└── passive ├── HUNT.py ├── exPscan.py └── exPscan ├── README ├── fuzzdb-errors.txt ├── nonreg-strings.txt ├── nonreg-strings.txt.NOMATCH ├── sqlmap-errors.xml ├── zaproxy-pscanrules-application_errors.xml └── zaproxy-pscanrulesAlpha-SourceCodeDisclosureScanner.java /passive/HUNT.py: -------------------------------------------------------------------------------- 1 | import re 2 | from org.zaproxy.zap.extension.script import ScriptVars 3 | 4 | '''find possible vulnerable entry points using Hunt Methodology - https://github.com/bugcrowd/HUNT''' 5 | 6 | 7 | def appliesToHistoryType(histType): 8 | """ 9 | Limit scanned history types, which otherwise default to 10 | types in `PluginPassiveScanner.getDefaultHistoryTypes()` 11 | """ 12 | from org.parosproxy.paros.model import HistoryReference as hr 13 | 14 | return histType in [hr.TYPE_PROXIED, hr.TYPE_SPIDER] 15 | 16 | 17 | def find_words_in_params(param_list, word_list): 18 | result = [] 19 | for word in word_list: 20 | for param in param_list: 21 | if word in param: 22 | result.append(word) 23 | return result 24 | 25 | 26 | def hunt_alert(ps, msg, uri, result, title, desc): 27 | if not result: 28 | return 29 | 30 | result_repr = ','.join(result) 31 | title += " (HUNT script)" 32 | desc = desc.strip().format(result=result_repr) 33 | 34 | info = msg.getRequestHeader().toString() 35 | info += "\n" + msg.getRequestBody().toString() 36 | 37 | # Docs on alert raising function: 38 | # raiseAlert(int risk, int confidence, str name, str description, str uri, 39 | # str param, str attack, str otherInfo, str solution, 40 | # str evidence, int cweId, int wascId, HttpMessage msg) 41 | # risk: 0: info, 1: low, 2: medium, 3: high 42 | # confidence: 0: falsePositive, 1: low, 2: medium, 3: high, 4: confirmed 43 | ps.raiseAlert(0, 1, title, desc, uri, result_repr, 44 | None, info, None, None, 0, 0, msg) 45 | 46 | 47 | def scan(ps, msg, src): 48 | words_dlp = ['access','admin','dbg','debug','edit','grant','test','alter','clone','create','delete','disable','enable','exec','execute','load','make','modify','rename','reset','shell','toggle','adm','root','cfg','config'] 49 | words_pfi = ['file','document','folder','root','path','pg','style','pdf','template','php_path','doc'] 50 | words_pidor = ['id','user','account','number','order','no','doc','key','email','group','profile','edit','report'] 51 | words_prce = ['daemon','host' ,'upload','dir','execute','download','log','ip','cli','cmd'] 52 | words_psql = ['id','select','report','role','update','query','user','name','sort','where','search','params','process','row','view','table','from','sel','results','sleep','fetch','order','keyword','column','field','delete','string','number','filter'] 53 | words_pssrf = ['dest','redirect','uri','path','continue','url','window','next','data','reference','site','html','val','validate','domain','callback','return','page','feed','host','port','to','out','view','dir','show','navigation','open'] 54 | words_pssti = ['template','preview','id','view','activity','name','content','redirect'] 55 | 56 | uri = msg.getRequestHeader().getURI().toString() 57 | params = [p.lower() for p in msg.getParamNames()] 58 | 59 | base_uri = re.search('^https?://[^/]+/[^?#=]*', uri) 60 | 61 | if not params or not base_uri: 62 | return 63 | 64 | base_uri = base_uri.group() 65 | urlParam_repr = base_uri + str(params) 66 | globalvar = max(ScriptVars.getGlobalVar("hunt"), "") 67 | 68 | if urlParam_repr in globalvar: 69 | return 70 | 71 | ScriptVars.setGlobalVar("hunt", globalvar + ' , ' + urlParam_repr) 72 | 73 | # Searching Debug and Logic 74 | result = find_words_in_params(params, words_dlp) 75 | hunt_alert(ps, msg, uri, result, 76 | "Possible Debug & Logic Parameters", """ 77 | HUNT located the {result} parameter inside of your application traffic. \ 78 | The {result} parameter is most often associated to debug, access, or \ 79 | critical functionality in applications. 