mirror of
https://github.com/urbanadventurer/WhatWeb
synced 2026-06-21 14:12:19 +00:00
first commit
This commit is contained in:
Andrew Horton
@@ -0,0 +1,137 @@
|
|||||||
|
Version 0.4.6 Released ? 2010
|
||||||
|
* Added x plugins from Brendan Coles. They are: ClipShare, PhpMesFilms, wpQuiz, phpQuestionnaire, RevSense, linkSpheric, WebspotBlogging, XchangeBoard, SazCart, AirvaeCommerce, Cartweaver, BosClassifieds, zFeeder, CMScout, Ultrastats, Connectix-Boards
|
||||||
|
* Added Escenic CMS plugin from Erik Inge Bolsø
|
||||||
|
* Changed $ANEMONE_SKIP_REGEX=Regexp.union line to be compatible with Ruby 1.8.6. Thanks to Michal Ambroz
|
||||||
|
* Added plugin reporting support for :model=>, :firmware=>, :modules=>
|
||||||
|
* Modified Joomla plugin to use :modules instead of :string, changed certainty of a regexp
|
||||||
|
* Modified PHP-Nuke plugin to use :modules
|
||||||
|
* Modified XML logging to record modules separately
|
||||||
|
* Added --wait SECONDS between connections. Combine with -t 1 if preferred.
|
||||||
|
* Added meta-refresh redirect support. eg. <meta http-equiv="refresh" content="0;url=../default/mail/index.html">. Only for non-spidering
|
||||||
|
* Added {:version=>/regexp/, :version_regex_offset} to remove cargo cult programming. eg.
|
||||||
|
{:version=>/<meta name="Generator" (content|CONTENT)="(ASPNUKE|ASP-Nuke) ([^->"]+)/, :version_regexp_offset=>2, :name=>"meta generator tag" }
|
||||||
|
* Updated plugins to use :version=>/regexp/: Advanced-Guestbook, ASP-Nuke, Concrete5, Coppermine, FormMail, InvisionPowerBoard, FormMail, MikroTik, MovableType, SearchFitShoppingCart, SquirrelMail, VBulletin, VP-ASP, VSNSLemon, WordPress
|
||||||
|
* Replaced :probability with :certainty in my-plugins/plugin-template.rb.txt. Thanks Erik Inge Bolsø
|
||||||
|
* Added support for em-resolv-replace which speeds up whatweb many times. http://github.com/mperham/em-resolv-replace
|
||||||
|
* whatweb.xsl added by Brendan Coles
|
||||||
|
* Added reporting of version detection with matches to the Plugin Info, eg. whatweb -I
|
||||||
|
* Changed whatweb -I behaviour to search plugins for keywords. eg. './whatweb -I nuke' brings up ASP-Nuke, PHPNuke, DotNetNuke, etc.
|
||||||
|
* Bugfix: Changed webpage data for when working with files, not URIs. Now it passes empty hashes, etc instead of nil which caused plugins to report errors.
|
||||||
|
* Added JSON logging. Must have the json ruby gem installed or be using Ruby 1.9
|
||||||
|
* Added error logging.
|
||||||
|
* Added XML header and footer to XML logs
|
||||||
|
|
||||||
|
|
||||||
|
Version 0.4.5 Released August 17th 2010
|
||||||
|
* Added 5 plugins from Tonmoy Saikia. They are: Commonspot, TextPattern, Mediawiki, DUclassified and Mailman
|
||||||
|
* Added 119 plugins from Brendan Coles. They are: Alcatel-Lucent-Omniswitch, Allinta-CMS, anyInventory, Arab-Portal, AVTech-Video-Web-Server, Barracuda-Spam-Firewall, Basilic, Biromsoft-WebCam, BlueNet-Video-Server, BM-Classifieds, Brother-Printer, BusinessSpace, BXR, Campsite, Canon-Network-Camera, Cisco-VPN-3000-Concentrator, CMSQLite, ColdFusion, coWiki, cpCommerce, CruxCMS, CruxPA, Dell-Printer, D-Link-Network-Camera, DMXReady, DT-Centrepiece, EazyCMS, eLitius, EMO-Realty-Manager, Empire-CMS, envezion~media, eSyndiCat, Evo-Cam, FestOS, Flax-Article-Manager, FluentNET, Forest-Blog, GuppY, HP-LaserJet-Printer, i-Catcher-Console, iDVR, Intellinet-IP-Camera, Interspire-Shopping-Cart, IPCop-Firewall, IQeye-Netcam, iRealty, iScripts-CyberMatch, iScripts-EasySnaps, iScripts-MultiCart, iScripts-ReserveLogic, iScripts-SocialWare, JAMM-CMS, Jamroom, Linksys-NAS, Linksys-Network-Camera, Linksys-Wireless-G-Camera, LocazoList-Classifieds, Lucky-Tech-iGuard, Mobotix-Network-Camera, MyioSoft-Ajax-Portal, My-PHP-Indexer, My-WebCamXP-Server, NetBotz-Network-Monitoring-Device, Netious-CMS, Netsnap-Web-Camera, Nukedit, Open-Blog, ORCA-Platform, ORITE-301-Camera, PageUp-People, Panasonic-Network-Camera, Parked-Domain, PHPDirector, PHPEasyData, phPhotoAlbum, Pixel-Ads-Script, Pixie, Pligg-CMS, PortalApp, Pressflow, RunCMS, sabros.us, samPHPweb, SHOUTcast-Administrator, SimpNews, SkaLinks, SmodCMS, Snap-Appliance-Server, Softbiz-Freelancers-Script, Softbiz-Online-Auctions-Script, Softbiz-Online-Classifieds, Sony-Network-Camera, Sony-Video-Network-Station, Stardot-Express, StarDot-NetCam, Star-Network, Subdreamer-CMS, Subrion-CMS, SyndeoCMS, syntaxCMS, TaskFreak, Team-Board, The-PHP-Real-Estate-Script, TomatoCMS, Toshiba-Network-Camera, Veo-Observer, VisionGS-Webcam, WebDVR, WebEye-Network-Camera, WebPress, WhiteBoard, Winamp-Web-Interface, Windows-Internet-Printing, Xerox-Printers, xGB, XHP-CMS, Zeus-Cart, Zoph, Zyxel-Vantage-Service-Gateway
|
||||||
|
* Added 11 plugins from Caleb Anderson. They are: AdobeFlash, AtomFeed, CodeIgniterProfiler, DublinCore, MicrosoftODBCError, MysqlSyntaxError, OpenGraphProtocol, OpenID, OpenSearch, PasswordField, RSSFeed
|
||||||
|
* Updated plugins: Aardvark-Topsites-PHP, Confluence, Open-Source-Ticket-Request-System, PHP-Link-Directory, PHP-Shell, Vulnerable-to-XSS, Zoph
|
||||||
|
* Updated mailto plugin
|
||||||
|
* Verbose output now shows which patterns were matched within a plugin
|
||||||
|
* Fixed bug: Removed Makefile reference to 'disabled-plugins' folder
|
||||||
|
* Ruby 1.9 compatability fix. requires digest/md5 instead of md5
|
||||||
|
* Ruby 1.9 compatability fix. Replace UTF8 chars in frog-cms, dotnetnuke and mno-go-search and wordpress-supercache
|
||||||
|
* Fixed spelling error of verion in help information
|
||||||
|
* Fixed a typo where -t is shown as the command line option for proxies
|
||||||
|
* Modified command line usage and is now in 80x24 terminal format
|
||||||
|
* MD5sum of body is now available as @md5sum to all plugins
|
||||||
|
* :md5 is available in matches[], eg. {:name=>"must be treshna.com",:md5=>"8666257030b94d3bdb46e05945f60b42"}
|
||||||
|
* tag pattern of HTML elements in body is now available as @tagpattern to all plugins
|
||||||
|
* :tagpattern is available in matches[], eg. {:name=>"must be google.com",:tagpattern=>""!doctype,html,head,meta,title,/title,script,/script,style,/style, etc...."}
|
||||||
|
* :url is available in plugins. eg. {:url=>"/wp-login.php", :text=>'action=lostpassword'}, this will match the url and the text passively and when scanning aggressively, it will request the specified url and check for the text. Another example, {:url=>"/readme.html", :md5=>'9ea06ab0184049bf4ea2410bf51ce402', :version=>"3.0"},
|
||||||
|
* Added --url-prefix, eg. whatweb --url-prefix www.morningstarsecurity.com/ -i ./guess-files
|
||||||
|
* Added --url-suffix, eg. whatweb --url-suffix /robots.txt -i ./target-urls
|
||||||
|
* Added --url-pattern, eg. whatweb --url-pattern www.example.com/%insert%/.htaccess -i ./folder-list
|
||||||
|
* Added --custom-plugin to define a plugin on the command line. eg, ./whatweb --custom-plugin ":text=>'powered by abc'" -i ./targets or --custom-plugin "{:text=>'powered by abc'},{:regexp=>/meta abc/i}" -i ./targets
|
||||||
|
* Plugin errors are now in red, added target name
|
||||||
|
* Added --open-timeout and --read-timeout
|
||||||
|
* Removed div-span plugin, replaced with HTML tag pattern hash
|
||||||
|
* Added --spider-skip-extensions. Redefine the file extensions that Anemone will skip. The list is comma delimited.
|
||||||
|
* Moved plugin-template.rb to my-plugins and added more example, comments, etc
|
||||||
|
* Added $DEBUG = false. If set to true, it will raise errors in plugins to assist plugin development.
|
||||||
|
|
||||||
|
Version 0.4.4 Released June 29th 2010
|
||||||
|
* :probability is renamed to :certainty. :certainty in plugins is no longer required, it defaults to 100 if not specified.
|
||||||
|
* Fixed bug with ruby 1.8.5 when loading plugins
|
||||||
|
* Added author names to plugin info, eg. whatweb -I
|
||||||
|
* Added 67 plugins from Brendan Coles, bringing WhatWeb up to 163 plugins. 360-Web-Manager,ANECMS,AWStats,Aardvark-Topsites-PHP,ArGoSoft-Mail-Server,Axis-Network-Camera,BeEF,BlognPlus,Burning-Board-Lite,CGI,CGIProxy,CMScontrol,CMSimple,Confluence,DUforum,DUgallery,F3Site,File-Upload-Manager,Google-API,Google-Hack-Honeypot,IMGallery,JGS-Portal,Kloxo,Liferay,Lime-Survey,Linksys-USB-HDD,Loggix,Microsoft-Sharepoint,Open-Freeway,Open-Source-Ticket-Request-System,PG-Roomate-Finder-Solution,PHP-Fusion,PHP-Layers,PHP-Link-Directory,PHP-Shell,PHPFM,PHPraid,PhilBoard,Piwik,QNAP-NAS,Saurus-CMS,Site-Sift,TWiki,Trac,Turbo-Seek,Umbraco,VideoShareEnterprise,Virtualmin,Vulnerable-To-XSS,WWWBoard,Web-Calendar-System,Web-Data-Administrator,WoW-Raid-Manager,X7-Chat,Zen-Cart,Zikula,boastMachine,ezBOO-WebStats,jobberBase,mojoPortal,php-ping,phpFreeChat,phpMyAdmin,phpPgAdmin,phpSysInfo,phpinfo,uPortal
|
||||||
|
* Added references to Security-Assessment.com
|
||||||
|
* Updates to README, CHANGELOG, plugin-template.rb.txt
|
||||||
|
|
||||||
|
Version 0.4.3 Released May 24th 2010
|
||||||
|
* Added GPLv2 notices
|
||||||
|
* Added Makefile (Thanks Michal Ambroz <rebus AT seznam.cz>)
|
||||||
|
* Added man pages (Thanks Michal Ambroz <rebus AT seznam.cz>)
|
||||||
|
* Added --version
|
||||||
|
* Added Invalid command line argument handling
|
||||||
|
* Added @cookie variable to plugins but is not availble for recursive use
|
||||||
|
* Changed output colour of page titles
|
||||||
|
* Changed plugin names to use a CamelCase convention
|
||||||
|
* Merged the google analytics GA and Urchin plugins
|
||||||
|
* Modified MovableType plugin
|
||||||
|
* Added Cookie names plugin
|
||||||
|
* Added Concrete5 CMS plugin
|
||||||
|
* Added CushyCMS plugin
|
||||||
|
* Added FrogCMS plugin
|
||||||
|
* Added ModxCMS plugin
|
||||||
|
* Added TypoLight plugin
|
||||||
|
* Added ExpressionEngine plugin
|
||||||
|
* Fixed a bug in Tomcat plugin
|
||||||
|
* New feature, my-plugins/ folder. Keep your personal plugins separate.
|
||||||
|
* Usage info shows correct defaults
|
||||||
|
* Fixed a bug where aggressive plugins didn't use the proxy settings
|
||||||
|
* Added XML (naive) logging
|
||||||
|
* Updated usage to show how to pipe HTML to /dev/stdin
|
||||||
|
* Added --no-redirect option. Do not follow HTTP 3xx redirects
|
||||||
|
|
||||||
|
Version 0.4.2 Released April 30th 2010
|
||||||
|
* Added header-hash plugin. Makes a hash of the first 500 characters. This is useful to identify unknown systems
|
||||||
|
* Added footer-hash plugin. Makes a hash of the last 500 characters, only if the page has > 1000 characters. This is useful to identify unknown systems
|
||||||
|
* Added div-span-structure plugin. Makes a hash of a signature of div and span tags. This is useful to identify unknown systems
|
||||||
|
* Added MikroTik Router plugin. Recognises version
|
||||||
|
* Fixed a bug where the URL had a ? suffix. This caused some types of http servers to repspond incorrectly.
|
||||||
|
* Added SquirrelMail plugin. Recognises version
|
||||||
|
* Added SearchFitShoppingCart plugin. Recognises version
|
||||||
|
* Added RoundCube plugin.
|
||||||
|
* Modified OSCommerce plugin. Recognises security warnings about file permissions and installation directory.
|
||||||
|
* Changed output colour to be more readable. Plugins that create hashes are in grey
|
||||||
|
* Changed output order of plugins, so plugins that create hashes come last
|
||||||
|
|
||||||
|
Version 0.4.1 Released April 28th 2010
|
||||||
|
* Removed dependency on rubygems and libxslt by modifying and locally including the Anemone gem. This also simplified installation
|
||||||
|
* Fixed a bug which didn't send URL parameters. eg. would send /index.php instead of /index.php?q=foo
|
||||||
|
* Improved installation instructions. Henri Salo contacted me to say ruby-dev is required for Anemone
|
||||||
|
* Removed UTF-8 character in formmail
|
||||||
|
* Changed require 'md5' to require 'digest/md5' for compatibility with ruby 1.9
|
||||||
|
* Fixed bug in Tomcat plugin
|
||||||
|
* Added SilverStripe plugin
|
||||||
|
* Added DotNetNuke plugin
|
||||||
|
* Added HTML5 plugin
|
||||||
|
* Added PHP error plugin
|
||||||
|
* Modified PHP-Nuke plugin
|
||||||
|
* Changed the plugin development script, wget-list to retry only twice
|
||||||
|
* Added proxy support
|
||||||
|
* Default threads is now 25
|
||||||
|
* Default max recursive spidering depth is now 10
|
||||||
|
* Default max number of links to follow on a single page is now 250
|
||||||
|
|
||||||
|
Version 0.4 Released March 13th 2010
|
||||||
|
* Added HTTPS support
|
||||||
|
* Improved installation instructions
|
||||||
|
* Improved documentation
|
||||||
|
* Better compatibility with ruby 1.9. Changed a case statement syntax, changed when 0: to when 0 then.
|
||||||
|
* Removed UTF-8 characters in plugins that were causing crashes
|
||||||
|
* Added php-nuke plugin, passively recognises modules
|
||||||
|
* Added Fluxbb plugin, can identify versions aggressively
|
||||||
|
* Added meta powered-by plugin. Matches tags like <meta name="powered-by" content="abc/1.23" />
|
||||||
|
* Added powered by plugin. Matches "Powered by BobsCMS", any text following powered by
|
||||||
|
* Improved plugin info listing invoked by ./whatweb -I. Shows number of examples and matches, and shows presence of passive and aggressive functions
|
||||||
|
* Changed output style. Before strings are surrounded by single quotes, now all strings are surrounded by square brackets
|
||||||
|
* Added OpenCMS plugin submitted by Emilio Casbas
|
||||||
|
* Added TomCat plugin submitted by Louis Nyffenegger
|
||||||
|
* Improved meta-generator plugin
|
||||||
|
* Fixed a bug in processing a target list from a file where a trailing space would be interpreted incorrectly
|
||||||
|
|
||||||
|
Version 0.3 Released November 2nd 2009 at Kiwicon III
|
||||||
|
|
||||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,23 @@
|
|||||||
|
INSTALL
|
||||||
|
|
||||||
|
Packages are available for:
|
||||||
|
|
||||||
|
* Arch Linux
|
||||||
|
* Mandriva Linux
|
||||||
|
* FreeBSD
|
||||||
|
* Gentoo
|
||||||
|
|
||||||
|
Please note that these packages may not be up to date.
|
||||||
|
|
||||||
|
|
||||||
|
Installation instructions for Ubuntu Linux
|
||||||
|
|
||||||
|
1. Install Ruby
|
||||||
|
---------------------------------------
|
||||||
|
sudo apt-get install ruby ruby-dev libopenssl-ruby
|
||||||
|
|
||||||
|
In older versions whatweb required rubygems, the anemone rubygem and ruby-dev.
|
||||||
|
|
||||||
|
Please contact me if these installation instructions don't work for you.
