Class: Watobo::Modules::Passive::Dirindexing
- Inherits:
-
PassiveCheck
- Object
- PassiveCheck
- Watobo::Modules::Passive::Dirindexing
- Defined in:
- modules/passive/dirindexing.rb
Constant Summary
Constants included from Constants
Constants::AC_GROUP_APACHE, Constants::AC_GROUP_DOMINO, Constants::AC_GROUP_ENUMERATION, Constants::AC_GROUP_FILE_INCLUSION, Constants::AC_GROUP_FLASH, Constants::AC_GROUP_GENERIC, Constants::AC_GROUP_JBOSS, Constants::AC_GROUP_JOOMLA, Constants::AC_GROUP_SAP, Constants::AC_GROUP_SQL, Constants::AC_GROUP_TYPO3, Constants::AC_GROUP_XSS, Constants::AUTH_TYPE_BASIC, Constants::AUTH_TYPE_DIGEST, Constants::AUTH_TYPE_NONE, Constants::AUTH_TYPE_NTLM, Constants::CHAT_SOURCE_AUTO_SCAN, Constants::CHAT_SOURCE_FUZZER, Constants::CHAT_SOURCE_INTERCEPT, Constants::CHAT_SOURCE_MANUAL, Constants::CHAT_SOURCE_MANUAL_SCAN, Constants::CHAT_SOURCE_PROXY, Constants::CHAT_SOURCE_UNDEF, Constants::DEFAULT_PORT_HTTP, Constants::DEFAULT_PORT_HTTPS, Constants::FINDING_TYPE_HINT, Constants::FINDING_TYPE_INFO, Constants::FINDING_TYPE_UNDEFINED, Constants::FINDING_TYPE_VULN, Constants::FIRST_TIME_FILE, Constants::GUI_REGULAR_FONT_SIZE, Constants::GUI_SMALL_FONT_SIZE, Constants::ICON_PATH, Constants::LOG_DEBUG, Constants::LOG_INFO, Constants::SCAN_CANCELED, Constants::SCAN_FINISHED, Constants::SCAN_PAUSED, Constants::SCAN_STARTED, Constants::TE_CHUNKED, Constants::TE_COMPRESS, Constants::TE_DEFLATE, Constants::TE_GZIP, Constants::TE_IDENTITY, Constants::TE_NONE, Constants::VULN_RATING_CRITICAL, Constants::VULN_RATING_HIGH, Constants::VULN_RATING_INFO, Constants::VULN_RATING_LOW, Constants::VULN_RATING_MEDIUM, Constants::VULN_RATING_UNDEFINED
Instance Method Summary collapse
- #do_test(chat) ⇒ Object
-
#initialize(project) ⇒ Dirindexing
constructor
A new instance of Dirindexing.
Constructor Details
#initialize(project) ⇒ Dirindexing
Returns a new instance of Dirindexing.
31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 |
# File 'modules/passive/dirindexing.rb', line 31 def initialize(project) @project = project super(project) @info.update( :check_name => 'Directory Indexing', # name of check which briefly describes functionality, will be used for tree and progress views :description => "Detects if directory indexing is not disabled.", # description of checkfunction :author => "Andreas Schmidt", # author of check :version => "0.9" # check version ) @finding.update( :threat => 'May reveal sensitive information..', # thread of vulnerability, e.g. loss of information :class => "Directory Indexing", # vulnerability class, e.g. Stored XSS, SQL-Injection, ... :type => FINDING_TYPE_VULN, # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN :rating => VULN_RATING_LOW ) @tested_directories = [] @pattern_list = [] @pattern_list << 'Parent Directory</a>' @pattern_list << 'Directory Listing for' @pattern_list << '<title>.*Folder Listing.*<\/title>' @pattern_list << '<title>.*Index of /.*</title>' @pattern_list << '<table summary="Directory Listing" ' @pattern_list << 'Browsing directory' @pattern_list << 'To Parent Directory' end |
Instance Method Details
#do_test(chat) ⇒ Object
61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 |
# File 'modules/passive/dirindexing.rb', line 61 def do_test(chat) begin @pattern_list.each do |pat| if chat.response.body =~ /(#{pat})/i then match = $1 addFinding( :proof_pattern => "#{match}", :chat => chat, :title => "/#{chat.request.path}" ) end end rescue => bang puts "ERROR!! #{Module.nesting[0].name}" puts bang end end |