admin/urbanadventurer-WhatWeb
1
0
Fork 0
mirror of https://github.com/urbanadventurer/WhatWeb synced 2026-06-21 14:12:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

first commit

Browse Source
This commit is contained in:
Andrew Horton
2010-09-30 23:03:42 +13:00
commit 2829cfb53b
10 changed files with 5444 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG
+137
View File
@@ -0,0 +1,137 @@
Version 0.4.6 Released ? 2010
* Added x plugins from Brendan Coles. They are: ClipShare, PhpMesFilms, wpQuiz, phpQuestionnaire, RevSense, linkSpheric, WebspotBlogging, XchangeBoard, SazCart, AirvaeCommerce, Cartweaver, BosClassifieds, zFeeder, CMScout, Ultrastats, Connectix-Boards
* Added Escenic CMS plugin from Erik Inge Bolsø
* Changed $ANEMONE_SKIP_REGEX=Regexp.union line to be compatible with Ruby 1.8.6. Thanks to Michal Ambroz
* Added plugin reporting support for :model=>, :firmware=>, :modules=>
* Modified Joomla plugin to use :modules instead of :string, changed certainty of a regexp
* Modified PHP-Nuke plugin to use :modules
* Modified XML logging to record modules separately
* Added --wait SECONDS between connections. Combine with -t 1 if preferred.
* Added meta-refresh redirect support. eg. <meta http-equiv="refresh" content="0;url=../default/mail/index.html">. Only for non-spidering
* Added {:version=>/regexp/, :version_regex_offset} to remove cargo cult programming. eg.
{:version=>/<meta name="Generator" (content|CONTENT)="(ASPNUKE|ASP-Nuke) ([^->"]+)/, :version_regexp_offset=>2, :name=>"meta generator tag" }
* Updated plugins to use :version=>/regexp/: Advanced-Guestbook, ASP-Nuke, Concrete5, Coppermine, FormMail, InvisionPowerBoard, FormMail, MikroTik, MovableType, SearchFitShoppingCart, SquirrelMail, VBulletin, VP-ASP, VSNSLemon, WordPress
* Replaced :probability with :certainty in my-plugins/plugin-template.rb.txt. Thanks Erik Inge Bolsø
* Added support for em-resolv-replace which speeds up whatweb many times. http://github.com/mperham/em-resolv-replace
* whatweb.xsl added by Brendan Coles
* Added reporting of version detection with matches to the Plugin Info, eg. whatweb -I
* Changed whatweb -I behaviour to search plugins for keywords. eg. './whatweb -I nuke' brings up ASP-Nuke, PHPNuke, DotNetNuke, etc.
* Bugfix: Changed webpage data for when working with files, not URIs. Now it passes empty hashes, etc instead of nil which caused plugins to report errors.
* Added JSON logging. Must have the json ruby gem installed or be using Ruby 1.9
* Added error logging.
* Added XML header and footer to XML logs
Version 0.4.5 Released August 17th 2010
* Added 5 plugins from Tonmoy Saikia. They are: Commonspot, TextPattern, Mediawiki, DUclassified and Mailman
* Added 119 plugins from Brendan Coles. They are: Alcatel-Lucent-Omniswitch, Allinta-CMS, anyInventory, Arab-Portal, AVTech-Video-Web-Server, Barracuda-Spam-Firewall, Basilic, Biromsoft-WebCam, BlueNet-Video-Server, BM-Classifieds, Brother-Printer, BusinessSpace, BXR, Campsite, Canon-Network-Camera, Cisco-VPN-3000-Concentrator, CMSQLite, ColdFusion, coWiki, cpCommerce, CruxCMS, CruxPA, Dell-Printer, D-Link-Network-Camera, DMXReady, DT-Centrepiece, EazyCMS, eLitius, EMO-Realty-Manager, Empire-CMS, envezion~media, eSyndiCat, Evo-Cam, FestOS, Flax-Article-Manager, FluentNET, Forest-Blog, GuppY, HP-LaserJet-Printer, i-Catcher-Console, iDVR, Intellinet-IP-Camera, Interspire-Shopping-Cart, IPCop-Firewall, IQeye-Netcam, iRealty, iScripts-CyberMatch, iScripts-EasySnaps, iScripts-MultiCart, iScripts-ReserveLogic, iScripts-SocialWare, JAMM-CMS, Jamroom, Linksys-NAS, Linksys-Network-Camera, Linksys-Wireless-G-Camera, LocazoList-Classifieds, Lucky-Tech-iGuard, Mobotix-Network-Camera, MyioSoft-Ajax-Portal, My-PHP-Indexer, My-WebCamXP-Server, NetBotz-Network-Monitoring-Device, Netious-CMS, Netsnap-Web-Camera, Nukedit, Open-Blog, ORCA-Platform, ORITE-301-Camera, PageUp-People, Panasonic-Network-Camera, Parked-Domain, PHPDirector, PHPEasyData, phPhotoAlbum, Pixel-Ads-Script, Pixie, Pligg-CMS, PortalApp, Pressflow, RunCMS, sabros.us, samPHPweb, SHOUTcast-Administrator, SimpNews, SkaLinks, SmodCMS, Snap-Appliance-Server, Softbiz-Freelancers-Script, Softbiz-Online-Auctions-Script, Softbiz-Online-Classifieds, Sony-Network-Camera, Sony-Video-Network-Station, Stardot-Express, StarDot-NetCam, Star-Network, Subdreamer-CMS, Subrion-CMS, SyndeoCMS, syntaxCMS, TaskFreak, Team-Board, The-PHP-Real-Estate-Script, TomatoCMS, Toshiba-Network-Camera, Veo-Observer, VisionGS-Webcam, WebDVR, WebEye-Network-Camera, WebPress, WhiteBoard, Winamp-Web-Interface, Windows-Internet-Printing, Xerox-Printers, xGB, XHP-CMS, Zeus-Cart, Zoph, Zyxel-Vantage-Service-Gateway
* Added 11 plugins from Caleb Anderson. They are: AdobeFlash, AtomFeed, CodeIgniterProfiler, DublinCore, MicrosoftODBCError, MysqlSyntaxError, OpenGraphProtocol, OpenID, OpenSearch, PasswordField, RSSFeed
* Updated plugins: Aardvark-Topsites-PHP, Confluence, Open-Source-Ticket-Request-System, PHP-Link-Directory, PHP-Shell, Vulnerable-to-XSS, Zoph
* Updated mailto plugin
* Verbose output now shows which patterns were matched within a plugin
* Fixed bug: Removed Makefile reference to 'disabled-plugins' folder
* Ruby 1.9 compatability fix. requires digest/md5 instead of md5
* Ruby 1.9 compatability fix. Replace UTF8 chars in frog-cms, dotnetnuke and mno-go-search and wordpress-supercache
* Fixed spelling error of verion in help information
* Fixed a typo where -t is shown as the command line option for proxies
* Modified command line usage and is now in 80x24 terminal format
* MD5sum of body is now available as @md5sum to all plugins
* :md5 is available in matches[], eg. {:name=>"must be treshna.com",:md5=>"8666257030b94d3bdb46e05945f60b42"}
* tag pattern of HTML elements in body is now available as @tagpattern to all plugins
* :tagpattern is available in matches[], eg. {:name=>"must be google.com",:tagpattern=>""!doctype,html,head,meta,title,/title,script,/script,style,/style, etc...."}
* :url is available in plugins. eg. {:url=>"/wp-login.php", :text=>'action=lostpassword'}, this will match the url and the text passively and when scanning aggressively, it will request the specified url and check for the text. Another example, {:url=>"/readme.html", :md5=>'9ea06ab0184049bf4ea2410bf51ce402', :version=>"3.0"},
* Added --url-prefix, eg. whatweb --url-prefix www.morningstarsecurity.com/ -i ./guess-files
* Added --url-suffix, eg. whatweb --url-suffix /robots.txt -i ./target-urls
* Added --url-pattern, eg. whatweb --url-pattern www.example.com/%insert%/.htaccess -i ./folder-list
* Added --custom-plugin to define a plugin on the command line. eg, ./whatweb --custom-plugin ":text=>'powered by abc'" -i ./targets or --custom-plugin "{:text=>'powered by abc'},{:regexp=>/meta abc/i}" -i ./targets
* Plugin errors are now in red, added target name
* Added --open-timeout and --read-timeout
* Removed div-span plugin, replaced with HTML tag pattern hash
* Added --spider-skip-extensions. Redefine the file extensions that Anemone will skip. The list is comma delimited.
* Moved plugin-template.rb to my-plugins and added more example, comments, etc
* Added $DEBUG = false. If set to true, it will raise errors in plugins to assist plugin development.
Version 0.4.4 Released June 29th 2010
* :probability is renamed to :certainty. :certainty in plugins is no longer required, it defaults to 100 if not specified.
* Fixed bug with ruby 1.8.5 when loading plugins
* Added author names to plugin info, eg. whatweb -I
* Added 67 plugins from Brendan Coles, bringing WhatWeb up to 163 plugins. 360-Web-Manager,ANECMS,AWStats,Aardvark-Topsites-PHP,ArGoSoft-Mail-Server,Axis-Network-Camera,BeEF,BlognPlus,Burning-Board-Lite,CGI,CGIProxy,CMScontrol,CMSimple,Confluence,DUforum,DUgallery,F3Site,File-Upload-Manager,Google-API,Google-Hack-Honeypot,IMGallery,JGS-Portal,Kloxo,Liferay,Lime-Survey,Linksys-USB-HDD,Loggix,Microsoft-Sharepoint,Open-Freeway,Open-Source-Ticket-Request-System,PG-Roomate-Finder-Solution,PHP-Fusion,PHP-Layers,PHP-Link-Directory,PHP-Shell,PHPFM,PHPraid,PhilBoard,Piwik,QNAP-NAS,Saurus-CMS,Site-Sift,TWiki,Trac,Turbo-Seek,Umbraco,VideoShareEnterprise,Virtualmin,Vulnerable-To-XSS,WWWBoard,Web-Calendar-System,Web-Data-Administrator,WoW-Raid-Manager,X7-Chat,Zen-Cart,Zikula,boastMachine,ezBOO-WebStats,jobberBase,mojoPortal,php-ping,phpFreeChat,phpMyAdmin,phpPgAdmin,phpSysInfo,phpinfo,uPortal
* Added references to Security-Assessment.com
* Updates to README, CHANGELOG, plugin-template.rb.txt
Version 0.4.3 Released May 24th 2010
* Added GPLv2 notices
* Added Makefile (Thanks Michal Ambroz <rebus AT seznam.cz>)
* Added man pages (Thanks Michal Ambroz <rebus AT seznam.cz>)
* Added --version
* Added Invalid command line argument handling
* Added @cookie variable to plugins but is not availble for recursive use
* Changed output colour of page titles
* Changed plugin names to use a CamelCase convention
* Merged the google analytics GA and Urchin plugins
* Modified MovableType plugin
* Added Cookie names plugin
* Added Concrete5 CMS plugin
* Added CushyCMS plugin
* Added FrogCMS plugin
* Added ModxCMS plugin
* Added TypoLight plugin
* Added ExpressionEngine plugin
* Fixed a bug in Tomcat plugin
* New feature, my-plugins/ folder. Keep your personal plugins separate.
* Usage info shows correct defaults
* Fixed a bug where aggressive plugins didn't use the proxy settings
* Added XML (naive) logging
* Updated usage to show how to pipe HTML to /dev/stdin
* Added --no-redirect option. Do not follow HTTP 3xx redirects
Version 0.4.2 Released April 30th 2010
* Added header-hash plugin. Makes a hash of the first 500 characters. This is useful to identify unknown systems
* Added footer-hash plugin. Makes a hash of the last 500 characters, only if the page has > 1000 characters. This is useful to identify unknown systems
* Added div-span-structure plugin. Makes a hash of a signature of div and span tags. This is useful to identify unknown systems
* Added MikroTik Router plugin. Recognises version
* Fixed a bug where the URL had a ? suffix. This caused some types of http servers to repspond incorrectly.
* Added SquirrelMail plugin. Recognises version
* Added SearchFitShoppingCart plugin. Recognises version
* Added RoundCube plugin.
* Modified OSCommerce plugin. Recognises security warnings about file permissions and installation directory.
