'''
formatString.py
Copyright 2006 Andres Riancho
This file is part of w3af, w3af.sourceforge.net .
w3af is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation version 2 of the License.
w3af is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with w3af; if not, write to the Free Software
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
'''
from core.data.fuzzer.fuzzer import *
import core.controllers.outputManager as om
from core.controllers.basePlugin.baseAuditPlugin import baseAuditPlugin
from core.controllers.w3afException import w3afException
import core.data.parsers.urlParser as urlParser
import core.data.kb.knowledgeBase as kb
import core.data.kb.vuln as vuln
class formatString(baseAuditPlugin):
'''
This plugin tests for format String bugs.
@author: Andres Riancho ( andres.riancho@gmail.com )
'''
def __init__(self):
baseAuditPlugin.__init__(self)
def _fuzzRequests(self, freq ):
'''
Tests an URL for format string vulnerabilities.
@param freq: A fuzzableRequest
'''
om.out.debug( 'formatString plugin is testing: ' + freq.getURL() )
strList = self._getStringList()
mutants = createMutants( freq , strList )
for mutant in mutants:
targs = (mutant,)
self._tm.startFunction( target=self._sendMutant, args=targs, ownerObj=self )
def _analyzeResult( self, mutant, response ):
'''
Analyze results of the _sendMutant method.
'''
for error in self._getErrors():
# hmmm...
if response.getBody().count( error ):
v = vuln.vuln( mutant )
v.setId( response.id )
v.setDesc( 'A possible (detection is really hard...) format string was found at: ' + response.getURL() + ' . Using method: ' + v.getMethod() + '. The data sent was: ' + str(mutant.getDc()) )
kb.kb.append( self, 'formatString', v )
def _getErrors( self ):
res = []
res.append('\n500 Internal Server Error\n\nInternal Server Error
')
return res
def end(self):
'''
This method is called when the plugin wont be used anymore.
'''
self._tm.join( self )
self.printUniq( kb.kb.getData( 'formatString', 'formatString' ), 'VAR' )
def _getStringList( self ):
'''
@return: This method returns a list of format strings.
'''
strings = []
lengths = [ 1 , 10 , 25, 50, 100 ]
for l in lengths:
strings.append( createFormatString( l ) )
return strings
def getOptionsXML(self):
'''
This method returns a XML containing the Options that the plugin has.
Using this XML the framework will build a window, a menu, or some other input method to retrieve
the info from the user. The XML has to validate against the xml schema file located at :
w3af/core/ui/userInterface.dtd
@return: XML with the plugin options.
'''
return '\
\
\
'
def setOptions( self, OptionList ):
'''
This method sets all the options that are configured using the user interface
generated by the framework using the result of getOptionsXML().
@parameter OptionList: A dictionary with the options for the plugin.
@return: No value is returned.
'''
pass
def getPluginDeps( self ):
'''
@return: A list with the names of the plugins that should be runned before the
current one.
'''
return []
def getLongDesc( self ):
'''
@return: A DETAILED description of the plugin functions and features.
'''
return '''
This plugin will find format string bugs.
Users have to know that detecting a format string vulnerability will be only possible if the server is configured
to return errors, and the application is developed in cgi-c or some other language that allows the programmer to
do this kind of mistakes.
'''