|
||||||
|
|
||||||
|
|
||||||
@@ -0,0 +1,339 @@
|
|||||||
|
GNU GENERAL PUBLIC LICENSE
|
||||||
|
Version 2, June 1991
|
||||||
|
|
||||||
|
Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
|
||||||
|
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
||||||
|
Everyone is permitted to copy and distribute verbatim copies
|
||||||
|
of this license document, but changing it is not allowed.
|
||||||
|
|
||||||
|
Preamble
|
||||||
|
|
||||||
|
The licenses for most software are designed to take away your
|
||||||
|
freedom to share and change it. By contrast, the GNU General Public
|
||||||
|
License is intended to guarantee your freedom to share and change free
|
||||||
|
software--to make sure the software is free for all its users. This
|
||||||
|
General Public License applies to most of the Free Software
|
||||||
|
Foundation's software and to any other program whose authors commit to
|
||||||
|
using it. (Some other Free Software Foundation software is covered by
|
||||||
|
the GNU Lesser General Public License instead.) You can apply it to
|
||||||
|
your programs, too.
|
||||||
|
|
||||||
|
When we speak of free software, we are referring to freedom, not
|
||||||
|
price. Our General Public Licenses are designed to make sure that you
|
||||||
|
have the freedom to distribute copies of free software (and charge for
|
||||||
|
this service if you wish), that you receive source code or can get it
|
||||||
|
if you want it, that you can change the software or use pieces of it
|
||||||
|
in new free programs; and that you know you can do these things.
|
||||||
|
|
||||||
|
To protect your rights, we need to make restrictions that forbid
|
||||||
|
anyone to deny you these rights or to ask you to surrender the rights.
|
||||||
|
These restrictions translate to certain responsibilities for you if you
|
||||||
|
distribute copies of the software, or if you modify it.
|
||||||
|
|
||||||
|
For example, if you distribute copies of such a program, whether
|
||||||
|
gratis or for a fee, you must give the recipients all the rights that
|
||||||
|
you have. You must make sure that they, too, receive or can get the
|
||||||
|
source code. And you must show them these terms so they know their
|
||||||
|
rights.
|
||||||
|
|
||||||
|
We protect your rights with two steps: (1) copyright the software, and
|
||||||
|
(2) offer you this license which gives you legal permission to copy,
|
||||||
|
distribute and/or modify the software.
|
||||||
|
|
||||||
|
Also, for each author's protection and ours, we want to make certain
|
||||||
|
that everyone understands that there is no warranty for this free
|
||||||
|
software. If the software is modified by someone else and passed on, we
|
||||||
|
want its recipients to know that what they have is not the original, so
|
||||||
|
that any problems introduced by others will not reflect on the original
|
||||||
|
authors' reputations.
|
||||||
|
|
||||||
|
Finally, any free program is threatened constantly by software
|
||||||
|
patents. We wish to avoid the danger that redistributors of a free
|
||||||
|
program will individually obtain patent licenses, in effect making the
|
||||||
|
program proprietary. To prevent this, we have made it clear that any
|
||||||
|
patent must be licensed for everyone's free use or not licensed at all.
|
||||||
|
|
||||||
|
The precise terms and conditions for copying, distribution and
|
||||||
|
modification follow.
|
||||||
|
|
||||||
|
GNU GENERAL PUBLIC LICENSE
|
||||||
|
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||||
|
|
||||||
|
0. This License applies to any program or other work which contains
|
||||||
|
a notice placed by the copyright holder saying it may be distributed
|
||||||
|
under the terms of this General Public License. The "Program", below,
|
||||||
|
refers to any such program or work, and a "work based on the Program"
|
||||||
|
means either the Program or any derivative work under copyright law:
|
||||||
|
that is to say, a work containing the Program or a portion of it,
|
||||||
|
either verbatim or with modifications and/or translated into another
|
||||||
|
language. (Hereinafter, translation is included without limitation in
|
||||||
|
the term "modification".) Each licensee is addressed as "you".
|
||||||
|
|
||||||
|
Activities other than copying, distribution and modification are not
|
||||||
|
covered by this License; they are outside its scope. The act of
|
||||||
|
running the Program is not restricted, and the output from the Program
|
||||||
|
is covered only if its contents constitute a work based on the
|
||||||
|
Program (independent of having been made by running the Program).
|
||||||
|
Whether that is true depends on what the Program does.
|
||||||
|
|
||||||
|
1. You may copy and distribute verbatim copies of the Program's
|
||||||
|
source code as you receive it, in any medium, provided that you
|
||||||
|
conspicuously and appropriately publish on each copy an appropriate
|
||||||
|
copyright notice and disclaimer of warranty; keep intact all the
|
||||||
|
notices that refer to this License and to the absence of any warranty;
|
||||||
|
and give any other recipients of the Program a copy of this License
|
||||||
|
along with the Program.
|
||||||
|
|
||||||
|
You may charge a fee for the physical act of transferring a copy, and
|
||||||
|
you may at your option offer warranty protection in exchange for a fee.
|
||||||
|
|
||||||
|
2. You may modify your copy or copies of the Program or any portion
|
||||||
|
of it, thus forming a work based on the Program, and copy and
|
||||||
|
distribute such modifications or work under the terms of Section 1
|
||||||
|
above, provided that you also meet all of these conditions:
|
||||||
|
|
||||||
|
a) You must cause the modified files to carry prominent notices
|
||||||
|
stating that you changed the files and the date of any change.
|
||||||
|
|
||||||
|
b) You must cause any work that you distribute or publish, that in
|
||||||
|
whole or in part contains or is derived from the Program or any
|
||||||
|
part thereof, to be licensed as a whole at no charge to all third
|
||||||
|
parties under the terms of this License.
|
||||||
|
|
||||||
|
c) If the modified program normally reads commands interactively
|
||||||
|
when run, you must cause it, when started running for such
|
||||||
|
interactive use in the most ordinary way, to print or display an
|
||||||
|
announcement including an appropriate copyright notice and a
|
||||||
|
notice that there is no warranty (or else, saying that you provide
|
||||||
|
a warranty) and that users may redistribute the program under
|
||||||
|
these conditions, and telling the user how to view a copy of this
|
||||||
|
License. (Exception: if the Program itself is interactive but
|
||||||
|
does not normally print such an announcement, your work based on
|
||||||
|
the Program is not required to print an announcement.)
|
||||||
|
|
||||||
|
These requirements apply to the modified work as a whole. If
|
||||||
|
identifiable sections of that work are not derived from the Program,
|
||||||
|
and can be reasonably considered independent and separate works in
|
||||||
|
themselves, then this License, and its terms, do not apply to those
|
||||||
|
sections when you distribute them as separate works. But when you
|
||||||
|
distribute the same sections as part of a whole which is a work based
|
||||||
|
on the Program, the distribution of the whole must be on the terms of
|
||||||
|
this License, whose permissions for other licensees extend to the
|
||||||
|
entire whole, and thus to each and every part regardless of who wrote it.
|
||||||
|
|
||||||
|
Thus, it is not the intent of this section to claim rights or contest
|
||||||
|
your rights to work written entirely by you; rather, the intent is to
|
||||||
|
exercise the right to control the distribution of derivative or
|
||||||
|
collective works based on the Program.
|
||||||
|
|
||||||
|
In addition, mere aggregation of another work not based on the Program
|
||||||
|
with the Program (or with a work based on the Program) on a volume of
|
||||||
|
a storage or distribution medium does not bring the other work under
|
||||||
|
the scope of this License.
|
||||||
|
|
||||||
|
3. You may copy and distribute the Program (or a work based on it,
|
||||||
|
under Section 2) in object code or executable form under the terms of
|
||||||
|
Sections 1 and 2 above provided that you also do one of the following:
|
||||||
|
|
||||||
|
a) Accompany it with the complete corresponding machine-readable
|
||||||
|
source code, which must be distributed under the terms of Sections
|
||||||
|
1 and 2 above on a medium customarily used for software interchange; or,
|
||||||
|
|
||||||
|
b) Accompany it with a written offer, valid for at least three
|
||||||
|
years, to give any third party, for a charge no more than your
|
||||||
|
cost of physically performing source distribution, a complete
|
||||||
|
machine-readable copy of the corresponding source code, to be
|
||||||
|
distributed under the terms of Sections 1 and 2 above on a medium
|
||||||
|
customarily used for software interchange; or,
|
||||||
|
|
||||||
|
c) Accompany it with the information you received as to the offer
|
||||||
|
to distribute corresponding source code. (This alternative is
|
||||||
|
allowed only for noncommercial distribution and only if you
|
||||||
|
received the program in object code or executable form with such
|
||||||
|
an offer, in accord with Subsection b above.)
|
||||||
|
|
||||||
|
The source code for a work means the preferred form of the work for
|
||||||
|
making modifications to it. For an executable work, complete source
|
||||||
|
code means all the source code for all modules it contains, plus any
|
||||||
|
associated interface definition files, plus the scripts used to
|
||||||
|
control compilation and installation of the executable. However, as a
|
||||||
|
special exception, the source code distributed need not include
|
||||||
|
anything that is normally distributed (in either source or binary
|
||||||
|
form) with the major components (compiler, kernel, and so on) of the
|
||||||
|
operating system on which the executable runs, unless that component
|
||||||
|
itself accompanies the executable.
|
||||||
|
|
||||||
|
If distribution of executable or object code is made by offering
|
||||||
|
access to copy from a designated place, then offering equivalent
|
||||||
|
access to copy the source code from the same place counts as
|
||||||
|
distribution of the source code, even though third parties are not
|
||||||
|
compelled to copy the source along with the object code.
|
||||||
|
|
||||||
|
4. You may not copy, modify, sublicense, or distribute the Program
|
||||||
|
except as expressly provided under this License. Any attempt
|
||||||
|
otherwise to copy, modify, sublicense or distribute the Program is
|
||||||
|
void, and will automatically terminate your rights under this License.
|
||||||
|
However, parties who have received copies, or rights, from you under
|
||||||
|
this License will not have their licenses terminated so long as such
|
||||||
|
parties remain in full compliance.
|
||||||
|
|
||||||
|
5. You are not required to accept this License, since you have not
|
||||||
|
signed it. However, nothing else grants you permission to modify or
|
||||||
|
distribute the Program or its derivative works. These actions are
|
||||||
|
prohibited by law if you do not accept this License. Therefore, by
|
||||||
|
modifying or distributing the Program (or any work based on the
|
||||||
|
Program), you indicate your acceptance of this License to do so, and
|
||||||
|
all its terms and conditions for copying, distributing or modifying
|
||||||
|
the Program or works based on it.
|
||||||
|
|
||||||
|
6. Each time you redistribute the Program (or any work based on the
|
||||||
|
Program), the recipient automatically receives a license from the
|
||||||
|
original licensor to copy, distribute or modify the Program subject to
|
||||||
|
these terms and conditions. You may not impose any further
|
||||||
|
restrictions on the recipients' exercise of the rights granted herein.
|
||||||
|
You are not responsible for enforcing compliance by third parties to
|
||||||
|
this License.
|
||||||
|
|
||||||
|
7. If, as a consequence of a court judgment or allegation of patent
|
||||||
|
infringement or for any other reason (not limited to patent issues),
|
||||||
|
conditions are imposed on you (whether by court order, agreement or
|
||||||
|
otherwise) that contradict the conditions of this License, they do not
|
||||||
|
excuse you from the conditions of this License. If you cannot
|
||||||
|
distribute so as to satisfy simultaneously your obligations under this
|
||||||
|
License and any other pertinent obligations, then as a consequence you
|
||||||
|
may not distribute the Program at all. For example, if a patent
|
||||||
|
license would not permit royalty-free redistribution of the Program by
|
||||||
|
all those who receive copies directly or indirectly through you, then
|
||||||
|
the only way you could satisfy both it and this License would be to
|
||||||
|
refrain entirely from distribution of the Program.
|
||||||
|
|
||||||
|
If any portion of this section is held invalid or unenforceable under
|
||||||
|
any particular circumstance, the balance of the section is intended to
|
||||||
|
apply and the section as a whole is intended to apply in other
|
||||||
|
circumstances.
|
||||||
|
|
||||||
|
It is not the purpose of this section to induce you to infringe any
|
||||||
|
patents or other property right claims or to contest validity of any
|
||||||
|
such claims; this section has the sole purpose of protecting the
|
||||||
|
integrity of the free software distribution system, which is
|
||||||
|
implemented by public license practices. Many people have made
|
||||||
|
generous contributions to the wide range of software distributed
|
||||||
|
through that system in reliance on consistent application of that
|
||||||
|
system; it is up to the author/donor to decide if he or she is willing
|
||||||
|
to distribute software through any other system and a licensee cannot
|
||||||
|
impose that choice.
|
||||||
|
|
||||||
|
This section is intended to make thoroughly clear what is believed to
|
||||||
|
be a consequence of the rest of this License.
|
||||||
|
|
||||||
|
8. If the distribution and/or use of the Program is restricted in
|
||||||
|
certain countries either by patents or by copyrighted interfaces, the
|
||||||
|
original copyright holder who places the Program under this License
|
||||||
|
may add an explicit geographical distribution limitation excluding
|
||||||
|
those countries, so that distribution is permitted only in or among
|
||||||
|
countries not thus excluded. In such case, this License incorporates
|
||||||
|
the limitation as if written in the body of this License.
|
||||||
|
|
||||||
|
9. The Free Software Foundation may publish revised and/or new versions
|
||||||
|
of the General Public License from time to time. Such new versions will
|
||||||
|
be similar in spirit to the present version, but may differ in detail to
|
||||||
|
address new problems or concerns.
|
||||||
|
|
||||||
|
Each version is given a distinguishing version number. If the Program
|
||||||
|
specifies a version number of this License which applies to it and "any
|
||||||
|
later version", you have the option of following the terms and conditions
|
||||||
|
either of that version or of any later version published by the Free
|
||||||
|
Software Foundation. If the Program does not specify a version number of
|
||||||
|
this License, you may choose any version ever published by the Free Software
|
||||||
|
Foundation.
|
||||||
|
|
||||||
|
10. If you wish to incorporate parts of the Program into other free
|
||||||
|
programs whose distribution conditions are different, write to the author
|
||||||
|
to ask for permission. For software which is copyrighted by the Free
|
||||||
|
Software Foundation, write to the Free Software Foundation; we sometimes
|
||||||
|
make exceptions for this. Our decision will be guided by the two goals
|
||||||
|
of preserving the free status of all derivatives of our free software and
|
||||||
|
of promoting the sharing and reuse of software generally.
|
||||||
|
|
||||||
|
NO WARRANTY
|
||||||
|
|
||||||
|
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
|
||||||
|
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
|
||||||
|
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
|
||||||
|
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
|
||||||
|
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||||
|
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
|
||||||
|
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
|
||||||
|
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
|
||||||
|
REPAIR OR CORRECTION.
|
||||||
|
|
||||||
|
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||||
|
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
|
||||||
|
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
|
||||||
|
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
|
||||||
|
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
|
||||||
|
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
|
||||||
|
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
|
||||||
|
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
|
||||||
|
POSSIBILITY OF SUCH DAMAGES.
|
||||||
|
|
||||||
|
END OF TERMS AND CONDITIONS
|
||||||
|
|
||||||
|
How to Apply These Terms to Your New Programs
|
||||||
|
|
||||||
|
If you develop a new program, and you want it to be of the greatest
|
||||||
|
possible use to the public, the best way to achieve this is to make it
|
||||||
|
free software which everyone can redistribute and change under these terms.
|
||||||
|
|
||||||
|
To do so, attach the following notices to the program. It is safest
|
||||||
|
to attach them to the start of each source file to most effectively
|
||||||
|
convey the exclusion of warranty; and each file should have at least
|
||||||
|
the "copyright" line and a pointer to where the full notice is found.
|
||||||
|
|
||||||
|
<one line to give the program's name and a brief idea of what it does.>
|
||||||
|
Copyright (C) <year> <name of author>
|
||||||
|
|
||||||
|
This program is free software; you can redistribute it and/or modify
|
||||||
|
it under the terms of the GNU General Public License as published by
|
||||||
|
the Free Software Foundation; either version 2 of the License, or
|
||||||
|
(at your option) any later version.
|
||||||
|
|
||||||
|
This program is distributed in the hope that it will be useful,
|
||||||
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
GNU General Public License for more details.
|
||||||
|
|
||||||
|
You should have received a copy of the GNU General Public License along
|
||||||
|
with this program; if not, write to the Free Software Foundation, Inc.,
|
||||||
|
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||||
|
|
||||||
|
Also add information on how to contact you by electronic and paper mail.
|
||||||
|
|
||||||
|
If the program is interactive, make it output a short notice like this
|
||||||
|
when it starts in an interactive mode:
|
||||||
|
|
||||||
|
Gnomovision version 69, Copyright (C) year name of author
|
||||||
|
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
||||||
|
This is free software, and you are welcome to redistribute it
|
||||||
|
under certain conditions; type `show c' for details.
|
||||||
|
|
||||||
|
The hypothetical commands `show w' and `show c' should show the appropriate
|
||||||
|
parts of the General Public License. Of course, the commands you use may
|
||||||
|
be called something other than `show w' and `show c'; they could even be
|
||||||
|
mouse-clicks or menu items--whatever suits your program.
|
||||||
|
|
||||||
|
You should also get your employer (if you work as a programmer) or your
|
||||||
|
school, if any, to sign a "copyright disclaimer" for the program, if
|
||||||
|
necessary. Here is a sample; alter the names:
|
||||||
|
|
||||||
|
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
|
||||||
|
`Gnomovision' (which makes passes at compilers) written by James Hacker.
|
||||||
|
|
||||||
|
<signature of Ty Coon>, 1 April 1989
|
||||||
|
Ty Coon, President of Vice
|
||||||
|
|
||||||
|
This General Public License does not permit incorporating your program into
|
||||||
|
proprietary programs. If your program is a subroutine library, you may
|
||||||
|
consider it more useful to permit linking proprietary applications with the
|
||||||
|
library. If this is what you want to do, use the GNU Lesser General
|
||||||
|
Public License instead of this License.
