Changeset 292


Ignore:
Timestamp:
01/29/2010 04:44:00 AM (3 years ago)
Author:
sullo
Message:

Ticket #116: Add dynamic variables to User-Agent string.

Location:
trunk
Files:
18 edited

Legend:

Unmodified
Added
Removed

  • trunk/docs/CHANGES.txt

    r278 r292  
    112010-01-20 Nikto 2.1.1 
     2        - Moved User-Agent string to nikto.conf 
     3        - Added dynamic variables to User-Agent (Testid, Evasion methods) 
    24        - Reporting: simplify xml/html code, fix a bug when a space is in the uri, and load ony needed templates 
    35        - Enable 2 new LW evasion tacticts (carriage return or binary value as request spacer) 

  • trunk/nikto.conf

    r174 r292  
    1313 
    1414# ports never to scan 
    15 SKIPPORTS=21 111 
     15#SKIPPORTS=21 111 
     16 
     17# User-Agent variables: 
     18 # @VERSION - Nikto version 
     19 # @TESTID - Test identifier 
     20 # @EVASIONS - List of active evasions 
     21USERAGENT="Mozilla/4.75 (Nikto/@VERSION) (Evasions:@EVASIONS) (Test:@TESTID)"; 
    1622 
    1723# IDs never to alert on (Note: this only works for IDs loaded from db_tests) 

  • trunk/plugins/nikto_apache_expect_xss.plugin

    r240 r292  
    3939   my ($mark) = @_; 
    4040   my %headers=('Expect', '<script>alert(xss)</script>'); 
    41    (my $RES, $CONTENT) = nfetch($mark,"/", "GET", "", \%headers); 
     41   (my $RES, $CONTENT) = nfetch($mark, "/", "GET", "", \%headers, "", "apache_expect_xss"); 
    4242 
    4343   if ($CONTENT =~ /<script>alert\(xss\)<\/script>/) 

  • trunk/plugins/nikto_apacheusers.plugin

    r240 r292  
    3838{ 
    3939   my ($mark) = @_; 
    40    (my $RES, $CONTENT) = nfetch($mark,"/~root", "GET"); 
     40   (my $RES, $CONTENT) = nfetch($mark, "/~root", "GET", "", "", "", "apacheusers: known user"); 
    4141 
    4242   $CONTENT = char_escape($CONTENT); 
    4343   if ($CONTENT =~ /forbidden/i)    # good on "root" 
    4444   { 
    45       (my $RES, $CONTENT) = nfetch($mark,"/~" . LW2::utils_randstr(8), "GET"); 
     45      (my $RES, $CONTENT) = nfetch($mark, "/~" . LW2::utils_randstr(8), "GET", "", "", "", "apacheusers: invalid user"); 
    4646 
    4747      $CONTENT = char_escape($CONTENT); 

  • trunk/plugins/nikto_cgi.plugin

    r284 r292  
    6262      foreach $possiblecgidir (@CFGCGI) 
    6363      { 
    64          ($res, $content)=nfetch($mark,$possiblecgidir,"GET"); 
     64         ($res, $content)=nfetch($mark, $possiblecgidir, "GET", "", "", "", "cgi dir check"); 
    6565         nprint("Checked for CGI dir\t$possiblecgidir\tgot:$res","d"); 
    6666         if (content_present($res) eq TRUE) 