80 | 81 | HUNT recommends further manual analysis of the parameter in question. 82 | """) 83 | 84 | # Searching File Inclusion 85 | result = find_words_in_params(params, words_pfi) 86 | hunt_alert(ps, msg, uri, result, 87 | "Possible File Inclusion or Path Traversal", """ 88 | HUNT located the {result} parameter inside of your application traffic. \ 89 | The {result} parameter is most often susceptible to \ 90 | File Inclusion or Path Traversal. 91 | 92 | HUNT recommends further manual analysis of the parameter in question. 93 | 94 | Also note that several parameters from this section and SSRF might overlap or \ 95 | need testing for both vulnerability categories. 96 | 97 | For File Inclusion or Path Traversal HUNT recommends the following resources \ 98 | to aid in manual testing: 99 | 100 | - The Web Application Hackers Handbook: \ 101 | Chapter 10 102 | - LFI Cheat Sheet: https://highon.coffee/blog/lfi-cheat-sheet/ 103 | - Gracefuls Path Traversal Cheat Sheet: Windows: \ 104 | https://www.gracefulsecurity.com/path-traversal-cheat-sheet-windows/ 105 | - Gracefuls Path Traversal Cheat Sheet: Linux: \ 106 | https://www.gracefulsecurity.com/path-traversal-cheat-sheet-linux/ 107 | """) 108 | 109 | # Searching IDORs 110 | result = find_words_in_params(params, words_pidor) 111 | hunt_alert(ps, msg, uri, result, 112 | "Possible IDOR", """ 113 | HUNT located the {result} parameter inside of your application traffic. \ 114 | The {result} parameter is most often susceptible to \ 115 | Insecure Direct Object Reference Vulnerabilities. 116 | 117 | Direct object reference vulnerabilities occur when there are insufficient \ 118 | authorization checks performed against object identifiers used in requests. \ 119 | This could occur when database keys, filenames, or other identifiers are used \ 120 | to directly access resources within an application. 121 | These identifiers would likely be predictable (an incrementing counter, \ 122 | the name of a file, etc), making it easy for an attacker to detect this \ 123 | vulnerability class. If further authorization checks are not performed, this \ 124 | could lead to unauthorized access to the underlying data. 125 | 126 | HUNT recommends further manual analysis of the parameter in question. 127 | 128 | For Insecure Direct Object Reference Vulnerabilities HUNT recommends the \ 129 | following resources to aid in manual testing: 130 | 131 | - The Web Application Hackers Handbook: \ 132 | Chapter 8 133 | - Testing for Insecure Direct Object References (OTG-AUTHZ-004): \ 134 | https://www.owasp.org/index.php/Testing_for_Insecure_Direct_Object_References_(OTG-AUTHZ-004) 135 | - Using Burp to Test for Insecure Direct Object References: \ 136 | https://support.portswigger.net/customer/portal/articles/1965691-using-burp-to-test-for-insecure-direct-object-references 137 | - IDOR Examples from ngalongc/bug-bounty-reference: \ 138 | https://github.com/ngalongc/bug-bounty-reference#insecure-direct-object-reference-idor 139 | """) 140 | 141 | # Searching RCEs 142 | result = find_words_in_params(params, words_prce) 143 | hunt_alert(ps, msg, uri, result, 144 | "Possible RCE", """ 145 | HUNT located the {result} parameter inside of your application traffic. \ 146 | The {result} parameter is most often susceptible to OS Command Injection. 