Skip to content

Commit 1c1cd85

Browse files
thc202thc202
authored
Merge pull request #446 from ricekot/passive-scripts-metadata
Implement `getMetadata` for some Passive scripts
2 parents c80fe5d + 1abafbe commit 1c1cd85

File tree

8 files changed

+154
-171
lines changed

8 files changed

+154
-171
lines changed

‎CHANGELOG.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
1919
- active/gof_lite.js
2020
- active/JWT None Exploit.js
2121
- active/SSTI.js
22+
- passive/clacks.js
23+
- passive/CookieHTTPOnly.js
24+
- passive/detect_csp_notif_and_reportonly.js
25+
- passive/detect_samesite_protection.js
26+
- passive/f5_bigip_cookie_internal_ip.js
2227

2328
## [18] - 2024-01-29
2429
### Added

‎active/Cross Site WebSocket Hijacking.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,8 +61,8 @@ references:
6161
category: server
6262
risk: high
6363
confidence: medium
64-
cweId: 346 # CWE-346: Origin Validation Error, http://cwe.mitre.org/data/definitions/346.html
65-
wascId: 9 # WASC-9 Cross Site Request Forgery, http://projects.webappsec.org/w/page/13246919/Cross%20Site%20Request%20Forgery
64+
cweId: 346 # CWE-346: Origin Validation Error
65+
wascId: 9 # WASC-9 Cross Site Request Forgery
6666
alertTags:
6767
${CommonAlertTag.OWASP_2021_A01_BROKEN_AC.getTag()}: ${CommonAlertTag.OWASP_2021_A01_BROKEN_AC.getValue()}
6868
${CommonAlertTag.OWASP_2017_A05_BROKEN_AC.getTag()}: ${CommonAlertTag.OWASP_2017_A05_BROKEN_AC.getValue()}

‎active/JWT None Exploit.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ references:
2323
category: server
2424
risk: high
2525
confidence: medium
26-
cweId: 347 # CWE-347: Improper Verification of Cryptographic Signature, http://cwe.mitre.org/data/definitions/347.html
26+
cweId: 347 # CWE-347: Improper Verification of Cryptographic Signature
2727
wascId: 15 # WASC-15: Application Misconfiguration
2828
alertTags:
2929
${CommonAlertTag.OWASP_2021_A01_BROKEN_AC.getTag()}: ${CommonAlertTag.OWASP_2021_A01_BROKEN_AC.getValue()}

‎passive/CookieHTTPOnly.js‎

Lines changed: 24 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,32 @@
11
// Cookie HttpOnly Check by freakyclown@gmail.com
22

3-
function scan(ps, msg, src) {
4-
var alertRisk = 1;
5-
var alertConfidence = 2;
6-
var alertTitle = "Cookie set without HTTPOnly Flag(script)";
7-
var alertDesc =
8-
"A cookie has been set without the HttpOnly flag, which means that the cookie can be accessed by JavaScript. If a malicious script can be run on this page then the cookie will be accessible and can be transmitted to another site. If this is a session cookie then session hijacking may be possible.";
9-
var alertSolution = "Ensure that the HttpOnly flag is set for all cookies.";
3+
var ScanRuleMetadata = Java.type(
4+
"org.zaproxy.addon.commonlib.scanrules.ScanRuleMetadata"
5+
);
106

11-
var cweId = 0;
12-
var wascId = 13;
13-
14-
var url = msg.getRequestHeader().getURI().toString();
15-
var headers = msg.getResponseHeader().getHeaders("Set-Cookie");
7+
function getMetadata() {
8+
return ScanRuleMetadata.fromYaml(`
9+
id: 100003
10+
name: Cookie Set Without HttpOnly Flag
11+
description: >
12+
A cookie has been set without the HttpOnly flag, which means that the cookie can be accessed by JavaScript.
13+
If a malicious script can be run on this page then the cookie will be accessible and can be transmitted to another site.
14+
If this is a session cookie then session hijacking may be possible.
15+
solution: Ensure that the HttpOnly flag is set for all cookies.
16+
risk: low
17+
confidence: medium
18+
cweId: 0
19+
wascId: 13 # WASC-13: Information Leakage
20+
status: alpha
21+
`);
22+
}
1623

