Example #1
0
    def test_save_current_to_new_profile(self):
        w3af_core = w3afCore()
        w3af_core.profiles.use_profile('OWASP_TOP10', workdir='.')

        audit = w3af_core.plugins.get_enabled_plugins('audit')
        disabled_plugin = audit[-1]
        audit = audit[:-1]
        w3af_core.plugins.set_plugins(audit, 'audit')
        enabled = w3af_core.plugins.get_enabled_plugins('audit')
        self.assertEquals(set(enabled), set(audit))
        self.assertTrue(disabled_plugin not in enabled)

        w3af_core.profiles.save_current_to_new_profile('unittest-OWASP_TOP10')

        # Get a new, clean instance of the core.
        w3af_core = w3afCore()
        audit = w3af_core.plugins.get_enabled_plugins('audit')
        self.assertEquals(audit, [])

        w3af_core.profiles.use_profile('unittest-OWASP_TOP10')
        enabled_plugins = w3af_core.plugins.get_all_enabled_plugins()

        self.assertTrue(disabled_plugin not in enabled_plugins['audit'])
        self.assertTrue('credit_cards' in enabled_plugins['grep'])
        self.assertTrue('private_ip' in enabled_plugins['grep'])
        self.assertTrue('dns_wildcard' in enabled_plugins['infrastructure'])
        self.assertTrue('web_spider' in enabled_plugins['crawl'])

        w3af_core.profiles.remove_profile('unittest-OWASP_TOP10')
Example #2
0
    def test_saveCurrentToNewProfile(self):
        w3af_core = w3afCore()
        w3af_core.profiles.useProfile('OWASP_TOP10')
        
        audit = w3af_core.plugins.getEnabledPlugins('audit')
        disabled_plugin = audit[-1]
        audit = audit[:-1]
        w3af_core.plugins.setPlugins(audit,'audit')
        enabled = w3af_core.plugins.getEnabledPlugins('audit')
        self.assertEquals(enabled, audit)
        self.assertTrue(disabled_plugin not in enabled)

        w3af_core.profiles.saveCurrentToNewProfile('unittest-OWASP_TOP10')
        
        # Get a new, clean instance of the core.
        w3af_core = w3afCore()
        audit = w3af_core.plugins.getEnabledPlugins('audit')
        self.assertEquals( audit, [])

        w3af_core.profiles.useProfile('unittest-OWASP_TOP10')
        enabled_plugins = w3af_core.plugins.getAllEnabledPlugins()
        
        self.assertTrue( disabled_plugin not in enabled_plugins['audit'])
        self.assertTrue( 'creditCards' in enabled_plugins['grep'])
        self.assertTrue( 'privateIP' in enabled_plugins['grep'])
        self.assertTrue( 'dnsWildcard' in enabled_plugins['discovery'])        
        
        w3af_core.profiles.removeProfile('unittest-OWASP_TOP10')
Example #3
0
    def test_remove_profile(self):
        w3af_core = w3afCore()
        w3af_core.profiles.save_current_to_new_profile('unittest-remove')
        w3af_core.profiles.remove_profile('unittest-remove')

        self.assertRaises(
            w3afException, w3af_core.profiles.use_profile, 'unittest-remove')
Example #4
0
    def test_use_all_profiles(self):
        '''
        This test catches the errors in my profiles that generate these messages:

        ***************************************************************************
        The profile you are trying to load (web_infrastructure) seems to be outdated,
        this is a common issue which happens when the framework is updated and one of
        its plugins adds/removes one of the configuration parameters referenced by a
        profile, or the plugin is removed all together.

        The profile was loaded but some of your settings might have been lost.
        This is the list of issues that were found:

        - Setting the options for plugin "infrastructure.server_header" raised
        an exception due to unknown configuration parameters.