147 | 148 | HUNT recommends further manual analysis of the parameter in question. 149 | 150 | For OS Command Injection HUNT recommends the following resources to aid \ 151 | in manual testing: 152 | 153 | - (OWASP) Testing for OS Command Injection: \ 154 | https://www.owasp.org/index.php/Testing_for_Command_Injection_(OTG-INPVAL-013) 155 | - Joberts How To Command Injection: \ 156 | https://www.hackerone.com/blog/how-to-command-injections 157 | - Commix Command Injection Tool: \ 158 | https://github.com/commixproject/commix 159 | -The FuzzDB OS CMD Exec section: \ 160 | https://github.com/fuzzdb-project/fuzzdb/tree/master/attack/os-cmd-execution 161 | - Ferruh Mavitunas CMDi Cheat Sheet: \ 162 | https://ferruh.mavituna.com/unix-command-injection-cheat-sheet-oku/ 163 | - The Web Application Hackers Handbook: Chapter 10 164 | """) 165 | 166 | # Searching SQLi 167 | result = find_words_in_params(params, words_psql) 168 | hunt_alert(ps, msg, uri, result, 169 | "Possible SQLi", """ 170 | HUNT located the {result} parameter inside of your application traffic. \ 171 | The {result} parameter is most often susceptible to SQL Injection. 172 | 173 | HUNT recommends further manual analysis of the parameter in question. 174 | 175 | For SQL Injection HUNT references The Bug Hunters Methodology \ 176 | SQL Injection references table: 177 | 178 | - PentestMonkeys MySQL Injection Cheat Sheet: \ 179 | http://pentestmonkey.net/cheat-sheet/sql-injection/mysql-sql-injection-cheat-sheet 180 | - Reiners MySQL Injection Filter Evasion: \ 181 | https://websec.wordpress.com/2010/12/04/sqli-filter-evasion-cheat-sheet-mysql/ 182 | - EvilSQLs Error/Union/Blind MSSQL Cheat Sheet: \ 183 | http://evilsql.com/main/page2.php 184 | - PentestMonkeys MSSQL SQL Injection Cheat Sheet: \ 185 | http://pentestmonkey.net/cheat-sheet/sql-injection/mssql-sql-injection-cheat-sheet 186 | - PentestMonkeys Oracle SQL Cheat Sheet: \ 187 | http://pentestmonkey.net/cheat-sheet/sql-injection/oracle-sql-injection-cheat-sheet 188 | - PentestMonkeys PostgreSQL Cheat Sheet: \ 189 | http://pentestmonkey.net/cheat-sheet/sql-injection/postgres-sql-injection-cheat-sheet 190 | - Access SQL Injection Cheat Sheet: \ 191 | http://nibblesec.org/files/MSAccessSQLi/MSAccessSQLi.html 192 | - PentestMonkeys Ingres SQL Injection Cheat Sheet: \ 193 | http://pentestmonkey.net/cheat-sheet/sql-injection/ingres-sql-injection-cheat-sheet 194 | - PentestMonkeys DB2 SQL Injection Cheat Sheet: \ 195 | http://pentestmonkey.net/cheat-sheet/sql-injection/db2-sql-injection-cheat-sheet 196 | - PentestMonkeys Informix SQL Injection Cheat Sheet: \ 197 | http://pentestmonkey.net/cheat-sheet/sql-injection/informix-sql-injection-cheat-sheet 198 | - SQLite3 Injection Cheat Sheet: \ 199 | https://sites.google.com/site/0x7674/home/sqlite3injectioncheatsheet 200 | - Ruby on Rails (ActiveRecord) SQL Injection Guide: \ 201 | https://sites.google.com/site/0x7674/home/sqlite3injectioncheatsheet 202 | """) 203 | 204 | # Searching SSRF 205 | result = find_words_in_params(params, words_pssrf) 206 | hunt_alert(ps, msg, uri, result, 207 | "Possible SSRF", """ 208 | HUNT located the {result} parameter inside of your application traffic. \ 209 | The {result} parameter is most often susceptible to \ 210 | Server Side Request Forgery (and sometimes URL redirects). 211 | 212 | HUNT recommends further manual analysis of the parameter in question. 