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
NAME = whatweb
|
||||||
|
PREFIX = /usr
|
||||||
|
BINPATH = $(PREFIX)/bin
|
||||||
|
LIBPATH = $(PREFIX)/share
|
||||||
|
MANPATH = $(PREFIX)/share/man
|
||||||
|
|
||||||
|
install:
|
||||||
|
install -p -D -m 755 $(NAME) $(DESTDIR)$(BINPATH)/$(NAME)
|
||||||
|
install -p -D -m 644 $(NAME).1 $(DESTDIR)$(MANPATH)/man1/$(NAME).1
|
||||||
|
gzip -f $(DESTDIR)$(MANPATH)/man1/$(NAME).1
|
||||||
|
install -d $(DESTDIR)$(LIBPATH)/$(NAME)
|
||||||
|
cp -p -r my-plugins plugins lib plugin-development $(DESTDIR)$(LIBPATH)/$(NAME)/
|
||||||
|
|
||||||
@@ -0,0 +1,782 @@
|
|||||||
|
WhatWeb - Next generation web scanner.
|
||||||
|
By urbanadventurer aka Andrew Horton from Security-Assessment.com
|
||||||
|
Version : 0.4.5, August 17th 2010
|
||||||
|
Homepage: http://www.morningstarsecurity.com/research/whatweb
|
||||||
|
License: GPLv2
|
||||||
|
|
||||||
|
|
||||||
|
Identify content management systems (CMS), blogging platforms, stats/analytics packages, javascript libraries, servers and more. When you visit a website in your browser the transaction includes many unseen hints about how the webserver is set up and what software is delivering the webpage. Some of these hints are obvious, eg. "Powered by XYZ" and others are more subtle. WhatWeb recognises these cues and reports what it finds.
|
||||||
|
|
||||||
|
WhatWeb has over 250 plugins and needs community support to develop more. Plugins can identify systems with obvious identifying hints removed by also looking for subtle clues. For example, a WordPress site might remove the tag <meta name="generator" content="WordPress 2.6.5"> but the WordPress plugin also looks for "wp-content" which is less easy to disguise. Plugins are flexible and can return any datatype, for example plugins can return version numbers, email addresses, account ID's and more.
|
||||||
|
|
||||||
|
There are both passive and aggressive plugins, passive plugins use information on the page, in cookies and in the URL to identify the system. A passive request is as light weight as a simple GET / HTTP/1.1 request. Aggressive plugins guess URLs and request more files. Plugins are easy to write, you don't need to know ruby to make them.
|
||||||
|
|
||||||
|
|
||||||
|
EXAMPLE USAGE
|
||||||
|
|
||||||
|
Using WhatWeb on a handful of websites, standard WhatWeb output is in colour.
|
||||||
|
|
||||||
|
$ whatweb slashdot.org reddit.com digg.com http://www.engadget.com/ www.whitehouse.gov
|
||||||
|
http://reddit.com [302] HTTPServer[AkamaiGHost], RedirectLocation[http://www.reddit.com/], MD5[d41d8cd98f00b204e9800998ecf8427e]
|
||||||
|
http://www.whitehouse.gov [200] Cookies[d], RSSFeed[http://www.whitehouse.gov/opensearch/apachesolr_search], Drupal, OpenSearch[http://www.whitehouse.gov/opensearch/apachesolr_search], Google-Analytics[GA][10791350], Title[The White House], MD5[130f09ee31cf626fa75b699cd94c7de0], Footer-Hash[8fa0ba794e1c21e1ee93d12064764f1a], Div-Span-Structure[19b509a62c40d9ce7210a8a33c740784], Header-Hash[6ab220f882680f23982afcd35d28da29]
|
||||||
|
http://slashdot.org [200] X-Powered-By[Slash 2.005001302], UncommonHeaders[x-fry,x-varnish,x-xrds-location,slash_log_data], Google-Analytics[GA][32013], HTTPServer[Apache/1.3.41 (Unix) mod_perl/1.31-rc4], Title[Slashdot - News for nerds, stuff that matters], RSSFeed[//a.fsdn.com/sd/idlecore-tidied.css?T_2_5_0_302], PasswordField[upasswd], Mailto[jamie@slashdot.org], MD5[d80992f646155d9a601847fd5750aeb7], Header-Hash[fd1bda33896292c8183cf21321db611c], Footer-Hash[7fafeba5d1d7b9cee5387feed4bf8338], Div-Span-Structure[22f6ac9e051e449400d5dc0b82c713a1]
|
||||||
|
http://www.engadget.com/ [200] probably BlogSmithMedia, Title[Engadget], RSSFeed[http://www.blogsmithmedia.com/www.engadget.com/media/favicon.ico], HTTPServer[Apache/2.2], PasswordField[login-pw,newkey], UncommonHeaders[keep-alive], Header-Hash[40cbd7dad1da86fa8db86b1f67e8c161], Footer-Hash[acc6ad1f37193dc0a722264bd04bbaa0], Div-Span-Structure[63dc0a8a6f4d6031419cedb4d77de546], MD5[82ca88e88d6d542efc8879e9907852fb]
|
||||||
|
http://digg.com [200] Cookies[1337,PHPSESSID,ccc], UncommonHeaders[keep-alive], Title[Digg - The Latest News Headlines, Videos and Images], HTTPServer[Apache], RSSFeed[/opensearch.xml], OpenSearch[/opensearch.xml], X-Powered-By[PHP/5.2.9-digg8], Header-Hash[2df7eaaa4480f28013aaf48ae9266b84], Footer-Hash[6e2c99013c0f12a0b9493ad54d2db2da], Div-Span-Structure[7f4e9099c1e7c62e31d9cf0fb89ab66b], MD5[b246c05975e7ab71270de3ea8fc44e84]
|
||||||
|
http://www.reddit.com/ [200] Cookies[reddit_first], RSSFeed[/static/reddit.css?v=b11e18eb53fe51d29cb4756ca6cf7584], PasswordField[passwd,passwd2], Google-Analytics[GA][12131688], HTTPServer['; DROP TABLE servertypes; --], JQuery, Title[reddit.com: what's new online!], MD5[c62ca3b43ee4c756d90d759aec3f1fce], Footer-Hash[9086bcb16723f874c9cebdb8497731bb], Div-Span-Structure[849596c76df42ee019847417bea59a41], Header-Hash[4fbc1dcf08d2a4be4f8b4de0617e9956]
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
HELP
|
||||||
|
WhatWeb - Next generation web scanner.
|
||||||
|
Version 0.4.5 by Andrew Horton aka urbanadventurer from Security-Assessment.com
|
||||||
|
Homepage: http://www.morningstarsecurity.com/research/whatweb
|
||||||
|
|
||||||
|
Usage: whatweb [options] <URLs>
|
||||||
|
|
||||||
|
<URLs> Enter URLs or filenames. Use /dev/stdin to pipe HTML
|
||||||
|
directly
|
||||||
|
--input-file=FILE, -i Identify URLs found in FILE, eg. -i /dev/stdin
|
||||||
|
--aggression, -a 1 passive - on-page
|
||||||
|
2 polite - unimplemented
|
||||||
|
3 impolite - guess URLs when plugin matches
|
||||||
|
(smart, guess a few urls)
|
||||||
|
4 aggressive - try guess URLs for every plugin
|
||||||
|
(guess a lot of urls like nikto)
|
||||||
|
--recursion, -r Follow links recursively. Only follows links under the
|
||||||
|
path (default: off)
|
||||||
|
--depth, -d Maximum recursion depth (default: 10)
|
||||||
|
--max-links, -m Maximum number of links to follow on one page
|
||||||
|
(default: 250)
|
||||||
|
--spider-skip-extensions Redefine extensions to skip.
|
||||||
|
(default: zip,gz,tar,jpg,exe,png,pdf)
|
||||||
|
--list-plugins, -l List the plugins
|
||||||
|
--run-plugins, -p Run comma delimited list of plugins. Default is all
|
||||||
|
--info-plugins, -I Display information plugins. Optionally specific a comma
|
||||||
|
delimited list.
|
||||||
|
--example-urls, -e Add example urls for each plugin to the target list
|
||||||
|
--colour=[WHEN],
|
||||||
|
--color=[WHEN] control whether colour is used. WHEN may be `never',
|
||||||
|
`always', or `auto'
|
||||||
|
--log-full=FILE Log verbose output
|
||||||
|
--log-brief=FILE Log brief, one-line output
|
||||||
|
--log-xml=FILE Log XML format
|
||||||
|
--user-agent, -U Identify as user-agent instead of WhatWeb/0.4.5.
|
||||||
|
--max-threads, -t Number of simultaneous threads. Default is 25.
|
||||||
|
--no-redirect Do not follow HTTP 3xx redirects.
|
||||||
|
--proxy <hostname[:port]> Set proxy hostname and port
|
||||||
|
(default: 8080)
|
||||||
|
--proxy-user <username:password> Set proxy user and password
|
||||||
|
--open-timeout Time in seconds
|
||||||
|
--read-timeout Time in seconds
|
||||||
|
--custom-plugin Define a custom plugin call Custom,
|
||||||
|
Examples: ":text=>'powered by abc'"
|
||||||
|
":regexp=>/powered[ ]?by ab[0-9]/"
|
||||||
|
":ghdb=>'intitle:abc \"powered by abc\"'"
|
||||||
|
":md5=>'8666257030b94d3bdb46e05945f60b42'"
|
||||||
|
"{:text=>'powered by abc'},{:regexp=>/abc [ ]?1/i}"
|
||||||
|
--url-prefix Add a prefix to target URLs
|
||||||
|
--url-suffix Add a suffix to target URLs
|
||||||
|
--url-pattern Insert the targets into a URL. Requires --input-file,
|
||||||
|
eg. www.example.com/%insert%/robots.txt
|
||||||
|
--help, -h This help
|
||||||
|
--verbose, -v Increase verbosity, use twice for debugging.
|
||||||
|
--version Display version information.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
VERBOSE OUTPUT
|
||||||
|
./whatweb -v www.morningstarsecurity.com
|
||||||
|
www.morningstarsecurity.com/ [200]
|
||||||
|
http://www.morningstarsecurity.com [200] WordPress[3.0.1], Google-API[ajax/libs/jquery/1.3.2/jquery.min.js ], Google-Analytics[GA][791888], HTTPServer[Apache], UncommonHeaders[x-pingback], JQuery[1.4.2], Title[MorningStar Security], MetaGenerator[WordPress 3.0.1], RSSFeed[http://www.morningstarsecurity.com/wp-content/themes/pyrmont-v2-white/style.css], MD5[2b47722f6e9ad3add669f5a4d2267642], Tag-Hash[bce4fdbac307d13d570d3a0d2d45b078], Header-Hash[dba021c0aa225c8eede02c7dcc45b0d8], Footer-Hash[bd8866bbab7e53b19e03131a041d451a]
|
||||||
|
Footer-Hash => hash
|
||||||
|
Google-API => google javascript API (version: ajax/libs/jquery/1.3.2/jquery.min.js )
|
||||||
|
Google-Analytics => pageTracker = ...UA-123-1231
|
||||||
|
HTTPServer => server string
|
||||||
|
Header-Hash => hash
|
||||||
|
JQuery => script (version: 1.4.2)
|
||||||
|
MD5 => md5 hash of html
|
||||||
|
MetaGenerator => meta generator tag
|
||||||
|
RSSFeed => rss link type, rss link
|
||||||
|
Tag-Hash => tag pattern hash
|
||||||
|
Title => page title
|
||||||
|
UncommonHeaders => headers
|
||||||
|
WordPress => wp-content (certainty: 75), meta generator tag (version: 3.0.1)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
LOG OUTPUT
|
||||||
|
|
||||||
|
There are currently 3 types of log output. They are:
|
||||||
|
--log-brief Brief logging. Default output
|
||||||
|
--log-full Full logging. Complete output from each plugin
|
||||||
|
--log-xml XML logging. Same information as default output but in XML format
|
||||||
|
|
||||||
|
You can output to multiple logs simulatenously by specifying muliple command line logging options.
|
||||||
|
|
||||||
|
Brief Logging.
|
||||||
|
|
||||||
|
Example usage: whatweb --brief-full b.log digg.com
|
||||||
|
|
||||||
|
http://digg.com [200] X-Powered-By[PHP/5.2.9-digg8], Cookies[1337,PHPSESSID,ccc], UncommonHeaders[keep-alive], Title[Digg - The Latest News Headlines, Videos and Images], HTTPServer[Apache], Mailto, Header-Hash[2df7eaaa4480f28013aaf48ae9266b84], MD5[24bc43e698e5d1388e836f5eee094fbe], Footer-Hash[ca2ffbc939969a2246cde196f0fc4841], Div-Span-Structure[828d809947c3c760d41c720c9203993b]
|
||||||
|
|
||||||
|
|
||||||
|
Full Logging (may be removed in future)
|
||||||
|
|
||||||
|
Example usage: whatweb --log-full f.log digg.com
|
||||||
|
Identifying: http://digg.com
|
||||||
|
HTTP-Status: 200
|
||||||
|
[["Cookies",
|
||||||
|
[{:certainty=>100,
|
||||||
|
:name=>"cookie names",
|
||||||
|
:string=>["1337", "PHPSESSID", "ccc"]}]],
|
||||||
|
["Footer-Hash",
|
||||||
|
[{:certainty=>100,
|
||||||
|
:name=>"hash",
|
||||||
|
:string=>"6e2c99013c0f12a0b9493ad54d2db2da"}]],
|
||||||
|
["HTTPServer",
|
||||||
|
[{:certainty=>100, :name=>"server string", :string=>"Apache"}]],
|
||||||
|
["Header-Hash",
|
||||||
|
[{:certainty=>100,
|
||||||
|
:name=>"hash",
|
||||||
|
:string=>"2df7eaaa4480f28013aaf48ae9266b84"}]],
|
||||||
|
["MD5",
|
||||||
|
[{:certainty=>100,
|
||||||
|
:name=>"md5 hash of html",
|
||||||
|
:string=>"77d9c9878dfc609c84ce2cad0eed1e61"}]],
|
||||||
|
["OpenSearch",
|
||||||
|
[{:certainty=>100,
|
||||||
|
:name=>"open search",
|
||||||
|
:regexp=>
|
||||||
|
/<link .*?type=["']application\/opensearchdescription\+xml['"].*?>/mi},
|
||||||
|
{:certainty=>100, :name=>"search link", :string=>"/opensearch.xml"}]],
|
||||||
|
["RSSFeed",
|
||||||
|
[{:certainty=>100,
|
||||||
|
:name=>"rss link type",
|
||||||
|
:regexp=>/<link .*?type=["']application\/rss\+xml["'].*?>/mi},
|
||||||
|
{:certainty=>100, :name=>"rss link", :string=>"/opensearch.xml"}]],
|
||||||
|
["Tag-Hash",
|
||||||
|
[{:certainty=>100,
|
||||||
|
:name=>"tag pattern hash",
|
||||||
|
:string=>"f0d06a3e709e6ea1c1942a4b749e4afe"}]],
|
||||||
|
["Title",
|
||||||
|
[{:certainty=>100,
|
||||||
|
:name=>"page title",
|
||||||
|
:string=>"Digg - The Latest News Headlines, Videos and Images"}]],
|
||||||
|
["UncommonHeaders",
|
||||||
|
[{:certainty=>100, :name=>"headers", :string=>"keep-alive"}]],
|
||||||
|
["X-Powered-By",
|
||||||
|
[{:certainty=>100,
|
||||||
|
:name=>"x-powered-by string",
|
||||||
|
:string=>"PHP/5.2.9-digg8"}]]]
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
XML Logging
|
||||||
|
|
||||||
|
The XML logging is currently naive and may change. Please contact me if you have suggestions.
|
||||||
|
|
||||||
|
Example usage: ./whatweb --log-full f.log --log-xml x.log digg.com
|
||||||
|
|
||||||
|
<target>
|
||||||
|
<uri>http://digg.com</uri>
|
||||||
|
<http-status>200</http-status>
|
||||||
|
<plugin>
|
||||||
|
<name>Cookies</name>
|
||||||
|
<string>1337</string>
|
||||||
|
<string>PHPSESSID</string>
|
||||||
|
<string>ccc</string>
|
||||||
|
</plugin>
|
||||||
|
<plugin>
|
||||||
|
<name>Footer-Hash</name>
|
||||||
|
<string>6e2c99013c0f12a0b9493ad54d2db2da</string>
|
||||||
|
</plugin>
|
||||||
|
<plugin>
|
||||||
|
<name>HTTPServer</name>
|
||||||
|
<string>Apache</string>
|
||||||
|
</plugin>
|
||||||
|
<plugin>
|
||||||
|
<name>Header-Hash</name>
|
||||||
|
<string>2df7eaaa4480f28013aaf48ae9266b84</string>
|
||||||
|
</plugin>
|
||||||
|
<plugin>
|
||||||
|
<name>MD5</name>
|
||||||
|
<string>2443327e1f1815f752af9901be54bc54</string>
|
||||||
|
</plugin>
|
||||||
|
<plugin>
|
||||||
|
<name>OpenSearch</name>
|
||||||
|
<string>/opensearch.xml</string>
|
||||||
|
</plugin>
|
||||||
|
<plugin>
|
||||||
|
<name>RSSFeed</name>
|
||||||
|
<string>/opensearch.xml</string>
|
||||||
|
</plugin>
|
||||||
|
<plugin>
|
||||||
|
<name>Tag-Hash</name>
|
||||||
|
<string>f0d06a3e709e6ea1c1942a4b749e4afe</string>
|
||||||
|
</plugin>
|
||||||
|
<plugin>
|
||||||
|
<name>Title</name>
|
||||||
|
<string>Digg - The Latest News Headlines, Videos and Images</string>
|
||||||
|
</plugin>
|
||||||
|
<plugin>
|
||||||
|
<name>UncommonHeaders</name>
|
||||||
|
<string>keep-alive</string>
|
||||||
|
</plugin>
|
||||||
|
<plugin>
|
||||||
|
<name>X-Powered-By</name>
|
||||||
|
<string>PHP/5.2.9-digg8</string>
|
||||||
|
</plugin>
|
||||||
|
</target>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
PLUGINS
|
||||||
|
|
||||||
|
Plugins are easy to make.
