Class: Watobo::Modules::Passive::Redirect_url
- Inherits:
-
PassiveCheck
- Object
- PassiveCheck
- Watobo::Modules::Passive::Redirect_url
- Defined in:
- modules/passive/redirect_url.rb
Constant Summary
Constants included from Constants
Constants::AC_GROUP_APACHE, Constants::AC_GROUP_DOMINO, Constants::AC_GROUP_ENUMERATION, Constants::AC_GROUP_FILE_INCLUSION, Constants::AC_GROUP_FLASH, Constants::AC_GROUP_GENERIC, Constants::AC_GROUP_JBOSS, Constants::AC_GROUP_JOOMLA, Constants::AC_GROUP_SAP, Constants::AC_GROUP_SQL, Constants::AC_GROUP_TYPO3, Constants::AC_GROUP_XSS, Constants::AUTH_TYPE_BASIC, Constants::AUTH_TYPE_DIGEST, Constants::AUTH_TYPE_NONE, Constants::AUTH_TYPE_NTLM, Constants::CHAT_SOURCE_AUTO_SCAN, Constants::CHAT_SOURCE_FUZZER, Constants::CHAT_SOURCE_INTERCEPT, Constants::CHAT_SOURCE_MANUAL, Constants::CHAT_SOURCE_MANUAL_SCAN, Constants::CHAT_SOURCE_PROXY, Constants::CHAT_SOURCE_UNDEF, Constants::DEFAULT_PORT_HTTP, Constants::DEFAULT_PORT_HTTPS, Constants::FINDING_TYPE_HINT, Constants::FINDING_TYPE_INFO, Constants::FINDING_TYPE_UNDEFINED, Constants::FINDING_TYPE_VULN, Constants::FIRST_TIME_FILE, Constants::GUI_REGULAR_FONT_SIZE, Constants::GUI_SMALL_FONT_SIZE, Constants::ICON_PATH, Constants::LOG_DEBUG, Constants::LOG_INFO, Constants::SCAN_CANCELED, Constants::SCAN_FINISHED, Constants::SCAN_PAUSED, Constants::SCAN_STARTED, Constants::TE_CHUNKED, Constants::TE_COMPRESS, Constants::TE_DEFLATE, Constants::TE_GZIP, Constants::TE_IDENTITY, Constants::TE_NONE, Constants::VULN_RATING_CRITICAL, Constants::VULN_RATING_HIGH, Constants::VULN_RATING_INFO, Constants::VULN_RATING_LOW, Constants::VULN_RATING_MEDIUM, Constants::VULN_RATING_UNDEFINED
Instance Method Summary collapse
- #do_test(chat) ⇒ Object
-
#initialize(project) ⇒ Redirect_url
constructor
A new instance of Redirect_url.
Constructor Details
#initialize(project) ⇒ Redirect_url
Returns a new instance of Redirect_url.
30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 |
# File 'modules/passive/redirect_url.rb', line 30 def initialize(project) @project = project super(project) @info.update( :check_name => 'Detect Redirect Parameters', # name of check which briefly describes functionality, will be used for tree and progress views :description => "Checks parameters for suspicious names like 'url' or 'goto'.", # description of checkfunction :author => "Andreas Schmidt", # author of check :version => "0.9" # check version ) @finding.update( :threat => 'Redirect functionalities can be exploited by an attacker redirect a user to an malicious site (Drive By Attacks).', # thread of vulnerability, e.g. loss of information :class => "Redirect Parameters", # vulnerability class, e.g. Stored XSS, SQL-Injection, ... :type => FINDING_TYPE_HINT # FINDING_TYPE_HINT, FINDING_TYPE_INFO, FINDING_TYPE_VULN ) @suspicious_names = ['url', 'extern', 'goto'] end |
Instance Method Details
#do_test(chat) ⇒ Object
50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 |
# File 'modules/passive/redirect_url.rb', line 50 def do_test(chat) begin chat.request.get_parm_names.each do |parm| @suspicious_names.each do |sn| # puts "#{parm} : #{sn}" if parm =~ /(#{sn})/i then addFinding( :check_pattern => "#{parm}=", :proof_pattern =>"#{parm}=", :chat => chat, :title => parm ) end end end chat.request.post_parm_names.each do |parm| @suspicious_names.each do |sn| if parm =~ /(#{sn})/i then addFinding( :check_pattern => "#{parm}=", :proof_pattern =>"#{parm}=", :chat => chat, :title => parm ) end end end rescue => bang raise puts "ERROR!! #{Module.nesting[0].name}" puts bang end end |