  • trunk/plugins/nikto_core.plugin

    r291 r292  
    660660 if (defined $CLI{'evasion'}) 
    661661 { 
    662     $CLI{'evasion'}=~s/[^0-9]//g; 
     662    $CLI{'evasion'}=~s/[^1-8AB]//g; 
    663663 } 
    664664 
    … …  
    670670 $NIKTO{'timeout'}=$CLI{'timeout'} || 10; 
    671671 
    672  $NIKTO{'useragent'}="Mozilla/4.75 ($NIKTO{'name'}/$NIKTO{'version'})"; 
     672 # Set up User-Agent 
     673 $NIKTO{'useragent'} = $NIKTOCONFIG{'USERAGENT'}; 
     674 $NIKTO{'useragent'} =~ s/\@VERSION/$NIKTO{'version'}/g; 
     675 my $ev = $CLI{'evasion'} || "None"; 
     676 $NIKTO{'useragent'} =~ s/\@EVASIONS/$ev/g; 
    673677  
    674678 # SSL Test 
    … …  
    11871191   my %headers; 
    11881192    
    1189    (my $res, $content) = nfetch($mark,"/","GET","",\%headers); 
     1193   (my $res, $content) = nfetch($mark, "/", "GET", "", \%headers, "", "Get Banner"); 
    11901194 
    11911195   return $headers{server}; 
    … …  
    12141218         $m->{ssl}=($checkssl eq "HTTP")?0:1; 
    12151219         proxy_check($m); 
    1216          my ($res, $content)=nfetch($m, "/", $method, "", \%headers); 
     1220         my ($res, $content)=nfetch($m, "/", $method, "", \%headers, "", "Port Check"); 
    12171221 
    12181222         if ($res) 
    … …  
    17701774 { 
    17711775  LW2::http_close(\%request);  # force-close any old connections 
    1772   setup_hash(\%request, $mark); 
     1776  setup_hash(\%request, $mark, "Proxy Check"); 
    17731777  $request{'whisker'}->{'method'}="GET"; 
    17741778  $request{'whisker'}->{'uri'}="/"; 
    … …  
    18911895    $request{'whisker'}->{'uri'}    = $CLI{'root'} . $_[0];   # prepend -root option value 
    18921896 } 
     1897 
     1898 # Set testid in UA 
     1899 my $temp_ua = $request{'User-Agent'}; 
     1900 my $testid = $_[3]; 
     1901 $request{'User-Agent'}=~s/\@TESTID/$testid/g; 
     1902 
    18931903 $request{'whisker'}->{'method'} = $_[1]; 
    18941904 delete $request{'whisker'}->{'data'}; 
    … …  
    19561966    } 
    19571967 } 
     1968 $request{'User-Agent'}=$temp_ua; # reset UA 
    19581969 return $result{'whisker'}->{'code'}, $result{'whisker'}->{'data'}; 
    19591970} 
    … …  
    19611972sub setup_hash 
    19621973{ 
    1963    my ($reqhash,$mark) = @_; 
     1974   my ($reqhash, $mark, $testid) = @_; 
    19641975 
    19651976   # Do the standard set up for the hash  
    … …  
    19681979   $reqhash->{whisker}->{lowercase_incoming_headers}=1; 
    19691980   $reqhash->{whisker}->{timeout}=$NIKTO{'timeout'}; 
    1970    if (defined $CLI{'evasion'}) 
    1971    { 
    1972       $reqhash->{whisker}->{encode_anti_ids}=$CLI{'evasion'}; 
    1973    } 
     1981   if (defined $CLI{'evasion'}) { 
     1982        $reqhash->{whisker}->{encode_anti_ids}=$CLI{'evasion'}; 
     1983        } 
    19741984   $reqhash->{'User-Agent'}=$NIKTO{'useragent'}; 
     1985   $reqhash->{'User-Agent'}=~s/\@TESTID/$testid/g; 
    19751986   $reqhash->{whisker}->{retry}=0; 
    1976    $reqhash->{whisker}->{host} = $mark->{hostname} || $mark->{ip}; 
    1977  
    1978    if ($mark->{vhost}) 
    1979    { 
    1980       $request{Host} = $mark->{vhost}; 
    1981    } 
     1987   $reqhash->{whisker}->{host}=$mark->{hostname} || $mark->{ip}; 
     1988 
     1989   if ($mark->{vhost}) { 
     1990        $request{Host} = $mark->{vhost}; 
     1991        } 
    19821992   $reqhash->{whisker}->{port} = $mark->{port}; 
    19831993   $reqhash->{whisker}->{ssl} = $mark->{ssl}; 
    19841994    
    19851995   # Proxy stuff 
    1986    if (defined $NIKTOCONFIG{PROXYHOST} && defined $CLI{'useproxy'}) 
    1987    { 
    1988       $reqhash->{'whisker'}->{'proxy_host'}=$NIKTOCONFIG{PROXYHOST}; 
    1989       $reqhash->{'whisker'}->{'proxy_port'}=$NIKTOCONFIG{PROXYPORT}; 
    1990       LW2::auth_set("proxy-basic",$reqhash,$NIKTOCONFIG{PROXYUSER}, 
    1991                     $NIKTOCONFIG{PROXYPASS});   # set auth 
    1992    } 
     1996   if (defined $NIKTOCONFIG{PROXYHOST} && defined $CLI{'useproxy'}) { 
     1997        $reqhash->{'whisker'}->{'proxy_host'}=$NIKTOCONFIG{PROXYHOST}; 
     1998        $reqhash->{'whisker'}->{'proxy_port'}=$NIKTOCONFIG{PROXYPORT}; 
     1999        LW2::auth_set("proxy-basic",$reqhash,$NIKTOCONFIG{PROXYUSER}, $NIKTOCONFIG{PROXYPASS}); 
     2000        } 
    19932001    
    19942002   return $reqhash; 
    … …  
    19972005sub nfetch 
    19982006{ 
    1999    my ($mark, $uri, $method, $data, $headers, $noclean) = @_; 
     2007   my ($mark, $uri, $method, $data, $headers, $noclean, $testid) = @_; 
    20002008   if ($CLI{'pause'} > 0) { sleep $CLI{'pause'}; } 
    20012009   my (%request, %result); 
    2002    setup_hash(\%request, $mark); 
     2010   setup_hash(\%request, $mark, $testid); 
    20032011  
    20042012   $request{whisker}->{uri} = $uri; 
    … …  
    23232331        $request{'Host'}="www.cirt.net"; 
    23242332        LW2::http_fixup_request(\%request); 
    2325    ($RES, $CONTENT) = fetch("/cgi-bin/versions?DATA=$updated_version","GET"); 
     2333        ($RES, $CONTENT) = fetch("/cgi-bin/versions?DATA=$updated_version","GET"); 
    23262334  } 
    23272335 