        We recommend you review the specific plugin configurations, apply the
        required changes and save the profile in order to update it and avoid
        this message. If this warning does not disappear you can manually edit
        the profile file to fix it.
        ***************************************************************************
        '''
        w3af_core = w3afCore()
        valid, invalid = w3af_core.profiles.get_profile_list('.')

        self.assertTrue(len(valid) > 5)
        self.assertEqual(len(invalid), 0)

        for profile_inst in valid:
            profile_name = profile_inst.get_name()

            w3af_core.profiles.use_profile(profile_name, workdir='.')
Example #5
0
    def test_error_handling(self):
        class InvalidPlugin(object):
            def information(self, msg, new_line=True):
                raise Exception('Test')

            def error(self, msg, new_line=True):
                pass

            def get_name(self):
                return 'InvalidPlugin'

        invalid_plugin = InvalidPlugin()

        w3af_core = w3afCore()

        om.out._output_plugin_instances = [
            invalid_plugin,
        ]
        om.out.information('abc')
        om.out.process_all_messages()

        exc_list = w3af_core.exception_handler.get_all_exceptions()
        self.assertEqual(len(exc_list), 1, exc_list)

        edata = exc_list[0]
        self.assertEqual(str(edata.exception), 'Test')
Example #6
0
 def test_getPluginInstanceAll(self):
     w3af_core = w3afCore()
     
     for plugin_type in itertools.chain( w3af_core.plugins.getPluginTypes() , ['attack'] ):
         for plugin_name in w3af_core.plugins.getPluginList(plugin_type):
             plugin_inst = w3af_core.plugins.getPluginInstance(plugin_name, plugin_type)
             self.assertEquals( plugin_inst.getName(), plugin_name )
Example #7
0
    def test_getPluginList(self):
        w3af_core = w3afCore()
        plugin_list = w3af_core.plugins.getPluginList('audit')

        expected = ['sqli', 'xss', 'eval']
        for plugin_name in expected:
            self.assertTrue( plugin_name in plugin_list )   
Example #8
0
 def test_set_plugins_negative(self):
     w3af_core = w3afCore()
     enabled = [
         'fake',
     ]
     self.assertRaises(ValueError, w3af_core.plugins.set_plugins, enabled,
                       'output')
Example #9
0
 def test_strategy_exception(self):
     core = w3afCore()
     
     target = core.target.get_options()
     target['target'].set_value(self.TARGET_URL)
     core.target.set_options(target)
     
     core.plugins.set_plugins(['sqli',], 'audit')        
     core.plugins.init_plugins()
     
     core.verify_environment()
     core.scan_start_hook()
     
     strategy = w3af_core_strategy(core)
     strategy.join_all_consumers = Mock(side_effect=Exception)
     
     strategy.terminate = Mock(wraps=strategy.terminate)
     
     self.assertRaises(Exception, strategy.start)
     
     # Now test that those threads are being terminated
     self.assertEqual(strategy.terminate.called, True)
     
     core.exploit_phase_prerequisites = lambda: 42
     core.scan_end_hook()
     
     thread_names = [t.name for t in threading.enumerate()]
     self.assertEqual(len(thread_names), 3, thread_names)
     
     thread_names = set(thread_names)
     expected_names = set(['MainThread', 'SQLiteExecutor', 'OutputManager'])
     
     self.assertEqual(thread_names, expected_names)
Example #10
0
    def test_error_handling(self):
        
        class InvalidPlugin(object):
            def information(self, msg, new_line=True):
                raise Exception('Test')

            def error(self, msg, new_line=True):
                pass

            def get_name(self):
                return 'InvalidPlugin'

        invalid_plugin = InvalidPlugin()

        w3af_core = w3afCore()

        om.out._output_plugin_instances = [invalid_plugin, ]
        om.out.information('abc')
        om.out.process_all_messages()

        exc_list = w3af_core.exception_handler.get_all_exceptions()
        self.assertEqual(len(exc_list), 1, exc_list)

        edata = exc_list[0]
        self.assertEqual(str(edata.exception), 'Test')
Example #11
0
    def setUp(self):
        '''
        This is a rather complex setUp since I need to move the
        exception_raise.py plugin to the plugin directory in order to be able
        to run it afterwards.