213 | 214 | For Server Side Request Forgery HUNT recommends the following resources to \ 215 | aid in manual testing: 216 | 217 | - Server-side browsing considered harmful - Nicolas Gregoire: \ 218 | http://www.agarri.fr/docs/AppSecEU15-Server_side_browsing_considered_harmful.pdf 219 | - How To: Server-Side Request Forgery (SSRF) - Jobert Abma: \ 220 | https://www.hackerone.com/blog-How-To-Server-Side-Request-Forgery-SSRF 221 | - SSRF Examples from ngalongc/bug-bounty-reference: \ 222 | https://github.com/ngalongc/bug-bounty-reference#server-side-request-forgery-ssrf 223 | - Safebuff SSRF Tips: \ 224 | http://blog.safebuff.com/2016/07/03/SSRF-Tips/ 225 | - The SSRF Bible: \ 226 | https://docs.google.com/document/d/1v1TkWZtrhzRLy0bYXBcdLUedXGb9njTNIJXa3u9akHM/edit 227 | """) 228 | 229 | # Searching SSTI 230 | result = find_words_in_params(params, words_pssti) 231 | hunt_alert(ps, msg, uri, result, 232 | "Possible SSTI", """ 233 | HUNT located the {result} parameter inside of your application traffic. \ 234 | The {result} parameter is most often susceptible to \ 235 | Server Side Template Injection. 236 | 237 | HUNT recommends further manual analysis of the parameter in question. 238 | """) 239 | -------------------------------------------------------------------------------- /passive/exPscan.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python2 2 | 3 | import re 4 | import functools 5 | import traceback 6 | import pickle 7 | import uuid 8 | import pprint 9 | 10 | from org.zaproxy.zap.extension.script import ScriptVars 11 | 12 | 13 | # configuration 14 | DEV_MODE = True 15 | NAME = "exPscan" 16 | MAX_BODY_SIZE = 300000 17 | 18 | DATA_TYPES = { 19 | "js": ["javascript", "ecmascript"], 20 | "css": ["text/css"], 21 | "default": None, 22 | } 23 | 24 | # don't touch these globales 25 | _GLOB = { 26 | "REGEX": dict.fromkeys(DATA_TYPES, ""), 27 | "IREGEX": dict.fromkeys(DATA_TYPES, ""), 28 | "REG_BY_IDS": {}, 29 | "ERRORS": "", 30 | } 31 | _NONREG_STRINGS = """ 32 | ## vi: ft=conf 33 | ## NOTE: 34 | ## this file is a aggregate of strings that `should probably` be recognized. 35 | ## It is useful for non-regression tests 36 | ## * Lines starting with '#' are ignored 37 | ## 38 | ## vim tips: 39 | ## remove duplicates: 40 | ## :'<,'>!sort -u 41 | ## sort by line length: 42 | ## :'<,'>!awk '{ print length, $0 }' | sort -n -s | cut -d" " -f2- 43 | DB2 ODBC 44 | Index of 45 | JDBC SQL 46 | ODBC DB2 47 | ODBC SQL 48 | #DB2 Error #(always contains SQLSTATE, or SQL0204N like strings) 49 | PHP Error 50 | server at 51 | #CLI Driver # (always contains SQL0420N like str) 52 | #DB2 Driver 53 | JDBC Error 54 | JDBC MySQL 55 | MySQL ODBC 56 | ODBC Error 57 | #Oracle DB2 # useless 58 | Fatal error 59 | JDBC Driver 60 | JDBC Oracle 61 | mysql error 62 | MySQL Error 63 | ODBC Driver 64 | ODBC Oracle 65 | Oracle ODBC 66 | PHP Warning 67 | data source= 68 | Error Report 69 | include_path 70 | Invalid SQL: 71 | MySQL Driver 72 | Oracle Error 73 | SQLException 74 | invalid query 75 | Oracle Driver 76 | Type mismatch 77 | Unknown table 78 | database error 79 | internal error 80 | ODBC SQL Server 81 | PHP Parse error 82 | Parent Directory 83 | unexpected error 84 | ADODB.Field error 85 | #ASP.NET_SessionId # irrelevant 86 | mix of collations 87 | SQL Server Driver 88 | missing expression 89 | server object error 90 | #Warning: pg_connect # already detected to "on line [0-9]" regex in real life 91 | Can't find record in 92 | #Custom Error Message #??? 