* Changed output colour to be more readable. Plugins that create hashes are in grey
* Changed output order of plugins, so plugins that create hashes come last
Version 0.4.1 Released April 28th 2010
* Removed dependency on rubygems and libxslt by modifying and locally including the Anemone gem. This also simplified installation
* Fixed a bug which didn't send URL parameters. eg. would send /index.php instead of /index.php?q=foo
* Improved installation instructions. Henri Salo contacted me to say ruby-dev is required for Anemone
* Removed UTF-8 character in formmail
* Changed require 'md5' to require 'digest/md5' for compatibility with ruby 1.9
* Fixed bug in Tomcat plugin
* Added SilverStripe plugin
* Added DotNetNuke plugin
* Added HTML5 plugin
* Added PHP error plugin
* Modified PHP-Nuke plugin
* Changed the plugin development script, wget-list to retry only twice
* Added proxy support
* Default threads is now 25
* Default max recursive spidering depth is now 10
* Default max number of links to follow on a single page is now 250
Version 0.4 Released March 13th 2010
* Added HTTPS support
* Improved installation instructions
* Improved documentation
* Better compatibility with ruby 1.9. Changed a case statement syntax, changed when 0: to when 0 then.
* Removed UTF-8 characters in plugins that were causing crashes
* Added php-nuke plugin, passively recognises modules
* Added Fluxbb plugin, can identify versions aggressively
* Added meta powered-by plugin. Matches tags like <meta name="powered-by" content="abc/1.23" />
* Added powered by plugin. Matches "Powered by BobsCMS", any text following powered by
* Improved plugin info listing invoked by ./whatweb -I. Shows number of examples and matches, and shows presence of passive and aggressive functions
* Changed output style. Before strings are surrounded by single quotes, now all strings are surrounded by square brackets
* Added OpenCMS plugin submitted by Emilio Casbas
* Added TomCat plugin submitted by Louis Nyffenegger
* Improved meta-generator plugin
* Fixed a bug in processing a target list from a file where a trailing space would be interpreted incorrectly
Version 0.3 Released November 2nd 2009 at Kiwicon III
How-to-develop-WhatWeb-plugins-1.1.txt
+2129
View File
File diff suppressed because it is too large Load Diff
INSTALL
+23
View File
@@ -0,0 +1,23 @@
INSTALL
Packages are available for:
* Arch Linux
* Mandriva Linux
* FreeBSD
* Gentoo
Please note that these packages may not be up to date.
Installation instructions for Ubuntu Linux
1. Install Ruby
---------------------------------------
sudo apt-get install ruby ruby-dev libopenssl-ruby
In older versions whatweb required rubygems, the anemone rubygem and ruby-dev.
Please contact me if these installation instructions don't work for you.
LICENSE
+339
View File
@@ -0,0 +1,339 @@
GNU GENERAL PUBLIC LICENSE
Version 2, June 1991
Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The licenses for most software are designed to take away your
freedom to share and change it. By contrast, the GNU General Public
License is intended to guarantee your freedom to share and change free
software--to make sure the software is free for all its users. This
General Public License applies to most of the Free Software
Foundation's software and to any other program whose authors commit to
using it. (Some other Free Software Foundation software is covered by
the GNU Lesser General Public License instead.) You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
this service if you wish), that you receive source code or can get it
if you want it, that you can change the software or use pieces of it
in new free programs; and that you know you can do these things.
To protect your rights, we need to make restrictions that forbid
anyone to deny you these rights or to ask you to surrender the rights.
These restrictions translate to certain responsibilities for you if you
distribute copies of the software, or if you modify it.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must give the recipients all the rights that
you have. You must make sure that they, too, receive or can get the
source code. And you must show them these terms so they know their
rights.
We protect your rights with two steps: (1) copyright the software, and
(2) offer you this license which gives you legal permission to copy,
distribute and/or modify the software.
Also, for each author's protection and ours, we want to make certain
that everyone understands that there is no warranty for this free
software. If the software is modified by someone else and passed on, we
want its recipients to know that what they have is not the original, so
that any problems introduced by others will not reflect on the original
authors' reputations.
Finally, any free program is threatened constantly by software
patents. We wish to avoid the danger that redistributors of a free
program will individually obtain patent licenses, in effect making the
program proprietary. To prevent this, we have made it clear that any
patent must be licensed for everyone's free use or not licensed at all.
The precise terms and conditions for copying, distribution and
modification follow.
GNU GENERAL PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
0. This License applies to any program or other work which contains
a notice placed by the copyright holder saying it may be distributed
under the terms of this General Public License. The "Program", below,
refers to any such program or work, and a "work based on the Program"
means either the Program or any derivative work under copyright law:
that is to say, a work containing the Program or a portion of it,
either verbatim or with modifications and/or translated into another
language. (Hereinafter, translation is included without limitation in
the term "modification".) Each licensee is addressed as "you".
Activities other than copying, distribution and modification are not
covered by this License; they are outside its scope. The act of
running the Program is not restricted, and the output from the Program
is covered only if its contents constitute a work based on the
Program (independent of having been made by running the Program).
Whether that is true depends on what the Program does.
1. You may copy and distribute verbatim copies of the Program's
source code as you receive it, in any medium, provided that you
conspicuously and appropriately publish on each copy an appropriate
copyright notice and disclaimer of warranty; keep intact all the
notices that refer to this License and to the absence of any warranty;
and give any other recipients of the Program a copy of this License
along with the Program.
You may charge a fee for the physical act of transferring a copy, and
you may at your option offer warranty protection in exchange for a fee.
2. You may modify your copy or copies of the Program or any portion
of it, thus forming a work based on the Program, and copy and
distribute such modifications or work under the terms of Section 1
above, provided that you also meet all of these conditions:
a) You must cause the modified files to carry prominent notices
stating that you changed the files and the date of any change.
b) You must cause any work that you distribute or publish, that in
whole or in part contains or is derived from the Program or any
part thereof, to be licensed as a whole at no charge to all third
parties under the terms of this License.
c) If the modified program normally reads commands interactively
when run, you must cause it, when started running for such
interactive use in the most ordinary way, to print or display an
announcement including an appropriate copyright notice and a
notice that there is no warranty (or else, saying that you provide
a warranty) and that users may redistribute the program under
these conditions, and telling the user how to view a copy of this
License. (Exception: if the Program itself is interactive but
does not normally print such an announcement, your work based on
the Program is not required to print an announcement.)
These requirements apply to the modified work as a whole. If
identifiable sections of that work are not derived from the Program,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works. But when you
distribute the same sections as part of a whole which is a work based
on the Program, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote it.
Thus, it is not the intent of this section to claim rights or contest
your rights to work written entirely by you; rather, the intent is to
exercise the right to control the distribution of derivative or
collective works based on the Program.
In addition, mere aggregation of another work not based on the Program
with the Program (or with a work based on the Program) on a volume of
a storage or distribution medium does not bring the other work under
the scope of this License.
3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following:
a) Accompany it with the complete corresponding machine-readable
source code, which must be distributed under the terms of Sections
1 and 2 above on a medium customarily used for software interchange; or,
b) Accompany it with a written offer, valid for at least three
years, to give any third party, for a charge no more than your
cost of physically performing source distribution, a complete
machine-readable copy of the corresponding source code, to be
distributed under the terms of Sections 1 and 2 above on a medium
customarily used for software interchange; or,
c) Accompany it with the information you received as to the offer
to distribute corresponding source code. (This alternative is
allowed only for noncommercial distribution and only if you
received the program in object code or executable form with such
an offer, in accord with Subsection b above.)
The source code for a work means the preferred form of the work for
making modifications to it. For an executable work, complete source
code means all the source code for all modules it contains, plus any
associated interface definition files, plus the scripts used to
control compilation and installation of the executable. However, as a
special exception, the source code distributed need not include
anything that is normally distributed (in either source or binary
form) with the major components (compiler, kernel, and so on) of the
operating system on which the executable runs, unless that component
itself accompanies the executable.
If distribution of executable or object code is made by offering
access to copy from a designated place, then offering equivalent
access to copy the source code from the same place counts as
distribution of the source code, even though third parties are not
compelled to copy the source along with the object code.
4. You may not copy, modify, sublicense, or distribute the Program
except as expressly provided under this License. Any attempt
otherwise to copy, modify, sublicense or distribute the Program is
void, and will automatically terminate your rights under this License.
However, parties who have received copies, or rights, from you under
this License will not have their licenses terminated so long as such
parties remain in full compliance.
5. You are not required to accept this License, since you have not
signed it. However, nothing else grants you permission to modify or
distribute the Program or its derivative works. These actions are
prohibited by law if you do not accept this License. Therefore, by
modifying or distributing the Program (or any work based on the
Program), you indicate your acceptance of this License to do so, and
all its terms and conditions for copying, distributing or modifying
the Program or works based on it.
6. Each time you redistribute the Program (or any work based on the
Program), the recipient automatically receives a license from the
original licensor to copy, distribute or modify the Program subject to
these terms and conditions. You may not impose any further
restrictions on the recipients' exercise of the rights granted herein.
You are not responsible for enforcing compliance by third parties to
this License.
7. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot
distribute so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you
may not distribute the Program at all. For example, if a patent
license would not permit royalty-free redistribution of the Program by
all those who receive copies directly or indirectly through you, then
the only way you could satisfy both it and this License would be to
refrain entirely from distribution of the Program.
If any portion of this section is held invalid or unenforceable under
any particular circumstance, the balance of the section is intended to
apply and the section as a whole is intended to apply in other
circumstances.
It is not the purpose of this section to induce you to infringe any
patents or other property right claims or to contest validity of any
such claims; this section has the sole purpose of protecting the
integrity of the free software distribution system, which is
implemented by public license practices. Many people have made
generous contributions to the wide range of software distributed
through that system in reliance on consistent application of that
system; it is up to the author/donor to decide if he or she is willing
to distribute software through any other system and a licensee cannot
impose that choice.
This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.
8. If the distribution and/or use of the Program is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Program under this License
may add an explicit geographical distribution limitation excluding
those countries, so that distribution is permitted only in or among
countries not thus excluded. In such case, this License incorporates
the limitation as if written in the body of this License.
9. The Free Software Foundation may publish revised and/or new versions
of the General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the Program
specifies a version number of this License which applies to it and "any
later version", you have the option of following the terms and conditions
either of that version or of any later version published by the Free
Software Foundation. If the Program does not specify a version number of
this License, you may choose any version ever published by the Free Software
Foundation.
10. If you wish to incorporate parts of the Program into other free
programs whose distribution conditions are different, write to the author
to ask for permission. For software which is copyrighted by the Free
Software Foundation, write to the Free Software Foundation; we sometimes
make exceptions for this. Our decision will be guided by the two goals
of preserving the free status of all derivatives of our free software and
of promoting the sharing and reuse of software generally.
NO WARRANTY
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
REPAIR OR CORRECTION.
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.
To do so, attach the following notices to the program. It is safest
to attach them to the start of each source file to most effectively
convey the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.
<one line to give the program's name and a brief idea of what it does.>
Copyright (C) <year> <name of author>
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License along
with this program; if not, write to the Free Software Foundation, Inc.,
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
Also add information on how to contact you by electronic and paper mail.
If the program is interactive, make it output a short notice like this
when it starts in an interactive mode:
Gnomovision version 69, Copyright (C) year name of author
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
This is free software, and you are welcome to redistribute it
under certain conditions; type `show c' for details.
The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License. Of course, the commands you use may
be called something other than `show w' and `show c'; they could even be
mouse-clicks or menu items--whatever suits your program.
You should also get your employer (if you work as a programmer) or your
school, if any, to sign a "copyright disclaimer" for the program, if
necessary. Here is a sample; alter the names:
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
`Gnomovision' (which makes passes at compilers) written by James Hacker.
<signature of Ty Coon>, 1 April 1989
Ty Coon, President of Vice
This General Public License does not permit incorporating your program into
proprietary programs. If your program is a subroutine library, you may
consider it more useful to permit linking proprietary applications with the
library. If this is what you want to do, use the GNU Lesser General
Public License instead of this License.
Makefile
+13
View File
@@ -0,0 +1,13 @@
NAME = whatweb
PREFIX = /usr
BINPATH = $(PREFIX)/bin
LIBPATH = $(PREFIX)/share
MANPATH = $(PREFIX)/share/man
install:
install -p -D -m 755 $(NAME) $(DESTDIR)$(BINPATH)/$(NAME)
install -p -D -m 644 $(NAME).1 $(DESTDIR)$(MANPATH)/man1/$(NAME).1
gzip -f $(DESTDIR)$(MANPATH)/man1/$(NAME).1
install -d $(DESTDIR)$(LIBPATH)/$(NAME)
cp -p -r my-plugins plugins lib plugin-development $(DESTDIR)$(LIBPATH)/$(NAME)/
README
+782
View File
@@ -0,0 +1,782 @@
WhatWeb - Next generation web scanner.