  • trunk/plugins/nikto_dictionary_attack.plugin

    r284 r292  
    6767      my $dir=$_; 
    6868      if (($ctr % 100) == 0) { nprint("- Directory enumeration guess $ctr ($dir): /$dir/", "v"); } 
    69       my ($result, $content) = nfetch($mark,"/$dir/", "HEAD"); 
     69      my ($result, $content) = nfetch($mark, "/$dir/", "HEAD", "", "", "", "dictionary_attack"); 
    7070      foreach my $found (split(/ /, $VARIABLES{"\@HTTPFOUND"})) 
    7171      { 

  • trunk/plugins/nikto_embedded.plugin

    r284 r292  
    3333   { 
    3434      name         => "embedded", 
    35       full_name    => "Embedded Destection", 
     35      full_name    => "Embedded Detection", 
    3636      author       => "Deity", 
    3737      description  => "Checks to see whether the host is an embedded server.", 
    … …  
    5050   foreach my $item (@$dbarray) 
    5151   { 
    52       (my $res, $content) = nfetch($mark,$item->{uri},"GET"); 
     52      (my $res, $content) = nfetch($mark, $item->{uri}, "GET", "", "", "", "embedded detection"); 
    5353      if ($res eq "200") 
    5454      { 

  • trunk/plugins/nikto_favicon.plugin

    r240 r292  
    3838{ 
    3939   my ($mark)=@_; 
    40    my ($RES, $CONTENT) = nfetch($mark,"/favicon.ico","GET"); 
     40   my ($RES, $CONTENT) = nfetch($mark, "/favicon.ico", "GET", "", "", "", "favicon"); 
    4141   my $dbarray = init_db("db_favicon"); 
    4242 

  • trunk/plugins/nikto_headers.plugin

    r284 r292  
    4949   foreach my $f (qw/\/index.php \/junk999.php \/ \/index.php3 \/ \/junk999.php3 \/index.cfm \/junk999.cfm \/index.asp \/junk999.asp \/index.aspx \/junk988.aspx/ ) 
    5050   { 
    51       (my $res, $content) = nfetch($mark,$f, "GET", "", \%headers); 
     51      (my $res, $content) = nfetch($mark, $f, "GET", "", \%headers, "", "headers: powered-by"); 
    5252      if (defined $headers{'x-powered-by'}) { $xpb{ $headers{'x-powered-by'} } = 1; } 
    5353   } 
    … …  
    6969   foreach my $f (qw/\/index.asp \/junk999.asp \/index.aspx \/junk988.aspx \/login.asp \/login.aspx/ ) 
    7070   { 
    71       (my $res, $content) = nfetch($mark, $f , "GET", "", \%transheaders); 
     71      (my $res, $content) = nfetch($mark, $f , "GET", "", \%transheaders, "", "headers: Translate-f #1"); 
    7272      if ($res eq "200") 
    7373      { 
    7474         $transheaders{'Translate'}="f"; 
    75          ($res, $content) = nfetch($mark,$f . "\\", "GET", "", \%transheaders); 
     75         ($res, $content) = nfetch($mark, $f . "\\", "GET", "", \%transheaders, "", "headers: Translate-f #2"); 
    7676         if ($res eq "200") 
    7777         { 
    … …  
    168168    
    169169   # First let's hit something we know should return something 
    170    my ($res, $content)=nfetch($mark,"/","GET","",\%headers); 
     170   my ($res, $content)=nfetch($mark, "/", "GET" ,"" ,\%headers, "", "headers: base"); 
    171171 
    172172   foreach my $header (@interesting_headers) 
    … …  
    210210   foreach my $f (qw/\/index.html \/index.htm \/robots.txt/) 
    211211   { 
    212       (my $res, $content) = nfetch($mark,$f, "GET","", \%headers); 
     212      (my $res, $content) = nfetch($mark, $f, "GET", "", \%headers, "", "headers: etag"); 
    213213      last if (defined $headers{'etag'}); 
    214214   } 

