diff --git a/Makefile b/Makefile index 25be194..6410bda 100644 --- a/Makefile +++ b/Makefile @@ -15,6 +15,7 @@ interactive-w3af: -e HTTPS_PROXY=$(HTTPS_PROXY) \ -e http_proxy=$(http_proxy) \ -e https_proxy=$(https_proxy) \ + -v "$(PWD)/resources/com/cadoles/w3af/audit.w3af.tmpl:/home/w3af/w3af/audit.w3af.tmpl:ro" \ jenkins-w3af:latest \ /bin/sh diff --git a/reports/report.html b/reports/report.html new file mode 100644 index 0000000..0a10086 --- /dev/null +++ b/reports/report.html @@ -0,0 +1,606 @@ + + + + + + + Application Security Scan Report for quid-dev-sync.cadol.es + + + + + + + +
+
+
+
+

+

Application Security Scan for quid-dev-sync.cadol.es

+

+
+
+
+
+
+

Meta-data

+

This report contains the application security scan results + for the w3af scan of the quid-dev-sync.cadol.es which finished + 15.04.2019

+
+ +
+

Configured target URLs

+
    +
  • https://quid-dev-sync.cadol.es/login
    • +
+
+ +
+

Enabled plugins

+
    +
  • audit
    +
      +
    • file_upload
      • +
    • os_commanding
      • +
    • lfi
      • +
    • blind_sqli
      • +
    • sqli
      • +
    • dav
      • +
    • eval
      • +
    • rfi
      • +
    +
    • +
  • infrastructure
    +
      +
    • allowed_methods
      • +
    • server_header
      • +
    +
    • +
  • grep
    +
      +
    +
    • +
  • evasion
    +
      +
    +
    • +
  • crawl
    +
      +
    • web_spider
      • +
    +
    • +
  • auth
    +
      +
    • detailed
      • +
    +
    • +
  • bruteforce
    +
      +
    +
    • +
  • output
    +
      +
    • html_file
      • +
    • console
      • +
    +
    • +
  • mangle
    +
      +
    +
    • +
+
+
+
+
+
+
+
+

Server header

+

INFO

+
+
+
+
+

Summary

+

The server header for the remote web server is: "nginx/1.10.3 (Ubuntu)". This information was found in the request with id 28.

+ +
+
+
+
+
+
+
    + +
+
+
+
+ + + +
+
+

HTTP proof

+
+
+ +
+
+
+ 
GET https://quid-dev-sync.cadol.es/login HTTP/1.1
+Accept-encoding: gzip, deflate
+Accept: */*
+User-agent: w3af.org
+Host: quid-dev-sync.cadol.es
+Cookie: quid_sync=MTU1NTM1MjM5Nnwxa2ZEUDdUdmd4YnNSMFJsRkJ6d0FjTTlLdFVaTm5SeU5IQzFvUVNuWnh1RWs2bllEc25QTzE5dWNDQWVfN3pvVFgwSWl1NHV1a2NUN0lkcnZ0T2FERVcxZE9EYmtseHJ3Q2VEaUJyX3pScmdfb1hZdE4ybWF2cTBYVklva2w5QlZQdz18TXiAblvgNn75j8ki3zz4no_1jtW6rjREpPmO9H5-uzE=
+Authorization: Basic ZWZzOnF1aWRkZXYyMDE5
+
+
+
+
+
+
+ 
HTTP/1.1 200 OK
+content-length: 585
+content-encoding: gzip
+set-cookie: quid_sync=MTU1NTM1MjM5NnxNbjJLSVRVcUtLd3FUMnN1OUQwazFkc3RyT3FPX1Izbks4MHp3ZG9oWmRscWJBOUpzallNSnl4ZDJfVlROZXQwWFpmSXBQbU9OcjZROC15VkVPVVRPNFlyM3ZRdlFrRDRBRjJjVVMyTFlDWlhHQ2k1Q3ZULTRKMlM0akUyR3BnNUNPRT18YKydkxi11UB8j6ONxtW3h3lddmW2WBIdDi22lslK7lc=; Path=/; Expires=Wed, 15 May 2019 18:19:56 GMT; Max-Age=2592000
+server: nginx/1.10.3 (Ubuntu)
+connection: keep-alive
+date: Mon, 15 Apr 2019 18:19:56 GMT
+x-frame-options: SAMEORIGIN, SAMEORIGIN
+content-type: text/html; charset=utf-8
+
+
+
+
+
+<!DOCTYPE html>
+<html lang="fr">
+  <head>
+    
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    
+    <title>Authentification - Quid</title>
+    
+  <link rel="stylesheet" href="/css/sync-app.css">
+
+  </head>
+  <body>
+    
+  
+<section class="hero is-fullheight login">
+  <div class="hero-body">
+    <div class="container">
+      <div class="column is-4 is-offset-4">
+        
+  <div class="flash has-margin-top-small"></div>
+
+        <div class="has-text-centered has-margin-top-small">
+          <div class="box">
+            <figure class="avatar">
+              <img src="/img/logo-efs.svg" width="128" height="128">
+            </figure>
+            <form method="POST">
+              <div class="field">
+                <div class="control">
+                  <input class="input is-normal"
+                    name="email" type="email" 
+                    placeholder="Votre adresse courriel" autofocus="">
+                </div>
+              </div>
+              <div class="field">
+              <div class="control">
+                <input class="input is-normal" 
+                  name="password" type="password" 
+                  placeholder="Votre mot de passe">
+              </div>
+              </div>
+              <button class="button is-block is-info is-normal is-fullwidth">S'identifier</button>
+            </form>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+</section>
+
+
+    
+  </body>
+</html>
+
+
+
+
+
+
+
+

