def __initReport(self):
if self.reportGeneratorType.lower() == "xml":
self.reportGen = XMLReportGenerator()
elif self.reportGeneratorType.lower() == "html":
self.reportGen = HTMLReportGenerator()
elif self.reportGeneratorType.lower() == "txt":
self.reportGen = TXTReportGenerator()
else: # default
self.reportGen = XMLReportGenerator()
xmlParser = VulnerabilityXMLParser()
xmlParser.parse(os.path.join(CONF_DIR, "config/vulnerabilities/vulnerabilities.xml"))
for vul in xmlParser.getVulnerabilities():
self.reportGen.addVulnerabilityType(
_(vul.getName()), _(vul.getDescription()), _(vul.getSolution()), vul.getReferences()
)
def __initReport(self):
if self.reportGeneratorType.lower() == "xml":
self.reportGen = XMLReportGenerator()
elif self.reportGeneratorType.lower() == "html":
self.reportGen = HTMLReportGenerator()
elif self.reportGeneratorType.lower() == "txt":
self.reportGen = TXTReportGenerator()
else: #default
self.reportGen = XMLReportGenerator()
if "__file__" in dir():
BASE_DIR = os.path.normpath(os.path.join(os.path.abspath(__file__), '..'))
else:
BASE_DIR = os.getcwd()
xmlParser = VulnerabilityXMLParser()
xmlParser.parse(BASE_DIR + "/config/vulnerabilities/vulnerabilities.xml")
for vul in xmlParser.getVulnerabilities():
self.reportGen.addVulnerabilityType(_(vul.getName()), _(vul.getDescription()),
_(vul.getSolution()), vul.getReferences())
class Wapiti:
"""
Wapiti-SVN - A web application vulnerability scanner
Usage: python wapiti.py http://server.com/base/url/ [options]
Supported options are:
-s <url>
--start <url>
To specify an url to start with
-x <url>
--exclude <url>
To exclude an url from the scan (for example logout scripts)
You can also use a wildcard (*)
Example : -x "http://server/base/?page=*&module=test"
or -x http://server/base/admin/* to exclude a directory
-p <url_proxy>
--proxy <url_proxy>
To specify a proxy
Exemple: -p http://proxy:port/
-c <cookie_file>
--cookie <cookie_file>
To use a cookie
-t <timeout>
--timeout <timeout>
To fix the timeout (in seconds)
-a <login%password>
--auth <login%password>
Set credentials for HTTP authentication
Doesn't work with Python 2.4
-r <parameter_name>
--remove <parameter_name>
Remove a parameter from URLs
-n <limit>
--nice <limit>
Define a limit of urls to read with the same pattern
Use this option to prevent endless loops
Must be greater than 0
-m <module_options>
--module <module_options>
Set the modules and HTTP methods to use for attacks.
Example: -m "-all,xss:get,exec:post"
-u
--underline
Use color to highlight vulnerables parameters in output
-v <level>
--verbose <level>
Set the verbosity level
0: quiet (default), 1: print each url, 2: print every attack
-f <type_file>
--reportType <type_file>
Set the type of the report
xml: Report in XML format
html: Report in HTML format
-o <output>
--output <output_file>
Set the name of the report file
If the selected report type is "html", this parameter must be a directory
-i <file>
--continue <file>
This parameter indicates Wapiti to continue with the scan from the specified
file, this file should contain data from a previous scan.
The file is optional, if it is not specified, Wapiti takes the default file
from \"scans\" folder.
-k <file>
--attack <file>
This parameter indicates Wapiti to perform attacks without scanning again the
website and following the data of this file.
The file is optional, if it is not specified, Wapiti takes the default file
from \"scans\" folder.