By urbanadventurer aka Andrew Horton from Security-Assessment.com
Version : 0.4.5, August 17th 2010
Homepage: http://www.morningstarsecurity.com/research/whatweb
License: GPLv2
Identify content management systems (CMS), blogging platforms, stats/analytics packages, javascript libraries, servers and more. When you visit a website in your browser the transaction includes many unseen hints about how the webserver is set up and what software is delivering the webpage. Some of these hints are obvious, eg. "Powered by XYZ" and others are more subtle. WhatWeb recognises these cues and reports what it finds.
WhatWeb has over 250 plugins and needs community support to develop more. Plugins can identify systems with obvious identifying hints removed by also looking for subtle clues. For example, a WordPress site might remove the tag <meta name="generator" content="WordPress 2.6.5"> but the WordPress plugin also looks for "wp-content" which is less easy to disguise. Plugins are flexible and can return any datatype, for example plugins can return version numbers, email addresses, account ID's and more.
There are both passive and aggressive plugins, passive plugins use information on the page, in cookies and in the URL to identify the system. A passive request is as light weight as a simple GET / HTTP/1.1 request. Aggressive plugins guess URLs and request more files. Plugins are easy to write, you don't need to know ruby to make them.
EXAMPLE USAGE
Using WhatWeb on a handful of websites, standard WhatWeb output is in colour.
$ whatweb slashdot.org reddit.com digg.com http://www.engadget.com/ www.whitehouse.gov
http://reddit.com [302] HTTPServer[AkamaiGHost], RedirectLocation[http://www.reddit.com/], MD5[d41d8cd98f00b204e9800998ecf8427e]
http://www.whitehouse.gov [200] Cookies[d], RSSFeed[http://www.whitehouse.gov/opensearch/apachesolr_search], Drupal, OpenSearch[http://www.whitehouse.gov/opensearch/apachesolr_search], Google-Analytics[GA][10791350], Title[The White House], MD5[130f09ee31cf626fa75b699cd94c7de0], Footer-Hash[8fa0ba794e1c21e1ee93d12064764f1a], Div-Span-Structure[19b509a62c40d9ce7210a8a33c740784], Header-Hash[6ab220f882680f23982afcd35d28da29]
http://slashdot.org [200] X-Powered-By[Slash 2.005001302], UncommonHeaders[x-fry,x-varnish,x-xrds-location,slash_log_data], Google-Analytics[GA][32013], HTTPServer[Apache/1.3.41 (Unix) mod_perl/1.31-rc4], Title[Slashdot - News for nerds, stuff that matters], RSSFeed[//a.fsdn.com/sd/idlecore-tidied.css?T_2_5_0_302], PasswordField[upasswd], Mailto[jamie@slashdot.org], MD5[d80992f646155d9a601847fd5750aeb7], Header-Hash[fd1bda33896292c8183cf21321db611c], Footer-Hash[7fafeba5d1d7b9cee5387feed4bf8338], Div-Span-Structure[22f6ac9e051e449400d5dc0b82c713a1]
http://www.engadget.com/ [200] probably BlogSmithMedia, Title[Engadget], RSSFeed[http://www.blogsmithmedia.com/www.engadget.com/media/favicon.ico], HTTPServer[Apache/2.2], PasswordField[login-pw,newkey], UncommonHeaders[keep-alive], Header-Hash[40cbd7dad1da86fa8db86b1f67e8c161], Footer-Hash[acc6ad1f37193dc0a722264bd04bbaa0], Div-Span-Structure[63dc0a8a6f4d6031419cedb4d77de546], MD5[82ca88e88d6d542efc8879e9907852fb]
http://digg.com [200] Cookies[1337,PHPSESSID,ccc], UncommonHeaders[keep-alive], Title[Digg - The Latest News Headlines, Videos and Images], HTTPServer[Apache], RSSFeed[/opensearch.xml], OpenSearch[/opensearch.xml], X-Powered-By[PHP/5.2.9-digg8], Header-Hash[2df7eaaa4480f28013aaf48ae9266b84], Footer-Hash[6e2c99013c0f12a0b9493ad54d2db2da], Div-Span-Structure[7f4e9099c1e7c62e31d9cf0fb89ab66b], MD5[b246c05975e7ab71270de3ea8fc44e84]
http://www.reddit.com/ [200] Cookies[reddit_first], RSSFeed[/static/reddit.css?v=b11e18eb53fe51d29cb4756ca6cf7584], PasswordField[passwd,passwd2], Google-Analytics[GA][12131688], HTTPServer['; DROP TABLE servertypes; --], JQuery, Title[reddit.com: what's new online!], MD5[c62ca3b43ee4c756d90d759aec3f1fce], Footer-Hash[9086bcb16723f874c9cebdb8497731bb], Div-Span-Structure[849596c76df42ee019847417bea59a41], Header-Hash[4fbc1dcf08d2a4be4f8b4de0617e9956]
HELP
WhatWeb - Next generation web scanner.
Version 0.4.5 by Andrew Horton aka urbanadventurer from Security-Assessment.com
Homepage: http://www.morningstarsecurity.com/research/whatweb
Usage: whatweb [options] <URLs>
<URLs> Enter URLs or filenames. Use /dev/stdin to pipe HTML
directly
--input-file=FILE, -i Identify URLs found in FILE, eg. -i /dev/stdin
--aggression, -a 1 passive - on-page
2 polite - unimplemented
3 impolite - guess URLs when plugin matches
(smart, guess a few urls)
4 aggressive - try guess URLs for every plugin
(guess a lot of urls like nikto)
--recursion, -r Follow links recursively. Only follows links under the
path (default: off)
--depth, -d Maximum recursion depth (default: 10)
--max-links, -m Maximum number of links to follow on one page
(default: 250)
--spider-skip-extensions Redefine extensions to skip.
(default: zip,gz,tar,jpg,exe,png,pdf)
--list-plugins, -l List the plugins
--run-plugins, -p Run comma delimited list of plugins. Default is all
--info-plugins, -I Display information plugins. Optionally specific a comma
delimited list.
--example-urls, -e Add example urls for each plugin to the target list
--colour=[WHEN],
--color=[WHEN] control whether colour is used. WHEN may be `never',
`always', or `auto'
--log-full=FILE Log verbose output
--log-brief=FILE Log brief, one-line output
--log-xml=FILE Log XML format
--user-agent, -U Identify as user-agent instead of WhatWeb/0.4.5.
--max-threads, -t Number of simultaneous threads. Default is 25.
--no-redirect Do not follow HTTP 3xx redirects.
--proxy <hostname[:port]> Set proxy hostname and port
(default: 8080)
--proxy-user <username:password> Set proxy user and password
--open-timeout Time in seconds
--read-timeout Time in seconds
--custom-plugin Define a custom plugin call Custom,
Examples: ":text=>'powered by abc'"
":regexp=>/powered[ ]?by ab[0-9]/"
":ghdb=>'intitle:abc \"powered by abc\"'"
":md5=>'8666257030b94d3bdb46e05945f60b42'"
"{:text=>'powered by abc'},{:regexp=>/abc [ ]?1/i}"
--url-prefix Add a prefix to target URLs
--url-suffix Add a suffix to target URLs
--url-pattern Insert the targets into a URL. Requires --input-file,
eg. www.example.com/%insert%/robots.txt
--help, -h This help
--verbose, -v Increase verbosity, use twice for debugging.
--version Display version information.
VERBOSE OUTPUT
./whatweb -v www.morningstarsecurity.com
www.morningstarsecurity.com/ [200]
http://www.morningstarsecurity.com [200] WordPress[3.0.1], Google-API[ajax/libs/jquery/1.3.2/jquery.min.js ], Google-Analytics[GA][791888], HTTPServer[Apache], UncommonHeaders[x-pingback], JQuery[1.4.2], Title[MorningStar Security], MetaGenerator[WordPress 3.0.1], RSSFeed[http://www.morningstarsecurity.com/wp-content/themes/pyrmont-v2-white/style.css], MD5[2b47722f6e9ad3add669f5a4d2267642], Tag-Hash[bce4fdbac307d13d570d3a0d2d45b078], Header-Hash[dba021c0aa225c8eede02c7dcc45b0d8], Footer-Hash[bd8866bbab7e53b19e03131a041d451a]
Footer-Hash => hash
Google-API => google javascript API (version: ajax/libs/jquery/1.3.2/jquery.min.js )
Google-Analytics => pageTracker = ...UA-123-1231
HTTPServer => server string
Header-Hash => hash
JQuery => script (version: 1.4.2)
MD5 => md5 hash of html
MetaGenerator => meta generator tag
RSSFeed => rss link type, rss link
Tag-Hash => tag pattern hash
Title => page title
UncommonHeaders => headers
WordPress => wp-content (certainty: 75), meta generator tag (version: 3.0.1)
LOG OUTPUT
There are currently 3 types of log output. They are:
--log-brief Brief logging. Default output
--log-full Full logging. Complete output from each plugin
--log-xml XML logging. Same information as default output but in XML format
You can output to multiple logs simulatenously by specifying muliple command line logging options.
Brief Logging.
Example usage: whatweb --brief-full b.log digg.com
http://digg.com [200] X-Powered-By[PHP/5.2.9-digg8], Cookies[1337,PHPSESSID,ccc], UncommonHeaders[keep-alive], Title[Digg - The Latest News Headlines, Videos and Images], HTTPServer[Apache], Mailto, Header-Hash[2df7eaaa4480f28013aaf48ae9266b84], MD5[24bc43e698e5d1388e836f5eee094fbe], Footer-Hash[ca2ffbc939969a2246cde196f0fc4841], Div-Span-Structure[828d809947c3c760d41c720c9203993b]
Full Logging (may be removed in future)
Example usage: whatweb --log-full f.log digg.com
Identifying: http://digg.com
HTTP-Status: 200
[["Cookies",
[{:certainty=>100,
:name=>"cookie names",
:string=>["1337", "PHPSESSID", "ccc"]}]],
["Footer-Hash",
[{:certainty=>100,
:name=>"hash",
:string=>"6e2c99013c0f12a0b9493ad54d2db2da"}]],
["HTTPServer",
[{:certainty=>100, :name=>"server string", :string=>"Apache"}]],
["Header-Hash",
[{:certainty=>100,
:name=>"hash",
:string=>"2df7eaaa4480f28013aaf48ae9266b84"}]],
["MD5",
[{:certainty=>100,
:name=>"md5 hash of html",
:string=>"77d9c9878dfc609c84ce2cad0eed1e61"}]],
["OpenSearch",
[{:certainty=>100,
:name=>"open search",
:regexp=>
/<link .*?type=["']application\/opensearchdescription\+xml['"].*?>/mi},
{:certainty=>100, :name=>"search link", :string=>"/opensearch.xml"}]],
["RSSFeed",
[{:certainty=>100,
:name=>"rss link type",
:regexp=>/<link .*?type=["']application\/rss\+xml["'].*?>/mi},
{:certainty=>100, :name=>"rss link", :string=>"/opensearch.xml"}]],
["Tag-Hash",
[{:certainty=>100,
:name=>"tag pattern hash",
:string=>"f0d06a3e709e6ea1c1942a4b749e4afe"}]],
["Title",
[{:certainty=>100,
:name=>"page title",
:string=>"Digg - The Latest News Headlines, Videos and Images"}]],
["UncommonHeaders",
[{:certainty=>100, :name=>"headers", :string=>"keep-alive"}]],
["X-Powered-By",
[{:certainty=>100,
:name=>"x-powered-by string",
:string=>"PHP/5.2.9-digg8"}]]]
XML Logging
The XML logging is currently naive and may change. Please contact me if you have suggestions.