|
||||||
|
|
||||||
|
Matches are made with:
|
||||||
|
* Text strings (case sensitive)
|
||||||
|
* Regular expressions
|
||||||
|
* Google Hack Database queries (limited set of keywords)
|
||||||
|
* MD5 hashes
|
||||||
|
* URL recognition
|
||||||
|
* HTML tag patterns
|
||||||
|
* Custom ruby code for passive and aggressive operations
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
To list the plugins supported:
|
||||||
|
./whatweb -l
|
||||||
|
Plugins Loaded
|
||||||
|
------------------------------
|
||||||
|
360-Web-Manager,0.1
|
||||||
|
ANECMS,0.1
|
||||||
|
ASP-Nuke,0.2
|
||||||
|
AVTech-Video-Web-Server,0.1
|
||||||
|
AWStats,0.1
|
||||||
|
Aardvark-Topsites-PHP,0.1
|
||||||
|
Acclipse,0.2
|
||||||
|
AdobeFlash,0.1
|
||||||
|
Advanced-Guestbook,0.2
|
||||||
|
Alcatel-Lucent-Omniswitch,0.1
|
||||||
|
Allinta-CMS,0.1
|
||||||
|
Antiboard,0.1
|
||||||
|
Apache-Default,0.3
|
||||||
|
ArGoSoft-Mail-Server,0.1
|
||||||
|
Arab-Portal,0.1
|
||||||
|
AtomFeed,0.1
|
||||||
|
Axis-Network-Camera,0.1
|
||||||
|
BM-Classifieds,0.1
|
||||||
|
BXR,0.1
|
||||||
|
Barracuda-Spam-Firewall,0.1
|
||||||
|
Basilic,0.1
|
||||||
|
BeEF,0.1
|
||||||
|
Belkin-Modem,0.2
|
||||||
|
Bing-SearchEngine,0.1
|
||||||
|
Biromsoft-WebCam,0.1
|
||||||
|
BlogSmithMedia,0.2
|
||||||
|
Blogger,0.1
|
||||||
|
BlognPlus,0.1
|
||||||
|
BlueNet-Video-Server,0.1
|
||||||
|
Brother-Printer,0.1
|
||||||
|
Burning-Board-Lite,0.1
|
||||||
|
BusinessSpace,0.1
|
||||||
|
CGI Backdoor,0.1
|
||||||
|
CGIProxy,0.1
|
||||||
|
CMSQLite,0.1
|
||||||
|
CMScontrol,0.1
|
||||||
|
CMSimple,0.1
|
||||||
|
CPanel,0.2
|
||||||
|
Campsite,0.1
|
||||||
|
Canon-Network-Camera,0.1
|
||||||
|
Cisco-VPN-3000-Concentrator,0.1
|
||||||
|
Citrix-Metaframe,0.2
|
||||||
|
CodeIgniterProfiler,0.1
|
||||||
|
ColdFusion,0.1
|
||||||
|
Comersus,0.2
|
||||||
|
CommonSpot,0.1
|
||||||
|
Concrete5,0.2
|
||||||
|
Confluence,0.1
|
||||||
|
Cookies,0.1
|
||||||
|
Coppermine,0.2
|
||||||
|
CruxCMS,0.1
|
||||||
|
CruxPA,0.1
|
||||||
|
CushyCMS,0.2
|
||||||
|
D-Link-Network-Camera,0.1
|
||||||
|
DMXReady,0.1
|
||||||
|
DT-Centrepiece,0.1
|
||||||
|
DUclassified,0.1
|
||||||
|
DUforum,0.1
|
||||||
|
DUgallery,0.1
|
||||||
|
Dell-Printer,0.1
|
||||||
|
DiBos,0.2
|
||||||
|
DotCMS,0.2
|
||||||
|
DotNetNuke,0.3
|
||||||
|
Drupal,0.2
|
||||||
|
DublinCore,0.1
|
||||||
|
EMO-Realty-Manager,0.1
|
||||||
|
EarlyImpact-ProductCart,0.2
|
||||||
|
EazyCMS,0.1
|
||||||
|
Echo,0.2
|
||||||
|
Empire-CMS,0.1
|
||||||
|
Evo-Cam,0.1
|
||||||
|
ExpressionEngine,0.2
|
||||||
|
F3Site,0.1
|
||||||
|
FestOS,0.1
|
||||||
|
File-Upload-Manager,0.1
|
||||||
|
Flax-Article-Manager,0.1
|
||||||
|
FluentNET,0.1
|
||||||
|
FluxBB,0.3
|
||||||
|
FontFace,0.1
|
||||||
|
Footer-Hash,0.2
|
||||||
|
Forest-Blog,0.1
|
||||||
|
FormMail,0.2
|
||||||
|
FrogCMS,0.3
|
||||||
|
GoAhead-Webs,0.2
|
||||||
|
Google-API,0.1
|
||||||
|
Google-Analytics,0.2
|
||||||
|
Google-Hack-Honeypot,0.1
|
||||||
|
GuppY,0.1
|
||||||
|
HP-LaserJet-Printer,0.1
|
||||||
|
HTML5,0.2
|
||||||
|
HTTPServer,0.2
|
||||||
|
Header-Hash,0.1
|
||||||
|
IIS-SiteNotFound,0.2
|
||||||
|
IIS-UnderConstruction,0.2
|
||||||
|
IMGallery,0.1
|
||||||
|
IPCop-Firewall,0.1
|
||||||
|
IQeye-Netcam,0.1
|
||||||
|
ISPConfig,0.2
|
||||||
|
Index-Of,0.2
|
||||||
|
Intellinet-IP-Camera,0.1
|
||||||
|
Interspire-Shopping-Cart,0.1
|
||||||
|
InvisionPowerBoard,0.2
|
||||||
|
JAMM-CMS,0.1
|
||||||
|
JGS-Portal,0.1
|
||||||
|
JQuery,0.2
|
||||||
|
Jamroom,0.1
|
||||||
|
Jboss,0.1
|
||||||
|
Joomla,0.4
|
||||||
|
Kloxo Single Server,0.1
|
||||||
|
Liferay,0.1
|
||||||
|
Lightbox,0.2
|
||||||
|
Lime-Survey,0.1
|
||||||
|
Linksys-NAS,0.1
|
||||||
|
Linksys-Network-Camera,0.1
|
||||||
|
Linksys-USB-HDD,0.1
|
||||||
|
Linksys-Wireless-G-Camera,0.1
|
||||||
|
LocazoList-Classifieds,0.1
|
||||||
|
Loggix,0.1
|
||||||
|
Lucky-Tech-iGuard,0.1
|
||||||
|
MD5,0.2
|
||||||
|
MailSiteExpress,0.2
|
||||||
|
Mailman,0.1
|
||||||
|
Mailto,0.2
|
||||||
|
Mambo,0.2
|
||||||
|
MediaWiki,0.1
|
||||||
|
MetaGenerator,0.2
|
||||||
|
MetaPoweredBy,0.2
|
||||||
|
Microsoft-Sharepoint,0.1
|
||||||
|
MicrosoftODBCError,0.1
|
||||||
|
MikroTik,0.2
|
||||||
|
Minify,0.1
|
||||||
|
MnoGoSearch,0.2
|
||||||
|
Mobotix-Network-Camera,0.1
|
||||||
|
ModxCMS,0.2
|
||||||
|
Moodle,0.2
|
||||||
|
MovableType,0.2
|
||||||
|
My-PHP-Indexer,0.1
|
||||||
|
My-WebCamXP-Server,0.1
|
||||||
|
MyioSoft-Ajax-Portal,0.1
|
||||||
|
MysqlSyntaxError,0.1
|
||||||
|
NetBotz-Network-Monitoring-Device,0.1
|
||||||
|
Netious-CMS,0.1
|
||||||
|
Netsnap-Web-Camera,0.1
|
||||||
|
NovellGroupwise,0.2
|
||||||
|
Nukedit,0.1
|
||||||
|
ORCA-Platform,0.1
|
||||||
|
ORITE-301-Camera,0.1
|
||||||
|
OSCommerce,0.3
|
||||||
|
Oce,0.2
|
||||||
|
OkiPBX,0.2
|
||||||
|
Open-Blog,0.1
|
||||||
|
Open-Freeway,0.1
|
||||||
|
Open-Source-Ticket-Request-System,0.1
|
||||||
|
OpenCms,0.1
|
||||||
|
OpenGraphProtocol,0.1
|
||||||
|
OpenID,0.1
|
||||||
|
OpenSearch,0.1
|
||||||
|
PG-Roomate-Finder-Solution,0.1
|
||||||
|
PHP-Fusion,0.1
|
||||||
|
PHP-Layers,0.1
|
||||||
|
PHP-Link-Directory,0.1
|
||||||
|
PHP-Shell,0.1
|
||||||
|
PHPCake,0.2
|
||||||
|
PHPDirector,0.1
|
||||||
|
PHPEasyData,0.1
|
||||||
|
PHPError,0.2
|
||||||
|
PHPFM,0.1
|
||||||
|
PHPNuke,0.2
|
||||||
|
PHPraid,0.1
|
||||||
|
PageUp-People,0.1
|
||||||
|
Panasonic-Network-Camera,0.1
|
||||||
|
Parked-Domain,0.1
|
||||||
|
PasswordField,0.1
|
||||||
|
PhilBoard,0.1
|
||||||
|
Piwik,0.1
|
||||||
|
Pixel-Ads-Script,0.1
|
||||||
|
Pixie,0.1
|
||||||
|
Plesk,0.2
|
||||||
|
Pligg-CMS,0.1
|
||||||
|
Plone,0.2
|
||||||
|
PortalApp,0.1
|
||||||
|
PoweredBy,0.2
|
||||||
|
Pressflow,0.1
|
||||||
|
Prototype,0.2
|
||||||
|
QNAP-NAS,0.1
|
||||||
|
Quantcast,0.1
|
||||||
|
RSSFeed,0.1
|
||||||
|
RedirectLocation,0.2
|
||||||
|
RoundCube,0.2
|
||||||
|
RunCMS,0.1
|
||||||
|
SHOUTcast-Administrator,0.1
|
||||||
|
SMF,0.2
|
||||||
|
Saurus-CMS,0.1
|
||||||
|
Scriptaculous,0.2
|
||||||
|
SearchFitShoppingCart,0.2
|
||||||
|
SiemensSpeedStreamRouter,0.2
|
||||||
|
SilverStripe,0.2
|
||||||
|
SimpNews,0.1
|
||||||
|
Site-Sift,0.1
|
||||||
|
SkaLinks,0.1
|
||||||
|
SmodCMS,0.1
|
||||||
|
Snap-Appliance-Server,0.1
|
||||||
|
SnomPhone,0.2
|
||||||
|
Softbiz-Freelancers-Script,0.1
|
||||||
|
Softbiz-Online-Auctions-Script,0.1
|
||||||
|
Softbiz-Online-Classifieds,0.1
|
||||||
|
Sony-Network-Camera,0.1
|
||||||
|
Sony-Video-Network-Station,0.1
|
||||||
|
SquirrelMail,0.2
|
||||||
|
Star-Network,0.1
|
||||||
|
StarDot-NetCam,0.1
|
||||||
|
Stardot-Express,0.1
|
||||||
|
Subdreamer-CMS,0.1
|
||||||
|
Subrion-CMS,0.1
|
||||||
|
SyndeoCMS,0.1
|
||||||
|
TWiki,0.1
|
||||||
|
Tag-Hash,0.2
|
||||||
|
TaskFreak,0.1
|
||||||
|
Team-Board,0.1
|
||||||
|
Textpattern,0.1
|
||||||
|
The-PHP-Real-Estate-Script,0.1
|
||||||
|
Title,0.2
|
||||||
|
TomatoCMS,0.1
|
||||||
|
Tomcat,0.2
|
||||||
|
Toshiba-Network-Camera,0.1
|
||||||
|
ToshibaPrinter,0.2
|
||||||
|
Trac,0.1
|
||||||
|
Turbo-Seek,0.1
|
||||||
|
TypePad,0.2
|
||||||
|
TypoLight,0.2
|
||||||
|
Umbraco,0.1
|
||||||
|
UncommonHeaders,0.2
|
||||||
|
VBulletin,0.2
|
||||||
|
VP-ASP,0.2
|
||||||
|
VSNSLemon,0.2
|
||||||
|
Veo-Observer,0.1
|
||||||
|
VideoShareEnterprise,0.1
|
||||||
|
Virtualmin,0.1
|
||||||
|
VisionGS-Webcam,0.1
|
||||||
|
Vulnerable-To-XSS,0.1
|
||||||
|
WWWBoard,0.1
|
||||||
|
Web-Calendar-System,0.1
|
||||||
|
Web-Data-Administrator,0.1
|
||||||
|
WebDVR,0.1
|
||||||
|
WebEye-Network-Camera,0.1
|
||||||
|
WebGuard,0.2
|
||||||
|
WebPress,0.1
|
||||||
|
WhiteBoard,0.1
|
||||||
|
Winamp-Web-Interface,0.1
|
||||||
|
Windows-Internet-Printing,0.1
|
||||||
|
WindowsSBS,0.2
|
||||||
|
WoW-Raid-Manager,0.1
|
||||||
|
WordPress,0.2
|
||||||
|
WordPressSpamFree,0.2
|
||||||
|
WordpressSuperCache,0.3
|
||||||
|
X-ASPNetVersion,0.2
|
||||||
|
X-Powered-By,0.2
|
||||||
|
X7-Chat,0.1
|
||||||
|
XHP-CMS,0.1
|
||||||
|
Xerox-Printers,0.1
|
||||||
|
XtraBusinessHosting,0.2
|
||||||
|
Zen-Cart,0.1
|
||||||
|
Zeus-Cart,0.1
|
||||||
|
Zikula,0.1
|
||||||
|
Zoph,0.1
|
||||||
|
Zyxel-Vantage-Service-Gateway,0.1
|
||||||
|
anyInventory,0.1
|
||||||
|
boastMachine,0.1
|
||||||
|
coWiki,0.1
|
||||||
|
cpCommerce,0.1
|
||||||
|
eLitius,0.1
|
||||||
|
eSyndiCat,0.1
|
||||||
|
envezion~media,0.1
|
||||||
|
ezBOO-WebStats,0.1
|
||||||
|
i-Catcher-Console,0.1
|
||||||
|
iDVR,0.1
|
||||||
|
iRealty,0.1
|
||||||
|
iScripts-CyberMatch,0.1
|
||||||
|
iScripts-EasySnaps,0.1
|
||||||
|
iScripts-MultiCart,0.1
|
||||||
|
iScripts-ReserveLogic,0.1
|
||||||
|
iScripts-SocialWare,0.1
|
||||||
|
ispCP-Omega,0.2
|
||||||
|
jobberBase,0.1
|
||||||
|
mojoPortal,0.1
|
||||||
|
phPhotoAlbum,0.1
|
||||||
|
php-ping,0.1
|
||||||
|
phpBB,0.2
|
||||||
|
phpFreeChat,0.1
|
||||||
|
phpMyAdmin,0.1
|
||||||
|
phpPgAdmin,0.1
|
||||||
|
phpSysInfo,0.1
|
||||||
|
phpinfo,0.1
|
||||||
|
sabros.us,0.1
|
||||||
|
samPHPweb,0.1
|
||||||
|
syntaxCMS,0.1
|
||||||
|
uPortal,0.1
|
||||||
|
xGB,0.1
|
||||||
|
|
||||||
|
|
||||||
|
To view more detail about a plugin or plugins:
|
||||||
|
|
||||||
|
./whatweb -I Joomla
|
||||||
|
Plugin Information
|
||||||
|
------------------------------
|
||||||
|
Joomla version 0.4 by Andrew Horton
|
||||||
|
[14] examples, [3] matches, [x] aggressive, [x] passive.
|
||||||
|
Description: Opensource CMS written in PHP. Homepage: http://joomla.org. Plugin can aggresively identify version by comparing md5 hashes of 4 files. Valid up to version 1.5.15.
|
||||||
|
|
||||||
|
--------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
WRITING PLUGINS
|
||||||
|
|
||||||
|
To get started modify plugin-template.rb.txt in the my-plugins folder. Also read the (out of date) tutorial on writing WhatWeb plugins at www.morningstarsecurity.com/downloads/How-to-develop-WhatWeb-plugins-1.1.txt.