-h
--help
To print this usage message"""
urls = {}
forms = []
color = 0
verbose = 0
reportGeneratorType = "html"
REPORT_DIR = "report"
REPORT_FILE = "vulnerabilities.xml"
HOME_DIR = os.getenv("HOME") or os.getenv("USERPROFILE")
COPY_REPORT_DIR = os.path.join(HOME_DIR, ".wapiti", "generated_report")
outputFile = ""
options = ""
HTTP = None
reportGen = None
attacks = []
def __init__(self, rooturl):
self.HTTP = HTTP.HTTP(rooturl)
def __initReport(self):
if self.reportGeneratorType.lower() == "xml":
self.reportGen = XMLReportGenerator()
elif self.reportGeneratorType.lower() == "html":
self.reportGen = HTMLReportGenerator()
elif self.reportGeneratorType.lower() == "txt":
self.reportGen = TXTReportGenerator()
else: # default
self.reportGen = XMLReportGenerator()
xmlParser = VulnerabilityXMLParser()
xmlParser.parse(os.path.join(CONF_DIR, "config/vulnerabilities/vulnerabilities.xml"))
for vul in xmlParser.getVulnerabilities():
self.reportGen.addVulnerabilityType(
_(vul.getName()), _(vul.getDescription()), _(vul.getSolution()), vul.getReferences()
)
def __initAttacks(self):
self.__initReport()
attack = __import__("attack")
print "[*]", _("Loading modules"), ":"
print "\t" + ", ".join(attack.modules)
for mod_name in attack.modules:
mod = __import__("attack." + mod_name, fromlist=attack.modules)
mod_instance = getattr(mod, mod_name)(self.HTTP, self.reportGen)
if hasattr(mod_instance, "setTimeout"):
mod_instance.setTimeout(self.HTTP.getTimeOut())
self.attacks.append(mod_instance)
self.attacks.sort(lambda a, b: a.PRIORITY - b.PRIORITY)
for attack in self.attacks:
attack.setVerbose(self.verbose)
if self.color == 1:
attack.setColor()
if self.options != "":
opts = self.options.split(",")
for opt in opts:
method = ""
if opt.find(":") > 0:
module, method = opt.split(":", 1)
else:
module = opt
# desactivate some module options
if module.startswith("-"):
module = module[1:]
if module == "all":
for x in self.attacks:
if method == "get" or method == "":
x.doGET = False
if method == "post" or method == "":
x.doPOST = False
else:
for x in self.attacks:
if x.name == module:
if method == "get" or method == "":
x.doGET = False
if method == "post" or method == "":
x.doPOST = False
# activate some module options
else:
if module.startswith("+"):
module = module[1:]
if module == "all":
for x in self.attacks:
if method == "get" or method == "":
x.doGET = True
if method == "post" or method == "":
x.doPOST = True
else:
for x in self.attacks:
if x.name == module:
if method == "get" or method == "":
x.doGET = True
if method == "post" or method == "":
x.doPOST = True
def browse(self, crawlerFile):
"Extract hyperlinks and forms from the webpages found on the website"
self.urls, self.forms = self.HTTP.browse(crawlerFile)
def attack(self):
"Launch the attacks based on the preferences set by the command line"
if self.urls == {} and self.forms == []:
print _("No links or forms found in this page !")
print _("Make sure the url is correct.")
sys.exit(1)
self.__initAttacks()
for x in self.attacks:
if x.doGET == False and x.doPOST == False:
continue
print
if x.require != []:
t = [y.name for y in self.attacks if y.name in x.require and (y.doGET or y.doPOST)]
if x.require != t:
print "[!]", _("Missing dependecies for module"), x.name, ":"
print " ", ",".join([y for y in x.require if y not in t])
continue
else:
x.loadRequire([y for y in self.attacks if y.name in x.require])
print "[+]", _("Launching module"), x.name
x.attack(self.urls, self.forms)
if self.HTTP.getUploads() != []:
print "\n" + _("Upload scripts found") + ":"
print "----------------------"
for url in self.HTTP.getUploads():
print url
if not self.outputFile:
if self.reportGeneratorType == "html":
self.outputFile = self.COPY_REPORT_DIR
else:
self.outputFile = self.REPORT_FILE
self.reportGen.generateReport(self.outputFile)
print "\n" + _("Report")
print "------"
print _("A report has been generated in the file") + " " + self.outputFile
if self.reportGeneratorType == "html":
print _("Open") + " " + self.outputFile + "/index.html " + _("with a browser to see this report.")
def setTimeOut(self, timeout=6.0):
"Set the timeout for the time waiting for a HTTP response"
self.HTTP.setTimeOut(timeout)
def setProxy(self, proxy=""):
"Set a proxy to use for HTTP requests."
self.HTTP.setProxy(proxy)
def addStartURL(self, url):
"Specify an URL to start the scan with. Can be called several times."
self.HTTP.addStartURL(url)
def addExcludedURL(self, url):
"Specify an URL to exclude from the scan. Can be called several times."
self.HTTP.addExcludedURL(url)
def setCookieFile(self, cookie):
"Load session data from a cookie file"
self.HTTP.setCookieFile(cookie)
def setAuthCredentials(self, auth_basic):
"Set credentials to use if the website require an authentification."
self.HTTP.setAuthCredentials(auth_basic)
def addBadParam(self, bad_param):
"""Exclude a parameter from an url (urls with this parameter will be
modified. This function can be call several times"""
self.HTTP.addBadParam(bad_param)
def setNice(self, nice):
"""Define how many tuples of parameters / values must be sent for a
given URL. Use it to prevent infinite loops."""
self.HTTP.setNice(nice)
def setScope(self, scope):
"""Set the scope of the crawler for the analysis of the web pages"""
self.HTTP.setScope(scope)
def setColor(self):
"Put colors in the console output (terminal must support colors)"
self.color = 1
def verbosity(self, vb):
"Define the level of verbosity of the output."
self.verbose = vb
self.HTTP.verbosity(vb)
def setModules(self, options=""):
"""Activate or desactivate (default) all attacks"""
self.options = options
def setReportGeneratorType(self, repGentype="xml"):
"Set the format of the generated report. Can be xml, html of txt"
self.reportGeneratorType = repGentype
def setOutputFile(self, outputFile):
"Set the filename where the report will be written"
self.outputFile = outputFile