Allowed HTTP methods

+

INFO

+
+
+
+
+

Summary

+

The URL "https://quid-dev-sync.cadol.es/" has the following enabled HTTP methods: *, GET. This information was found in the requests with ids 27, 174 and 179.

+ +
+

Description

+

There are a number of HTTP methods that can be used on a webserver +(OPTIONS, HEAD, GET, POST, PUT, DELETE etc.). Each of +these methods perform a different function and each have an associated +level of risk when their use is permitted on the webserver.

+

A client +can use the OPTIONS method within a request to query a server to +determine which methods are allowed.

+

Cyber-criminals will almost +always perform this simple test as it will give a very quick +indication of any high-risk methods being permitted by the server. +The tool discovered that several methods are supported by the server.

+
+
+
+
+
+
+ +
+
+
+ +
+
+
+

Fix

+

It is recommended that a whitelisting approach be taken to explicitly +permit the HTTP methods required by the application and block all +others.

+

Typically the only HTTP methods required for most +applications are GET and POST. All other methods perform actions +that are rarely required or perform actions that are inherently risky. +These risky methods (such as PUT, DELETE, etc) should be protected +by strict limitations, such as ensuring that the channel is secure +(SSL/TLS enabled) and only authorised and trusted clients are +permitted to use them.

+ +

References

+ +
+
+
+ + +
+
+

HTTP proof

+
+
+ +
+
+
+ 
OPTIONS https://quid-dev-sync.cadol.es/ HTTP/1.1
+Accept-encoding: gzip, deflate
+Accept: */*
+User-agent: w3af.org
+Host: quid-dev-sync.cadol.es
+Cookie: quid_sync=MTU1NTM1MjM5Nnwxa2ZEUDdUdmd4YnNSMFJsRkJ6d0FjTTlLdFVaTm5SeU5IQzFvUVNuWnh1RWs2bllEc25QTzE5dWNDQWVfN3pvVFgwSWl1NHV1a2NUN0lkcnZ0T2FERVcxZE9EYmtseHJ3Q2VEaUJyX3pScmdfb1hZdE4ybWF2cTBYVklva2w5QlZQdz18TXiAblvgNn75j8ki3zz4no_1jtW6rjREpPmO9H5-uzE=
+Authorization: Basic ZWZzOnF1aWRkZXYyMDE5
+
+
+
+
+
+
+ 
HTTP/1.1 405 Method Not Allowed
+date: Mon, 15 Apr 2019 18:19:56 GMT
+content-length: 0
+connection: keep-alive
+server: nginx/1.10.3 (Ubuntu)
+
+
+
+
+
+
+ 
GET https://quid-dev-sync.cadol.es/ HTTP/1.1
+Accept-encoding: gzip, deflate
+Accept: */*