Example usage: ./whatweb --log-full f.log --log-xml x.log digg.com
<target>
<uri>http://digg.com</uri>
<http-status>200</http-status>
<plugin>
<name>Cookies</name>
<string>1337</string>
<string>PHPSESSID</string>
<string>ccc</string>
</plugin>
<plugin>
<name>Footer-Hash</name>
<string>6e2c99013c0f12a0b9493ad54d2db2da</string>
</plugin>
<plugin>
<name>HTTPServer</name>
<string>Apache</string>
</plugin>
<plugin>
<name>Header-Hash</name>
<string>2df7eaaa4480f28013aaf48ae9266b84</string>
</plugin>
<plugin>
<name>MD5</name>
<string>2443327e1f1815f752af9901be54bc54</string>
</plugin>
<plugin>
<name>OpenSearch</name>
<string>/opensearch.xml</string>
</plugin>
<plugin>
<name>RSSFeed</name>
<string>/opensearch.xml</string>
</plugin>
<plugin>
<name>Tag-Hash</name>
<string>f0d06a3e709e6ea1c1942a4b749e4afe</string>
</plugin>
<plugin>
<name>Title</name>
<string>Digg - The Latest News Headlines, Videos and Images</string>
</plugin>
<plugin>
<name>UncommonHeaders</name>
<string>keep-alive</string>
</plugin>
<plugin>
<name>X-Powered-By</name>
<string>PHP/5.2.9-digg8</string>
</plugin>
</target>
PLUGINS
Plugins are easy to make.
Matches are made with:
* Text strings (case sensitive)
* Regular expressions
* Google Hack Database queries (limited set of keywords)
* MD5 hashes
* URL recognition
* HTML tag patterns
* Custom ruby code for passive and aggressive operations
To list the plugins supported:
./whatweb -l
Plugins Loaded
------------------------------
360-Web-Manager,0.1
ANECMS,0.1
ASP-Nuke,0.2
AVTech-Video-Web-Server,0.1
AWStats,0.1
Aardvark-Topsites-PHP,0.1
Acclipse,0.2
AdobeFlash,0.1
Advanced-Guestbook,0.2
Alcatel-Lucent-Omniswitch,0.1
Allinta-CMS,0.1
Antiboard,0.1
Apache-Default,0.3
ArGoSoft-Mail-Server,0.1
Arab-Portal,0.1
AtomFeed,0.1
Axis-Network-Camera,0.1
BM-Classifieds,0.1
BXR,0.1
Barracuda-Spam-Firewall,0.1
Basilic,0.1
BeEF,0.1
Belkin-Modem,0.2
Bing-SearchEngine,0.1
Biromsoft-WebCam,0.1
BlogSmithMedia,0.2
Blogger,0.1
BlognPlus,0.1
BlueNet-Video-Server,0.1
Brother-Printer,0.1
Burning-Board-Lite,0.1
BusinessSpace,0.1
CGI Backdoor,0.1
CGIProxy,0.1
CMSQLite,0.1
CMScontrol,0.1
CMSimple,0.1
CPanel,0.2
Campsite,0.1
Canon-Network-Camera,0.1
Cisco-VPN-3000-Concentrator,0.1
Citrix-Metaframe,0.2
CodeIgniterProfiler,0.1
ColdFusion,0.1
Comersus,0.2
CommonSpot,0.1
Concrete5,0.2
Confluence,0.1
Cookies,0.1
Coppermine,0.2
CruxCMS,0.1
CruxPA,0.1
CushyCMS,0.2
D-Link-Network-Camera,0.1
DMXReady,0.1
DT-Centrepiece,0.1
DUclassified,0.1
DUforum,0.1
DUgallery,0.1
Dell-Printer,0.1
DiBos,0.2
DotCMS,0.2
DotNetNuke,0.3
Drupal,0.2
DublinCore,0.1
EMO-Realty-Manager,0.1
EarlyImpact-ProductCart,0.2
EazyCMS,0.1
Echo,0.2
Empire-CMS,0.1
Evo-Cam,0.1
ExpressionEngine,0.2
F3Site,0.1
FestOS,0.1
File-Upload-Manager,0.1
Flax-Article-Manager,0.1
FluentNET,0.1
FluxBB,0.3
FontFace,0.1
Footer-Hash,0.2
Forest-Blog,0.1
FormMail,0.2
FrogCMS,0.3
GoAhead-Webs,0.2
Google-API,0.1
Google-Analytics,0.2
Google-Hack-Honeypot,0.1
GuppY,0.1
HP-LaserJet-Printer,0.1
HTML5,0.2
HTTPServer,0.2
Header-Hash,0.1
IIS-SiteNotFound,0.2
IIS-UnderConstruction,0.2
IMGallery,0.1
IPCop-Firewall,0.1
IQeye-Netcam,0.1
ISPConfig,0.2
Index-Of,0.2
Intellinet-IP-Camera,0.1
Interspire-Shopping-Cart,0.1
InvisionPowerBoard,0.2
JAMM-CMS,0.1
JGS-Portal,0.1
JQuery,0.2
Jamroom,0.1
Jboss,0.1
Joomla,0.4
Kloxo Single Server,0.1
Liferay,0.1
Lightbox,0.2
Lime-Survey,0.1
Linksys-NAS,0.1
Linksys-Network-Camera,0.1
Linksys-USB-HDD,0.1
Linksys-Wireless-G-Camera,0.1
LocazoList-Classifieds,0.1
Loggix,0.1
Lucky-Tech-iGuard,0.1
MD5,0.2
MailSiteExpress,0.2
Mailman,0.1
Mailto,0.2
Mambo,0.2
MediaWiki,0.1
MetaGenerator,0.2
MetaPoweredBy,0.2
Microsoft-Sharepoint,0.1
MicrosoftODBCError,0.1
MikroTik,0.2
Minify,0.1
MnoGoSearch,0.2
Mobotix-Network-Camera,0.1
ModxCMS,0.2
Moodle,0.2
MovableType,0.2
My-PHP-Indexer,0.1
My-WebCamXP-Server,0.1
MyioSoft-Ajax-Portal,0.1
MysqlSyntaxError,0.1
NetBotz-Network-Monitoring-Device,0.1
Netious-CMS,0.1
Netsnap-Web-Camera,0.1
NovellGroupwise,0.2
Nukedit,0.1
ORCA-Platform,0.1
ORITE-301-Camera,0.1
OSCommerce,0.3
Oce,0.2
OkiPBX,0.2
Open-Blog,0.1
Open-Freeway,0.1
Open-Source-Ticket-Request-System,0.1
OpenCms,0.1
OpenGraphProtocol,0.1
OpenID,0.1
OpenSearch,0.1
PG-Roomate-Finder-Solution,0.1
PHP-Fusion,0.1
PHP-Layers,0.1
PHP-Link-Directory,0.1
PHP-Shell,0.1
PHPCake,0.2
PHPDirector,0.1
PHPEasyData,0.1
PHPError,0.2
PHPFM,0.1
PHPNuke,0.2
PHPraid,0.1
PageUp-People,0.1
Panasonic-Network-Camera,0.1
Parked-Domain,0.1
PasswordField,0.1
PhilBoard,0.1
Piwik,0.1
Pixel-Ads-Script,0.1
Pixie,0.1
Plesk,0.2
Pligg-CMS,0.1
Plone,0.2
PortalApp,0.1
PoweredBy,0.2
Pressflow,0.1
Prototype,0.2
QNAP-NAS,0.1
Quantcast,0.1
RSSFeed,0.1
RedirectLocation,0.2
RoundCube,0.2
RunCMS,0.1
SHOUTcast-Administrator,0.1
SMF,0.2
Saurus-CMS,0.1
Scriptaculous,0.2
SearchFitShoppingCart,0.2
SiemensSpeedStreamRouter,0.2
SilverStripe,0.2
SimpNews,0.1
Site-Sift,0.1
SkaLinks,0.1
SmodCMS,0.1
Snap-Appliance-Server,0.1
SnomPhone,0.2
Softbiz-Freelancers-Script,0.1
Softbiz-Online-Auctions-Script,0.1
Softbiz-Online-Classifieds,0.1
Sony-Network-Camera,0.1
Sony-Video-Network-Station,0.1
SquirrelMail,0.2
Star-Network,0.1
StarDot-NetCam,0.1
Stardot-Express,0.1
Subdreamer-CMS,0.1
Subrion-CMS,0.1
SyndeoCMS,0.1
TWiki,0.1
Tag-Hash,0.2
TaskFreak,0.1
Team-Board,0.1
Textpattern,0.1
The-PHP-Real-Estate-Script,0.1
Title,0.2
TomatoCMS,0.1
Tomcat,0.2
Toshiba-Network-Camera,0.1
ToshibaPrinter,0.2
Trac,0.1
Turbo-Seek,0.1
TypePad,0.2
TypoLight,0.2
Umbraco,0.1
UncommonHeaders,0.2
VBulletin,0.2
VP-ASP,0.2
VSNSLemon,0.2
Veo-Observer,0.1
VideoShareEnterprise,0.1
Virtualmin,0.1
VisionGS-Webcam,0.1
Vulnerable-To-XSS,0.1
WWWBoard,0.1
Web-Calendar-System,0.1
Web-Data-Administrator,0.1
WebDVR,0.1
WebEye-Network-Camera,0.1
WebGuard,0.2
WebPress,0.1
WhiteBoard,0.1
Winamp-Web-Interface,0.1
Windows-Internet-Printing,0.1
WindowsSBS,0.2
WoW-Raid-Manager,0.1
WordPress,0.2
WordPressSpamFree,0.2
WordpressSuperCache,0.3
X-ASPNetVersion,0.2
X-Powered-By,0.2
X7-Chat,0.1
XHP-CMS,0.1
Xerox-Printers,0.1
XtraBusinessHosting,0.2
Zen-Cart,0.1
Zeus-Cart,0.1
Zikula,0.1
Zoph,0.1
Zyxel-Vantage-Service-Gateway,0.1
anyInventory,0.1
boastMachine,0.1
coWiki,0.1
cpCommerce,0.1
eLitius,0.1
eSyndiCat,0.1
envezion~media,0.1
ezBOO-WebStats,0.1
i-Catcher-Console,0.1
iDVR,0.1
iRealty,0.1
iScripts-CyberMatch,0.1
iScripts-EasySnaps,0.1
iScripts-MultiCart,0.1
iScripts-ReserveLogic,0.1
iScripts-SocialWare,0.1
ispCP-Omega,0.2
jobberBase,0.1
mojoPortal,0.1
phPhotoAlbum,0.1
php-ping,0.1
phpBB,0.2
phpFreeChat,0.1
phpMyAdmin,0.1
phpPgAdmin,0.1
phpSysInfo,0.1
phpinfo,0.1
sabros.us,0.1
samPHPweb,0.1
syntaxCMS,0.1
uPortal,0.1
xGB,0.1
To view more detail about a plugin or plugins:
./whatweb -I Joomla
Plugin Information
------------------------------
Joomla version 0.4 by Andrew Horton
[14] examples, [3] matches, [x] aggressive, [x] passive.
Description: Opensource CMS written in PHP. Homepage: http://joomla.org. Plugin can aggresively identify version by comparing md5 hashes of 4 files. Valid up to version 1.5.15.
--------------------------------------------------------------------------------
WRITING PLUGINS
To get started modify plugin-template.rb.txt in the my-plugins folder. Also read the (out of date) tutorial on writing WhatWeb plugins at www.morningstarsecurity.com/downloads/How-to-develop-WhatWeb-plugins-1.1.txt.
A typical plugin looks like this:
Plugin.define "Plone" do
author "Andrew Horton"
version "0.2"
description "CMS http://plone.org"
examples %w| www.norden.org www.trolltech.com www.plone.net www.smeal.psu.edu|
matches [
{:name=>"meta generator tag",
:regexp=>/<meta name="generator" content="[^>]*http:\/\/plone.org" \/>/},
{:name=>"plone css",
:regexp=>/(@import url|text\/css)[^>]*portal_css\/.*plone.*css(\)|")/}, #"
{:name=>"plone javascript",
:regexp=>/src="[^"]*ploneScripts[0-9]+.js"/}, #"
{:text=>'<div class="visualIcon contenttype-plone-site">'},
{:name=>"div tag, visual-portal-wrapper",
:certainty=>75,
:text=>'<div id="visual-portal-wrapper">'},
]
def passive
m=[]
#X-Caching-Rule-Id: plone-content-types
#X-Cache-Rule: plone-content-types
m << {:name=>"X-Caching-Rule-Id: plone-content-types" } if @meta["x-caching-rule-id"] =~ /plone-content-types/i
m << {:name=>"X-Cache-Rule: plone-content-types" } if @meta["x-cache-rule"] =~ /plone-content-types/i
m
end
end
There are 3 levels to a plugin. Simple matches, passive and agressive tests. You don’t need to know ruby to write plugins with simple matches. Passive and aggressive tests are written in ruby.
The matches [] array contains a set of ways to match a website to a system.
The methods are:
* :text Matches text within the webpage
* :regexp A regular expression. Append /i for case insensitive matches
* :ghdb Like a google query
* :md5 MD5 hash of the HTML page
* :tagpattern Pattern of HTML tags
* :name This is the name of the match, and is optional.