        In the tearDown method, I'll remove the file.
        '''
        self.src = os.path.join('core', 'controllers', 'tests',
                                'exception_raise.py')
        self.dst = os.path.join('plugins', 'crawl', 'exception_raise.py')
        shutil.copy(self.src, self.dst)

        self.w3afcore = w3afCore()

        target_opts = create_target_option_list(URL('http://moth/'))
        self.w3afcore.target.set_options(target_opts)

        self.w3afcore.plugins.set_plugins([
            'exception_raise',
        ], 'crawl')

        # Verify env and start the scan
        self.w3afcore.plugins.init_plugins()
        self.w3afcore.verify_environment()

        self.exception_plugin = self.w3afcore.plugins.plugins['crawl'][0]
Example #12
0
    def setUp(self):
        self.url_str = "http://moth/"
        self.url_inst = URL(self.url_str)

        self._w3af = w3afCore()
        self._plugins = []
        for pname in self._w3af.plugins.get_plugin_list("grep"):
            self._plugins.append(self._w3af.plugins.get_plugin_inst("grep", pname))
Example #13
0
 def test_set_plugins(self):
     w3af_core = w3afCore()
     enabled = [
         'sqli',
     ]
     w3af_core.plugins.set_plugins(enabled, 'audit')
     retrieved = w3af_core.plugins.get_enabled_plugins('audit')
     self.assertEquals(enabled, retrieved)
Example #14
0
 def test_get_plugin_types(self):
     w3af_core = w3afCore()
     plugin_types = w3af_core.plugins.get_plugin_types()
     expected = set([
         'grep', 'output', 'mangle', 'audit', 'crawl', 'evasion',
         'bruteforce', 'auth', 'infrastructure'
     ])
     self.assertEquals(set(plugin_types), expected)
Example #15
0
    def test_plugin_options(self):
        w3af_core = w3afCore()
        plugin_inst = w3af_core.plugins.get_plugin_inst('crawl', 'web_spider')
        options_1 = plugin_inst.get_options()

        w3af_core.plugins.set_plugin_options('crawl', 'web_spider', options_1)
        options_2 = w3af_core.plugins.get_plugin_options('crawl', 'web_spider')

        self.assertEquals(options_1, options_2)
Example #16
0
 def __initRoot(self, do_upd):
     '''
     Root menu init routine.
     '''
     cons_upd = ConsoleUIUpdater(force=do_upd)
     cons_upd.update()
     # Core initialization
     self._w3af = w3afCore()
     self._w3af.plugins.set_plugins(['console'], 'output')
Example #17
0
    def test_get_plugin_instAll(self):
        w3af_core = w3afCore()

        for plugin_type in itertools.chain(
                w3af_core.plugins.get_plugin_types(), ['attack']):
            for plugin_name in w3af_core.plugins.get_plugin_list(plugin_type):
                plugin_inst = w3af_core.plugins.get_plugin_inst(
                    plugin_type, plugin_name)
                self.assertEquals(plugin_inst.get_name(), plugin_name)
Example #18
0
 def test_plugin_options(self):
     w3af_core = w3afCore()
     plugin_inst = w3af_core.plugins.getPluginInstance('webSpider','discovery')
     options_1 = plugin_inst.getOptions()
     
     w3af_core.plugins.setPluginOptions('discovery', 'webSpider', options_1)
     options_2 = w3af_core.plugins.getPluginOptions('discovery', 'webSpider')
     
     self.assertEquals( options_1, options_2 )
Example #19
0
    def setUp(self):
        self.url_str = 'http://moth/'
        self.url_inst = URL(self.url_str)

        self._w3af = w3afCore()
        self._plugins = []
        for pname in self._w3af.plugins.get_plugin_list('grep'):
            self._plugins.append(
                self._w3af.plugins.get_plugin_inst('grep', pname))
Example #20
0
    def test_plugin_options(self):
        w3af_core = w3afCore()
        plugin_inst = w3af_core.plugins.get_plugin_inst('crawl', 'web_spider')
        options_1 = plugin_inst.get_options()

        w3af_core.plugins.set_plugin_options('crawl', 'web_spider', options_1)
        options_2 = w3af_core.plugins.get_plugin_options('crawl', 'web_spider')