+User-agent: w3af.org
+Host: quid-dev-sync.cadol.es
+Cookie: quid_sync=MTU1NTM1MjQwMnx0OW0zb2t1a3F0M1hOSFI0S3V2TFhhRG9wZ1RxMWZaUzlmdTZzSGMyTzV1aXVEZ0Jwakt1Z3FBSVdmSnh6Mkt6XzRfTmdzLTlPTzRlZ056eW9ncTlCRElDTndBaGpmV3kyQW9LQlFzVnN1XzMyWDdMei1BVkJQcFo0cUJpTDV1eWowRT18EoBy_faVfRRNOYwAG3u6kGEw2hAnDTWn_6SsTFVd_-E=
+Authorization: Basic ZWZzOnF1aWRkZXYyMDE5
+
+
+
+
+
+
+ 
HTTP/1.1 303 See Other
+content-length: 68
+content-encoding: gzip
+server: nginx/1.10.3 (Ubuntu)
+connection: keep-alive
+location: /surveys/overview
+date: Mon, 15 Apr 2019 18:20:02 GMT
+x-frame-options: SAMEORIGIN, SAMEORIGIN
+content-type: text/html; charset=utf-8
+
+<a href="/surveys/overview">See Other</a>.
+
+
+
+
+
+
+ 
* https://quid-dev-sync.cadol.es/ HTTP/1.1
+Accept-encoding: gzip, deflate
+Accept: */*
+User-agent: w3af.org
+Host: quid-dev-sync.cadol.es
+Cookie: quid_sync=MTU1NTM1MjQwMXwyWjloNmtlcVA2WHFTU1VpNVhEY0xOOGJMYnA5U2dpakFrVzlYNnI2ekY0WmVPVEx1ZlJLdGlMVlhrb21sUHpJUFMxa1p6RkpXbFVIWkVGQWdZc1VMS3Z0MDVYMFZDb3M2Y3pzZ3pXbkRnODlMTXZ1dzFLRTM5MWhxdE84NElvUzloeFAwR080dWwxa0lieExZWjJSaHREQWpwNEdzek1mVkJQOEFQLXZiUjZkS3dFVS1rUTNQVHJXVVJ0MUxkX1hVT0p4MGFMNzBWTDBFSDlnd01YSlpoN0dhSzNHUTRXaDBjal9fOUdESTdBWjNSQVRYbmpBdEs0LV9OZlBBaEFQQl9fT2tVWC0yVW55SW12R1hvSWI5NENqNzh3Wm92UnhORUJCMEZZYjBjSldIU0tjY1pHdUh6c3daUTIxX0xJcFNFWjBtTTI3NWNzNjRmVERLSWUzQXQ5ay13SS1VWWhPXzVEUWZ2dEhJbjZJZkRNanRpQjhTeGpQNDJiSUstdy1DU1UxQ25wc2xxZGFLVUY4dElOQU9vWmRQdXUwZlkxUlp2cTBmYUhHWkE3am9oYjVJbGZ4U0k5M3BpY0hoOHlZOWVOd1F4eTVQNDRQX3lSbC1ETkZDdktidDdiVjA1ak9xTG9BZVhTSEZIQkEySVhUTFJhRy1zMHMtR09JZndXdUFfMmJiUjJ2RnlVcm1ZWlMtcUFmN1ZJPXw4gdJc3OeP2rbnQuqmjJmH_UqN_hmOjAyXwl4vWXmTUw==
+Authorization: Basic ZWZzOnF1aWRkZXYyMDE5
+
+
+
+
+
+
+ 
HTTP/1.1 400 Bad Request
+date: Mon, 15 Apr 2019 18:20:02 GMT
+content-length: 182
+content-type: text/html
+connection: close
+server: nginx/1.10.3 (Ubuntu)
+
+<html>
+<head><title>400 Bad Request</title></head>
+<body bgcolor="white">
+<center><h1>400 Bad Request</h1></center>
+<hr><center>nginx/1.10.3 (Ubuntu)</center>
+</body>
+</html>
+
+
+
+
+
+
+
+

Omitted server header

+

INFO

+
+
+
+
+

Summary

+

The remote HTTP Server omitted the "server" header in its response. This information was found in the request with id 912.