* :url The URL has to match this. Used for passive and agressive testing
* :certainty Optional, defaults to 100. Values are maybe (25), probably (75) and certain (100).
If you port a GHDB match, use :ghdb. I usually rewrite the GHDB matches with regular expressions, especially if they require inurl:
Example:
# http://johnny.ihackstuff.com/ghdb?function=detail&id=1840
{ :ghdb=>'"Powered by Vsns Lemon" intitle:"Vsns Lemon"' }
Note the GHDB queries are case insensitive, as a Google query is.
Supported codes are:
* intitle:
* inurl:
* filetype:
Each plugin can access @body, @meta, @status, @base_uri, @md5 and @tagpattern variables.
Passive tests add matches to the m array, each match is a hash containing the name of the match, probability and more.
The entire hash is returned with Full output, Brief output returns just the match, :version and :string
To discover the regular expressions to match against, wget about 20-30 examples into the tests/ folder. Be aware that some software can have dramatic variations between versions.
AGGRESSIVE PLUGINS
There are currently aggressive plugins for Joomla, phpBB, FluxBB, OSCommerce and Tomcat.
With the passive plugin we know that ardentcreative.co.nz is running Joomla version 1.5
$ ./whatweb ardentcreative.co.nz
http://ardentcreative.co.nz [301] HTTPServer[Apache], RedirectLocation[http://www.ardentcreative.co.nz/], Title[301 Moved Permanently], Header-Hash[0670664f07b972398a96c6a58e812c2d], MD5[0670664f07b972398a96c6a58e812c2d]
http://www.ardentcreative.co.nz/ [200] Cookies[e964b8ff6be2b1058b145da14a39e90d], MetaGenerator[Joomla! 1.5 - Open Source Content Management], Joomla[1.5], Google-Analytics[GA][791888], HTTPServer[Apache], Title[Ardent Creative, Christchurch Web Design], Footer-Hash[a19d726fa577100ccaec0c61b1bf8ea7], MD5[fcb3ec0dfafae53dfdef2e991a24f1c1], Div-Span-Structure[e56dd07d6f482ee11873e4ea99a9e6a8], Header-Hash[4379923363b07114470ba24584214e3f]
With the aggressive plugin we know that ardentcreative.co.nz is running Joomla version 1.5.13 - 1.5.14
dc@dc-laptop:~/projects/whatweb/whatweb-0.4.4$ ./whatweb -a 3 ardentcreative.co.nz
http://ardentcreative.co.nz [301] HTTPServer[Apache], RedirectLocation[http://www.ardentcreative.co.nz/], Title[301 Moved Permanently], Header-Hash[0670664f07b972398a96c6a58e812c2d], MD5[0670664f07b972398a96c6a58e812c2d]
http://www.ardentcreative.co.nz/ [200] Cookies[e964b8ff6be2b1058b145da14a39e90d], MetaGenerator[Joomla! 1.5 - Open Source Content Management], Joomla[1.5,1.5.15], Google-Analytics[GA][791888], HTTPServer[Apache], Title[Ardent Creative, Christchurch Web Design], Footer-Hash[a19d726fa577100ccaec0c61b1bf8ea7], MD5[fcb3ec0dfafae53dfdef2e991a24f1c1], Div-Span-Structure[e56dd07d6f482ee11873e4ea99a9e6a8], Header-Hash[4379923363b07114470ba24584214e3f]
Do not use aggressive plugins with recursive site crawling. WhatWeb has no understanding of a website, instead it currently treats each URL separately.
It also has no caching so if you use aggressive plugins with recursion you will fetch the same files multiple times. The same is true for aggressive modes on redirecting URLs.
RECURSIVE SPIDER
The recursion option is used to scan some or all of a website with whatweb. Recursive spidering will follow each link on a webpage if it is within the same website, then repeat the process on the followed pages.
The configurable settings for recursive spidering are:
--recursion, -r Follow links recursively. Only follows links under the path (default: off)
--depth, -d Maximum recursion depth (default: 3)
--max-links, -m Maximum number of links to follow on one page (default: 25)
The spider skips this hardcoded list of file extensions:
/\.zip$/,/\.gz$/,/\.tar$/,/\.jpg$/,/\.exe$/,/\.png$/,/\.pdf$/
Limitations of the spidering. This follows links in <a> tags, these are the HTML tags designed specifically for links. The spider does not obtain urls from other sources. Some good choices for future improvement are image tags, eg. <img src="/images/boats.jpg">, form tags, eg. <form action="/vote.php">, url paths in CSS files, etc.
The spider is provided by Anemone, a third party ruby gem. It doesn't follow redirects. For example the URL treshna.com will fail and www.treshna.com will produce results.
KNOWN ISSUES OR BUGS
* The web spider, Anemone doesn't following 302 redirects
* Don't use aggressive modes with website spidering as it will repeat the tests and URL requests.
* :text matches are case sensitive
* :regexp matches are case sensitive, you can make then case insensitive by appending i, eg. /foobar/i
* The MD5 hashing algorithm is used not for it's security but for it's speed as a hashing algorithm especially compared to SHA1
* Timeout settings do not apply to the Anemone spider
* Meta refresh redirects do not apply to the Anemone spider
RELATED PROJECTS
WhatWeb is unique however there are some web projects with the same goal of identifying a website.
Blind Elephant
The BlindElephant Web Application Fingerprinter attempts to discover the version of a (known) web application by comparing static files at known locations against precomputed hashes for versions of those files in all all available releases. The technique is fast, low-bandwidth, non-invasive, generic, and highly automatable.
http://blindelephant.sourceforge.net/
WAFP - Web Application Finger Printing
Wafp identifies systems by requesting a large quantity of URLs and comparing md5 sums of the results against a database. This method is reliable for known systems in the database and it is simple to add new ones. Unlike whatweb, this method is intrusive and will create a lot of webserver log entries.
http://www.mytty.org/wafp
Wappalyzer
This is the most similar project to WhatWeb.
Firefox plugin identifies sites using 1 regexp each. Only looks for obvious identifiers like meta generator tags. Sends all recognized urls to a DB. Has nice icons
https://addons.mozilla.org/en-US/firefox/addon/10229
w3af
http://w3af.sourceforge.net
Very slight overlap of features in the grep and discovery scripts section.
HTTPRecon
No feature overlap, fingerprints the HTTP Server
http://w3dt.net/tools/httprecon/
http://www.net-square.com/httprint/httprint_paper.html
http://www.darknet.org.uk/2007/09/httprint-v301-web-server-fingerprinting-tool-download/
Nmap version scan
Nmap shows some info about HTTP servers when using version scan, eg. nmap -sV -p80 treshna.com
THC's Amap
This tool is an application fingerprint scanner which can identify an HTTP protocol server. It doesn't identify types of HTTP servers.
What's that web server running 1.0 (whatweb.exe)
This shares the same name and goal but is shit. It ONLY uses the HTTP Server string. For example 'Apache/2.0.55 (Ubuntu) PHP/5.1.2'
http://www.spambutcher.com/whatweb.html
http-stats.com
Lots of info about HTTP server names
Builtwith.com
Stats of popularity of web stuff.
FUNNY & UNUSUAL
Slashdot.org
X-Fry: You mean Bender is the evil Bender? I'm shocked! Shocked! Well not that shocked.
popurls.com
X-popurls-a: in the future every url will be popular for 1.5 seconds
reddit.com
HTTPServer:'; DROP TABLE servertypes; --
NOTES
Version 0.3 Released at Kiwicon III (kiwicon.org), 2009.
Version 0.4 Released March 14th, 2010
Version 0.4.1 Released April 28th, 2010
Version 0.4.2 Released April 30th, 2010
Version 0.4.3 Released May 24th, 2010
Version 0.4.4 Released June 29th, 2010
Version 0.4.5 Released August 17th, 2010
CREDITS
Written by urbanadventurer aka Andrew Horton from Security-Assessment.com
Homepage: http://www.morningstarsecurity.com
License: GPLv2
Anemone library (used for spidering) is written by Chris Kite
Homepage: http://anemone.rubyforge.org/
License: MIT
COMMUNITY PLUGINS
Thank you to the following people who have contributed plugins to WhatWeb.
Brendan Coles (Major contributor!)
Emilio Casbas
Louis Nyffenegger
Patrik Wallström
Caleb Anderson
Tonmoy Saikia
Michal Ambroz for writing the Makefile and Man pages, not plugins.
TODO
+778
View File
@@ -0,0 +1,778 @@
TO-DO
Good luck understanding these notes for myself :) Some of this stuff has already been done.
put whatweb on github
[x] JSON output plugin
precompile regular expressions for matching speed
escape output in logs. \[ for brief logs. <> for xml logs. <---?
[x] add XML log initialisation and termination:
Add CVE array and version matching:
Here's some CVE arrays.
Also, scrap this line from the TODO file:s
["6.0+", "CVE-1115, "XSS in asdf.php"], # All know versions from 6 to date
---
AWStats
CVEs [
# AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to aswtats.pl.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0116
["6.1", "CVE-2005-0116", "Remote Code Execution in aswtats.pl"],
# awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to read server web logs by setting the loadplugin and pluginmode parameters to rawlog.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0435
["6.3-6.4", "CVE-2005-0435", "Information Disclosure vulnerability in the loadplugin and pluginmode parameters of awstats.pl."],
# Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to execute arbitrary Perl code via the HTTP Referrer, which is used in a $url parameter that is inserted into an eval function call.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0436
["6.3-6.4", "CVE-2005-0436", "Remote Code Execution vulnerability in the PluginMode parameter of awstats.pl" ],
# awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to obtain sensitive information by setting the debug parameter.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0438
["6.3-6.4", "CVE-2005-0438", "Information disclosure vulnerability in the debug parameter of awstats.pl."],
# The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1527
["6.4-", "CVE-2005-1527", "Remote Code Execution vulnerability in awstats.pl" ],
# Direct code injection vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to execute portions of Perl code via the PluginMode parameter
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2237
["6.4-6.5", "CVE-2006-2237", "Remote Code Execution vulnerability in the migrate parameter of awstats.pl."],
# awstats.pl in AWStats 6.5 build 1.857 and earlier allows remote attackers to obtain the installation path via the (1) year, (2) pluginmode or (3) month parameters.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3682
["6.5-", "CVE-2006-3682", "Information Disclosure vulnerability in the year, pluginmode and month parameters of awstats.pl."],
# Multiple cross-site scripting (XSS) vulnerabilities in awstats.pl in AWStats 6.5 build 1.857 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) refererpagesfilter, (2) refererpagesfilterex, (3) urlfilterex, (4) urlfilter, (5) hostfilter, or (6) hostfilterex parameters, a different set of vectors than CVE-2006-1945.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3681
["6.5-", "CVE-2006-3681", "Cross Site Scripting vulnerability in the refererpagesfilter, refererpagesfilterex, urlfilterex, urlfilter, hostfilter, or hostfilterex parameters of awstats.pl." ],
# Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web script or HTML via the query_string, a different vulnerability than CVE-2006-3681 and CVE-2006-1945.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3714
["6.8", "CVE-2008-3714", "Cross Site Scripting vulnerability in awstats.pl" ],
# awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the query_string parameter. NOTE: this issue exists because of an incomplete fix for CVE-2008-3714.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5080
["6.8-", "CVE-2008-5080", "Cross Site Scripting vulnerability in the query_string parameter of awstats.pl." ],
],
cmsimple
CVEs [
# Multiple PHP remote file inclusion vulnerabilities in cmsimple/cms.php in CMSimple 2.7 allow remote attackers to execute arbitrary PHP code via a URL in the (1) pth[file][config] and (2) pth[file][image] parameters.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0551
["2.7", "CVE-2007-0551", "Remote File Include vulnerability in cms.php"],
# Cross-site scripting (XSS) vulnerability in the mailform feature in CMSimple 2.7 fix1 allows remote attackers to inject arbitrary web script or HTML via the sender parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0610
["2.7 fix1", "CVE-2007-0610", "Cross Site Scripting vulnerability in cms.php"],
# Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including adm.php and then invoking the upload action. NOTE: on 20080601, the vendor patched 3.1 without changing the version number.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2650
["3.1", "CVE-2008-2650", "Directory traversal vulnerability in cmsimple/cms.php"],
]
DUforum
CVEs [
# Multiple SQL injection vulnerabilities in DUware DUforum 3.1, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via the (1) iMsg parameter to messages.asp, iFor parameter to (2) post.asp or (3) forums.asp, or (4) id parameter to userEdit.asp. NOTE: vectors 1 and 3 were later reported to affect version 3.0.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2048
["3.1", "CVE-2005-2048", "SQL Injection vulnerability in iMsg parameter of messages.asp, iFor parameter of post.asp, iFor parameter of forums.asp and id parameter of userEdit.asp"],
# SQL injection vulnerability in DUware DUforum 3.0 through 3.1 allows remote attackers to execute arbitrary SQL commands via the FOR_ID parameter in messages.asp, (2) MSG_ID parameter in messageDetail.asp, or (3) password parameter in the login form.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2201
["3.0-3.1", "CVE-2004-2201", "SQL Injection vulnerability in the FOR_ID parameter of messages.asp, MSG_ID parameter of messageDetail.asp and password parameter in the login form"],
# Cross-site scripting (XSS) vulnerability in DUware DUforum 3.0 through 3.1 allows remote attackers to inject arbitrary web script or HTML via via the message text.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2200
["3.0-3.1", "CVE-2004-2200", "Cross Site Scripting vulnerability via the message text."],
],
DUGallery
CVEs [
# SQL injection vulnerability in admin_default.asp in DUGallery 2.x allows remote attackers to execute arbitrary SQL commands via the (1) Login or (2) password field.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2302
["2.x", "CVE-2006-2302", "SQL Injection vulnerability in the login or password fields." ],
],
Ezboo webstats
CVEs [
# Ezboo webstats, possibly 3.0.3, allows remote attackers to bypass authentication and gain access via a direct request to (1) update.php and (2) config.php.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1043
["3.0.3", "CVE-2007-1043", "Authentication bypass vulnerability in update.php and config.php." ],
],
LimeSurvey
CVEs [
# PHP remote file inclusion vulnerability in classes/core/language.php in LimeSurvey 1.5.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the rootdir parameter.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5573
["1.5.2-", "CVE-2007-5573", "Remote File Inclusion vulnerability in classes/core/language.php." ],
#Cross-site request forgery (CSRF) vulnerability in LimeSurvey (formerly PHPSurveyor) before 1.71 allows remote attackers to change arbitrary quotas as administrators via a "modify quota" action.