        self.assertEquals(options_1, options_2)
Example #21
0
 def __initRoot(self, do_upd):
     '''
     Root menu init routine.
     '''
     cons_upd = ConsoleUIUpdater(force=do_upd)
     cons_upd.update()
     # Core initialization
     self._w3af = w3afCore()
     self._w3af.plugins.set_plugins(['console'], 'output')
Example #22
0
 def test_set_plugins_negative_without_raise(self):
     w3af_core = w3afCore()
     enabled = [
         'fake',
     ]
     unknown_plugins = w3af_core.plugins.set_plugins(enabled,
                                                     'output',
                                                     raise_on_error=False)
     self.assertEqual(enabled, unknown_plugins)
     w3af_core.plugins.init_plugins()
Example #23
0
 def test_useProfile(self):
     w3af_core = w3afCore()
     w3af_core.profiles.useProfile('OWASP_TOP10')
     
     enabled_plugins = w3af_core.plugins.getAllEnabledPlugins()
     
     self.assertTrue( 'sqli' in enabled_plugins['audit'])
     self.assertTrue( 'creditCards' in enabled_plugins['grep'])
     self.assertTrue( 'privateIP' in enabled_plugins['grep'])
     self.assertTrue( 'dnsWildcard' in enabled_plugins['discovery'])
Example #24
0
    def test_init_plugins(self):
        w3af_core = w3afCore()
        enabled = ['web_spider']
        w3af_core.plugins.set_plugins(enabled, 'crawl')
        w3af_core.plugins.init_plugins()

        self.assertEquals(len(w3af_core.plugins.plugins['crawl']), 1,
                          w3af_core.plugins.plugins['crawl'])

        plugin_inst = list(w3af_core.plugins.plugins['crawl'])[0]
        self.assertEquals(plugin_inst.get_name(), 'web_spider')
Example #25
0
    def test_enable_all(self):
        w3af_core = w3afCore()
        enabled = ['all']
        w3af_core.plugins.set_plugins(enabled, 'crawl')
        w3af_core.plugins.init_plugins()

        self.assertEquals(set(w3af_core.plugins.get_enabled_plugins('crawl')),
                          set(w3af_core.plugins.get_plugin_list('crawl')))

        self.assertEquals(len(w3af_core.plugins.get_enabled_plugins('crawl')),
                          len(w3af_core.plugins.get_plugin_list('crawl')))
Example #26
0
    def test_enable_all(self):
        w3af_core = w3afCore()
        enabled = ['all']
        w3af_core.plugins.set_plugins(enabled, 'crawl')
        w3af_core.plugins.init_plugins()

        self.assertEquals(set(w3af_core.plugins.get_enabled_plugins('crawl')),
                          set(w3af_core.plugins.get_plugin_list('crawl')))

        self.assertEquals(len(w3af_core.plugins.get_enabled_plugins('crawl')),
                          len(w3af_core.plugins.get_plugin_list('crawl')))
Example #27
0
    def test_init_plugins(self):
        w3af_core = w3afCore()
        enabled = ['web_spider']
        w3af_core.plugins.set_plugins(enabled, 'crawl')
        w3af_core.plugins.init_plugins()

        self.assertEquals(len(w3af_core.plugins.plugins['crawl']), 1,
                          w3af_core.plugins.plugins['crawl'])

        plugin_inst = list(w3af_core.plugins.plugins['crawl'])[0]
        self.assertEquals(plugin_inst.get_name(), 'web_spider')
Example #28
0
    def test_get_all_enabled_plugins(self):
        w3af_core = w3afCore()
        enabled_audit = ['sqli', 'xss']
        enabled_grep = ['private_ip']
        w3af_core.plugins.set_plugins(enabled_audit, 'audit')
        w3af_core.plugins.set_plugins(enabled_grep, 'grep')

        all_enabled = w3af_core.plugins.get_all_enabled_plugins()

        self.assertEquals(enabled_audit, all_enabled['audit'])
        self.assertEquals(enabled_grep, all_enabled['grep'])
Example #29
0
    def test_enable_dependency_same_type(self):
        w3af_core = w3afCore()
        enabled_infra = ['php_eggs', ]
        w3af_core.plugins.set_plugins(enabled_infra, 'infrastructure')
        w3af_core.plugins.init_plugins()

        enabled_infra.append('server_header')

        self.assertEquals(
            set(w3af_core.plugins.get_enabled_plugins('infrastructure')),
            set(enabled_infra))
Example #30
0
 def setUp(self):
     self.w3afcore = w3afCore()
     
     self.plugin_types = self.w3afcore.plugins.getPluginTypes()
     self.plugin_types += ['attack']
     self.plugins = []
     