  • trunk/plugins/nikto_httpoptions.plugin

    r285 r292  
    4242   my %headers; 
    4343   # test for both OPTIONS / and OPTIONS * as they may give different results 
    44    (my $res, $content) = nfetch($mark,"*", "OPTIONS", "", \%headers); 
     44   (my $res, $content) = nfetch($mark, "*", "OPTIONS", "", \%headers, "", "httpoptions: OPTIONS *"); 
    4545   my $aoptions = "$headers{allow}, "; 
    4646   my $poptions = "$headers{public}, "; 
    … …  
    5151   $dbarray=init_db("db_httpoptions"); 
    5252 
    53    ($res, $content) = nfetch($mark,"/", "OPTIONS", "", \%headers); 
     53   ($res, $content) = nfetch($mark, "/", "OPTIONS", "", \%headers, "", "httpoptions: OPTIONS /"); 
    5454   $aoptions .= $headers{allow}; 
    5555   $poptions .= $headers{public}; 
    … …  
    7878   # IIS Debug 
    7979 
    80    ($res, $content) = nfetch($mark,"/","DEBUG",); 
     80   ($res, $content) = nfetch($mark, "/" ,"DEBUG", "" ,"" ,"" ,"httpoptions: DEBUG"); 
    8181   if ($res == 200)  
    8282   { 
    … …  
    8888      "Content-Length" => "0", 
    8989   ); 
    90    ($res, $content) = nfetch($mark,"/","PROPFIND","",\%headers,1); 
     90   ($res, $content) = nfetch($mark, "/", "PROPFIND", "", \%headers, 1, "httpoptions: PROPFIND"); 
    9191   if ($res == 207) 
    9292   { 
    … …  
    110110      { 
    111111         $request{whisker}{version} = $version;  
    112          ($res, $content) = nfetch($mark,"/","$method","",\%headers); 
     112         ($res, $content) = nfetch($mark, "/", $method, "", \%headers, "", "httpoptions: $method"); 
    113113         if ($res == 200) 
    114114         { 

  • trunk/plugins/nikto_msgs.plugin

    r285 r292  
    6060   if ($mark->{banner} =~ /(Agent-ListenServer-HttpSvr\/1\.0)\b/i)  
    6161   {  
    62       my ($RES, $CONTENT) = nfetch($mark,"/","GET");  
     62      my ($RES, $CONTENT) = nfetch($mark, "/", "GET", "", "", "", "msgs: Agent-ListenServer-HttpSvr");  
    6363      next unless ($RES == 200);  
    6464      # Computer name  
    … …  
    7272   if ($mark->{banner} =~ /(CompaqHTTPServer)/i)  
    7373   {  
    74       my ($RES, $CONTENT) = nfetch($mark,"/cpqlogin.htm","GET");  
     74      my ($RES, $CONTENT) = nfetch($mark, "/cpqlogin.htm", "GET", "", "", "", "msgs: CompaqHTTPServer");  
    7575      next unless ($RES == 200);  
    7676      my $ipaddrs="";  

  • trunk/plugins/nikto_multiple_index.plugin

    r264 r292  
    4242   my ($found, $hashes); 
    4343   foreach my $item (@$dbarray) { 
    44         # Use fetch to minimise extra code 
     44        # Use nfetch to minimise extra code 
    4545        # First we need to mangle the host. 
    46         my ($res, $content) = nfetch($mark,"/$item->{index}", "GET"); 
     46        my ($res, $content) = nfetch($mark, "/$item->{index}", "GET", "", "", "", "multiple_index"); 
    4747 
    4848        if (($res == 200) || ($res == 404)) { 