17-
if (headers != null) {
24+
function scan(helper, msg, src) {
25+
var cookies = msg.getResponseHeader().getHeaders("Set-Cookie");
26+
if (cookies != null) {
1827
var re_noflag = /([Hh][Tt][Tt][Pp][Oo][Nn][Ll][Yy])/g;
19-
if (!re_noflag.test(headers)) {
20-
ps.raiseAlert(
21-
alertRisk,
22-
alertConfidence,
23-
alertTitle,
24-
alertDesc,
25-
url,
26-
"",
27-
"",
28-
"",
29-
alertSolution,
30-
headers,
31-
cweId,
32-
wascId,
33-
msg
34-
);
28+
if (!re_noflag.test(cookies)) {
29+
helper.newAlert().setMessage(msg).setEvidence(cookies).raise();
3530
}
3631
}
3732
}

‎passive/clacks.js‎

Lines changed: 22 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,30 @@
11
// Clacks Header Check by freakyclown@gmail.com
22

3-
function scan(ps, msg, src) {
4-
var alertRisk = 0;
5-
var alertConfidence = 3;
6-
var alertTitle = "Server is running on CLACKS - GNU Terry Pratchett";
7-
var alertDesc =
8-
"The web/application server is running over the CLACKS network, some say its turtles/IP, some says its turtles all the way down the layer stack.";
9-
var alertSolution =
10-
"Give the sys admin a high five and rejoice in the disc world.";
3+
var ScanRuleMetadata = Java.type(
4+
"org.zaproxy.addon.commonlib.scanrules.ScanRuleMetadata"
5+
);
116

12-
var cweId = 200;
13-
var wascId = 13;
7+
function getMetadata() {
8+
return ScanRuleMetadata.fromYaml(`
9+
id: 100002
10+
name: Server is running on Clacks - GNU Terry Pratchett
11+
description: >
12+
The web/application server is running over the Clacks network, some say it's turtles/IP,
13+
some say it's turtles all the way down the layer stack.
14+
solution: Give the sysadmin a high five and rejoice in the disc world.
15+
references:
16+
- https://xclacksoverhead.org/home/about
17+
risk: info
18+
confidence: high
19+
cweId: 200 # CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
20+
wascId: 13 # WASC-13: Information Leakage
21+
status: alpha
22+
`);
23+
}
1424

15-
var url = msg.getRequestHeader().getURI().toString();
25+
function scan(helper, msg, src) {
1626
var headers = msg.getResponseHeader().getHeaders("X-Clacks-Overhead");
17-
1827
if (headers != null) {
19-
ps.raiseAlert(
20-
alertRisk,
21-
alertConfidence,
22-
alertTitle,
23-
alertDesc,
24-
url,
25-
"",
26-
"",
27-
"",
28-
alertSolution,
29-
headers,
30-
cweId,
31-
wascId,
32-
msg
33-
);
28+
helper.newAlert().setMessage(msg).setEvidence(headers).raise();
3429
}
3530
}

‎passive/detect_csp_notif_and_reportonly.js‎

Lines changed: 28 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,26 @@ [email protected]
1818
*/
1919

2020
var Locale = Java.type("java.util.Locale");
21+
var ScanRuleMetadata = Java.type(
22+
"org.zaproxy.addon.commonlib.scanrules.ScanRuleMetadata"
23+
);
24+
25+
function getMetadata() {
26+
return ScanRuleMetadata.fromYaml(`
27+
id: 100004
28+
name: Content Security Policy Violations Reporting Enabled
29+
solution: >
30+
Site owner will be notified at each policies violations, so, start by analyzing if a real monitoring of the
31+
notifications is in place before to use fuzzing or to be more aggressive.
32+
references:
33+
- https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Using_CSP_violation_reports
34+
risk: info
35+
confidence: high
36+
cweId: 200 # CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
37+
wascId: 13 # WASC-13: Information Leakage
38+
status: alpha
39+
`);
40+
}
2141