     for plugin_type in self.plugin_types:
         for plugin_name in self.w3afcore.plugins.getPluginList( plugin_type ): 
             plugin = self.w3afcore.plugins.getPluginInstance(plugin_name, plugin_type)
             self.plugins.append(plugin)
Example #31
0
 def test_getAllEnabledPlugins(self):
     w3af_core = w3afCore()
     enabled_audit = ['sqli', 'xss']
     enabled_grep = ['privateIP']
     w3af_core.plugins.setPlugins(enabled_audit,'audit')
     w3af_core.plugins.setPlugins(enabled_grep,'grep')
     
     all_enabled = w3af_core.plugins.getAllEnabledPlugins()
     
     self.assertEquals( enabled_audit, all_enabled['audit'] )
     self.assertEquals( enabled_grep, all_enabled['grep'] )
Example #32
0
 def test_init_plugins(self):
     w3af_core = w3afCore()
     enabled = ['webSpider']
     w3af_core.plugins.setPlugins(enabled,'discovery')
     w3af_core.plugins.init_plugins()
     
     self.assertEquals( len(w3af_core.plugins.plugins['discovery']), 1 )
     
     plugin_inst = w3af_core.plugins.plugins['discovery'][0]
     self.assertEquals( plugin_inst.getName(), 'webSpider' )
             
Example #33
0
    def test_use_profile(self):
        w3af_core = w3afCore()
        w3af_core.profiles.use_profile('OWASP_TOP10', workdir='.')

        enabled_plugins = w3af_core.plugins.get_all_enabled_plugins()

        self.assertTrue('sqli' in enabled_plugins['audit'])
        self.assertTrue('credit_cards' in enabled_plugins['grep'])
        self.assertTrue('private_ip' in enabled_plugins['grep'])
        self.assertTrue('dns_wildcard' in enabled_plugins['infrastructure'])
        self.assertTrue('web_spider' in enabled_plugins['crawl'])
Example #34
0
    def test_enable_all_all(self):
        w3af_core = w3afCore()
        for plugin_type in w3af_core.plugins.get_plugin_types():
            w3af_core.plugins.set_plugins(['all', ], plugin_type)
        w3af_core.plugins.init_plugins()

        for plugin_type in w3af_core.plugins.get_plugin_types():
            enabled_plugins = w3af_core.plugins.get_enabled_plugins(
                plugin_type)
            all_plugins = w3af_core.plugins.get_plugin_list(plugin_type)
            self.assertEqual(set(enabled_plugins), set(all_plugins))
            self.assertEqual(len(enabled_plugins), len(all_plugins))
Example #35
0
    def test_enable_not_web_spider_all(self):
        w3af_core = w3afCore()
        enabled = ['!web_spider', 'all']
        w3af_core.plugins.set_plugins(enabled, 'crawl')
        w3af_core.plugins.init_plugins()

        all_plugins = w3af_core.plugins.get_plugin_list('crawl')
        all_plugins = all_plugins[:]
        all_plugins.remove('web_spider')

        self.assertEquals(set(w3af_core.plugins.get_enabled_plugins('crawl')),
                          set(all_plugins))
Example #36
0
    def test_enable_not_web_spider_all(self):
        w3af_core = w3afCore()
        enabled = ['!web_spider', 'all']
        w3af_core.plugins.set_plugins(enabled, 'crawl')
        w3af_core.plugins.init_plugins()

        all_plugins = w3af_core.plugins.get_plugin_list('crawl')
        all_plugins = all_plugins[:]
        all_plugins.remove('web_spider')

        self.assertEquals(set(w3af_core.plugins.get_enabled_plugins('crawl')),
                          set(all_plugins))
    def test_spider_with_time_limit(self):
        #
        #    First scan
        #
        cf.cf.save('max_discovery_time', 1)
        cfg = self._run_configs['basic']
        
        start_time = time.time()
        
        self._scan(self.target_url, cfg['plugins'])

        end_time = time.time()
        first_scan_time = end_time - start_time

        len_first_urls = len(self.kb.get_all_known_urls())
        self.assertGreater(len_first_urls, 500)
        self.assertLess(first_scan_time, 120)
        