  • trunk/plugins/nikto_put_del_test.plugin

    r240 r292  
    4242    # PUT a page 
    4343    my $uri = "/nikto-test-" . LW2::utils_randstr(8) . ".html"; 
    44     (my $RES, $CONTENT) = nfetch($mark,$uri, "PUT", "This was a Nikto test."); 
     44    (my $RES, $CONTENT) = nfetch($mark, $uri, "PUT", "This was a Nikto test.", "", "", "put_del_test: PUT"); 
    4545 
    4646    # Request it back 
    4747    if ($RES eq 201) 
    4848    { 
    49         (my $RES, $CONTENT) = nfetch($mark,$uri, "GET"); 
     49        (my $RES, $CONTENT) = nfetch($mark, $uri, "GET", "", "", "", "put_del_test: GET"); 
    5050        if ($CONTENT =~ /This was a Nikto test/) 
    5151        { 
    … …  
    5353 
    5454            # we were able to put it there--can we delete it? 
    55             (my $RES, $CONTENT) = nfetch($mark,$uri, "DELETE"); 
     55            (my $RES, $CONTENT) = nfetch($mark, $uri, "DELETE", "", "", "", "put_del_test: DELETE"); 
    5656            if ($RES eq 200) 
    5757            { 
    58                 (my $RES, $CONTENT) = nfetch($mark,$uri, "GET"); 
     58                (my $RES, $CONTENT) = nfetch($mark, $uri, "GET", "", "", "", "put_del_test: GET"); 
    5959                if ($CONTENT !~ /This was a Nikto test/)    # gone now 
    6060                { 

  • trunk/plugins/nikto_robots.plugin

    r240 r292  
    3939{ 
    4040   my ($mark) = @_; 
    41    (my $RES, $CONTENT) = nfetch($mark,"/robots.txt", "GET"); 
     41   (my $RES, $CONTENT) = nfetch($mark, "/robots.txt", "GET", "", "", "", "robots"); 
    4242 
    4343   if (($RES eq 200) || ($RES eq $FoF{okay}{response}))    # got one! 

  • trunk/plugins/nikto_subdomain.plugin

    r283 r292  
    7070      my $newhost=$item->{subdomain} . "." . $host; 
    7171      $request{whisker}{host} = $newhost; 
    72       my ($result, $content) = fetch("/", "HEAD"); 
     72      my ($result, $content) = fetch("/", "HEAD", "", "subdomain"); 
    7373 
    7474      if ($result{whisker}{error} eq "") 

  • trunk/plugins/nikto_tests.plugin

    r269 r292  
    5050      foreach my $uri (@urilist) 
    5151      { 
    52          (my $RES, $CONTENT) = fetch($uri,$TESTS{$CHECKID}{method},$TESTS{$CHECKID}{data}); 
     52         (my $RES, $CONTENT) = fetch($uri,$TESTS{$CHECKID}{method},$TESTS{$CHECKID}{data}, $CHECKID); 
    5353         nprint("- $RES for $TESTS{$CHECKID}{method}:\t$request{whisker}{uri}","v"); 
    5454         # Check for errors to reduce false positives  
    … …  
    5858            # Try it again before we report it fully 
    5959            sleep(1); 
    60             ($RES, $CONTENT) = fetch($uri,$TESTS{$CHECKID}{method},$TESTS{$CHECKID}{data}); 
     60            ($RES, $CONTENT) = fetch($uri,$TESTS{$CHECKID}{method},$TESTS{$CHECKID}{data}, $CHECKID); 
    6161            nprint("- $RES for $TESTS{$CHECKID}{method}:\t$request{whisker}{uri}","v"); 
    6262             

  • trunk/plugins/nikto_user_enum_apache.plugin

    r284 r292  
    7474         { 
    7575            my $curl = "$cgidir" . "cgiwrap"; 
    76             (my $result, $content) = nfetch($mark,"$curl", "GET"); 
     76            (my $result, $content) = nfetch($mark, $curl, "GET", "", "", "", "user_enum_apache: cgiwrap"); 
    7777            if ($content =~ /check your URL/i) 
    7878            { 
    … …  
    123123   { 
    124124      if (($ctr % 500) eq 0) { nprint("- User enumeration guess $ctr ($text)", "v"); } 
    125       ($result, $content) = nfetch($mark, $url . $text, "HEAD"); 
     125      ($result, $content) = nfetch($mark, $url . $text, "HEAD", "", "", "", "user_enum_apache: enumeration"); 
    126126      my $user = nikto_user_enum_apache_check($result, $text); 
    127127      if (defined $user) 
    … …  
    164164      if ($_ eq "" ) { next }; 
    165165      if (($ctr % 500) == 0) { nprint("- User enumeration guess $ctr ($_)", "v"); } 
    166       ($result, $content) = nfetch($mark, $url . $_, "HEAD"); 
     166      ($result, $content) = nfetch($mark, $url . $_, "HEAD", "", "", "", "user_enum_apache: dictionary"); 
    167167      my $user = nikto_user_enum_apache_check($result, $_); 
    168168      if ($user) 
Note: See TracChangeset for help on using the changeset viewer.