|
||||||
|
|
||||||
|
A typical plugin looks like this:
|
||||||
|
|
||||||
|
Plugin.define "Plone" do
|
||||||
|
author "Andrew Horton"
|
||||||
|
version "0.2"
|
||||||
|
description "CMS http://plone.org"
|
||||||
|
examples %w| www.norden.org www.trolltech.com www.plone.net www.smeal.psu.edu|
|
||||||
|
|
||||||
|
matches [
|
||||||
|
{:name=>"meta generator tag",
|
||||||
|
:regexp=>/<meta name="generator" content="[^>]*http:\/\/plone.org" \/>/},
|
||||||
|
|
||||||
|
{:name=>"plone css",
|
||||||
|
:regexp=>/(@import url|text\/css)[^>]*portal_css\/.*plone.*css(\)|")/}, #"
|
||||||
|
|
||||||
|
{:name=>"plone javascript",
|
||||||
|
:regexp=>/src="[^"]*ploneScripts[0-9]+.js"/}, #"
|
||||||
|
|
||||||
|
{:text=>'<div class="visualIcon contenttype-plone-site">'},
|
||||||
|
|
||||||
|
{:name=>"div tag, visual-portal-wrapper",
|
||||||
|
:certainty=>75,
|
||||||
|
:text=>'<div id="visual-portal-wrapper">'},
|
||||||
|
]
|
||||||
|
|
||||||
|
def passive
|
||||||
|
m=[]
|
||||||
|
#X-Caching-Rule-Id: plone-content-types
|
||||||
|
#X-Cache-Rule: plone-content-types
|
||||||
|
m << {:name=>"X-Caching-Rule-Id: plone-content-types" } if @meta["x-caching-rule-id"] =~ /plone-content-types/i
|
||||||
|
m << {:name=>"X-Cache-Rule: plone-content-types" } if @meta["x-cache-rule"] =~ /plone-content-types/i
|
||||||
|
m
|
||||||
|
end
|
||||||
|
|
||||||
|
|
||||||
|
end
|
||||||
|
|
||||||
|
There are 3 levels to a plugin. Simple matches, passive and agressive tests. You don’t need to know ruby to write plugins with simple matches. Passive and aggressive tests are written in ruby.
|
||||||
|
|
||||||
|
|
||||||
|
The matches [] array contains a set of ways to match a website to a system.
|
||||||
|
The methods are:
|
||||||
|
* :text Matches text within the webpage
|
||||||
|
* :regexp A regular expression. Append /i for case insensitive matches
|
||||||
|
* :ghdb Like a google query
|
||||||
|
* :md5 MD5 hash of the HTML page
|
||||||
|
* :tagpattern Pattern of HTML tags
|
||||||
|
* :name This is the name of the match, and is optional.
|
||||||
|
* :url The URL has to match this. Used for passive and agressive testing
|
||||||
|
* :certainty Optional, defaults to 100. Values are maybe (25), probably (75) and certain (100).
|
||||||
|
|
||||||
|
|
||||||
|
If you port a GHDB match, use :ghdb. I usually rewrite the GHDB matches with regular expressions, especially if they require inurl:
|
||||||
|
|
||||||
|
Example:
|
||||||
|
# http://johnny.ihackstuff.com/ghdb?function=detail&id=1840
|
||||||
|
{ :ghdb=>'"Powered by Vsns Lemon" intitle:"Vsns Lemon"' }
|
||||||
|
|
||||||
|
Note the GHDB queries are case insensitive, as a Google query is.
|
||||||
|
|
||||||
|
Supported codes are:
|
||||||
|
* intitle:
|
||||||
|
* inurl:
|
||||||
|
* filetype:
|
||||||
|
|
||||||
|
|
||||||
|
Each plugin can access @body, @meta, @status, @base_uri, @md5 and @tagpattern variables.
|
||||||
|
|
||||||
|
Passive tests add matches to the m array, each match is a hash containing the name of the match, probability and more.
|
||||||
|
The entire hash is returned with Full output, Brief output returns just the match, :version and :string
|
||||||
|
|
||||||
|
To discover the regular expressions to match against, wget about 20-30 examples into the tests/ folder. Be aware that some software can have dramatic variations between versions.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
AGGRESSIVE PLUGINS
|
||||||
|
|
||||||
|
There are currently aggressive plugins for Joomla, phpBB, FluxBB, OSCommerce and Tomcat.
|
||||||
|
With the passive plugin we know that ardentcreative.co.nz is running Joomla version 1.5
|
||||||
|
|
||||||
|
$ ./whatweb ardentcreative.co.nz
|
||||||
|
http://ardentcreative.co.nz [301] HTTPServer[Apache], RedirectLocation[http://www.ardentcreative.co.nz/], Title[301 Moved Permanently], Header-Hash[0670664f07b972398a96c6a58e812c2d], MD5[0670664f07b972398a96c6a58e812c2d]
|
||||||
|
http://www.ardentcreative.co.nz/ [200] Cookies[e964b8ff6be2b1058b145da14a39e90d], MetaGenerator[Joomla! 1.5 - Open Source Content Management], Joomla[1.5], Google-Analytics[GA][791888], HTTPServer[Apache], Title[Ardent Creative, Christchurch Web Design], Footer-Hash[a19d726fa577100ccaec0c61b1bf8ea7], MD5[fcb3ec0dfafae53dfdef2e991a24f1c1], Div-Span-Structure[e56dd07d6f482ee11873e4ea99a9e6a8], Header-Hash[4379923363b07114470ba24584214e3f]
|
||||||
|
|
||||||
|
With the aggressive plugin we know that ardentcreative.co.nz is running Joomla version 1.5.13 - 1.5.14
|
||||||
|
|
||||||
|
dc@dc-laptop:~/projects/whatweb/whatweb-0.4.4$ ./whatweb -a 3 ardentcreative.co.nz
|
||||||
|
http://ardentcreative.co.nz [301] HTTPServer[Apache], RedirectLocation[http://www.ardentcreative.co.nz/], Title[301 Moved Permanently], Header-Hash[0670664f07b972398a96c6a58e812c2d], MD5[0670664f07b972398a96c6a58e812c2d]
|
||||||
|
http://www.ardentcreative.co.nz/ [200] Cookies[e964b8ff6be2b1058b145da14a39e90d], MetaGenerator[Joomla! 1.5 - Open Source Content Management], Joomla[1.5,1.5.15], Google-Analytics[GA][791888], HTTPServer[Apache], Title[Ardent Creative, Christchurch Web Design], Footer-Hash[a19d726fa577100ccaec0c61b1bf8ea7], MD5[fcb3ec0dfafae53dfdef2e991a24f1c1], Div-Span-Structure[e56dd07d6f482ee11873e4ea99a9e6a8], Header-Hash[4379923363b07114470ba24584214e3f]
|
||||||
|
|
||||||
|
Do not use aggressive plugins with recursive site crawling. WhatWeb has no understanding of a website, instead it currently treats each URL separately.
|
||||||
|
It also has no caching so if you use aggressive plugins with recursion you will fetch the same files multiple times. The same is true for aggressive modes on redirecting URLs.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
RECURSIVE SPIDER
|
||||||
|
|
||||||
|
The recursion option is used to scan some or all of a website with whatweb. Recursive spidering will follow each link on a webpage if it is within the same website, then repeat the process on the followed pages.
|
||||||
|
|
||||||
|
The configurable settings for recursive spidering are:
|
||||||
|
--recursion, -r Follow links recursively. Only follows links under the path (default: off)
|
||||||
|
--depth, -d Maximum recursion depth (default: 3)
|
||||||
|
--max-links, -m Maximum number of links to follow on one page (default: 25)
|
||||||
|
|
||||||
|
The spider skips this hardcoded list of file extensions:
|
||||||
|
/\.zip$/,/\.gz$/,/\.tar$/,/\.jpg$/,/\.exe$/,/\.png$/,/\.pdf$/
|
||||||
|
|
||||||
|
Limitations of the spidering. This follows links in <a> tags, these are the HTML tags designed specifically for links. The spider does not obtain urls from other sources. Some good choices for future improvement are image tags, eg. <img src="/images/boats.jpg">, form tags, eg. <form action="/vote.php">, url paths in CSS files, etc.
|
||||||
|
|
||||||
|
The spider is provided by Anemone, a third party ruby gem. It doesn't follow redirects. For example the URL treshna.com will fail and www.treshna.com will produce results.
|
||||||
|
|
||||||
|
|
||||||
|
KNOWN ISSUES OR BUGS
|
||||||
|
|
||||||
|
* The web spider, Anemone doesn't following 302 redirects
|
||||||
|
* Don't use aggressive modes with website spidering as it will repeat the tests and URL requests.
|
||||||
|
* :text matches are case sensitive
|
||||||
|
* :regexp matches are case sensitive, you can make then case insensitive by appending i, eg. /foobar/i
|
||||||
|
* The MD5 hashing algorithm is used not for it's security but for it's speed as a hashing algorithm especially compared to SHA1
|
||||||
|
* Timeout settings do not apply to the Anemone spider
|
||||||
|
* Meta refresh redirects do not apply to the Anemone spider
|
||||||
|
|
||||||
|
RELATED PROJECTS
|
||||||
|
|
||||||
|
WhatWeb is unique however there are some web projects with the same goal of identifying a website.
|
||||||
|
|
||||||
|
Blind Elephant
|
||||||
|
The BlindElephant Web Application Fingerprinter attempts to discover the version of a (known) web application by comparing static files at known locations against precomputed hashes for versions of those files in all all available releases. The technique is fast, low-bandwidth, non-invasive, generic, and highly automatable.
|
||||||
|
http://blindelephant.sourceforge.net/
|
||||||
|
|
||||||
|
WAFP - Web Application Finger Printing
|
||||||
|
Wafp identifies systems by requesting a large quantity of URLs and comparing md5 sums of the results against a database. This method is reliable for known systems in the database and it is simple to add new ones. Unlike whatweb, this method is intrusive and will create a lot of webserver log entries.
|
||||||
|
http://www.mytty.org/wafp
|
||||||
|
|
||||||
|
Wappalyzer
|
||||||
|
This is the most similar project to WhatWeb.
|
||||||
|
Firefox plugin identifies sites using 1 regexp each. Only looks for obvious identifiers like meta generator tags. Sends all recognized urls to a DB. Has nice icons
|
||||||
|
https://addons.mozilla.org/en-US/firefox/addon/10229
|
||||||
|
|
||||||
|
w3af
|
||||||
|
http://w3af.sourceforge.net
|
||||||
|
Very slight overlap of features in the grep and discovery scripts section.
|
||||||
|
|
||||||
|
HTTPRecon
|
||||||
|
No feature overlap, fingerprints the HTTP Server
|
||||||
|
http://w3dt.net/tools/httprecon/
|
||||||
|
http://www.net-square.com/httprint/httprint_paper.html
|
||||||
|
http://www.darknet.org.uk/2007/09/httprint-v301-web-server-fingerprinting-tool-download/
|
||||||
|
|
||||||
|
Nmap version scan
|
||||||
|
Nmap shows some info about HTTP servers when using version scan, eg. nmap -sV -p80 treshna.com
|
||||||
|
|
||||||
|
THC's Amap
|
||||||
|
This tool is an application fingerprint scanner which can identify an HTTP protocol server. It doesn't identify types of HTTP servers.
|
||||||
|
|
||||||
|
What's that web server running 1.0 (whatweb.exe)
|
||||||
|
This shares the same name and goal but is shit. It ONLY uses the HTTP Server string. For example 'Apache/2.0.55 (Ubuntu) PHP/5.1.2'
|
||||||
|
http://www.spambutcher.com/whatweb.html
|
||||||
|
|
||||||
|
http-stats.com
|
||||||
|
Lots of info about HTTP server names
|
||||||
|
|
||||||
|
Builtwith.com
|
||||||
|
Stats of popularity of web stuff.
|
||||||
|
|
||||||
|
FUNNY & UNUSUAL
|
||||||
|
Slashdot.org
|
||||||
|
X-Fry: You mean Bender is the evil Bender? I'm shocked! Shocked! Well not that shocked.
|
||||||
|
|
||||||
|
popurls.com
|
||||||
|
X-popurls-a: in the future every url will be popular for 1.5 seconds
|
||||||
|
|
||||||
|
reddit.com
|
||||||
|
HTTPServer:'; DROP TABLE servertypes; --
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
NOTES
|
||||||
|
|
||||||
|
Version 0.3 Released at Kiwicon III (kiwicon.org), 2009.
|
||||||
|
Version 0.4 Released March 14th, 2010
|
||||||
|
Version 0.4.1 Released April 28th, 2010
|
||||||
|
Version 0.4.2 Released April 30th, 2010
|
||||||
|
Version 0.4.3 Released May 24th, 2010
|
||||||
|
Version 0.4.4 Released June 29th, 2010
|
||||||
|
Version 0.4.5 Released August 17th, 2010
|
||||||
|
|
||||||
|
|
||||||
|
CREDITS
|
||||||
|
|
||||||
|
Written by urbanadventurer aka Andrew Horton from Security-Assessment.com
|
||||||
|
Homepage: http://www.morningstarsecurity.com
|
||||||
|
License: GPLv2
|
||||||
|
|
||||||
|
Anemone library (used for spidering) is written by Chris Kite
|
||||||
|
Homepage: http://anemone.rubyforge.org/
|
||||||
|
License: MIT
|
||||||
|
|
||||||
|
|
||||||
|
COMMUNITY PLUGINS
|
||||||
|
|
||||||
|
Thank you to the following people who have contributed plugins to WhatWeb.
|
||||||
|
|
||||||
|
Brendan Coles (Major contributor!)
|
||||||
|
Emilio Casbas
|
||||||
|
Louis Nyffenegger
|
||||||
|
Patrik Wallström
|
||||||
|
Caleb Anderson
|
||||||
|
Tonmoy Saikia
|
||||||
|
Michal Ambroz for writing the Makefile and Man pages, not plugins.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@@ -0,0 +1,778 @@
|
|||||||
|
TO-DO
|
||||||
|
|
||||||
|
Good luck understanding these notes for myself :) Some of this stuff has already been done.
|
||||||
|
|
||||||
|
put whatweb on github
|
||||||
|
|
||||||
|
[x] JSON output plugin
|
||||||
|
|
||||||
|
precompile regular expressions for matching speed
|
||||||
|
|
||||||
|
escape output in logs. \[ for brief logs. <> for xml logs. <---?
|
||||||
|
|
||||||
|
[x] add XML log initialisation and termination:
|
||||||
|
|
||||||
|
Add CVE array and version matching:
|
||||||
|
|
||||||
|
Here's some CVE arrays.
