nfetch("/","$method","",\%headers); 
     113         ($RES, $CONTENT) = nfetch($mark,"/","$method","",\%headers); 
    114114         if ($RES == 200) 
    115115         { 

  • trunk/plugins/nikto_msgs.plugin

    r150 r152  
    6363   if ($mark->{banner} =~ /(Agent-ListenServer-HttpSvr\/1\.0)\b/i)  
    6464   {  
    65       my ($RES, $CONTENT) = nfetch("/","GET");  
     65      my ($RES, $CONTENT) = nfetch($mark,"/","GET");  
    6666      next unless ($RES == 200);  
    6767      # Computer name  
    … …  
    7575   if ($mark->{banner} =~ /(CompaqHTTPServer)/i)  
    7676   {  
    77       my ($RES, $CONTENT) = nfetch("/cpqlogin.htm","GET");  
     77      my ($RES, $CONTENT) = nfetch($mark,"/cpqlogin.htm","GET");  
    7878      next unless ($RES == 200);  
    7979      my $ipaddrs="";  

  • trunk/plugins/nikto_multiple_index.plugin

    r150 r152  
    4646      # Use fetch to minimise extra code 
    4747      # First we need to mangle the host. 
    48       my ($res, $content) = nfetch("/$item->{index}", "GET"); 
     48      my ($res, $content) = nfetch($mark,"/$item->{index}", "GET"); 
    4949 
    5050      if (($res == 200) || ($res == 302)) 

  • trunk/plugins/nikto_put_del_test.plugin

    r150 r152  
    4545    # PUT a page 
    4646    my $uri = "/nikto-test-" . LW2::utils_randstr(8) . ".html"; 
    47     (my $RES, $CONTENT) = nfetch($uri, "PUT", "This was a Nikto test."); 
     47    (my $RES, $CONTENT) = nfetch($mark,$uri, "PUT", "This was a Nikto test."); 
    4848 
    4949    # Request it back 
    5050    if ($RES eq 201) 
    5151    { 
    52         (my $RES, $CONTENT) = nfetch($uri, "GET"); 
     52        (my $RES, $CONTENT) = nfetch($mark,$uri, "GET"); 
    5353        if ($CONTENT =~ /This was a Nikto test/) 
    5454        { 
    … …  
    5656 
    5757            # we were able to put it there--can we delete it? 
    58             (my $RES, $CONTENT) = nfetch($uri, "DELETE"); 
     58            (my $RES, $CONTENT) = nfetch($mark,$uri, "DELETE"); 
    5959            if ($RES eq 200) 
    6060            { 
    61                 (my $RES, $CONTENT) = nfetch($uri, "GET"); 
     61                (my $RES, $CONTENT) = nfetch($mark,$uri, "GET"); 
    6262                if ($CONTENT !~ /This was a Nikto test/)    # gone now 
    6363                { 

  • trunk/plugins/nikto_robots.plugin

    r150 r152  
    4242{ 
    4343   my ($mark) = @_; 
    44    (my $RES, $CONTENT) = nfetch("/robots.txt", "GET"); 
     44   (my $RES, $CONTENT) = nfetch($mark,"/robots.txt", "GET"); 
    4545 
    4646   if (($RES eq 200) || ($RES eq $FoF{okay}{response}))    # got one! 

  • trunk/plugins/nikto_subdomain.plugin

    r150 r152  
    6464      my $newhost=$item->{subdomain} . "." . $host; 
    6565      $request{whisker}{host} = $newhost; 
    66       my ($res, $content) = nfetch("/", "HEAD"); 
     66      my ($res, $content) = nfetch($mark,"/", "HEAD"); 
    6767 
    6868      if (($res == 200) || ($res == 302)) 

  • trunk/plugins/nikto_tests.plugin

    r150 r152  
    5555         (my $RES, $CONTENT) = fetch($uri,$TESTS{$CHECKID}{method},$TESTS{$CHECKID}{data}); 
    5656         nprint("- $RES for $TESTS{$CHECKID}{method}:\t$request{whisker}{uri}","v"); 
    57          # Check for errors to reduce false positives 
    58          if (defined $result{whisker}{error}) 
    59          { 
    60             # An error occured, show in verbose mode and skip 
    61             nprint("- ERROR: $uri returned an error: $result{whisker}{error}\n"); 
    62             next; 
    63          } 
    6457         $NIKTO{resp_counts}{$RES}{total}++; 
    6558    

  • trunk/plugins/nikto_user_enum_apache.plugin

    r150 r152  
    7676         { 
    7777            my $curl = "$cgidir" . "cgiwrap"; 
    78             (my $result, $content) = nfetch("$curl", "GET"); 
     78            (my $result, $content) = nfetch($mark,"$curl", "GET"); 
    7979            if ($content =~ /check your URL/i) 
    8080            { 
    … …  
    124124   { 
    125125      if (($ctr % 500) eq 0) { nprint("- User enumeration guess $ctr ($text)", "v"); } 
    126       (my $result, $content) = nfetch("/~" . $text, "HEAD"); 
     126      (my $result, $content) = nfetch($mark,"/~" . $text, "HEAD"); 
    127127      my $user = nikto_user_enum_apache_check($result, $text); 
    128128      if (defined $user) 
    … …  
    163163      if ($_ eq "" ) { next }; 
    164164      if (($ctr % 500) == 0) { nprint("- User enumeration guess $ctr ($_)", "v"); } 
    165       (my $result, $content) = nfetch("/~" . $_, "HEAD"); 
     165      (my $result, $content) = nfetch($mark,"/~" . $_, "HEAD"); 
    166166      my $user = nikto_user_enum_apache_check($result, $_); 
    167167      if ($user) 
Note: See TracChangeset for help on using the changeset viewer.