93 | #Warning: mysql_query # already detected ty "on line [0-9]" regex in real life 94 | Incorrect column name 95 | Incorrect syntax near 96 | Internal Server Error 97 | ODBC Microsoft Access 98 | on MySQL result index 99 | The error occurred in 100 | Unable to jump to row 101 | Can't connect to local 102 | Disallowed Parent Path 103 | Invalid parameter type 104 | Invalid Path Character 105 | mySQL error with query 106 | ODBC SQL Server Driver 107 | #Warning: mysql_query() 108 | The script whose uid is 109 | is not allowed to access 110 | #Microsoft VBScript error # already caught in real life by microsoft regex '800a0400' 111 | Microsoft VBScript error '800a0400' 112 | Active Server Pages error 113 | detected an internal error 114 | A syntax error has occurred 115 | Error Diagnostic Information 116 | ODBC Microsoft Access Driver 117 | Unterminated string constant 118 | ): encountered SQLException [ 119 | SQL Server Driver][SQL Server 120 | unexpected end of SQL command 121 | Permission denied: 'GetObject' 122 | SQL command not properly ended 123 | [ODBC Informix driver][Informix] 124 | OLE/DB provider returned message 125 | Syntax error in query expression 126 | Invalid procedure call or argument 127 | Invision Power Board Database Error 128 | #Microsoft VBScript compilation error # already caught in real life by microsoft regex '800a0400' 129 | You have an error in your SQL syntax 130 | ERROR: parser: parse error at or near 131 | Incorrect column specifier for column 132 | Error Occurred While Processing Request 133 | Microsoft OLE DB Provider for SQL Server 134 | Unexpected end of command in statement [ 135 | You have an error in your SQL syntax near 136 | internal error [IBM][CLI Driver][DB2/6000] 137 | Microsoft OLE DB Provider for ODBC Drivers 138 | [Microsoft][ODBC Microsoft Access 97 Driver] 139 | Column count doesn't match value count at row 140 | Error converting data type varchar to numeric 141 | supplied argument is not a valid MySQL result 142 | An unexpected token "END-OF-STATEMENT" was found 143 | Error Message : Error loading required libraries. 144 | java.lang.NumberFormatException: For input string: 145 | Supplied argument is not a valid PostgreSQL result 146 | PostgreSQL query failed: ERROR: parser: parse error 147 | Unclosed quotation mark before the character string 148 | An illegal character has been found in the statement 149 | ASP.NET is configured to show verbose error messages 150 | detected an internal error [IBM][CLI Driver][DB2/6000] 151 | supplied argument is not a valid MySQL result resource 152 | [SQL Server Driver][SQL Server]Line 1: Incorrect syntax near 153 | Warning: Cannot modify header information - headers already sent 154 | Warning: Supplied argument is not a valid File-Handle resource in 155 | Warning: pg_connect(): Unable to connect to PostgreSQL server: FATAL 156 | Incorrect syntax near 157 | query failed 158 | #not an object # too much false positives 159 | error occurred 160 | ERROR OCCURRED 161 | Server Error 162 | invalid file name 163 | fatal error 164 | parse error 165 | ERROR 1049 (42000): Unknown database 166 | No database selected 167 | #exception report # not relevant on google hack search 168 | Servlet error : java.lang.IndexOutOfBoundsException 169 | """ 170 | 171 | 172 | def exception_handler(function): 173 | """ 174 | A decorator that wraps the passed in function and outputs 175 | exception instead if raising it, if DEV_MODE is True 176 | 177 | This is useful to not have to re-enable the script from ZAP 178 | each time we trigger an exception during development. 