Changeset 616

Timestamp:

01/31/2011 09:12:21 PM (2 years ago)

Author:

sullo

Message:

Not all udb* files were loaded properly
Server name not properly printed in update/submission output

Location:

trunk

Files:

• docs/CHANGES.txt (modified) (1 diff)
• nikto.pl (modified) (1 diff)
• plugins/nikto_core.plugin (modified) (8 diffs)

trunk/docs/CHANGES.txt

@@ -22 +22 @@
         - Ticket 155: -findonly is deprecated in favor of -Plugins "@@NONE" (-f will replicate this functionality)
         - Ticket 82: Auth is now checked per realm, not per resource
+        - Not all udb* files were loaded properly
+        - Server name not properly printed in update/submission output
         - Created $mark->{'components'} to store server build items instead of @BUILDITEMS
         - Variable consolidation & memory usage cleanup

trunk/nikto.pl

@@ -49 +49 @@
 $VARIABLES{'name'}        = "Nikto";
 $VARIABLES{'version'}     = "2.1.3";
-$VARIABLES{'configfile'}  = "/etc/nikto.conf";    ### Change this line if it's having trouble finding it
-
-# put a signal trap so we can close down reports properly
+$VARIABLES{'configfile'}  = "/etc/nikto.conf";    ### Change if it's having trouble finding it
+
+# signal trap so we can close down reports properly
 $SIG{'INT'} = \&safe_quit;
 
-# read the --config option
+# read just the --config option
 {
     my %optcfg;

trunk/plugins/nikto_core.plugin

@@ -1628 +1628 @@
     my $code_updates = 0;
     my $serverdir    = "/nikto/UPDATES/$VARIABLES{'version'}";
+    my $server = "CIRT.net";
 
     # set up our mark
-    my %mark = ('ident' => 'cirt.net',
+    my %mark = ('ident' => 'www.cirt.net',
                 'ssl'   => 0,
                 'port'  => 80
@@ -1646 +1647 @@
         }
     }
-    ($mark{'hostname'}, $mark{'ip'}, $mark{'display_name'}) = resolve('cirt.net');
+    ($mark{'hostname'}, $mark{'ip'}, $mark{'display_name'}) = resolve('www.cirt.net');
 
     # retrieve versions file
@@ -2387 +2388 @@
             "\n
       *********************************************************************
-      Portions of the server's ident string ($updated_version) are not in
-      the Nikto database or is newer than the known string. Would you like
+      Portions of the server's headers ($updated_version) are not in
+      the Nikto database or are newer than the known string. Would you like
       to submit this information (*no server specific data*) to CIRT.net
       for a Nikto update (or you may email to sullo\@cirt.net) (y/n)? ", ""
@@ -2409 +2410 @@
     }
 
-    ($mark{'hostname'}, $mark{'ip'}, $mark{'display_name'}) = resolve('cirt.net');
+    ($mark{'hostname'}, $mark{'ip'}, $mark{'display_name'}) = resolve('www.cirt.net');
 
     ($RES, $CONTENT) = nfetch(\%mark, "/cgi-bin/versions?DATA=$updated_version", "GET");
@@ -2428 +2429 @@
 
     if ($CONTENT !~ /SUCCESS/) {
-        nprint("+ ERROR: ($RES, $CONTENT): Unable to send update info to cirt.net");
+        nprint("+ ERROR: ($RES, $CONTENT): Unable to send update info to CIRT.net");
     }
     else {
@@ -2512 +2513 @@
                                x     Reverse Tuning Options (i.e., include all except specified)
        -useproxy          Use the proxy defined in nikto.conf
-       -update            Update databases and plugins from cirt.net
+       -update            Update databases and plugins from CIRT.net
        -vhost+            Virtual host (for Host header)
        -Version           Print plugin and database versions
@@ -2543 +2544 @@
        -timeout+           Timeout (default 2 seconds)
        -Tuning+            Scan tuning
-       -update             Update databases and plugins from cirt.net
+       -update             Update databases and plugins from CIRT.net
        -vhost+             Virtual host (for Host header)
        -Version            Print plugin and database versions
@@ -2587 +2588 @@
         }
     }
+    close(IN);
+
+    # and now the udb_* file
+    $filename = "$CONFIGFILE{PLUGINDIR}/u" . $dbname;
+    if (open(IN, "<$filename")) {
+        while (<IN>) {
+                chomp;
+                s/\#.*$//;
+                if ($_ eq "") { next; }
+                # contents; so split them up and apply to hash
+                my @contents = parse_csv($_);
+                my $hashref  = {};
+                for (my $i = 0 ; $i <= $#contents ; $i++) {
+                        $hashref->{ $headers[$i] } = $contents[$i];
+                        }
+               push(@dbarray, $hashref);
+                }
+        }
+    close(IN);
+
     return \@dbarray;
 }