|
||||||
|
|
||||||
|
Also, scrap this line from the TODO file:s
|
||||||
|
["6.0+", "CVE-1115, "XSS in asdf.php"], # All know versions from 6 to date
|
||||||
|
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
AWStats
|
||||||
|
|
||||||
|
CVEs [
|
||||||
|
|
||||||
|
# AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to aswtats.pl.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0116
|
||||||
|
["6.1", "CVE-2005-0116", "Remote Code Execution in aswtats.pl"],
|
||||||
|
|
||||||
|
# awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to read server web logs by setting the loadplugin and pluginmode parameters to rawlog.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0435
|
||||||
|
["6.3-6.4", "CVE-2005-0435", "Information Disclosure vulnerability in the loadplugin and pluginmode parameters of awstats.pl."],
|
||||||
|
|
||||||
|
# Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to execute arbitrary Perl code via the HTTP Referrer, which is used in a $url parameter that is inserted into an eval function call.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0436
|
||||||
|
["6.3-6.4", "CVE-2005-0436", "Remote Code Execution vulnerability in the PluginMode parameter of awstats.pl" ],
|
||||||
|
|
||||||
|
# awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to obtain sensitive information by setting the debug parameter.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0438
|
||||||
|
["6.3-6.4", "CVE-2005-0438", "Information disclosure vulnerability in the debug parameter of awstats.pl."],
|
||||||
|
|
||||||
|
# The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1527
|
||||||
|
["6.4-", "CVE-2005-1527", "Remote Code Execution vulnerability in awstats.pl" ],
|
||||||
|
|
||||||
|
# Direct code injection vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to execute portions of Perl code via the PluginMode parameter
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2237
|
||||||
|
["6.4-6.5", "CVE-2006-2237", "Remote Code Execution vulnerability in the migrate parameter of awstats.pl."],
|
||||||
|
|
||||||
|
# awstats.pl in AWStats 6.5 build 1.857 and earlier allows remote attackers to obtain the installation path via the (1) year, (2) pluginmode or (3) month parameters.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3682
|
||||||
|
["6.5-", "CVE-2006-3682", "Information Disclosure vulnerability in the year, pluginmode and month parameters of awstats.pl."],
|
||||||
|
|
||||||
|
# Multiple cross-site scripting (XSS) vulnerabilities in awstats.pl in AWStats 6.5 build 1.857 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) refererpagesfilter, (2) refererpagesfilterex, (3) urlfilterex, (4) urlfilter, (5) hostfilter, or (6) hostfilterex parameters, a different set of vectors than CVE-2006-1945.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3681
|
||||||
|
["6.5-", "CVE-2006-3681", "Cross Site Scripting vulnerability in the refererpagesfilter, refererpagesfilterex, urlfilterex, urlfilter, hostfilter, or hostfilterex parameters of awstats.pl." ],
|
||||||
|
|
||||||
|
# Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web script or HTML via the query_string, a different vulnerability than CVE-2006-3681 and CVE-2006-1945.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3714
|
||||||
|
["6.8", "CVE-2008-3714", "Cross Site Scripting vulnerability in awstats.pl" ],
|
||||||
|
|
||||||
|
# awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the query_string parameter. NOTE: this issue exists because of an incomplete fix for CVE-2008-3714.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5080
|
||||||
|
["6.8-", "CVE-2008-5080", "Cross Site Scripting vulnerability in the query_string parameter of awstats.pl." ],
|
||||||
|
|
||||||
|
],
|
||||||
|
|
||||||
|
|
||||||
|
cmsimple
|
||||||
|
|
||||||
|
CVEs [
|
||||||
|
# Multiple PHP remote file inclusion vulnerabilities in cmsimple/cms.php in CMSimple 2.7 allow remote attackers to execute arbitrary PHP code via a URL in the (1) pth[file][config] and (2) pth[file][image] parameters.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0551
|
||||||
|
["2.7", "CVE-2007-0551", "Remote File Include vulnerability in cms.php"],
|
||||||
|
# Cross-site scripting (XSS) vulnerability in the mailform feature in CMSimple 2.7 fix1 allows remote attackers to inject arbitrary web script or HTML via the sender parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0610
|
||||||
|
["2.7 fix1", "CVE-2007-0610", "Cross Site Scripting vulnerability in cms.php"],
|
||||||
|
# Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including adm.php and then invoking the upload action. NOTE: on 20080601, the vendor patched 3.1 without changing the version number.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2650
|
||||||
|
["3.1", "CVE-2008-2650", "Directory traversal vulnerability in cmsimple/cms.php"],
|
||||||
|
]
|
||||||
|
|
||||||
|
|
||||||
|
DUforum
|
||||||
|
|
||||||
|
CVEs [
|
||||||
|
# Multiple SQL injection vulnerabilities in DUware DUforum 3.1, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via the (1) iMsg parameter to messages.asp, iFor parameter to (2) post.asp or (3) forums.asp, or (4) id parameter to userEdit.asp. NOTE: vectors 1 and 3 were later reported to affect version 3.0.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2048
|
||||||
|
["3.1", "CVE-2005-2048", "SQL Injection vulnerability in iMsg parameter of messages.asp, iFor parameter of post.asp, iFor parameter of forums.asp and id parameter of userEdit.asp"],
|
||||||
|
|
||||||
|
# SQL injection vulnerability in DUware DUforum 3.0 through 3.1 allows remote attackers to execute arbitrary SQL commands via the FOR_ID parameter in messages.asp, (2) MSG_ID parameter in messageDetail.asp, or (3) password parameter in the login form.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2201
|
||||||
|
["3.0-3.1", "CVE-2004-2201", "SQL Injection vulnerability in the FOR_ID parameter of messages.asp, MSG_ID parameter of messageDetail.asp and password parameter in the login form"],
|
||||||
|
|
||||||
|
# Cross-site scripting (XSS) vulnerability in DUware DUforum 3.0 through 3.1 allows remote attackers to inject arbitrary web script or HTML via via the message text.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2200
|
||||||
|
["3.0-3.1", "CVE-2004-2200", "Cross Site Scripting vulnerability via the message text."],
|
||||||
|
|
||||||
|
],
|
||||||
|
|
||||||
|
|
||||||
|
DUGallery
|
||||||
|
|
||||||
|
CVEs [
|
||||||
|
|
||||||
|
# SQL injection vulnerability in admin_default.asp in DUGallery 2.x allows remote attackers to execute arbitrary SQL commands via the (1) Login or (2) password field.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2302
|
||||||
|
["2.x", "CVE-2006-2302", "SQL Injection vulnerability in the login or password fields." ],
|
||||||
|
|
||||||
|
],
|
||||||
|
|
||||||
|
|
||||||
|
Ezboo webstats
|
||||||
|
|
||||||
|
CVEs [
|
||||||
|
|
||||||
|
# Ezboo webstats, possibly 3.0.3, allows remote attackers to bypass authentication and gain access via a direct request to (1) update.php and (2) config.php.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1043
|
||||||
|
["3.0.3", "CVE-2007-1043", "Authentication bypass vulnerability in update.php and config.php." ],
|
||||||
|
|
||||||
|
],
|
||||||
|
|
||||||
|
|
||||||
|
LimeSurvey
|
||||||
|
|
||||||
|
CVEs [
|
||||||
|
|
||||||
|
# PHP remote file inclusion vulnerability in classes/core/language.php in LimeSurvey 1.5.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the rootdir parameter.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5573
|
||||||
|
["1.5.2-", "CVE-2007-5573", "Remote File Inclusion vulnerability in classes/core/language.php." ],
|
||||||
|
|
||||||
|
#Cross-site request forgery (CSRF) vulnerability in LimeSurvey (formerly PHPSurveyor) before 1.71 allows remote attackers to change arbitrary quotas as administrators via a "modify quota" action.
|
||||||
|
#http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2571
|
||||||
|
["1.7-", "CVE-2008-2571", "Cross Site Request Forgery vulnerability in classes/core/language.php." ],
|
||||||
|
|
||||||
|
# Multiple PHP remote file inclusion vulnerabilities in LimeSurvey (aka PHPSurveyor) 1.49RC2 allow remote attackers to execute arbitrary PHP code via a URL in the homedir parameter to (1) OLE/PPS/File.php, (2) OLE/PPS/Root.php, (3) Spreadsheet/Excel/Writer.php, or (4) OLE/PPS.php in admin/classes/pear/; or (5) Worksheet.php, (6) Parser.php, (7) Workbook.php, (8) Format.php, or (9) BIFFwriter.php in admin/classes/pear/Spreadsheet/Excel/Writer/.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3632
|
||||||
|
["1.49RC2", "CVE-2007-3632", "Remote File Inclusion vulnerability in homedir parameter to OLE/PPS/File.php, OLE/PPS/Root.php, Spreadsheet/Excel/Writer.php, or OLE/PPS.php in admin/classes/pear/; or Worksheet.php, Parser.php, Workbook.php, Format.php, or BIFFwriter.php in admin/classes/pear/Spreadsheet/Excel/Writer/" ],
|
||||||
|
|
||||||
|
# Cross-site request forgery (CSRF) vulnerability in LimeSurvey (formerly PHPSurveyor) before 1.71 allows remote attackers to change arbitrary quotas as administrators via a "modify quota" action.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2571
|
||||||
|
["1.7-", "CVE-2008-2571", "Cross Site Request Forgery vulnerability via a modify quota action." ],
|
||||||
|
|
||||||
|
# Unspecified vulnerability in LimeSurvey before 1.82 allows remote attackers to execute commands and obtain sensitive data via unknown attack vectors related to /admin/remotecontrol/.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1604
|
||||||
|
["1.81-", "CVE-2008-2571", "Remote Command Execution vulnerability in /admin/remotecontrol/." ],
|
||||||
|
|
||||||
|
],
|
||||||
|
|
||||||
|
|
||||||
|
SharePoint
|
||||||
|
|
||||||
|
CVEs [
|
||||||
|
|
||||||
|
# Cross-site scripting (XSS) vulnerability in Microsoft Windows SharePoint Services 2.0 allows remote attackers to inject arbitrary web script or HTML via the Picture Source (aka picture object source) field in the Rich Text Editor.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1888
|
||||||
|
["2.0", "CVE-2008-1888", "Cross Site Scripting vulnerability via the Picture Source (aka picture object source) field in the Rich Text Editor." ],
|
||||||
|
|
||||||
|
# Multiple cross-site scripting (XSS) vulnerabilities in Microsoft Windows SharePoint Services 3.0 for Windows Server 2003 and Office SharePoint Server 2007 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO (query string) in "every main page," as demonstrated by default.aspx.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2581
|
||||||
|
["3.0", "CVE-2007-2581", "Cross Site Scripting vulnerability in the PATH_INFO (query string) in 'every main page,' as demonstrated by default.aspx." ],
|
||||||
|
|
||||||
|
# The download functionality in Team Services in Microsoft Office SharePoint Server 2007 12.0.0.4518 and 12.0.0.6219 allows remote attackers to read ASP.NET source code via pathnames in the SourceUrl and Source parameters to _layouts/download.aspx.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3830
|
||||||
|
["12.0.0.4518-12.0.0.6219", "CVE-2009-3830", "Information Disclosure vulnerability in /admin/remotecontrol/." ],
|
||||||
|
|
||||||
|
],
|
||||||
|
|
||||||
|
|
||||||
|
OTRS
|
||||||
|
|
||||||
|
CVEs [
|
||||||
|
|
||||||
|
# Multiple SQL injection vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) user parameter in the Login action, and remote authenticated users via the (2) TicketID and (3) ArticleID parameters of the AgentTicketPlain action.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3893
|
||||||
|
["1.0.0-1.3.2, 2.0.0", "CVE-2005-3893", "Remote Command execution vulnerability in the user parameter in the Login action, and remote authenticated users via the TicketID and ArticleID parameters of the AgentTicketPlain action." ],
|
||||||
|
|
||||||
|
# Multiple cross-site scripting (XSS) vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) hex-encoded values in the QueueID parameter and (2) Action parameters.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3894
|
||||||
|
["1.0.0-1.3.2, 2.0.0-2.0.3", "CVE-2005-3894", "Cross Site Scripting vulnerability via hex-encoded values in the QueueID parameter and Action parameters of index.pl." ],
|
||||||
|
|
||||||
|
# Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, when AttachmentDownloadType is set to inline, renders text/html e-mail attachments as HTML in the browser when the queue moderator attempts to download the attachment, which allows remote attackers to execute arbitrary web script or HTML. NOTE: this particular issue is referred to as XSS by some sources.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3895
|
||||||
|
["1.0.0-1.3.2, 2.0.0-2.0.3", "CVE-2005-3895", "Cross Site Scripting vulnerability when AttachmentDownloadType is set to inline, OTRS renders text/html e-mail attachments as HTML in the browser when the queue moderator attempts to download the attachment, which allows remote attackers to execute arbitrary web script or HTML." ],
|
||||||
|
|
||||||
|
# Cross-site scripting (XSS) vulnerability in index.pl in Open Ticket Request System (OTRS) 2.0.x allows remote attackers to inject arbitrary web script or HTML via the Subaction parameter in an AgentTicketMailbox Action. NOTE: DEBIAN:DSA-1299 originally used this identifier for an ipsec-tools issue, but the proper identifier for the ipsec-tools issue is CVE-2007-1841.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2524
|
||||||
|
["2.0.x", "CVE-2007-2524", "Cross Site Scripting vulnerability via the Subaction parameter in an AgentTicketMailbox Action of index.pl." ],
|
||||||
|
|
||||||
|
# The SOAP interface in OTRS 2.1.x before 2.1.8 and 2.2.x before 2.2.6 allows remote attackers to 'read and modify objects' via SOAP requests, related to 'Missing security checks.'"
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1515
|
||||||
|
["2.1.0-2.1.7, 2.2.0-2.2.5", "CVE-2008-1515", "Missing security checks in the SOAP interface." ],
|
||||||
|
|
||||||
|
# Multiple SQL injection vulnerabilities in Kernel/System/Ticket.pm in OTRS-Core in Open Ticket Request System (OTRS) 2.1.x before 2.1.9, 2.2.x before 2.2.9, 2.3.x before 2.3.5, and 2.4.x before 2.4.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0438
|
||||||
|
["2.1.0-2.1.8, 2.2.0-2.2.8, 2.3.0-2.3.4, 2.4.0-2.4.6", "CVE-2010-0438", "SQL Injection vulnerability in Kernel/System/Ticket.pm in OTRS-Core." ],
|
||||||
|
|
||||||
|
],
|
||||||
|
|
||||||
|
|
||||||
|
PHP-Fusion
|
||||||
|
|
||||||
|
CVEs [
|
||||||
|
# SQL injection vulnerability in messages.php in PHP-Fusion 6.01.15 and 7.00.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the subject and msg_send parameters, a different vector than CVE-2005-3157, CVE-2005-3158, CVE-2005-3159, CVE-2005-4005, and CVE-2006-2459.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5335
|
||||||
|
["6.01.15, 7.00.1", "CVE-2008-5335", "SQL Injection vulnerability in messages.php." ],
|
||||||
|
|
||||||
|
# Cross-site scripting (XSS) vulnerability in PHP-Fusion before 6.00.304 allows remote attackers to inject arbitrary web script or HTML via the (1) shout_name field in shoutbox_panel.php and the (2) comments field in comments_include.php.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0593
|
||||||
|
["6.00.303-", "CVE-2006-0593", "SQL Injection vulnerability in the shout_name field in shoutbox_panel.php and the comments field in comments_include.php." ],
|
||||||
|
|
||||||
|
# PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, as demonstrated by uploading then executing an avatar file that ends in ".php.gif" and contains PHP code in EXIF metadata.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2330
|
||||||
|
["6.00.306-", "CVE-2006-2330", "Remote File Upload vulnerability resulting in Remote Code Execution." ],
|
||||||
|
|
||||||
|
# Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via (1) a .. (dot dot) in the settings[locale] parameter in infusions/last_seen_users_panel/last_seen_users_panel.php, and (2) a .. (dot dot) in the localeset parameter in setup.php.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2331
|
||||||
|
["6.00.306", "CVE-2006-2331", "Local file inclusion in the localeset parameter in setup.php." ],
|
||||||
|
|
||||||
|
# SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magic_quotes_gpc is disabled and the database table prefix is known, allows remote authenticated users to execute arbitrary SQL commands via the submit_info[] parameter in a link submission action. NOTE: it was later reported that 7.00.2 is also affected.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1918
|
||||||
|
["6.01.14, 6.00.307, 7.00.2", "CVE-2008-1918", "SQL Injection vulnerability in the shout_name field in the submit_info[] parameter in a link submission action." ],
|
||||||
|
|
||||||
|
# Cross-site scripting (XSS) vulnerability in fusion_core.php for PHP-Fusion 5.x allows remote attackers to inject arbitrary web script or HTML via a message with IMG bbcode containing character-encoded Javascript.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0692
|
||||||
|
["5.x", "CVE-2005-0692", "Cross Site Scripting vulnerability via a message with IMG bbcode containing character-encoded Javascript in fusion_core.php." ],
|
||||||
|
|
||||||
|
# SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to execute arbitrary SQL commands via the msg_send parameter, a different vulnerability than CVE-2005-3158 and CVE-2005-3159.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3157
|
||||||
|
["6.00.109", "CVE-2005-3157", "SQL Injection vulnerability in the msg_send parameter." ],
|
||||||
|
|
||||||
|
# Multiple SQL injection vulnerabilities in PHP-Fusion before 6.00.110 allow remote attackers to execute arbitrary SQL commands via (1) the activate parameter in register.php and (2) the cat_id parameter in faq.php.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3161
|
||||||
|
["6.00.110", "CVE-2005-3161", "SQL Injection vulnerability in the activate parameter in register.php and the cat_id parameter in faq.php." ],
|
||||||
|
|
||||||
|
|
||||||
|
# Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote attackers to conduct SQL injection attacks via the _SERVER[REMOTE_ADDR] parameter to news.php.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4673
|
||||||
|
["6.01.4", "CVE-2006-4673", "SQL Injection vulnerability in the activate parameter in thr _SERVER[REMOTE_ADDR] parameter of news.php." ],
|
||||||
|
|
||||||
|
# Cross-site scripting (XSS) vulnerability in messages.php in PHP-Fusion 6.01.17 and 7.00.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6850
|
||||||
|
["6.01.17,7.00.3", "CVE-2008-6850", "Cross Site Scripting vulnerability." ],
|
||||||
|
|
||||||
|
# Multiple cross-site scripting (XSS) vulnerabilities in submit.php in PHP-Fusion before 6.01.3 allow remote attackers to inject arbitrary web script or HTML by using edit_profile.php to upload a (1) avatar or (2) forum image attachment that has a .gif or .jpg extension, and begins with a GIF header followed by JavaScript code, which is executed by Internet Explorer.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3555
|
||||||
|
["6.01.2-", "CVE-2008-6850", "Cross Site Scripting vulnerability in submit.php by using edit_profile.php to upload a avatar or forum image attachment that has a .gif or .jpg extension, and begins with a GIF header followed by JavaScript code, which is executed by Internet Explorer." ],
|
||||||
|
|
||||||
|
# Cross-site scripting (XSS) vulnerability in PHP-Fusion 6.00.107 and earlier allows remote attackers to inject arbitrary web script or HTML via nested, malformed URL BBCode tags.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2783
|
||||||
|
["6.00.107-", "CVE-2005-2783", "Cross Site Scripting vulnerability via nested, malformed URL BBCode tags." ],
|
||||||
|
|
||||||
|
# The ReadMe First.txt file in PHP-Fusion 4.0 instructs users to set the permissions on the fusion_admin/db_backups directory to world read/write/execute (777), which allows remote attackers to download or view database backups, which have easily guessable filenames and contain the administrator username and password.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1724
|
||||||
|
["4.0", "CVE-2004-1724", "Information Disclosure vulnerability in fusion_admin/db_backups/." ],
|
||||||
|
|
||||||
|
# The (1) updateuser.php and (2) forums_prune.php scripts in PHP-Fusion 4.00 allow remote attackers to obtain sensitive information via a direct HTTP request, which reveals the installation path in an error message.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1723
|
||||||
|
["4.0", "CVE-2004-1723", "Information Disclosure vulnerability in updateuser.php and forums_prune.php." ],
|
||||||
|
|
||||||
|
# SQL injection vulnerability in readmore.php in PHP-Fusion 4.01 allows remote attackers to execute arbitrary SQL commands via the news_id parameter.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5946
|
||||||
|
["4.01", "CVE-2008-5946", "SQL Injection vulnerability via the news_id parameter." ],
|
||||||
|
|
||||||
|
# Cross-site scripting (XSS) vulnerability in infusions/shoutbox_panel/shoutbox_panel.php in PHP-Fusion 6.01.10 and 6.01.9, when guest posts are enabled, allows remote authenticated users to inject arbitrary web script or HTML via the URI, related to the FUSION_QUERY constant.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3559
|
||||||
|
["6.01.9-6.01.10", "CVE-2007-3559, "Cross Site Scripting vulnerability in infusions/shoutbox_panel/shoutbox_panel.php via the URI, related to the FUSION_QUERY constant." ],
|
||||||
|
|
||||||
|
# SQL injection vulnerability in PHP-Fusion 4.01 allows remote attackers to execute arbitrary SQL commands via the rowstart parameter to (1) index.php or (2) members.php, or (3) the comment_id parameter to comments.php.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2437
|
||||||
|
["4.01", "CVE-2004-2437", "SQL Injection vulnerability via the rowstart parameter of index.php or members.php, or comment_id parameter of comments.php." ],
|
||||||
|
|
||||||
|
# SQL injection vulnerability in messages.php in PHP-Fusion 6.00.307 and earlier allows remote authenticated users to execute arbitrary SQL commands via the srch_where parameter.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2459
|
||||||
|
["6.00.307-", "CVE-2006-2459", "SQL Injection vulnerability via the srch_where parameter of messages.php." ],
|
||||||
|
|
||||||
|
# Cross-site scripting (XSS) vulnerability in PHP-Fusion 4.01 allows remote attackers to inject arbitrary web script or HTML via the (1) Submit News, (2) Submit Link or (3) Submit Article field.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2438
|
||||||
|
["4.01", "CVE-2004-2438", "Cross Site Scripting vulnerability via the Submit News, Submit Link or Submit Article field." ],
|
||||||
|
|
||||||
|
# viewthread.php in php-fusion 4.x does not check the (1) forum_id or (2) forum_cat parameters, which allows remote attackers to view protected forums via the thread_id parameter.