#http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2571
["1.7-", "CVE-2008-2571", "Cross Site Request Forgery vulnerability in classes/core/language.php." ],
# Multiple PHP remote file inclusion vulnerabilities in LimeSurvey (aka PHPSurveyor) 1.49RC2 allow remote attackers to execute arbitrary PHP code via a URL in the homedir parameter to (1) OLE/PPS/File.php, (2) OLE/PPS/Root.php, (3) Spreadsheet/Excel/Writer.php, or (4) OLE/PPS.php in admin/classes/pear/; or (5) Worksheet.php, (6) Parser.php, (7) Workbook.php, (8) Format.php, or (9) BIFFwriter.php in admin/classes/pear/Spreadsheet/Excel/Writer/.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3632
["1.49RC2", "CVE-2007-3632", "Remote File Inclusion vulnerability in homedir parameter to OLE/PPS/File.php, OLE/PPS/Root.php, Spreadsheet/Excel/Writer.php, or OLE/PPS.php in admin/classes/pear/; or Worksheet.php, Parser.php, Workbook.php, Format.php, or BIFFwriter.php in admin/classes/pear/Spreadsheet/Excel/Writer/" ],
# Cross-site request forgery (CSRF) vulnerability in LimeSurvey (formerly PHPSurveyor) before 1.71 allows remote attackers to change arbitrary quotas as administrators via a "modify quota" action.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2571
["1.7-", "CVE-2008-2571", "Cross Site Request Forgery vulnerability via a modify quota action." ],
# Unspecified vulnerability in LimeSurvey before 1.82 allows remote attackers to execute commands and obtain sensitive data via unknown attack vectors related to /admin/remotecontrol/.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1604
["1.81-", "CVE-2008-2571", "Remote Command Execution vulnerability in /admin/remotecontrol/." ],
],
SharePoint
CVEs [
# Cross-site scripting (XSS) vulnerability in Microsoft Windows SharePoint Services 2.0 allows remote attackers to inject arbitrary web script or HTML via the Picture Source (aka picture object source) field in the Rich Text Editor.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1888
["2.0", "CVE-2008-1888", "Cross Site Scripting vulnerability via the Picture Source (aka picture object source) field in the Rich Text Editor." ],
# Multiple cross-site scripting (XSS) vulnerabilities in Microsoft Windows SharePoint Services 3.0 for Windows Server 2003 and Office SharePoint Server 2007 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO (query string) in "every main page," as demonstrated by default.aspx.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2581
["3.0", "CVE-2007-2581", "Cross Site Scripting vulnerability in the PATH_INFO (query string) in 'every main page,' as demonstrated by default.aspx." ],
# The download functionality in Team Services in Microsoft Office SharePoint Server 2007 12.0.0.4518 and 12.0.0.6219 allows remote attackers to read ASP.NET source code via pathnames in the SourceUrl and Source parameters to _layouts/download.aspx.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3830
["12.0.0.4518-12.0.0.6219", "CVE-2009-3830", "Information Disclosure vulnerability in /admin/remotecontrol/." ],
],
OTRS
CVEs [
# Multiple SQL injection vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) user parameter in the Login action, and remote authenticated users via the (2) TicketID and (3) ArticleID parameters of the AgentTicketPlain action.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3893
["1.0.0-1.3.2, 2.0.0", "CVE-2005-3893", "Remote Command execution vulnerability in the user parameter in the Login action, and remote authenticated users via the TicketID and ArticleID parameters of the AgentTicketPlain action." ],
# Multiple cross-site scripting (XSS) vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) hex-encoded values in the QueueID parameter and (2) Action parameters.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3894
["1.0.0-1.3.2, 2.0.0-2.0.3", "CVE-2005-3894", "Cross Site Scripting vulnerability via hex-encoded values in the QueueID parameter and Action parameters of index.pl." ],
# Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, when AttachmentDownloadType is set to inline, renders text/html e-mail attachments as HTML in the browser when the queue moderator attempts to download the attachment, which allows remote attackers to execute arbitrary web script or HTML. NOTE: this particular issue is referred to as XSS by some sources.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3895
["1.0.0-1.3.2, 2.0.0-2.0.3", "CVE-2005-3895", "Cross Site Scripting vulnerability when AttachmentDownloadType is set to inline, OTRS renders text/html e-mail attachments as HTML in the browser when the queue moderator attempts to download the attachment, which allows remote attackers to execute arbitrary web script or HTML." ],
# Cross-site scripting (XSS) vulnerability in index.pl in Open Ticket Request System (OTRS) 2.0.x allows remote attackers to inject arbitrary web script or HTML via the Subaction parameter in an AgentTicketMailbox Action. NOTE: DEBIAN:DSA-1299 originally used this identifier for an ipsec-tools issue, but the proper identifier for the ipsec-tools issue is CVE-2007-1841.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2524
["2.0.x", "CVE-2007-2524", "Cross Site Scripting vulnerability via the Subaction parameter in an AgentTicketMailbox Action of index.pl." ],
# The SOAP interface in OTRS 2.1.x before 2.1.8 and 2.2.x before 2.2.6 allows remote attackers to 'read and modify objects' via SOAP requests, related to 'Missing security checks.'"
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1515
["2.1.0-2.1.7, 2.2.0-2.2.5", "CVE-2008-1515", "Missing security checks in the SOAP interface." ],
# Multiple SQL injection vulnerabilities in Kernel/System/Ticket.pm in OTRS-Core in Open Ticket Request System (OTRS) 2.1.x before 2.1.9, 2.2.x before 2.2.9, 2.3.x before 2.3.5, and 2.4.x before 2.4.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0438
["2.1.0-2.1.8, 2.2.0-2.2.8, 2.3.0-2.3.4, 2.4.0-2.4.6", "CVE-2010-0438", "SQL Injection vulnerability in Kernel/System/Ticket.pm in OTRS-Core." ],
],
PHP-Fusion
CVEs [
# SQL injection vulnerability in messages.php in PHP-Fusion 6.01.15 and 7.00.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the subject and msg_send parameters, a different vector than CVE-2005-3157, CVE-2005-3158, CVE-2005-3159, CVE-2005-4005, and CVE-2006-2459.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5335
["6.01.15, 7.00.1", "CVE-2008-5335", "SQL Injection vulnerability in messages.php." ],
# Cross-site scripting (XSS) vulnerability in PHP-Fusion before 6.00.304 allows remote attackers to inject arbitrary web script or HTML via the (1) shout_name field in shoutbox_panel.php and the (2) comments field in comments_include.php.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0593
["6.00.303-", "CVE-2006-0593", "SQL Injection vulnerability in the shout_name field in shoutbox_panel.php and the comments field in comments_include.php." ],
# PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, as demonstrated by uploading then executing an avatar file that ends in ".php.gif" and contains PHP code in EXIF metadata.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2330
["6.00.306-", "CVE-2006-2330", "Remote File Upload vulnerability resulting in Remote Code Execution." ],
# Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via (1) a .. (dot dot) in the settings[locale] parameter in infusions/last_seen_users_panel/last_seen_users_panel.php, and (2) a .. (dot dot) in the localeset parameter in setup.php.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2331
["6.00.306", "CVE-2006-2331", "Local file inclusion in the localeset parameter in setup.php." ],
# SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magic_quotes_gpc is disabled and the database table prefix is known, allows remote authenticated users to execute arbitrary SQL commands via the submit_info[] parameter in a link submission action. NOTE: it was later reported that 7.00.2 is also affected.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1918
["6.01.14, 6.00.307, 7.00.2", "CVE-2008-1918", "SQL Injection vulnerability in the shout_name field in the submit_info[] parameter in a link submission action." ],
# Cross-site scripting (XSS) vulnerability in fusion_core.php for PHP-Fusion 5.x allows remote attackers to inject arbitrary web script or HTML via a message with IMG bbcode containing character-encoded Javascript.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0692
["5.x", "CVE-2005-0692", "Cross Site Scripting vulnerability via a message with IMG bbcode containing character-encoded Javascript in fusion_core.php." ],
# SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to execute arbitrary SQL commands via the msg_send parameter, a different vulnerability than CVE-2005-3158 and CVE-2005-3159.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3157
["6.00.109", "CVE-2005-3157", "SQL Injection vulnerability in the msg_send parameter." ],
# Multiple SQL injection vulnerabilities in PHP-Fusion before 6.00.110 allow remote attackers to execute arbitrary SQL commands via (1) the activate parameter in register.php and (2) the cat_id parameter in faq.php.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3161
["6.00.110", "CVE-2005-3161", "SQL Injection vulnerability in the activate parameter in register.php and the cat_id parameter in faq.php." ],
# Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote attackers to conduct SQL injection attacks via the _SERVER[REMOTE_ADDR] parameter to news.php.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4673
["6.01.4", "CVE-2006-4673", "SQL Injection vulnerability in the activate parameter in thr _SERVER[REMOTE_ADDR] parameter of news.php." ],
# Cross-site scripting (XSS) vulnerability in messages.php in PHP-Fusion 6.01.17 and 7.00.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6850
["6.01.17,7.00.3", "CVE-2008-6850", "Cross Site Scripting vulnerability." ],
# Multiple cross-site scripting (XSS) vulnerabilities in submit.php in PHP-Fusion before 6.01.3 allow remote attackers to inject arbitrary web script or HTML by using edit_profile.php to upload a (1) avatar or (2) forum image attachment that has a .gif or .jpg extension, and begins with a GIF header followed by JavaScript code, which is executed by Internet Explorer.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3555
["6.01.2-", "CVE-2008-6850", "Cross Site Scripting vulnerability in submit.php by using edit_profile.php to upload a avatar or forum image attachment that has a .gif or .jpg extension, and begins with a GIF header followed by JavaScript code, which is executed by Internet Explorer." ],
# Cross-site scripting (XSS) vulnerability in PHP-Fusion 6.00.107 and earlier allows remote attackers to inject arbitrary web script or HTML via nested, malformed URL BBCode tags.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2783
["6.00.107-", "CVE-2005-2783", "Cross Site Scripting vulnerability via nested, malformed URL BBCode tags." ],
# The ReadMe First.txt file in PHP-Fusion 4.0 instructs users to set the permissions on the fusion_admin/db_backups directory to world read/write/execute (777), which allows remote attackers to download or view database backups, which have easily guessable filenames and contain the administrator username and password.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1724
["4.0", "CVE-2004-1724", "Information Disclosure vulnerability in fusion_admin/db_backups/." ],
# The (1) updateuser.php and (2) forums_prune.php scripts in PHP-Fusion 4.00 allow remote attackers to obtain sensitive information via a direct HTTP request, which reveals the installation path in an error message.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1723
["4.0", "CVE-2004-1723", "Information Disclosure vulnerability in updateuser.php and forums_prune.php." ],
# SQL injection vulnerability in readmore.php in PHP-Fusion 4.01 allows remote attackers to execute arbitrary SQL commands via the news_id parameter.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5946
["4.01", "CVE-2008-5946", "SQL Injection vulnerability via the news_id parameter." ],
# Cross-site scripting (XSS) vulnerability in infusions/shoutbox_panel/shoutbox_panel.php in PHP-Fusion 6.01.10 and 6.01.9, when guest posts are enabled, allows remote authenticated users to inject arbitrary web script or HTML via the URI, related to the FUSION_QUERY constant.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3559
["6.01.9-6.01.10", "CVE-2007-3559, "Cross Site Scripting vulnerability in infusions/shoutbox_panel/shoutbox_panel.php via the URI, related to the FUSION_QUERY constant." ],
# SQL injection vulnerability in PHP-Fusion 4.01 allows remote attackers to execute arbitrary SQL commands via the rowstart parameter to (1) index.php or (2) members.php, or (3) the comment_id parameter to comments.php.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2437
["4.01", "CVE-2004-2437", "SQL Injection vulnerability via the rowstart parameter of index.php or members.php, or comment_id parameter of comments.php." ],
# SQL injection vulnerability in messages.php in PHP-Fusion 6.00.307 and earlier allows remote authenticated users to execute arbitrary SQL commands via the srch_where parameter.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2459
["6.00.307-", "CVE-2006-2459", "SQL Injection vulnerability via the srch_where parameter of messages.php." ],
# Cross-site scripting (XSS) vulnerability in PHP-Fusion 4.01 allows remote attackers to inject arbitrary web script or HTML via the (1) Submit News, (2) Submit Link or (3) Submit Article field.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2438
["4.01", "CVE-2004-2438", "Cross Site Scripting vulnerability via the Submit News, Submit Link or Submit Article field." ],
# viewthread.php in php-fusion 4.x does not check the (1) forum_id or (2) forum_cat parameters, which allows remote attackers to view protected forums via the thread_id parameter.
