Class: Watobo::Modules::Active::Domino::Domino_db

Inherits:
ActiveCheck
  • Object
show all
Defined in:
modules/active/domino/domino_db.rb

Constant Summary

Constants included from Constants

Constants::AC_GROUP_APACHE, Constants::AC_GROUP_DOMINO, Constants::AC_GROUP_ENUMERATION, Constants::AC_GROUP_FILE_INCLUSION, Constants::AC_GROUP_FLASH, Constants::AC_GROUP_GENERIC, Constants::AC_GROUP_JBOSS, Constants::AC_GROUP_JOOMLA, Constants::AC_GROUP_SAP, Constants::AC_GROUP_SQL, Constants::AC_GROUP_TYPO3, Constants::AC_GROUP_XSS, Constants::AUTH_TYPE_BASIC, Constants::AUTH_TYPE_DIGEST, Constants::AUTH_TYPE_NONE, Constants::AUTH_TYPE_NTLM, Constants::CHAT_SOURCE_AUTO_SCAN, Constants::CHAT_SOURCE_FUZZER, Constants::CHAT_SOURCE_INTERCEPT, Constants::CHAT_SOURCE_MANUAL, Constants::CHAT_SOURCE_MANUAL_SCAN, Constants::CHAT_SOURCE_PROXY, Constants::CHAT_SOURCE_UNDEF, Constants::DEFAULT_PORT_HTTP, Constants::DEFAULT_PORT_HTTPS, Constants::FINDING_TYPE_HINT, Constants::FINDING_TYPE_INFO, Constants::FINDING_TYPE_UNDEFINED, Constants::FINDING_TYPE_VULN, Constants::FIRST_TIME_FILE, Constants::GUI_REGULAR_FONT_SIZE, Constants::GUI_SMALL_FONT_SIZE, Constants::ICON_PATH, Constants::LOG_DEBUG, Constants::LOG_INFO, Constants::SCAN_CANCELED, Constants::SCAN_FINISHED, Constants::SCAN_PAUSED, Constants::SCAN_STARTED, Constants::TE_CHUNKED, Constants::TE_COMPRESS, Constants::TE_DEFLATE, Constants::TE_GZIP, Constants::TE_IDENTITY, Constants::TE_NONE, Constants::VULN_RATING_CRITICAL, Constants::VULN_RATING_HIGH, Constants::VULN_RATING_INFO, Constants::VULN_RATING_LOW, Constants::VULN_RATING_MEDIUM, Constants::VULN_RATING_UNDEFINED

Instance Method Summary collapse

Methods included from CheckInfoMixin::InfoMethods

#check_group, #check_name

Constructor Details

#initialize(project, prefs = {}) ⇒ Domino_db

Returns a new instance of Domino_db.



47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
 
# File 'modules/active/domino/domino_db.rb', line 47

def initialize(project, prefs={})
  super(project, prefs)
  
  @domino_dbs = []
  
  filename = "domino_db.lst"            
  path = File.dirname(__FILE__)            
  db_file = File.join(path, filename)
  
  begin
    fh = open(db_file,"r")  
    fh.each_line do |dbname|
      @domino_dbs.push dbname.strip
    end
  #  puts "* #{@domino_dbs.length} Lotus Domino DB Names loaded"
  rescue => bang
    puts "!!! ERROR: Problems import Domino DB List"
    puts "File:"
    puts "#{db_file}"
    puts bang
  end
end

Instance Method Details

#generateChecks(chat) ⇒ Object 



70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
 
# File 'modules/active/domino/domino_db.rb', line 70

def generateChecks(chat)            
  begin              
    if chat.request.url.to_s =~ /(.*)\/\w*\.nsf/ then
      @domino_dbs.each do |db|
        checker = proc{
          test_request = nil
          test_response = nil
          test = chat.copyRequest
          line = test.shift
          line.gsub!(/(\w*\.nsf.*) (HTTP\/.*)/, "#{db} \\2")
         # puts line
          test.unshift line
          
          test_request,test_response = doRequest(test,:default => true)
          
          
          if test_response.status =~ /ok/i then
           # test_chat = Chat.new(test, test_response, chat.id)
            if test_response.join =~ /(names\.nsf\?Login)/ # if default db found, check for content
              addFinding( test_request,test_response,
              :test_item => chat.request.url.to_s,
                         :check_pattern => "#{db}",
              :proof_pattern => "#{test_response.status}", 
              :chat=>chat,
              :title => db
              )
            else
              addFinding(test_request,test_response,
                         :check_pattern => "#{db}",
              :proof_pattern => "#{test_response.status}",
              :test_item => chat.request.url.to_s,
              :class => "Lotus Domino: Unprotected Default DB",
              :type => FINDING_TYPE_VULN,
              :chat => chat,
              :rating => VULN_RATING_HIGH,
              :title => db
              )
              [ test_request, test_response ]
            end
          end
        }
        yield checker
      end
    end            
  rescue => bang
    puts bang
    puts "ERROR!! #{Module.nesting[0].name}"
    raise
    
  end
end