|
||||||
|
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0345
|
||||||
|
["4.x", "CVE-2005-0345", "Information Disclosure vulnerability in forum_id or forum_cat parameters of viewthread.php." ],
|
||||||
|
|
||||||
|
],
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
*********************************************************************************
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# 6.00.307 and below
|
||||||
|
["6.00.307-", "CVE-2006-2459", "SQL Injection vulnerability via the srch_where parameter of messages.php." ],
|
||||||
|
|
||||||
|
# Version 4 point anything
|
||||||
|
["4.x", "CVE-2005-0345", "Information Disclosure vulnerability in forum_id or forum_cat parameters of viewthread.php." ],
|
||||||
|
|
||||||
|
# Only versions 6.01.14, 6.00.307, 7.00.2
|
||||||
|
["6.01.14, 6.00.307, 7.00.2", "CVE-2008-1918", "SQL Injection vulnerability in the shout_name field in the submit_info[] parameter in a link submission action." ],
|
||||||
|
|
||||||
|
# Versions 1.0.0-1.3.2 inclusive and versions 2.0.0-2.0.3 inclusive
|
||||||
|
["1.0.0-1.3.2, 2.0.0-2.0.3", "CVE-2005-3895", "Cross Site Scripting vulnerability when AttachmentDownloadType is set to inline, OTRS renders text/html e-mail attachments as HTML in the browser when the queue moderator attempts to download the attachment, which allows remote attackers to execute arbitrary web script or HTML." ],
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Test Erik's patch:
|
||||||
|
# set up ANEMONE skip regex
|
||||||
|
# turn an array of extensions into a regexp
|
||||||
|
-$ANEMONE_SKIP_REGEX=Regexp.union($ANEMONE_SKIP_EXTENSIONS.map {|x| /\.#{x}$/ })
|
||||||
|
+$ANEMONE_SKIP_REGEX=Regexp.union(*$ANEMONE_SKIP_EXTENSIONS.map {|x| /\.#{x}$/ })
|
||||||
|
|
||||||
|
|
||||||
|
maybe make :url=>/foo be relative to the target, eg. scan fuck.com/bar/ and it checks fuck.com/bar/foo
|
||||||
|
|
||||||
|
|
||||||
|
context aware webroot:
|
||||||
|
# this is enough to identify that it's WordPress by guessing URLs but it's hardly subtle
|
||||||
|
# this can also be used to work out the wordpress webroot, eg. 1 dir up from wp-content/ or wp-includes/
|
||||||
|
files %w| license.txt wp-blog-header.php wp-content/ wp-load.php wp-register.php xmlrpc.php readme.html wp-comments-post.php wp-cron.php wp-login.php wp-rss2.php wp-admin/ wp-commentsrss2.php wp-feed.php wp-mail.php wp-rss.php wp-app.php wp-config.php wp-includes/ wp-pass.php wp-settings.php index.php wp-atom.php wp-config-sample.php wp-links-opml.php wp-rdf.php wp-trackback.php|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# drop Div-Span-Structure
|
||||||
|
# add a hash for tagpattern
|
||||||
|
# add :url=> to matches
|
||||||
|
|
||||||
|
CVE array
|
||||||
|
# :model=>
|
||||||
|
# :firmware=>
|
||||||
|
# :modules=>
|
||||||
|
# :credentials=>
|
||||||
|
# --wait time
|
||||||
|
# follow meta-refresh
|
||||||
|
# {:version=>/<meta name=\"generator\" content=\"(WordPress)[ ]?([0-9\.]+)\"/, :version_regexp_offset=>1, :name=>"meta generator tag" } #"
|
||||||
|
|
||||||
|
CVEs [
|
||||||
|
["1.0-1.4", "CVE-1111, "XSS in asdf.php"],
|
||||||
|
["2.0-", "CVE-1112, "CSRF in asdf.php"], # All versions prior to 2.0
|
||||||
|
["4.0", "CVE-1113, "SQL injection in asdf.php"], # version 4.0
|
||||||
|
["5.3-5.6", "CVE-1114, "RCE in asdf.php"], # versions 5.3 to 5.6
|
||||||
|
["6.0+", "CVE-1115, "XSS in asdf.php"], # All know versions from 6 to date
|
||||||
|
]
|
||||||
|
|
||||||
|
search for slow regexps. use examples in plugins
|
||||||
|
|
||||||
|
plugins for cisco-ios version, linksys version
|
||||||
|
|
||||||
|
#add variables for : :fwversion, :model, :modules (joomla, WP, etc)
|
||||||
|
|
||||||
|
only do aggressive checks that provide more infoz.. eg, if it's already matched and all it does is identify the system then skip it
|
||||||
|
|
||||||
|
make a webpage model and a website model
|
||||||
|
|
||||||
|
show which plugin is requesting a URL
|
||||||
|
|
||||||
|
add option to not thread - need to rewrite main loop 1st
|
||||||
|
|
||||||
|
should :text be case insensitive? maybe
|
||||||
|
|
||||||
|
# make plugin errors red. check out Zoph error on
|
||||||
|
|
||||||
|
option to not display hashes? Hashes are most useful with a large dataset to find similar systems or when manually pentesting. maybe leave it in
|
||||||
|
|
||||||
|
why does it crash with low connect timeouts? eg. 1 second
|
||||||
|
/usr/lib/ruby/1.8/timeout.rb:60:in `timeout': execution expired from /usr/lib/ruby/1.8/net/http.rb:560:in `connect'
|
||||||
|
from /usr/lib/ruby/1.8/net/http.rb:553:in `do_start'
|
||||||
|
from /usr/lib/ruby/1.8/net/http.rb:542:in `start'
|
||||||
|
from /usr/lib/ruby/1.8/net/http.rb:1035:in `request'
|
||||||
|
from ./whatweb:521:in `open_target'
|
||||||
|
from ./whatweb:899
|
||||||
|
from ./whatweb:830:in `initialize'
|
||||||
|
from ./whatweb:830:in `new'
|
||||||
|
from ./whatweb:830
|
||||||
|
|
||||||
|
|
||||||
|
#start using a new convention so this issue can be avoided when people learn by example:
|
||||||
|
pattern=/<meta name=\"generator\" content=\"WordPress[ ]?[0-9\.]+\"/
|
||||||
|
if @body =~ pattern
|
||||||
|
version=@body.scan(pattern)[0][1]
|
||||||
|
m << ....
|
||||||
|
|
||||||
|
|
||||||
|
#custom plugins on the cmdline
|
||||||
|
# ./whatweb --custom-plugin ":text=>'powered by fuck'" -i ./targets
|
||||||
|
# ./whatweb --custom-plugin "{:text=>'powered by fuck'},{:regexp=>/meta generator/}" -i ./targets
|
||||||
|
#move tag pattern into main section so any plugin can use it
|
||||||
|
#move md5 into main section so any plugin can use it
|
||||||
|
|
||||||
|
Write a quick guide to writing plugins
|
||||||
|
|
||||||
|
change -example scanning. -e <plugin>,<plugin> <-- just where 2 take the targets from
|
||||||
|
--- nah
|
||||||
|
|
||||||
|
# add prefix, suffix, etc... for manual usage.
|
||||||
|
#make help wrap around a standard terminal size
|
||||||
|
|
||||||
|
option to not output hash plugins, footer, header, tag pattern, div span, md5. plugin groups? categories?
|
||||||
|
|
||||||
|
try to reconnect when a timeout is received
|
||||||
|
|
||||||
|
#add probability to XML output
|
||||||
|
#strip :probability requirement -- assume 100 if not specified.
|
||||||
|
#strip :name requirement -- same as regexp, etc if not specified.
|
||||||
|
#rename probability to certainty
|
||||||
|
|
||||||
|
make local plugin take precedence over installed location
|
||||||
|
|
||||||
|
Treat targets like a stack :: the stack is a global var
|
||||||
|
[a,r,r,a,y] pull next target from the array when the stack is empty
|
||||||
|
[s,t,a,c] pop from the stack until it's empty
|
||||||
|
[s,t,a,c,k] <-- plugins can push to the top of the stack. like links, css, js, whatever
|
||||||
|
|
||||||
|
|
||||||
|
option to supress 404s -- maybe they just just grep for 200 or -v 404
|
||||||
|
|
||||||
|
make plugins for http://trends.builtwith.com/cms
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
> one of the plugins attached, shoutcast administrator, doesn't work
|
||||||
|
> because it returns different HTTP 200 OK messages. is there some way to
|
||||||
|
> fix this or even use it for fingerprinting, rather than aborting the
|
||||||
|
> request?
|
||||||
|
>
|
||||||
|
> ~/proj/whatweb-0.4.4dev$ ./whatweb --log-brief=asdf.log -a 1
|
||||||
|
> 100.m2radio.fr:8000 <http://100.m2radio.fr:8000>
|
||||||
|
> http://100.m2radio.fr:8000 ERROR: wrong status line: "ICY 200 OK"
|
||||||
|
>
|
||||||
|
> ~/proj/whatweb-0.4.4dev$ ./whatweb --log-brief=asdf.log -a 1
|
||||||
|
> 128relay1.gothmetal.net:6666 <http://128relay1.gothmetal.net:6666>
|
||||||
|
> http://128relay1.gothmetal.net:6666 ERROR: wrong status line: "ICY 200 OK"
|
||||||
|
>
|
||||||
|
> ~/proj/whatweb-0.4.4dev$ ./whatweb --log-brief=asdf.log -a 1
|
||||||
|
> 160.79.128.30:7702 <http://160.79.128.30:7702>
|
||||||
|
> http://160.79.128.30:7702 ERROR: wrong status line: "ICY 400 Server Full"
|
||||||
|
>
|
||||||
|
> ~/proj/whatweb-0.4.4dev$ ./whatweb --log-brief=asdf.log -a 1
|
||||||
|
> aol-relay2.chuckeh.com:8026 <http://aol-relay2.chuckeh.com:8026>
|
||||||
|
> http://aol-relay2.chuckeh.com:8026 [302] Title[Redirect],
|
||||||
|
> RedirectLocation[http://scfire-ntc-aa03.stream.aol.com:80/stream/1051],
|
||||||
|
> MD5[2548da190bd45c8ab7b42f781b6d8b2c],
|
||||||
|
> Header-Hash[2548da190bd45c8ab7b42f781b6d8b2c]
|
||||||
|
> http://scfire-ntc-aa03.stream.aol.com:80/stream/1051 ERROR: wrong status
|
||||||
|
> line: "ICY 200 OK"
|
||||||
|
|
||||||
|
|
||||||
|
GUI
|
||||||
|
read XML and list urls by plugin
|
||||||
|
|
||||||
|
custom plugin defined on cmdline
|
||||||
|
|
||||||
|
|
||||||
|
each plugin should say what it identifies:
|
||||||
|
* presence of system
|
||||||
|
* version
|
||||||
|
* modules/components/plugins
|
||||||
|
* usernames/accountids/email addresses
|
||||||
|
* other
|
||||||
|
* find all pages
|
||||||
|
|
||||||
|
what methods it uses for each above task:
|
||||||
|
* identify patterns in headers and HTML of any page
|
||||||
|
* identify by pattern in guessed files
|
||||||
|
* identify by existance of guessed files
|
||||||
|
* identify by hash of guessed files
|
||||||
|
|
||||||
|
and whether the above are passive or aggressive functions.
|
||||||
|
|
||||||
|
|
||||||
|
possibly separate aggressive functions into:
|
||||||
|
def aggressive_identify
|
||||||
|
def aggressive_version
|
||||||
|
def aggressive_modules
|
||||||
|
def aggressive_users
|
||||||
|
def aggressive_other
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
i.e. someone should be able to turn on the aggression version test for joomla and not do the aggressive module test.
|
||||||
|
|
||||||
|
plugin identify file extensions in relative or same-site urls. eg. pl, asp, aspx, cfm, php, nsf, jsp, do.
|
||||||
|
we don't need 1 plugin per extension!
|
||||||
|
|
||||||
|
#change what verbose modes are.
|
||||||
|
# verbose 1. + names of plugin rules that match
|
||||||
|
verbose 2. show HTTP headers, connections, all results from plugins
|
||||||
|
|
||||||
|
|
||||||
|
list of filetypes to download and scan. useful ones are: css, js, favicon.ico. not links, but stuff that a browser would include on a page.
|
||||||
|
|
||||||
|
#target prefix and target suffix
|
||||||
|
|
||||||
|
joomla plugin aggressive tests should be relative to the site root.
|
||||||
|
now they're just relative to the site.
|
||||||
|
|
||||||
|
need finer control of which plugins are agressive, etc.
|
||||||
|
|
||||||
|
easily identify local vs remote links. eg. for passive joomla components
|
||||||
|
|
||||||
|
better error logging
|
||||||
|
|
||||||
|
when loading plugins, check they have unique names
|
||||||
|
|
||||||
|
-A, --accept=LIST comma-separated list of accepted extensions.
|
||||||
|
-R, --reject=LIST comma-separated list of rejected extensions.
|
||||||
|
|
||||||
|
|
||||||
|
improve the md5 hash identified of versions - download tgz versions into a folder
|
||||||
|
find smallest number of files that can be used to identify a specific version:
|
||||||
|
md5hash for each file suitable
|
||||||
|
whitelist of filetypes suitable - jpg, ini, cfg, css, js
|
||||||
|
blacklist of filetypes unsuitable - inc, php, .htaccess
|
||||||
|
show files with the most differences
|
||||||
|
|
||||||
|
should escape brackets in output eg. <title>SMC[231] Console</title> currently becomes title[SMC[231] Console]
|
||||||
|
|
||||||
|
add nikto, url guessing, except for certain types of servers, dont guess urls that don't exist. i.e. apache, iis, etc -
|
||||||
|
|
||||||
|
bundle anemone with whatweb so u dont need gems, etc and remove anemone's need to nokogiri
|
||||||
|
|
||||||
|
modules should return a static list of types of objects:
|
||||||
|
text, version, modules, usernames, userid,
|
||||||
|
- cms modules r just returned as a :string at the moment. could be improved on?
|
||||||
|
|
||||||
|
extract more info from https certificates, like hostnames
|
||||||
|
|
||||||
|
include IP in logs
|
||||||
|
|
||||||
|
more output types, like JSON,XML,YAML
|
||||||
|
|
||||||
|
make a distinction in colour between standard webpage things we find all the time like
|
||||||
|
title, meta generator, md5, server-header, Mailto and other matches, i.e. Joomla.
|
||||||
|
|
||||||
|
|
||||||
|
maybe plugins should return TEXT. i.e. type of default apache,etc
|
||||||
|
|
||||||
|
let ppl specific custom functions for plugins - like enumerating all drupal nodes.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
BUG https://120.136.48.33/ ERROR: EOF error end of file reached
|
||||||
|
This redirects but doesn't have a proper certificate
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
whatweb doesn't understand websites, only URLs
|
||||||
|
lots of good info in /robots.txt - recognise major versions of drupal
|
||||||
|
get favicon
|
||||||
|
get /robots.txt
|
||||||
|
|
||||||
|
remove aggression level 2?
|
||||||
|
|
||||||
|
include some caching of downloaded links
|
||||||
|
|
||||||
|
say whether it has aggressive tests in the plugin list
|
||||||
|
|
||||||
|
|
||||||
|
* doesn't follow redirects (sometimes)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
the plugin locking is ugly, might be better to make a new instance of the plugin for each test
|
||||||
|
|
||||||
|
|
||||||
|
should modify whatweb to run as a proxy and invoke wget
|
||||||
|
|
||||||
|
fast way:
|
||||||
|
use tiny proxy, or similar writtin in C.
|
||||||
|
capture the data and pass to ruby through a socket.
|
||||||
|
ruby just starts teh proxy, starts wget and collects the data.
|
||||||
|
|
||||||
|
|
||||||
|
the url guessing sux
|
||||||
|
eg. oscommerce
|
||||||
|
http://www.pokengirl.com/cart/catalog/index.php should guess http://www.pokengirl.com/cart/catalog/admin/login.php instead of http://www.pokengirl.com/admin/login.php
|
||||||
|
should list the file +dir strcuture so we can work out the base dir
|
||||||
|
|
||||||
|
|
||||||
|
need to log errors. in all registered logs, brief & verbose? separate log file?