        # Cleanup
        self.w3afcore.quit()
        self.kb.cleanup()
        self.w3afcore = w3afCore()
        
        #
        #    Second scan
        #
        cf.cf.save('max_discovery_time', 2)
        cfg = self._run_configs['basic']
        
        start_time = time.time()
        
        self._scan(self.target_url, cfg['plugins'])
        
        end_time = time.time()
        second_scan_time = end_time - start_time

        len_second_urls = len(self.kb.get_all_known_urls())
        self.assertGreater(len_second_urls, 900)
        self.assertGreater(len_second_urls, len_first_urls)
        self.assertLess(second_scan_time, 150)
        
        # The setup delta is the time it takes w3af to setup the scan, and
        # finish once the should_stop_scan method returns true. The 60 in the
        # next line is the initial scan time of 1 minute
        setup_delta = first_scan_time - 60
        
        # Scan should take at least the setup time, 2 minutes which is the time
        # delay and because the setup_delta might be a little bit off, we just
        # substract some seconds from it
        at_least_takes = setup_delta + 120 - 10
        
        self.assertGreater(second_scan_time, at_least_takes)
Example #38
0
    def test_spider_with_time_limit(self):
        #
        #    First scan
        #
        cf.cf.save('max_discovery_time', 1)
        cfg = self._run_configs['basic']

        start_time = time.time()

        self._scan(self.target_url, cfg['plugins'])

        end_time = time.time()
        first_scan_time = end_time - start_time

        len_first_urls = len(self.kb.get_all_known_urls())
        self.assertGreater(len_first_urls, 500)
        self.assertLess(first_scan_time, 120)

        # Cleanup
        self.w3afcore.quit()
        self.kb.cleanup()
        self.w3afcore = w3afCore()

        #
        #    Second scan
        #
        cf.cf.save('max_discovery_time', 2)
        cfg = self._run_configs['basic']

        start_time = time.time()

        self._scan(self.target_url, cfg['plugins'])

        end_time = time.time()
        second_scan_time = end_time - start_time

        len_second_urls = len(self.kb.get_all_known_urls())
        self.assertGreater(len_second_urls, 900)
        self.assertGreater(len_second_urls, len_first_urls)
        self.assertLess(second_scan_time, 150)

        # The setup delta is the time it takes w3af to setup the scan, and
        # finish once the should_stop_scan method returns true. The 60 in the
        # next line is the initial scan time of 1 minute
        setup_delta = first_scan_time - 60

        # Scan should take at least the setup time, 2 minutes which is the time
        # delay and because the setup_delta might be a little bit off, we just
        # substract some seconds from it
        at_least_takes = setup_delta + 120 - 10

        self.assertGreater(second_scan_time, at_least_takes)
Example #39
0
    def test_cant_start_new_thread_bug(self):
        '''
        This tests that https://github.com/andresriancho/w3af/issues/56 was
        properly fixed after the change in how sqlite threads were managed.
        '''
        w3af_core = w3afCore()
        valid, _ = w3af_core.profiles.get_profile_list('.')

        for _ in xrange(10):
            for profile_inst in valid:
                profile_name = profile_inst.get_name()

                w3af_core.profiles.use_profile(profile_name, workdir='.')
Example #40
0
    def setUp(self):
        self.w3afcore = w3afCore()

        self.plugin_types = self.w3afcore.plugins.get_plugin_types()
        self.plugin_types += ['attack']
        self.plugins = {}

        for plugin_type in self.plugin_types:
            self.plugins[plugin_type] = []
            for plugin_name in self.w3afcore.plugins.get_plugin_list(plugin_type):
                plugin = self.w3afcore.plugins.get_plugin_inst(
                    plugin_type, plugin_name)
                self.plugins[plugin_type].append(plugin)
Example #41
0
    def test_enable_all_but_two(self):
        w3af_core = w3afCore()
        enabled = ['all', '!web_spider', '!archive_dot_org']
        w3af_core.plugins.set_plugins(enabled, 'crawl')
        w3af_core.plugins.init_plugins()

        all_plugins = w3af_core.plugins.get_plugin_list('crawl')
        all_plugins = all_plugins[:]
        all_plugins.remove('web_spider')
        all_plugins.remove('archive_dot_org')

