Class: Watobo::Modules::Passive::Autocomplete
- Inherits:
-
PassiveCheck
- Object
- PassiveCheck
- Watobo::Modules::Passive::Autocomplete
- Defined in:
- modules/passive/autocomplete.rb
Constant Summary
Constants included from Constants
Constants::AC_GROUP_APACHE, Constants::AC_GROUP_DOMINO, Constants::AC_GROUP_ENUMERATION, Constants::AC_GROUP_FILE_INCLUSION, Constants::AC_GROUP_FLASH, Constants::AC_GROUP_GENERIC, Constants::AC_GROUP_JBOSS, Constants::AC_GROUP_JOOMLA, Constants::AC_GROUP_SAP, Constants::AC_GROUP_SQL, Constants::AC_GROUP_TYPO3, Constants::AC_GROUP_XSS, Constants::AUTH_TYPE_BASIC, Constants::AUTH_TYPE_DIGEST, Constants::AUTH_TYPE_NONE, Constants::AUTH_TYPE_NTLM, Constants::CHAT_SOURCE_AUTO_SCAN, Constants::CHAT_SOURCE_FUZZER, Constants::CHAT_SOURCE_INTERCEPT, Constants::CHAT_SOURCE_MANUAL, Constants::CHAT_SOURCE_MANUAL_SCAN, Constants::CHAT_SOURCE_PROXY, Constants::CHAT_SOURCE_UNDEF, Constants::DEFAULT_PORT_HTTP, Constants::DEFAULT_PORT_HTTPS, Constants::FINDING_TYPE_HINT, Constants::FINDING_TYPE_INFO, Constants::FINDING_TYPE_UNDEFINED, Constants::FINDING_TYPE_VULN, Constants::FIRST_TIME_FILE, Constants::GUI_REGULAR_FONT_SIZE, Constants::GUI_SMALL_FONT_SIZE, Constants::ICON_PATH, Constants::LOG_DEBUG, Constants::LOG_INFO, Constants::SCAN_CANCELED, Constants::SCAN_FINISHED, Constants::SCAN_PAUSED, Constants::SCAN_STARTED, Constants::TE_CHUNKED, Constants::TE_COMPRESS, Constants::TE_DEFLATE, Constants::TE_GZIP, Constants::TE_IDENTITY, Constants::TE_NONE, Constants::VULN_RATING_CRITICAL, Constants::VULN_RATING_HIGH, Constants::VULN_RATING_INFO, Constants::VULN_RATING_LOW, Constants::VULN_RATING_MEDIUM, Constants::VULN_RATING_UNDEFINED
Instance Method Summary collapse
- #do_test(chat) ⇒ Object
-
#initialize(project) ⇒ Autocomplete
constructor
A new instance of Autocomplete.
Constructor Details
#initialize(project) ⇒ Autocomplete
Returns a new instance of Autocomplete.
29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 |
# File 'modules/passive/autocomplete.rb', line 29 def initialize(project) @project = project super(project) @info.update( :check_name => 'Password AutoComplete', # name of check which briefly describes functionality, will be used for tree and progress views :description => "Checks Password Fields For AutoCompletion", # description of checkfunction :author => "Andreas Schmidt", # author of check :version => "0.9" # check version ) @finding.update( :threat => 'Password values may be stored on the local filesystem.', # thread of vulnerability, e.g. loss of information :class => "Password Autocompletion", # vulnerability class, e.g. Stored XSS, SQL-Injection, ... :type => FINDING_TYPE_VULN, # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN :rating => VULN_RATING_LOW, :measure => "The form field should have an attribute autocomplete=\"off\"" ) end |
Instance Method Details
#do_test(chat) ⇒ Object
49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 |
# File 'modules/passive/autocomplete.rb', line 49 def do_test(chat) begin if chat.response.respond_to? :input_fields chat.response.input_fields do |f| ac = f.autocomplete.nil? ? "" : f.autocomplete if f.type =~ /password/i and ( ac =~ /off/i or ac.empty? ) addFinding( :proof_pattern => "input[^>]*type=[^>=]*password.*>{1}", :title => "#{chat.request.file}", :chat => chat ) end end end rescue => bang # raise puts "ERROR!! #{Module.nesting[0].name}" puts bang puts bang.backtrace if $DEBUG end return false end |