|
||||||
|
add an error_out function to class OutputBrief, etc.
|
||||||
|
modify error function to call
|
||||||
|
output_list.each do |o|
|
||||||
|
o.error_out(target, err )
|
||||||
|
end
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
[x] dont sort targets. sorting each host in the input file is unsuitable for long files.
|
||||||
|
should just read 1 at a time, potentially from stdin
|
||||||
|
|
||||||
|
fix GHDB expressions
|
||||||
|
-- ghdb "abc def" doesn't match "abc <b>def</b>"
|
||||||
|
|
||||||
|
detect mobile versions
|
||||||
|
|
||||||
|
logs currently only log successful attempts. should be optional
|
||||||
|
|
||||||
|
maybe Make account, username, id, etc all username in output?
|
||||||
|
|
||||||
|
md5sums of files -identify favicon for mambo, joomla, apple, etc. have @md5_hash for plugins
|
||||||
|
|
||||||
|
|
||||||
|
Use NAMED GROUPS in regular expressions for stuff like version numbers
|
||||||
|
|
||||||
|
export plugin regexp matches to XML, separate program.
|
||||||
|
move plugin stuff into library
|
||||||
|
|
||||||
|
PHP plugin. take version from server meta string or x-powered-by, look for local links ending in .php
|
||||||
|
plugins for apache leaking win32 / unix, debian, redhat
|
||||||
|
|
||||||
|
alternative matches -- support/convert google dork/search stuff like intitle: ,
|
||||||
|
|
||||||
|
Colour Brief output according to plugin category & hilight versions
|
||||||
|
|
||||||
|
Plugin categories, i.e. javascript libraries for ( mootools, jquery, prototype)
|
||||||
|
server (IIS/ Apache)
|
||||||
|
cgi language (PHP, ASP, CFM)
|
||||||
|
CMS (Joomla, Mambo, ) / Blogging Platform (wordpress, typepad)
|
||||||
|
statistics (google analytics, quantcast)
|
||||||
|
|
||||||
|
Layers : Server, Language, Program, Javascript
|
||||||
|
Content: Contact
|
||||||
|
|
||||||
|
CMS is a type of Program,
|
||||||
|
Stats is a type of Javascript or Program
|
||||||
|
|
||||||
|
acclipse.rb CMS
|
||||||
|
blogger.rb CMS
|
||||||
|
blogsmithmedia.rb company?
|
||||||
|
drupal.rb CMS
|
||||||
|
echo.rb CMS
|
||||||
|
generic-server.rb ?
|
||||||
|
generic-x-powered-by.rb ?
|
||||||
|
google-analytics2.rb Stats
|
||||||
|
google-analytics.rb Stats
|
||||||
|
joomla.rb CMS
|
||||||
|
jquery.rb javascript
|
||||||
|
lightbox.rb javascript
|
||||||
|
mailto.rb contact
|
||||||
|
mambo.rb CMS
|
||||||
|
minify.rb Program
|
||||||
|
movable_type.rb CMS
|
||||||
|
plone.rb CMS
|
||||||
|
prototype.rb javascript
|
||||||
|
quantcast.rb stats
|
||||||
|
scriptaculous.rb javascript
|
||||||
|
typepad.rb CMS
|
||||||
|
wordpress.rb CMS
|
||||||
|
wordpress-spamfree.rb ?
|
||||||
|
|
||||||
|
|
||||||
|
update plugins, download from website
|
||||||
|
|
||||||
|
add plugin maturity, alpha, beta, stable, etc ?
|
||||||
|
- be useful when users submit plugins / make plugins on website
|
||||||
|
|
||||||
|
use curl lib, curb for:
|
||||||
|
add proxy support
|
||||||
|
add authentication basic/digest/form/cookie/ntlm
|
||||||
|
change agent behaviour
|
||||||
|
timeouts
|
||||||
|
|
||||||
|
let people pipe html + meta data straight from stdin, eg. curl -v securityfocus.com | ./whatweb --stdin
|
||||||
|
|
||||||
|
cache pages with sqlite or in files so they only have to be fetched once
|
||||||
|
|
||||||
|
make whatweb act as a proxy. so u can spider a site with wget, use firefox, etc.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
add output plugins -
|
||||||
|
yml,
|
||||||
|
brief view. eg. JQuery v2.1.7, Joomla v1.5, probably Drupal.
|
||||||
|
'probably' refers to the top % match being >50% and <100%. shows version + other info in shorthand, space delimited
|
||||||
|
|
||||||
|
test this out on CMS showcase lists to expose errors. some movable type showcase sites are drupal
|
||||||
|
|
||||||
|
make simple regexp matches more portable so they can be exported and used in other programs. maybe have an array of regexp matches in the plugins.
|
||||||
|
|
||||||
|
firefox plugin that display the identity in the footer and sends data to my server, like wapplyzer but better
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
website
|
||||||
|
let ppl make plugins in website.
|
||||||
|
form fields = example urls, name, etc.
|
||||||
|
write regular expressions & test which of the
|
||||||
|
examples it matches
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
What are your thoughts on returning info for hardware? Often there's different information to return, such as hardware model, firmware version, software versions, enabled modules, etc.
|
||||||
|
|
||||||
|
The output starts to get messy.
|
||||||
|
ABC-Hardware[xx.xx.xx][Model: XYZ][Firmware: xx.xx.xx][Modules:asdf,ghkj,zxcv]
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Fingerprinting using HTTP headers would be much cleaner if shodan style searches could be performed in a similair way to ghdb.
|
||||||
|
|
||||||
|
For example, instead of using:
|
||||||
|
|
||||||
|
server=@meta["server"] if @meta.keys.include?("server")
|
||||||
|
server=@meta["Server"] if @meta.keys.include?("Server")
|
||||||
|
if server =~ /GoAhead-Webs/i
|
||||||
|
m << {:name=>"server string",:string=>server}
|
||||||
|
end
|
||||||
|
|
||||||
|
|
||||||
|
You could use:
|
||||||
|
|
||||||
|
# regex style
|
||||||
|
{:name=>"server string", :shodan=>/[server|Server]+:[\s]*GoAhead-Webs/ },
|
||||||
|
|
||||||
|
# or perhaps plaintext style, case insensitive
|
||||||
|
{:name=>"server string", :shodan=>"Server: GoAhead-Webs/ },
|
||||||
|
|
||||||
|
|
||||||
|
The same applies to cookies:
|
||||||
|
|
||||||
|
m=[]
|
||||||
|
m << {:name=>"PastVisitor Cookie" } if @meta["set-cookie"] =~ /PastVisitor=[0-9]+.*/
|
||||||
|
|
||||||
|
becomes:
|
||||||
|
|
||||||
|
{:name=>"PastVisitor Cookie", :shodan=>/set-cookie:[\s]*PastVisitor=[0-9]+.*/ },
|
||||||
|
|
||||||
|
|
||||||
|
I've noted a few plugins where this could be useful:
|
||||||
|
|
||||||
|
~/proj/whatweb-0.4.4$ cat plugins/*.rb | grep -i Shodan
|
||||||
|
# About 13,446 Shodan results for Server:"AV787 Video Web Server" @ 2010-07-20
|
||||||
|
# About 1,002 Shodan results for Server:BarracudaHTTP @ 2010-07-24
|
||||||
|
# About 1,661 shodan results for printer Server:debut @ 2010-07-22
|
||||||
|
# About 21,276 Shodan results for Server:HP-ChaiSOE ONNECTION @ 2010-07-22
|
||||||
|
# About 189 Shodan results for Server:i-Catcher Console @ 2010-07-20
|
||||||
|
# About 94 Shodan results for Server:webcamXP @ 2010-07-24
|
||||||
|
# About 268 shodan results for Server: Snap Appliance, Inc. @ 2010-07-24
|
||||||
|
# About 543 Shodan results for Server:NetEVI @ 2010-07-22
|
||||||
|
# About 50 SHODAN results for Server:"Observer XT (c) Veo" @ 2010-07-18
|
||||||
|
|
||||||
|
|
||||||
|
I think ShodanHQ has gained enough publicity that using "shodan=>" would make sense.
|
||||||
|
|
||||||
|
|
||||||
|
Just a suggestion. Also I haven't been able to fingerprint using copyright symbols and different languages have been a challenge. UTF-8 support would be awesome :D
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
BUGS
|
||||||
|
auto colour - detect if it's being piped to a file or STDOUT, if to a file then turn off colour
|
||||||
|
nicer error handling when fed bad input, cmdline options, etc
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@@ -0,0 +1,140 @@
|
|||||||
|
.TH WHATWEB 1 "August 17, 2010"
|
||||||
|
.SH NAME
|
||||||
|
WhatWeb \- web scanner. Identify what websites are running.
|
||||||
|
.SH SYNOPSIS
|
||||||
|
.B whatweb
|
||||||
|
.RI [ options ]
|
||||||
|
.RI <URLs>
|
||||||
|
|
||||||
|
.br
|
||||||
|
.SH DESCRIPTION
|
||||||
|
.PP
|
||||||
|
Identify content management systems (CMS), blogging platforms, stats/analytics
|
||||||
|
packages, javascript libraries, servers and more. When you visit a website
|
||||||
|
in your browser the transaction includes many unseen hints about how
|
||||||
|
the webserver is set up and what software is delivering the webpage.
|
||||||
|
Some of these hints are obvious, eg. “Powered by XYZ” and others are more
|
||||||
|
subtle. WhatWeb recognises these hints and reports what it finds.
|
||||||
|
|
||||||
|
WhatWeb has over 290 plugins and needs community support to develop more.
|
||||||
|
Plugins can identify systems with obvious signs removed by looking for subtle
|
||||||
|
clues. For example, a WordPress site might remove the tag but the WordPress
|
||||||
|
plugin also looks for “wp-content” which is less easy to disguise. Plugins
|
||||||
|
are flexible and can return any datatype, for example plugins can return
|
||||||
|
version numbers, email addresses, account ID’s and more.
|
||||||
|
|
||||||
|
There are both passive and aggressive plugins, passive plugins use information
|
||||||
|
on the page, in cookies and in the URL to identify the system. A passive
|
||||||
|
request is as light weight as a simple GET / HTTP/1.1 request. Aggressive
|
||||||
|
plugins guess URLs and request more files. Plugins are easy to write, you
|
||||||
|
don’t need to know ruby to make them.
|
||||||
|
.SH OPTIONS
|
||||||
|
.TP
|
||||||
|
.B \<URLs\>
|
||||||
|
Enter URLs or filenames. Use /dev/stdin to pipe HTML directly
|
||||||
|
.TP
|
||||||
|
.B \-\-input-file=FILE \-i
|
||||||
|
Identify URLs found in FILE
|
||||||
|
.TP
|
||||||
|
.B \-\-aggression \-a
|
||||||
|
1 passive - on-page
|
||||||
|
|
||||||
|
2 polite - unimplemented
|
||||||
|
|
||||||
|
3 impolite - guess URLs when plugin matches (smart, guess a few URLs)
|
||||||
|
|
||||||
|
4 aggressive - guess URLs for every plugin (guess a lot of urls like nikto)
|
||||||
|
|
||||||
|
.TP
|
||||||
|
.B \-\-recursion \-r
|
||||||
|
Follow links recursively. Only follows links under the path (default: off)
|
||||||
|
.TP
|
||||||
|
.B \-\-depth \-d
|
||||||
|
Maximum recursion depth (default: 10)
|
||||||
|
.TP
|
||||||
|
.B \-\-max-links \-m
|
||||||
|
Maximum number of links to follow on one page (default: 250)
|
||||||
|
.TP
|
||||||
|
.B \-\-spider-skip-extensions
|
||||||
|
Redefine extensions to skip. (default: zip,gz,tar,jpg,exe,png,pdf)
|
||||||
|
.TP
|
||||||
|
.B \-\-list-plugins \-l
|
||||||
|
List the plugins
|
||||||
|
.TP
|
||||||
|
.B \-\-run-plugins \-p
|
||||||
|
Run comma delimited list of plugins. Default is to run all
|
||||||
|
.TP
|
||||||
|
.B \-\-info-plugins \-I
|
||||||
|
Display information about a comma delimited list of plugins. Default is all
|
||||||
|
.TP
|
||||||
|
.B \-\-example-urls \-e
|
||||||
|
Add example urls for each plugin to the target list
|
||||||
|
.TP
|
||||||
|
.B \-\-colour=[WHEN] \-\-color=[WHEN]
|
||||||
|
control whether colour is used. WHEN may be `never', `always', or `auto'
|
||||||
|
.TP
|
||||||
|
.B \-\-log-full=FILE
|
||||||
|
Log verbose output
|
||||||
|
.TP
|
||||||
|
.B \-\-log-brief=FILE
|
||||||
|
Log brief, one-line output
|
||||||
|
.TP
|
||||||
|
.B \-\-log-xml=FILE
|
||||||
|
Log XML format
|
||||||
|
.TP
|
||||||
|
.B \-\-user-agent \-U
|
||||||
|
Identify as user-agent instead of WhatWeb/VERSION.
|
||||||
|
.TP
|
||||||
|
.B \-\-max-threads \-t
|
||||||
|
Number of simultaneous threads. Default is 25.
|
||||||
|
.TP
|
||||||
|
.B \-\-no-redirect
|
||||||
|
Do not follow HTTP 3xx redirects.
|
||||||
|
.TP
|
||||||
|
.B \-\-proxy <hostname[:port]>
|
||||||
|
Set proxy hostname and port (default: 8080)
|
||||||
|
.TP
|
||||||
|
.B \-\-proxy-user <username:password>
|
||||||
|
Set proxy user and password
|
||||||
|
.TP
|
||||||
|
.B \-\-open-timeout
|
||||||
|
Time in seconds
|
||||||
|
.TP
|
||||||
|
.B \-\-read-timeout
|
||||||
|
Time in seconds
|
||||||
|
.TP
|
||||||
|
.B \-\-custom-plugin
|
||||||
|
Define a custom plugin call Custom,
|
||||||
|
Examples: ":text=>'powered by abc'"
|
||||||
|
":regexp=>/powered[ ]?by ab[0-9]/"
|
||||||
|
":ghdb=>'intitle:abc \"powered by abc\"'"
|
||||||
|
":md5=>'8666257030b94d3bdb46e05945f60b42'"
|
||||||
|
"{:text=>'powered by abc'},{:regexp=>/abc [ ]?1/i}"
|
||||||
|
.B \-\-url-prefix
|
||||||
|
Add a prefix to target URLs
|
||||||
|
.TP
|
||||||
|
.B \-\-url-suffix
|
||||||
|
Add a suffix to target URLs
|
||||||
|
.TP
|
||||||
|
.B \-\-url-pattern
|
||||||
|
Insert the targets into a URL. Requires --input-file,
|
||||||
|
eg. www.example.com/%insert%/robots.txt
|
||||||
|
.TP
|
||||||
|
.B \-\-help \-h
|
||||||
|
This help
|
||||||
|
.TP
|
||||||
|
.B \-\-verbose \-v
|
||||||
|
Increase verbosity (recommended), use twice for debugging.
|
||||||
|
.TP
|
||||||
|
.B \-\-version
|
||||||
|
Display verion information.
|
||||||
|
|
||||||
|
.SH AUTHOR
|
||||||
|
whatweb was written by Andrew Horton aka urbanadventurer
|
||||||
|
|
||||||
|
This manual page was originally written by Michal Ambroz <rebus AT seznam.cz>
|
||||||
|
for the Fedora project (and may be used by others). Updated by Andrew Horton.
|
||||||
|
.SH HOMEPAGE
|
||||||
|
http://www.morningstarsecurity.com/research/whatweb
|
||||||
|
.PP
|
||||||
|
|
||||||
+37
@@ -0,0 +1,37 @@
|
|||||||
|
<?xml version="1.0" encoding="ISO-8859-1"?>
|
||||||
|
<xsl:stylesheet version="1.0"
|
||||||
|
xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
|
||||||
|
|
||||||
|
<xsl:template match="log">
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<title>WhatWeb Report</title>
|
||||||
|
<style>*{padding:0;margin:0;}body,html{background:#ccc;font:medium "arial", "sans-serif";}#container{background-color:#ffffff;border:1px solid #cccccc;margin: 0px auto -1px auto;width:730px;}h1{width:100%;border:1px #000 solid;background:#eeeeee;}p{padding:10px;}table{margin-bottom:20px;}td{width:50%;}.target{background:#eee;border:1px solid #cccccc;}</style>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
|
||||||
|
<table id="container">
|
||||||
|
|
||||||
|
<xsl:for-each select="target">
|
||||||
|
<tr><td class="target" colspan="2"><strong><xsl:value-of select="uri"/></strong> [<xsl:value-of select="http-status"/>]</td></tr>
|
||||||
|
<xsl:for-each select="plugin">
|
||||||
|
<xsl:choose>
|
||||||
|
<xsl:when test="position() mod 2 = 0">
|
||||||
|
<tr><td><xsl:value-of select="name"/></td>
|
||||||
|
<td><xsl:value-of select="string"/></td></tr>
|
||||||
|
</xsl:when>
|
||||||
|
<xsl:otherwise>
|
||||||
|
<tr><td bgcolor="#eee"><xsl:value-of select="name"/></td>
|
||||||
|
<td bgcolor="#eee"><xsl:value-of select="string"/></td></tr>
|
||||||
|
</xsl:otherwise>
|
||||||
|
</xsl:choose>
|
||||||
|
</xsl:for-each>
|
||||||
|
</xsl:for-each>
|
||||||
|
|
||||||
|
</table>
|
||||||
|
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
</xsl:template>
|
||||||
|
|
||||||
|
</xsl:stylesheet>
|
||||||
Reference in New Issue
Block a user