179 | """ 180 | @functools.wraps(function) 181 | def wrapper(*args, **kwargs): 182 | if DEV_MODE: 183 | try: 184 | return function(*args, **kwargs) 185 | except: 186 | print("==== EXCEPTION CATCHED (DEV_MODE) ====") 187 | print(traceback.format_exc()) 188 | else: 189 | return function(*args, **kwargs) 190 | return wrapper 191 | 192 | 193 | def hash_source_code(): 194 | """ 195 | Get a hash representing the source code of current script 196 | It remains the same as long as source code has not changed 197 | """ 198 | import ctypes 199 | from org.parosproxy.paros.control import Control 200 | 201 | script_name = globals()["zap.script.name"] 202 | 203 | extLoader = Control.getSingleton().getExtensionLoader() 204 | extScript = extLoader.getExtension("ExtensionScript") 205 | script_source = extScript.getScript(script_name).getContents() 206 | 207 | h = ctypes.c_uint32(hash(script_source)).value % 0xffffff 208 | return hex(h)[2:].zfill(6) 209 | 210 | 211 | def str_to_lines(string): 212 | """yield non-empty lines from a multi-line string 213 | """ 214 | for line in string.splitlines(): 215 | if not line.strip(): 216 | continue 217 | # ignore indentation spaces 218 | while line[:4] == " ": 219 | line = line[4:] 220 | yield line 221 | 222 | 223 | def sanitize_regex(regex): 224 | # this will not work anyway with current implementation 225 | assert not regex.startswith("^") 226 | assert not regex.endswith("$") 227 | 228 | # make internal groups non-capturing to limit overhead 229 | assert not "\\\\(" in regex 230 | regex = regex.replace("\\(", "_-*placeholder1*-_") 231 | regex = regex.replace("(?:", "_-*placeholder2*-_") 232 | regex = regex.replace("(", "(?:") 233 | regex = regex.replace("_-*placeholder1*-_", "\\(") 234 | regex = regex.replace("_-*placeholder2*-_", "(?:") 235 | 236 | # limit wildcards (.* & .+ can considerably slow down processing time) 237 | regex = regex.replace(".+", ".{1,40}") 238 | regex = regex.replace(".*", ".{,40}") 239 | 240 | return regex 241 | 242 | 243 | def test_fail(obj, regex, line): 244 | global _GLOB 245 | word = "IGNORED" if obj else "FOUND" 246 | out = "-"*50 + "\n" 247 | out += "[-] Test Failed: line should be %s by regex\n" % word 248 | 249 | if regex: 250 | out += " REGEX: %s\n" % regex 251 | if line: 252 | out += " LINE: %s\n" % line 253 | if obj: 254 | out += " MATCH: %r\n\n" % obj 255 | _GLOB["ERRORS"] += out 256 | 257 | 258 | def process_regex(raw_regex, issue, 259 | test_finds="", test_ignores="", flags=0): 260 | global _GLOB 261 | 262 | issue_id = issue.replace(" ", "_kw_") + str(uuid.uuid4())[:8] 263 | 264 | assert issue_id not in _GLOB["REG_BY_IDS"] 265 | _GLOB["REG_BY_IDS"][issue_id] = raw_regex 266 | 267 | regex = "(?P<%s>%s)" % (issue_id, sanitize_regex(raw_regex)) 268 | 269 | # execute unit tests 270 | test = re.compile(regex, flags) 271 | for line in str_to_lines(test_finds): 272 | res = test.findall("\n"+line+"\n") 273 | if not res: 274 | test_fail(res, regex, line) 275 | for line in str_to_lines(test_ignores): 276 | res = test.findall("\n"+line+"\n") 277 | if res: 278 | test_fail(res, regex, line) 279 | 280 | return regex 281 | 282 | 283 | def add_strings(issue_name, strings): 284 | global _GLOB 285 | for line in str_to_lines(strings): 286 | regex = process_regex(r"\b%s\b" % line, issue_name) 287 | for t in DATA_TYPES: 288 | if _GLOB["REGEX"][t]: 289 | _GLOB["REGEX"][t] += "|" 290 | _GLOB["REGEX"][t] += regex 291 | 292 | 293 | def add_regex(issue_name, regex, 294 | test_finds, test_ignores="", ignored_types=""): 295 | global _GLOB 296 | regex = process_regex(regex, issue_name, 297 | test_finds, test_ignores) 298 | 299 | ignored_types = ignored_types.split() 300 | for t in DATA_TYPES: 