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0345
["4.x", "CVE-2005-0345", "Information Disclosure vulnerability in forum_id or forum_cat parameters of viewthread.php." ],
],
*********************************************************************************
# 6.00.307 and below
["6.00.307-", "CVE-2006-2459", "SQL Injection vulnerability via the srch_where parameter of messages.php." ],
# Version 4 point anything
["4.x", "CVE-2005-0345", "Information Disclosure vulnerability in forum_id or forum_cat parameters of viewthread.php." ],
# Only versions 6.01.14, 6.00.307, 7.00.2
["6.01.14, 6.00.307, 7.00.2", "CVE-2008-1918", "SQL Injection vulnerability in the shout_name field in the submit_info[] parameter in a link submission action." ],
# Versions 1.0.0-1.3.2 inclusive and versions 2.0.0-2.0.3 inclusive
["1.0.0-1.3.2, 2.0.0-2.0.3", "CVE-2005-3895", "Cross Site Scripting vulnerability when AttachmentDownloadType is set to inline, OTRS renders text/html e-mail attachments as HTML in the browser when the queue moderator attempts to download the attachment, which allows remote attackers to execute arbitrary web script or HTML." ],
Test Erik's patch:
# set up ANEMONE skip regex
# turn an array of extensions into a regexp
-$ANEMONE_SKIP_REGEX=Regexp.union($ANEMONE_SKIP_EXTENSIONS.map {|x| /\.#{x}$/ })
+$ANEMONE_SKIP_REGEX=Regexp.union(*$ANEMONE_SKIP_EXTENSIONS.map {|x| /\.#{x}$/ })
maybe make :url=>/foo be relative to the target, eg. scan fuck.com/bar/ and it checks fuck.com/bar/foo
context aware webroot:
# this is enough to identify that it's WordPress by guessing URLs but it's hardly subtle
# this can also be used to work out the wordpress webroot, eg. 1 dir up from wp-content/ or wp-includes/
files %w| license.txt wp-blog-header.php wp-content/ wp-load.php wp-register.php xmlrpc.php readme.html wp-comments-post.php wp-cron.php wp-login.php wp-rss2.php wp-admin/ wp-commentsrss2.php wp-feed.php wp-mail.php wp-rss.php wp-app.php wp-config.php wp-includes/ wp-pass.php wp-settings.php index.php wp-atom.php wp-config-sample.php wp-links-opml.php wp-rdf.php wp-trackback.php|
# drop Div-Span-Structure
# add a hash for tagpattern
# add :url=> to matches
CVE array
# :model=>
# :firmware=>
# :modules=>
# :credentials=>
# --wait time
# follow meta-refresh
# {:version=>/<meta name=\"generator\" content=\"(WordPress)[ ]?([0-9\.]+)\"/, :version_regexp_offset=>1, :name=>"meta generator tag" } #"
CVEs [
["1.0-1.4", "CVE-1111, "XSS in asdf.php"],
["2.0-", "CVE-1112, "CSRF in asdf.php"], # All versions prior to 2.0
["4.0", "CVE-1113, "SQL injection in asdf.php"], # version 4.0
["5.3-5.6", "CVE-1114, "RCE in asdf.php"], # versions 5.3 to 5.6
["6.0+", "CVE-1115, "XSS in asdf.php"], # All know versions from 6 to date
]
search for slow regexps. use examples in plugins
plugins for cisco-ios version, linksys version
#add variables for : :fwversion, :model, :modules (joomla, WP, etc)
only do aggressive checks that provide more infoz.. eg, if it's already matched and all it does is identify the system then skip it
make a webpage model and a website model
show which plugin is requesting a URL
add option to not thread - need to rewrite main loop 1st
should :text be case insensitive? maybe
# make plugin errors red. check out Zoph error on
option to not display hashes? Hashes are most useful with a large dataset to find similar systems or when manually pentesting. maybe leave it in
why does it crash with low connect timeouts? eg. 1 second
/usr/lib/ruby/1.8/timeout.rb:60:in `timeout': execution expired from /usr/lib/ruby/1.8/net/http.rb:560:in `connect'
from /usr/lib/ruby/1.8/net/http.rb:553:in `do_start'
from /usr/lib/ruby/1.8/net/http.rb:542:in `start'
from /usr/lib/ruby/1.8/net/http.rb:1035:in `request'
from ./whatweb:521:in `open_target'
from ./whatweb:899
from ./whatweb:830:in `initialize'
from ./whatweb:830:in `new'
from ./whatweb:830
#start using a new convention so this issue can be avoided when people learn by example:
pattern=/<meta name=\"generator\" content=\"WordPress[ ]?[0-9\.]+\"/
if @body =~ pattern
version=@body.scan(pattern)[0][1]
m << ....
#custom plugins on the cmdline
# ./whatweb --custom-plugin ":text=>'powered by fuck'" -i ./targets
# ./whatweb --custom-plugin "{:text=>'powered by fuck'},{:regexp=>/meta generator/}" -i ./targets
#move tag pattern into main section so any plugin can use it
#move md5 into main section so any plugin can use it
Write a quick guide to writing plugins
change -example scanning. -e <plugin>,<plugin> <-- just where 2 take the targets from
--- nah
# add prefix, suffix, etc... for manual usage.
#make help wrap around a standard terminal size
option to not output hash plugins, footer, header, tag pattern, div span, md5. plugin groups? categories?
try to reconnect when a timeout is received
#add probability to XML output
#strip :probability requirement -- assume 100 if not specified.
#strip :name requirement -- same as regexp, etc if not specified.
#rename probability to certainty
make local plugin take precedence over installed location
Treat targets like a stack :: the stack is a global var
[a,r,r,a,y] pull next target from the array when the stack is empty
[s,t,a,c] pop from the stack until it's empty
[s,t,a,c,k] <-- plugins can push to the top of the stack. like links, css, js, whatever
option to supress 404s -- maybe they just just grep for 200 or -v 404
make plugins for http://trends.builtwith.com/cms
> one of the plugins attached, shoutcast administrator, doesn't work
> because it returns different HTTP 200 OK messages. is there some way to
> fix this or even use it for fingerprinting, rather than aborting the
> request?
>
> ~/proj/whatweb-0.4.4dev$ ./whatweb --log-brief=asdf.log -a 1
> 100.m2radio.fr:8000 <http://100.m2radio.fr:8000>
> http://100.m2radio.fr:8000 ERROR: wrong status line: "ICY 200 OK"
>
> ~/proj/whatweb-0.4.4dev$ ./whatweb --log-brief=asdf.log -a 1
> 128relay1.gothmetal.net:6666 <http://128relay1.gothmetal.net:6666>
> http://128relay1.gothmetal.net:6666 ERROR: wrong status line: "ICY 200 OK"
>
> ~/proj/whatweb-0.4.4dev$ ./whatweb --log-brief=asdf.log -a 1
> 160.79.128.30:7702 <http://160.79.128.30:7702>
> http://160.79.128.30:7702 ERROR: wrong status line: "ICY 400 Server Full"
>
> ~/proj/whatweb-0.4.4dev$ ./whatweb --log-brief=asdf.log -a 1
> aol-relay2.chuckeh.com:8026 <http://aol-relay2.chuckeh.com:8026>
> http://aol-relay2.chuckeh.com:8026 [302] Title[Redirect],
> RedirectLocation[http://scfire-ntc-aa03.stream.aol.com:80/stream/1051],
> MD5[2548da190bd45c8ab7b42f781b6d8b2c],
> Header-Hash[2548da190bd45c8ab7b42f781b6d8b2c]
> http://scfire-ntc-aa03.stream.aol.com:80/stream/1051 ERROR: wrong status
> line: "ICY 200 OK"
GUI
read XML and list urls by plugin
custom plugin defined on cmdline
each plugin should say what it identifies:
* presence of system
* version
* modules/components/plugins
* usernames/accountids/email addresses
* other
* find all pages
what methods it uses for each above task:
* identify patterns in headers and HTML of any page
* identify by pattern in guessed files
* identify by existance of guessed files
* identify by hash of guessed files
and whether the above are passive or aggressive functions.
possibly separate aggressive functions into:
def aggressive_identify
def aggressive_version
def aggressive_modules
def aggressive_users
def aggressive_other
i.e. someone should be able to turn on the aggression version test for joomla and not do the aggressive module test.
plugin identify file extensions in relative or same-site urls. eg. pl, asp, aspx, cfm, php, nsf, jsp, do.
we don't need 1 plugin per extension!
#change what verbose modes are.
# verbose 1. + names of plugin rules that match
verbose 2. show HTTP headers, connections, all results from plugins
list of filetypes to download and scan. useful ones are: css, js, favicon.ico. not links, but stuff that a browser would include on a page.
#target prefix and target suffix
joomla plugin aggressive tests should be relative to the site root.
now they're just relative to the site.
need finer control of which plugins are agressive, etc.
easily identify local vs remote links. eg. for passive joomla components
better error logging
when loading plugins, check they have unique names
-A, --accept=LIST comma-separated list of accepted extensions.
-R, --reject=LIST comma-separated list of rejected extensions.
improve the md5 hash identified of versions - download tgz versions into a folder
find smallest number of files that can be used to identify a specific version:
md5hash for each file suitable
whitelist of filetypes suitable - jpg, ini, cfg, css, js
blacklist of filetypes unsuitable - inc, php, .htaccess
show files with the most differences
should escape brackets in output eg. <title>SMC[231] Console</title> currently becomes title[SMC[231] Console]
add nikto, url guessing, except for certain types of servers, dont guess urls that don't exist. i.e. apache, iis, etc -
bundle anemone with whatweb so u dont need gems, etc and remove anemone's need to nokogiri
modules should return a static list of types of objects:
text, version, modules, usernames, userid,
- cms modules r just returned as a :string at the moment. could be improved on?
extract more info from https certificates, like hostnames
include IP in logs
more output types, like JSON,XML,YAML
make a distinction in colour between standard webpage things we find all the time like
title, meta generator, md5, server-header, Mailto and other matches, i.e. Joomla.
maybe plugins should return TEXT. i.e. type of default apache,etc
let ppl specific custom functions for plugins - like enumerating all drupal nodes.