+ +
+
+
+
+
+
+
    + +
+
+
+
+ + + +
+
+

HTTP proof

+
+
+ +
+
+
+ 
None
+
+
+
+
+
+
+ 
None
+
+
+
+
+ +
+
+
+

+

URLs found during application scan

+

+
+
+
+
+
+ +
+
+
+
+ +
+
+
+

+

Scan log

+

+
+
+
+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + +
TimestampLog levelMessage
Mon Apr 15 18:19:55 2019errorCan't login into web application as admin@quid.local
Mon Apr 15 18:19:57 2019erroraudit.rfi plugin needs to be correctly configured to use. Please set valid values for local address (eg. 10.5.2.5) and port (eg. 44449), or use the official w3af site as the target server for remote inclusions. The configuration error is: "Listen address and port need to be configured"
Mon Apr 15 18:20:39 2019errorThe server_header plugin got an error while requesting "https://quid-dev-sync.cadol.es/surveys/f70c64f0-d5e2-4794-b967-db668f196322/edit/0". Exception: "HTTP timeout error". Generated 204 "No Content" response (id:912)
+
+
+
+
+ +
+ + + \ No newline at end of file diff --git a/resources/com/cadoles/w3af/Dockerfile b/resources/com/cadoles/w3af/Dockerfile index cba3277..d935fc5 100644 --- a/resources/com/cadoles/w3af/Dockerfile +++ b/resources/com/cadoles/w3af/Dockerfile @@ -1,3 +1,19 @@ +FROM golang:1.11.4 as envtpl + +ARG HTTP_PROXY= +ARG HTTPS_PROXY= +ARG http_proxy= +ARG https_proxy= + +RUN apt-get update -y && apt-get install -y git + +RUN git clone https://github.com/subfuzion/envtpl /src \ + && cd /src \ + && git checkout v1.0.0 \ + && CGO_ENABLED=0 GOOS=linux go build \ + -ldflags "-X main.AppVersionMetadata=$(date -u +%s)" \ + -a -installsuffix cgo -o ./bin/envtpl ./cmd/envtpl/. + FROM alpine:3.9 ARG HTTP_PROXY= @@ -5,6 +21,8 @@ ARG HTTPS_PROXY= ARG http_proxy= ARG https_proxy= +COPY --from=envtpl /src/bin/envtpl /usr/local/bin/envtpl + RUN apk --no-cache add \ build-base \ git \ @@ -78,4 +96,6 @@ RUN git clone --depth=1 \ USER w3af WORKDIR /home/w3af/w3af +COPY audit.w3af.tmpl audit.w3af.tmpl + CMD ["./w3af_console"] \ No newline at end of file diff --git a/resources/com/cadoles/w3af/audit.w3af b/resources/com/cadoles/w3af/audit.w3af deleted file mode 100644 index 81a7ef5..0000000 --- a/resources/com/cadoles/w3af/audit.w3af +++ /dev/null @@ -1,65 +0,0 @@ -# ----------------------------------------------------------------------------------------------------------- -# W3AF AUDIT SCRIPT FOR WEB APPLICATION -# ----------------------------------------------------------------------------------------------------------- -#Configure HTTP settings -http-settings -set timeout 30 -back -#Configure scanner global behaviors -misc-settings -set max_discovery_time 20 -set fuzz_cookies True -set fuzz_form_files True -set fuzz_url_parts True -set fuzz_url_filenames True -back -plugins -#Configure entry point (CRAWLING) scanner -crawl web_spider -crawl config web_spider -set only_forward False -set ignore_regex (?i)(logout|disconnect|signout|exit)+ -back -#Configure vulnerability scanners -##Specify list of AUDIT plugins type to use -audit blind_sqli, buffer_overflow, cors_origin, csrf, eval, file_upload, ldapi, lfi, os_commanding, phishing_vector, redos, response_splitting, sqli, xpath, xss, xst -##Customize behavior of each audit plugin when needed -audit config file_upload -set extensions jsp,php,php2,php3,php4,php5,asp,aspx,pl,cfm,rb,py,sh,ksh,csh,bat,ps,exe -back -##Specify list of GREP plugins type to use (grep plugin is a type of plugin that can find also vulnerabilities or informations disclosure) -grep