Changeset 271

Timestamp:

01/26/2010 05:25:08 AM (3 years ago)

Author:

sullo

Message:

More database syntax checks. Ticket #111.

File:

• trunk/plugins/nikto_core.plugin (modified) (10 diffs)

trunk/plugins/nikto_core.plugin

@@ -1044 +1044 @@
 sub dbcheck
 {
- my @dbs=qw/db_404_strings  db_outdated  db_realms  db_tests  db_variables/;
+ my @dbs=qw/db_headers db_httpoptions db_multiple_index db_server_msgs db_subdomains db_favicon db_embedded db_404_strings  db_outdated  db_realms  db_tests  db_variables/;
  my $prefix = $_[0];
-
  if ($prefix eq ""  )  { nprint "\n-->\tNikto Databases\n"; }
  if ($prefix eq "u"  ) { nprint "\n-->\tUser Databases\n"; }
@@ -1055 +1054 @@
    if (!-r $filename) { next; }
    open(IN,"<$filename") || die nprint("+ ERROR: Can't open \"$filename\":$!\n");
-   
    nprint "Syntax Check: $filename\n";
    
    if ($file eq 'db_outdated') 
      {
-       foreach $line (<IN>)
-         {
+       foreach $line (<IN>) {
            $line =~ s/^\s+//;
            if ($line =~ /^\#/) { next; }
@@ -1067 +1064 @@
            if ($line eq "") { next; }
            my @L=parse_csv($line);
-           if ($line !~ /^\".*\"\,\".*\"\,\".*\"$/) { print STDERR "\t+ ERROR: Invalid syntax ($#L): $line\n"; next; }
            if ($#L ne 3) { print STDERR "\t+ ERROR: Invalid syntax ($#L): $line\n"; next; }
            $ENTRIES{"$L[0]"}++;
          }
-
           foreach $entry (keys %ENTRIES) { if ($ENTRIES{$entry} > 1) { print STDERR "\t+ ERROR: Duplicate ($ENTRIES{$entry}): $entry\n"; } }
           nprint "\t" . keys(%ENTRIES) . " entries\n";
@@ -1078 +1073 @@
      {
        my %ENTRIES;
-       foreach my $line (<IN>)
-         {
+       foreach my $line (<IN>) {
            if ($line !~ /^\"/)  { next; }
            my @L=parse_csv($line);
@@ -1088 +1082 @@
            if (($L[3] =~ /^\@CG/) && ($L[3] !~ /^\@CGIDIRS/)) { print STDERR "\t+ ERROR: Possible \@CGIDIRS misspelling: $line"; }
            $ENTRIES{"$L[3],$L[4],$L[5],$L[6],$L[7],$L[8],$L[9],$L[11],$L[12]"}++;
-         }
-
+           if ((count_fields($line, 1) ne 12) && (count_fields($line) ne '')) { print STDERR "\t+ ERROR: Invalid syntax: $line\n"; }
+         }
        foreach $entry (keys %ENTRIES) { if ($ENTRIES{$entry} > 1) { print STDERR "\t+ ERROR: Duplicate ($ENTRIES{$entry}): $entry\n"; } }
        nprint "\t" . keys(%ENTRIES) . " entries\n";
@@ -1096 +1090 @@
      {
        my $ctr=0;
-       foreach $line (<IN>)
-         {
+       foreach $line (<IN>) {
            if ($line !~ /^\@/)  { next; }
            if ($line !~ /^\@.+\=.+$/i ) { print STDERR "\t+ ERROR: Invalid syntax: $line\n"; }
@@ -1107 +1100 @@
      {
        my $ctr=0;
-       foreach $line (<IN>)
-         {
-           if ($line !~ /^\"/)  { next; }
-           chomp($line);
-           my @L=parse_csv($line);
-           if ($#L ne 4) { print STDERR "\t+ ERROR: Invalid syntax: $line\n"; }
+       foreach $line (<IN>) {
+           if ((count_fields($line, 1) ne 4) && (count_fields($line) ne '')) { print STDERR "\t+ ERROR: Invalid syntax: $line"; }
            $ctr++;
          }
@@ -1120 +1109 @@
      {
        my $ctr=0;
-       foreach $line (<IN>)
-         {
+       foreach $line (<IN>) {
            # not really any syntax to check
            $ctr++;
@@ -1127 +1115 @@
         nprint "\t$ctr entries\n";
      }
+   elsif ($file eq 'db_embedded') 
+     {
+       my $ctr=0;
+       foreach $line (<IN>) {
+           if ((count_fields($line, 1) ne 4) && (count_fields($line) ne '')) { print STDERR "\t+ ERROR: Invalid syntax: $line"; }
+           $ctr++;
+         }
+        nprint "\t$ctr entries\n";
+     }
+   elsif ($file eq 'db_favicon') 
+     {
+       my $ctr=0;
+       foreach $line (<IN>) {
+           if ((count_fields($line, 1) ne 2) && (count_fields($line) ne '')) { print STDERR "\t+ ERROR: Invalid syntax: $line"; }
+           $ctr++;
+         }
+        nprint "\t$ctr entries\n";
+     }
+   elsif ($file eq 'db_headers')
+     {
+       my $ctr=0;
+       foreach $line (<IN>) {
+           if ((count_fields($line) ne 0) && (count_fields($line) ne '')) { print STDERR "\t+ ERROR: Invalid syntax: $line"; }
+           $ctr++;
+         }
+        nprint "\t$ctr entries\n";
+     }
+   elsif ($file eq 'db_httpoptions')
+     {
+       my $ctr=0;
+       foreach $line (<IN>) {
+           if ((count_fields($line, 1) ne 3) && (count_fields($line) ne '')) { print STDERR "\t+ ERROR: Invalid syntax: $line"; }
+           $ctr++;
+         }
+        nprint "\t$ctr entries\n";
+     }
+   elsif ($file eq 'db_multiple_index')
+     {
+       my $ctr=0;
+       foreach $line (<IN>) {
+           if ((count_fields($line) ne 0) && (count_fields($line) ne '')) { print STDERR "\t+ ERROR: Invalid syntax: $line"; }
+           $ctr++;
+         }
+        nprint "\t$ctr entries\n";
+     }
+   elsif ($file eq 'db_server_msgs')
+     {
+       my $ctr=0;
+       foreach $line (<IN>) {
+           if ((count_fields($line, 1) ne 2) && (count_fields($line) ne '')) { print STDERR "\t+ ERROR: Invalid syntax: $line"; }
+           $ctr++;
+         }
+        nprint "\t$ctr entries\n";
+     }
+   elsif ($file eq 'db_subdomains')
+     {
+       my $ctr=0;
+       foreach $line (<IN>) {
+           if ((count_fields($line, 1) ne 1) && (count_fields($line) ne '')) { print STDERR "\t+ ERROR: Invalid syntax: $line"; }
+           $ctr++;
+         }
+        nprint "\t$ctr entries\n";
+     }
 
    close(IN);  
@@ -1135 +1186 @@
  nprint "\n";
  exit;
+}
+###############################################################################
+sub count_fields
+{
+ my $line =$_[0] || return;
+ my $checkid=$_[1] || 0;
+ if ($line !~ /^\"/) { return; }
+ chomp($line);
+ $line =~ s/\s+$//;
+ if ($line eq '') { return; }
+ my @L=parse_csv($line);
+ if ($checkid && ($L[0] ne 'nikto_id') && (($L[0] =~ /[^0-9]/) || ($L[0] eq ''))) { return -1; }
+ return $#L;
 }
 ###############################################################################