        self.assertEquals(set(w3af_core.plugins.get_enabled_plugins('crawl')),
                          set(all_plugins))
Example #42
0
    def test_enable_dependency_same_type(self):
        w3af_core = w3afCore()
        enabled_infra = [
            'php_eggs',
        ]
        w3af_core.plugins.set_plugins(enabled_infra, 'infrastructure')
        w3af_core.plugins.init_plugins()

        enabled_infra.append('server_header')

        self.assertEquals(
            set(w3af_core.plugins.get_enabled_plugins('infrastructure')),
            set(enabled_infra))
Example #43
0
    def test_enable_all_but_two(self):
        w3af_core = w3afCore()
        enabled = ['all', '!web_spider', '!archive_dot_org']
        w3af_core.plugins.set_plugins(enabled, 'crawl')
        w3af_core.plugins.init_plugins()

        all_plugins = w3af_core.plugins.get_plugin_list('crawl')
        all_plugins = all_plugins[:]
        all_plugins.remove('web_spider')
        all_plugins.remove('archive_dot_org')

        self.assertEquals(set(w3af_core.plugins.get_enabled_plugins('crawl')),
                          set(all_plugins))
Example #44
0
    def test_queue_status_not_started(self):
        s = w3af_core_status(w3afCore())

        self.assertEqual(s.get_crawl_input_speed(), None)
        self.assertEqual(s.get_crawl_output_speed(), None)
        self.assertEqual(s.get_crawl_qsize(), None)
        self.assertEqual(s.get_crawl_current_fr(), None)
        self.assertEqual(s.get_crawl_eta(), None)

        self.assertEqual(s.get_audit_input_speed(), None)
        self.assertEqual(s.get_audit_output_speed(), None)
        self.assertEqual(s.get_audit_qsize(), None)
        self.assertEqual(s.get_audit_current_fr(), None)
        self.assertEqual(s.get_audit_eta(), None)
Example #45
0
    def test_enable_all_all(self):
        w3af_core = w3afCore()
        for plugin_type in w3af_core.plugins.get_plugin_types():
            w3af_core.plugins.set_plugins([
                'all',
            ], plugin_type)
        w3af_core.plugins.init_plugins()

        for plugin_type in w3af_core.plugins.get_plugin_types():
            enabled_plugins = w3af_core.plugins.get_enabled_plugins(
                plugin_type)
            all_plugins = w3af_core.plugins.get_plugin_list(plugin_type)
            self.assertEqual(set(enabled_plugins), set(all_plugins))
            self.assertEqual(len(enabled_plugins), len(all_plugins))
Example #46
0
 def test_queue_status_not_started(self):
     s = w3af_core_status(w3afCore())
     
     self.assertEqual(s.get_crawl_input_speed(), None)
     self.assertEqual(s.get_crawl_output_speed(), None)
     self.assertEqual(s.get_crawl_qsize(), None)
     self.assertEqual(s.get_crawl_current_fr(), None)
     self.assertEqual(s.get_crawl_eta(), None)
     
     self.assertEqual(s.get_audit_input_speed(), None)
     self.assertEqual(s.get_audit_output_speed(), None)
     self.assertEqual(s.get_audit_qsize(), None)
     self.assertEqual(s.get_audit_current_fr(), None)
     self.assertEqual(s.get_audit_eta(), None)
Example #47
0
    def setUp(self):
        self.w3afcore = w3afCore()

        self.plugin_types = self.w3afcore.plugins.get_plugin_types()
        self.plugin_types += ['attack']
        self.plugins = {}

        for plugin_type in self.plugin_types:
            self.plugins[plugin_type] = []
            for plugin_name in self.w3afcore.plugins.get_plugin_list(
                    plugin_type):
                plugin = self.w3afcore.plugins.get_plugin_inst(
                    plugin_type, plugin_name)
                self.plugins[plugin_type].append(plugin)
Example #48
0
    def test_enable_dependency_same_type_order(self):
        w3af_core = w3afCore()
        enabled_infra = ['php_eggs', ]
        w3af_core.plugins.set_plugins(enabled_infra, 'infrastructure')
        w3af_core.plugins.init_plugins()