analyze_cookies, click_jacking, code_disclosure, cross_domain_js, csp, directory_indexing, dom_xss, error_500, error_pages, -html_comments, objects, path_disclosure, private_ip, strange_headers, strange_http_codes, strange_parameters, strange_reason, url_session, xss_protection_header -##Specify list of INFRASTRUCTURE plugins type to use (infrastructure plugin is a type of plugin that can find informations disclosure) -infrastructure server_header, server_status, domain_dot, dot_net_errors -#Configure target authentication -auth detailed -auth config detailed -set username admin -set password password -set method POST -set auth_url http://pcdom/dvwa/login.php -set username_field user -set password_field pass -set check_url http://pcdom/dvwa/index.php -set check_string 'admin' -set data_format username=%U&password=%P&Login=Login -back -#Configure reporting in order to generate an HTML report -output console, html_file -output config html_file -set output_file /tmp/W3afReport.html -set verbose False -back -output config console -set verbose False -back -back -#Set target informations, do a cleanup and run the scan -target -set target http://pcdom/dvwa -set target_os windows -set target_framework php -back -cleanup -start \ No newline at end of file diff --git a/resources/com/cadoles/w3af/audit.w3af.tmpl b/resources/com/cadoles/w3af/audit.w3af.tmpl new file mode 100644 index 0000000..44f9158 --- /dev/null +++ b/resources/com/cadoles/w3af/audit.w3af.tmpl @@ -0,0 +1,72 @@ +# ----------------------------------------------------------------------------------------------------------- +# W3AF AUDIT SCRIPT FOR WEB APPLICATION +# ----------------------------------------------------------------------------------------------------------- + +#Configure HTTP settings +http-settings +set timeout {{ default 10 .W3AF_TIMEOUT }} +{{ if .W3AF_BASIC_AUTH_USERNAME }} +set basic_auth_user {{ .W3AF_BASIC_AUTH_USERNAME }} +set basic_auth_passwd {{ .W3AF_BASIC_AUTH_PASSWORD }} +{{if .W3AF_BASIC_AUTH_DOMAIN }} +set basic_auth_domain {{ .W3AF_BASIC_AUTH_DOMAIN }} +{{end}} +{{ end }} +back + +#Configure scanner global behaviors +misc-settings +set max_discovery_time {{ default 10 .W3AF_MAX_DISCOVERY_TIME }} +set fuzz_cookies True +set fuzz_form_files True +set fuzz_url_parts True +set fuzz_url_filenames True +back + +profiles +use {{ default "audit_high_risk" .W3AF_PROFILE }} +back + +plugins + +{{ if .W3AF_AUTH_FORM_URL }} +#Configure target authentication +auth detailed +auth config detailed +set username {{ .W3AF_AUTH_FORM_USERNAME }} +set password {{ .W3AF_AUTH_FORM_PASSWORD }} +set method POST +set auth_url {{ .W3AF_AUTH_FORM_URL }} +set username_field {{ default "username" .W3AF_AUTH_FORM_USERNAME_FIELD }} +set password_field {{ default "password" .W3AF_AUTH_FORM_PASSWORD_FIELD }} +set data_format {{ default "username=%U&password=%P" .W3AF_AUTH_FORM_DATA_FORMAT }} +set check_url {{ .W3AF_AUTH_FORM_CHECK_URL }} +set check_string '{{- default "connected" .W3AF_AUTH_FORM_CHECK_STRING -}}' +back +{{end}} + + +#Configure reporting in order to generate an HTML report +output console, html_file +output config html_file +set output_file reports/report{{- if .W3AF_REPORT_SUFFIX -}}_{{- .W3AF_REPORT_SUFFIX -}}{{- end -}}.html +set verbose {{ default "False" .W3AF_VERBOSE }} +back + +output config console +set verbose {{ default "False" .W3AF_VERBOSE }} +back +back + +#Set target informations, do a cleanup and run the scan +target +set target {{ .W3AF_TARGET_URL }} +set target_os {{ default "unix" .W3AF_TARGET_OS }} +set target_framework {{ default "unknown" .W3AF_TARGET_FRAMEWORK }} +back + +back + +cleanup +start +exit \ No newline at end of file diff --git a/vars/audit.groovy b/vars/audit.groovy index e985820..07c24e5 100644 --- a/vars/audit.groovy +++ b/vars/audit.groovy @@ -8,8 +8,44 @@ def call() { parameters { string( - name: 'url', - description: 'URL d\'entrée pour l\'audit' + name: 'targetUrl', + description: 'URL cible pour l\'audit' + ) + string( + name: 'basicAuthUsername', + description: "Nom d'utilisateur pour l'authentication 'Basic Auth' (si besoin)" + ) + password( + name: 'basicAuthPassword', + description: "Mot de passe pour l'authentication 'Basic Auth' (si besoin)" + ) + string( + name: 'basicAuthDomain', + description: "Nom de domaine pour l'authentication 'Basic Auth' (si besoin)" + ) + string( + name: 'authFormUrl', + description: "URL du formulaire d'authentication (si besoin)" + ) + string( + name: 'authFormUsername', + description: "Nom d'utilisateur du formulaire d'authentication (si besoin)" + ) + password( + name: 'authFormPassword', + description: "Mot de passe du formulaire d'authentication (si besoin)" + ) + string( + name: 'authFormCheckUrl', + description: "URL de vérification de la réussite de l'authentication (si besoin)" + ) + string( + name: 'authFormCheckString', + description: "Chaine de caractères à rechercher pour vérifier la réussite de l'authentication (si besoin)" + ) + string( + name: 'authFormDataFormat', + description: "Patron de formatage des données POST du formulaire d'authentification (si besoin). Exemple: username=%U&password=%P" ) } @@ -19,7 +55,7 @@ def call() { steps { script { if (!params.url?.trim()) { - error("L'URL du paquet n'est pas définie !") + error("L'URL cible n'est pas définie !") } } } @@ -30,32 +66,54 @@ def call() { script { def w3afImage = buildDockerImage() def dockerArgs = """ + -e W3AF_TARGET='${params.targetUrl}' + -e W3AF_BASIC_AUTH_USERNAME='${params.basicAuthUsername}' + -e W3AF_BASIC_AUTH_PASSWORD='${params.basicAuthPassword}' + -e W3AF_BASIC_AUTH_DOMAIN='${params.basicAuthDomain}' + -e W3AF_AUTH_FORM_URL='${params.authFormUrl}' + -e W3AF_AUTH_FORM_USERNAME='${params.authFormUsername}' + -e W3AF_AUTH_FORM_PASSWORD='${params.authFormPassword}' + -e W3AF_AUTH_FORM_CHECK_URL='${params.authFormCheckUrl}' + -e W3AF_AUTH_FORM_CHECK_STRING='${params.authFormCheckString}' + -e W3AF_AUTH_FORM_DATA_FORMAT='${params.authFormDataFormat}' """ w3afImage.inside(dockerArgs) { - sh './w3af_console ' + sh 'mkdir reports' + sh 'envtpl -o audit.w3af audit.w3af.tmpl' + sh './w3af_console -y -n -s audit.w3af' } } } } } - // post { - // failure { - // wrap([$class: 'BuildUser']) { - // rocketSend ( - // avatar: 'https://jenkins.cadol.es/static/b5f67753/images/headshot.png', - // message: """ - // Le test de sécurité pour `${params.url}` a échoué: + post { + always { + publishHTML target: [ + allowMissing: true, + alwaysLinkToLastBuild: false, + keepAll: true, + reportDir: 'reports', + reportFiles: 'report.html', + reportName: "Rapport d'audit" + ] + } + failure { + // wrap([$class: 'BuildUser']) { + // rocketSend ( + // avatar: 'https://jenkins.cadol.es/static/b5f67753/images/headshot.png', + // message: """ + // Le test de sécurité pour `${params.targetUrl}` a échoué: - // [Voir le job](${env.RUN_DISPLAY_URL}) + // [Voir le job](${env.RUN_DISPLAY_URL}) - // @${env.BUILD_USER_ID ? env.BUILD_USER_ID : 'here'} - // """.stripIndent(), - // rawMessage: true - // ) - // } - // } - // } + // @${env.BUILD_USER_ID ? env.BUILD_USER_ID : 'here'} + // """.stripIndent(), + // rawMessage: true + // ) + // } + } + } } }