301 | if t in ignored_types: 302 | continue 303 | if _GLOB["REGEX"][t]: 304 | _GLOB["REGEX"][t] += "|" 305 | _GLOB["REGEX"][t] += regex 306 | 307 | 308 | def add_iregex(issue_name, regex, 309 | test_finds, test_ignores="", ignored_types=""): 310 | global _GLOB 311 | regex = process_regex(regex, issue_name, 312 | test_finds, test_ignores, re.I) 313 | 314 | ignored_types = ignored_types.split() 315 | for t in DATA_TYPES: 316 | if t in ignored_types: 317 | continue 318 | if _GLOB["IREGEX"][t]: 319 | _GLOB["IREGEX"][t] += "|" 320 | _GLOB["IREGEX"][t] += regex 321 | 322 | 323 | def build_matcher(): 324 | 325 | ############################################################ 326 | name = "PHP Source code disclosure" 327 | 328 | add_regex(name, r"<\?(php\s|\=)", 329 | test_finds = """ 330 | data=" 332 | """, 333 | test_ignores = """ 334 | Array") 343 | 344 | add_regex(name, r"\$[a-zA-Z_][a-zA-Z0-9_]+\[", 345 | test_finds = """ 346 |  mysqli_connect($config['host'],  347 | $_POST[0] 348 | $_GET["x"] 349 | $ee[ 350 | """, 351 | test_ignores = """ 352 | $#[ 353 | $1[ 354 | $$_GET ["x"] 355 | $_GET ["x"] 356 | a$a[ 357 | $e[ 358 | """, 359 | ignored_types = "js") 360 | 361 | 362 | ############################################################ 363 | name = "JAVA Source code disclosure" 364 | 365 | add_regex(name, r'\bimport javax?\.[a-zA-Z0-9.]+;', 366 | test_finds = """ 367 | import java.io.File; 368 | import java.net.MalformedURLException; 369 | import javax.servlet.http.HttpServlet; 370 | """, 371 | test_ignores = """ 372 | Ximport javax.servlet.http.HttpServlet; 373 | """) 374 | 375 | add_regex(name, r'\bclass( \w+){1,3}\s*\{', 376 | test_finds = """ 377 | public class SimpleServlet extends HttpServlet { 378 | public class TestGate { 379 | public class TestGate{ 380 | """, 381 | test_ignores = """ 382 | public class { 383 | """) 384 | 385 | 386 | ############################################################ 387 | name = "ASP Source code disclosure" 388 | 389 | add_strings(name, "On Error Resume Next") 390 | 391 | 392 | ############################################################ 393 | name = "ASP NET Source code disclosure" 394 | 395 | add_regex(name, r'@Render[A-Z][a-z]+', 396 | test_finds = """ 397 | @RenderPage 398 | @RenderBody 399 | @RenderSection 400 | """) 401 | 402 | 403 | ############################################################ 404 | name = "C Source code disclosure" 405 | 406 | add_regex(name, r'#(include|define|ifn?def|endif)\b', 407 | test_finds = """ 408 | #include x 409 | #define 410 | #ifdef 411 | #ifndef 412 | #endif 413 | """, 414 | test_ignores = """ 415 | #includes 416 | """) 417 | 418 | 419 | ############################################################ 420 | name = "Cold Fusion Source code disclosure" 421 | 422 | add_regex(name, r' on line 73
465 | AuthPluginController.php on line 58 466 | RuntimeError: Expected object of type 467 | (RuntimeError) Element does not exist in cache 468 | @WebServlet 469 | HTTPServlet 470 | Server.CreateObject 471 | of type 'System.__ComObject 472 | The type or namespace name `Data.MySqlClient' could not be found. 473 | Class 'mysqlConnection' not found. 474 | Zend_Db_Statement_Db2_Exception 475 | Zend_Db_Adapter_Db2_Exception 476 | ArrayObject Object 477 | Servlet error : java.lang.IndexOutOfBoundsException 478 | """, 479 | test_ignores = """ 480 | Exception 481 | XExceptions 482 | Errors 483 | Bad Error. 484 | Controllers 485 | #Controller 486 | """, 487 | ignored_types = "js css") 488 | 489 | add_regex(name, r' runat=', 490 | test_finds = """ 491 | 492 |