        self.assertEqual(w3af_core.plugins.get_enabled_plugins(
            'infrastructure').index('server_header'), 0)
        self.assertEqual(w3af_core.plugins.get_enabled_plugins(
            'infrastructure').index('php_eggs'), 1)

        self.assertEqual(w3af_core.plugins.plugins[
                         'infrastructure'][0].get_name(), 'server_header')
        self.assertEqual(w3af_core.plugins.plugins[
                         'infrastructure'][1].get_name(), 'php_eggs')
Example #49
0
    def test_enable_dependency_different_type(self):
        w3af_core = w3afCore()
        enabled_crawl = ['url_fuzzer', ]
        w3af_core.plugins.set_plugins(enabled_crawl, 'crawl')

        enabled_infra = ['allowed_methods', ]

        w3af_core.plugins.init_plugins()

        self.assertEquals(set(w3af_core.plugins.get_enabled_plugins('crawl')),
                          set(enabled_crawl))

        self.assertEquals(
            set(w3af_core.plugins.get_enabled_plugins('infrastructure')),
            set(enabled_infra))
Example #50
0
    def test_all_wizards(self):
        mod = 'core.controllers.wizard.wizards.%s'
        w3af_core = w3afCore()

        for filename in os.listdir('core/controllers/wizard/wizards/'):
            wizard_id, ext = os.path.splitext(filename)

            if wizard_id in ('__init__', '.git') or ext == '.pyc':
                continue

            klass = mod % wizard_id
            wizard_inst = factory(klass, w3af_core)

            yield self._test_wizard_correct, wizard_inst

            wizard_inst = factory(klass, w3af_core)
            yield self._test_wizard_fail, wizard_inst
Example #51
0
    def test_enable_dependency_different_type(self):
        w3af_core = w3afCore()
        enabled_crawl = [
            'url_fuzzer',
        ]
        w3af_core.plugins.set_plugins(enabled_crawl, 'crawl')

        enabled_infra = [
            'allowed_methods',
        ]

        w3af_core.plugins.init_plugins()

        self.assertEquals(set(w3af_core.plugins.get_enabled_plugins('crawl')),
                          set(enabled_crawl))

        self.assertEquals(
            set(w3af_core.plugins.get_enabled_plugins('infrastructure')),
            set(enabled_infra))
Example #52
0
 def test_strategy_run(self):
     core = w3afCore()
     
     target = core.target.get_options()
     target['target'].set_value(self.TARGET_URL)
     core.target.set_options(target)
     
     core.plugins.set_plugins(['sqli',], 'audit')        
     core.plugins.init_plugins()
     
     core.verify_environment()
     core.scan_start_hook()
     
     def verify_threads_running(functor):
         thread_names = [t.name for t in threading.enumerate()]
         self.assertIn('WorkerThread', thread_names)
         self.called_teardown_audit = True
         return functor
     
     self.called_teardown_audit = False
     
     strategy = w3af_core_strategy(core)
     strategy._teardown_audit = verify_threads_running(strategy._teardown_audit)
     
     strategy.start()
     
     # Now test that those threads are being terminated
     self.assertTrue(self.called_teardown_audit)
     
     vulns = kb.get('sqli', 'sqli')
     self.assertEqual(len(vulns), 1)
     
     core.exploit_phase_prerequisites = lambda: 42
     core.scan_end_hook()
     
     thread_names = [t.name for t in threading.enumerate()]
     self.assertEqual(len(thread_names), 3, thread_names)
     
     thread_names = set(thread_names)
     expected_names = set(['MainThread', 'SQLiteExecutor', 'OutputManager'])
     
     self.assertEqual(thread_names, expected_names)
Example #53
0
    def test_all_questions(self):
        '''
        This is a very basic test where we perform the following:
            * Create an instance
            * Exercise all getters
            * Exercise all setters
            * Make sure "back" works
        '''
        mod = 'core.controllers.wizard.questions.%s'
        w3af_core = w3afCore()

        for filename in os.listdir('core/controllers/wizard/questions/'):
            question_id, ext = os.path.splitext(filename)

            if question_id in ('__init__', '.git') or ext == '.pyc':
                continue

            klass = mod % question_id
            question_inst = factory(klass, w3af_core)

            yield self._test_qid, question_inst