BUG https://120.136.48.33/ ERROR: EOF error end of file reached
This redirects but doesn't have a proper certificate
whatweb doesn't understand websites, only URLs
lots of good info in /robots.txt - recognise major versions of drupal
get favicon
get /robots.txt
remove aggression level 2?
include some caching of downloaded links
say whether it has aggressive tests in the plugin list
* doesn't follow redirects (sometimes)
the plugin locking is ugly, might be better to make a new instance of the plugin for each test
should modify whatweb to run as a proxy and invoke wget
fast way:
use tiny proxy, or similar writtin in C.
capture the data and pass to ruby through a socket.
ruby just starts teh proxy, starts wget and collects the data.
the url guessing sux
eg. oscommerce
http://www.pokengirl.com/cart/catalog/index.php should guess http://www.pokengirl.com/cart/catalog/admin/login.php instead of http://www.pokengirl.com/admin/login.php
should list the file +dir strcuture so we can work out the base dir
need to log errors. in all registered logs, brief & verbose? separate log file?
add an error_out function to class OutputBrief, etc.
modify error function to call
output_list.each do |o|
o.error_out(target, err )
end
[x] dont sort targets. sorting each host in the input file is unsuitable for long files.
should just read 1 at a time, potentially from stdin
fix GHDB expressions
-- ghdb "abc def" doesn't match "abc <b>def</b>"
detect mobile versions
logs currently only log successful attempts. should be optional
maybe Make account, username, id, etc all username in output?
md5sums of files -identify favicon for mambo, joomla, apple, etc. have @md5_hash for plugins
Use NAMED GROUPS in regular expressions for stuff like version numbers
export plugin regexp matches to XML, separate program.
move plugin stuff into library
PHP plugin. take version from server meta string or x-powered-by, look for local links ending in .php
plugins for apache leaking win32 / unix, debian, redhat
alternative matches -- support/convert google dork/search stuff like intitle: ,
Colour Brief output according to plugin category & hilight versions
Plugin categories, i.e. javascript libraries for ( mootools, jquery, prototype)
server (IIS/ Apache)
cgi language (PHP, ASP, CFM)
CMS (Joomla, Mambo, ) / Blogging Platform (wordpress, typepad)
statistics (google analytics, quantcast)
Layers : Server, Language, Program, Javascript
Content: Contact
CMS is a type of Program,
Stats is a type of Javascript or Program
acclipse.rb CMS
blogger.rb CMS
blogsmithmedia.rb company?
drupal.rb CMS
echo.rb CMS
generic-server.rb ?
generic-x-powered-by.rb ?
google-analytics2.rb Stats
google-analytics.rb Stats
joomla.rb CMS
jquery.rb javascript
lightbox.rb javascript
mailto.rb contact
mambo.rb CMS
minify.rb Program
movable_type.rb CMS
plone.rb CMS
prototype.rb javascript
quantcast.rb stats
scriptaculous.rb javascript
typepad.rb CMS
wordpress.rb CMS
wordpress-spamfree.rb ?
update plugins, download from website
add plugin maturity, alpha, beta, stable, etc ?
- be useful when users submit plugins / make plugins on website
use curl lib, curb for:
add proxy support
add authentication basic/digest/form/cookie/ntlm
change agent behaviour
timeouts
let people pipe html + meta data straight from stdin, eg. curl -v securityfocus.com | ./whatweb --stdin
cache pages with sqlite or in files so they only have to be fetched once
make whatweb act as a proxy. so u can spider a site with wget, use firefox, etc.
add output plugins -
yml,
brief view. eg. JQuery v2.1.7, Joomla v1.5, probably Drupal.
'probably' refers to the top % match being >50% and <100%. shows version + other info in shorthand, space delimited
test this out on CMS showcase lists to expose errors. some movable type showcase sites are drupal
make simple regexp matches more portable so they can be exported and used in other programs. maybe have an array of regexp matches in the plugins.
firefox plugin that display the identity in the footer and sends data to my server, like wapplyzer but better
website
let ppl make plugins in website.
form fields = example urls, name, etc.
write regular expressions & test which of the
examples it matches
What are your thoughts on returning info for hardware? Often there's different information to return, such as hardware model, firmware version, software versions, enabled modules, etc.
The output starts to get messy.
ABC-Hardware[xx.xx.xx][Model: XYZ][Firmware: xx.xx.xx][Modules:asdf,ghkj,zxcv]
Fingerprinting using HTTP headers would be much cleaner if shodan style searches could be performed in a similair way to ghdb.
For example, instead of using:
server=@meta["server"] if @meta.keys.include?("server")
server=@meta["Server"] if @meta.keys.include?("Server")
if server =~ /GoAhead-Webs/i
m << {:name=>"server string",:string=>server}
end
You could use:
# regex style
{:name=>"server string", :shodan=>/[server|Server]+:[\s]*GoAhead-Webs/ },
# or perhaps plaintext style, case insensitive
{:name=>"server string", :shodan=>"Server: GoAhead-Webs/ },
The same applies to cookies:
m=[]
m << {:name=>"PastVisitor Cookie" } if @meta["set-cookie"] =~ /PastVisitor=[0-9]+.*/
becomes:
{:name=>"PastVisitor Cookie", :shodan=>/set-cookie:[\s]*PastVisitor=[0-9]+.*/ },
I've noted a few plugins where this could be useful:
~/proj/whatweb-0.4.4$ cat plugins/*.rb | grep -i Shodan
# About 13,446 Shodan results for Server:"AV787 Video Web Server" @ 2010-07-20
# About 1,002 Shodan results for Server:BarracudaHTTP @ 2010-07-24
# About 1,661 shodan results for printer Server:debut @ 2010-07-22
# About 21,276 Shodan results for Server:HP-ChaiSOE ONNECTION @ 2010-07-22
# About 189 Shodan results for Server:i-Catcher Console @ 2010-07-20
# About 94 Shodan results for Server:webcamXP @ 2010-07-24
# About 268 shodan results for Server: Snap Appliance, Inc. @ 2010-07-24
# About 543 Shodan results for Server:NetEVI @ 2010-07-22
# About 50 SHODAN results for Server:"Observer XT (c) Veo" @ 2010-07-18
I think ShodanHQ has gained enough publicity that using "shodan=>" would make sense.
Just a suggestion. Also I haven't been able to fingerprint using copyright symbols and different languages have been a challenge. UTF-8 support would be awesome :D
BUGS
auto colour - detect if it's being piped to a file or STDOUT, if to a file then turn off colour
nicer error handling when fed bad input, cmdline options, etc
whatweb
Executable
+1066
View File
File diff suppressed because it is too large Load Diff
whatweb.1
+140
View File
@@ -0,0 +1,140 @@
.TH WHATWEB 1 "August 17, 2010"
.SH NAME
WhatWeb \- web scanner. Identify what websites are running.
.SH SYNOPSIS
.B whatweb
.RI [ options ]
.RI <URLs>
.br
.SH DESCRIPTION
.PP
Identify content management systems (CMS), blogging platforms, stats/analytics
packages, javascript libraries, servers and more. When you visit a website
in your browser the transaction includes many unseen hints about how
the webserver is set up and what software is delivering the webpage.
Some of these hints are obvious, eg. “Powered by XYZ” and others are more
subtle. WhatWeb recognises these hints and reports what it finds.
WhatWeb has over 290 plugins and needs community support to develop more.
Plugins can identify systems with obvious signs removed by looking for subtle
clues. For example, a WordPress site might remove the tag but the WordPress
plugin also looks for “wp-content” which is less easy to disguise. Plugins
are flexible and can return any datatype, for example plugins can return
version numbers, email addresses, account ID’s and more.
There are both passive and aggressive plugins, passive plugins use information
on the page, in cookies and in the URL to identify the system. A passive
request is as light weight as a simple GET / HTTP/1.1 request. Aggressive
plugins guess URLs and request more files. Plugins are easy to write, you
don’t need to know ruby to make them.
.SH OPTIONS
.TP
.B \<URLs\>
Enter URLs or filenames. Use /dev/stdin to pipe HTML directly
.TP
.B \-\-input-file=FILE \-i
Identify URLs found in FILE
.TP
.B \-\-aggression \-a
1 passive - on-page
2 polite - unimplemented
3 impolite - guess URLs when plugin matches (smart, guess a few URLs)
4 aggressive - guess URLs for every plugin (guess a lot of urls like nikto)
.TP
.B \-\-recursion \-r
Follow links recursively. Only follows links under the path (default: off)
.TP
.B \-\-depth \-d
Maximum recursion depth (default: 10)
.TP
.B \-\-max-links \-m
Maximum number of links to follow on one page (default: 250)
.TP
.B \-\-spider-skip-extensions
Redefine extensions to skip. (default: zip,gz,tar,jpg,exe,png,pdf)
.TP
.B \-\-list-plugins \-l
List the plugins
.TP
.B \-\-run-plugins \-p
Run comma delimited list of plugins. Default is to run all
.TP
.B \-\-info-plugins \-I
Display information about a comma delimited list of plugins. Default is all
.TP
.B \-\-example-urls \-e
Add example urls for each plugin to the target list
.TP
.B \-\-colour=[WHEN] \-\-color=[WHEN]
control whether colour is used. WHEN may be `never', `always', or `auto'
.TP
.B \-\-log-full=FILE
Log verbose output
.TP
.B \-\-log-brief=FILE
Log brief, one-line output
.TP
.B \-\-log-xml=FILE
Log XML format
.TP
.B \-\-user-agent \-U
Identify as user-agent instead of WhatWeb/VERSION.
.TP
.B \-\-max-threads \-t
Number of simultaneous threads. Default is 25.
.TP
.B \-\-no-redirect
Do not follow HTTP 3xx redirects.
.TP
.B \-\-proxy <hostname[:port]>
Set proxy hostname and port (default: 8080)
.TP
.B \-\-proxy-user <username:password>
Set proxy user and password
.TP
.B \-\-open-timeout
Time in seconds
.TP
.B \-\-read-timeout
Time in seconds
.TP
.B \-\-custom-plugin
Define a custom plugin call Custom,
Examples: ":text=>'powered by abc'"
":regexp=>/powered[ ]?by ab[0-9]/"
":ghdb=>'intitle:abc \"powered by abc\"'"
":md5=>'8666257030b94d3bdb46e05945f60b42'"
"{:text=>'powered by abc'},{:regexp=>/abc [ ]?1/i}"
.B \-\-url-prefix
Add a prefix to target URLs
.TP
.B \-\-url-suffix
Add a suffix to target URLs
.TP
.B \-\-url-pattern
Insert the targets into a URL. Requires --input-file,
eg. www.example.com/%insert%/robots.txt
.TP
.B \-\-help \-h
This help
.TP
.B \-\-verbose \-v
Increase verbosity (recommended), use twice for debugging.
.TP
.B \-\-version
Display verion information.
.SH AUTHOR
whatweb was written by Andrew Horton aka urbanadventurer
This manual page was originally written by Michal Ambroz <rebus AT seznam.cz>
for the Fedora project (and may be used by others). Updated by Andrew Horton.
.SH HOMEPAGE
http://www.morningstarsecurity.com/research/whatweb
.PP
whatweb.xsl
+37
View File
@@ -0,0 +1,37 @@
<?xml version="1.0" encoding="ISO-8859-1"?>
<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:template match="log">
<html>
<head>
<title>WhatWeb Report</title>
<style>*{padding:0;margin:0;}body,html{background:#ccc;font:medium "arial", "sans-serif";}#container{background-color:#ffffff;border:1px solid #cccccc;margin: 0px auto -1px auto;width:730px;}h1{width:100%;border:1px #000 solid;background:#eeeeee;}p{padding:10px;}table{margin-bottom:20px;}td{width:50%;}.target{background:#eee;border:1px solid #cccccc;}</style>
</head>
<body>
<table id="container">
<xsl:for-each select="target">
<tr><td class="target" colspan="2"><strong><xsl:value-of select="uri"/></strong> [<xsl:value-of select="http-status"/>]</td></tr>
<xsl:for-each select="plugin">
<xsl:choose>
<xsl:when test="position() mod 2 = 0">
<tr><td><xsl:value-of select="name"/></td>
<td><xsl:value-of select="string"/></td></tr>
</xsl:when>
<xsl:otherwise>
<tr><td bgcolor="#eee"><xsl:value-of select="name"/></td>
<td bgcolor="#eee"><xsl:value-of select="string"/></td></tr>
</xsl:otherwise>
</xsl:choose>
</xsl:for-each>
</xsl:for-each>
</table>
</body>
</html>
</xsl:template>
</xsl:stylesheet>