2242
function extractUrl(cspPolicies, cspReportInstruction) {
2343
//Extract the URL to which any CSP violations are reported
@@ -37,18 +57,7 @@ function extractUrl(cspPolicies, cspReportInstruction) {
3757
}
3858
}
3959

40-
function scan(ps, msg, src) {
41-
//Docs on alert raising function:
42-
// raiseAlert(risk, int confidence, String name, String description, String uri,
43-
// String param, String attack, String otherInfo, String solution, String evidence,
44-
// int cweId, int wascId, HttpMessage msg)
45-
// risk: 0: info, 1: low, 2: medium, 3: high
46-
// confidence: 0: falsePositive, 1: low, 2: medium, 3: high, 4: confirmed
47-
48-
//Common variables
49-
var cweId = 200;
50-
var wascId = 13;
51-
var url = msg.getRequestHeader().getURI().toString();
60+
function scan(helper, msg, src) {
5261
var cspHeaderNames = [
5362
"Content-Security-Policy",
5463
"X-Content-Security-Policy",
@@ -57,7 +66,6 @@ function scan(ps, msg, src) {
5766
];
5867
var cspReportInstruction = "report-uri";
5968

60-
//Response headers collection
6169
var responseHeaders = msg.getResponseHeader();
6270

6371
//Detect and analyze presence of the CSP headers
@@ -84,25 +92,13 @@ function scan(ps, msg, src) {
8492
" mode) report violation to '" +
8593
reportUrl +
8694
"'.";
87-
var infoLinkRef =
88-
"https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Using_CSP_violation_reports";
89-
var solution =
90-
"Site owner will be notified at each policies violations, so, start by analyzing if a real monitoring of the notifications is in place before to use fuzzing or to be more aggressive.";
91-
ps.raiseAlert(
92-
0,
93-
3,
94-
"Content Security Policy violations reporting enabled",
95-
description,
96-
url,
97-
"HTTP response header '" + headerName + "'",
98-
"",
99-
infoLinkRef,
100-
solution,
101-
headerValues[j],
102-
cweId,
103-
wascId,
104-
msg
105-
);
95+
helper
96+
.newAlert()
97+
.setDescription(description)
98+
.setParam("HTTP response header '" + headerName + "'")
99+
.setEvidence(headerValues[j])
100+
.setMessage(msg)
101+
.raise();
106102
}
107103
}
108104
}

‎passive/detect_samesite_protection.js‎

Lines changed: 28 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -13,19 +13,29 @@ [email protected]
1313
*/
1414

1515
var Locale = Java.type("java.util.Locale");
16+
var ScanRuleMetadata = Java.type(
17+
"org.zaproxy.addon.commonlib.scanrules.ScanRuleMetadata"
18+
);
1619

17-
function scan(ps, msg, src) {
18-
//Docs on alert raising function:
19-
// raiseAlert(risk, int confidence, String name, String description, String uri,
20-
// String param, String attack, String otherInfo, String solution, String evidence,
21-
// int cweId, int wascId, HttpMessage msg)
22-
// risk: 0: info, 1: low, 2: medium, 3: high
23-
// confidence: 0: falsePositive, 1: low, 2: medium, 3: high, 4: confirmed
20+
function getMetadata() {
21+
return ScanRuleMetadata.fromYaml(`
22+
id: 100005
23+
name: SameSite Cookie Attribute Protection Used
24+
solution: >
25+
CSRF possible vulnerabilities presents on the site will be mitigated depending on the browser used by the user
26+
(browser defines the support level for this cookie attribute).
27+
references:
28+
- https://tools.ietf.org/html/draft-west-first-party-cookies
29+
- https://chloe.re/2016/04/13/goodbye-csrf-samesite-to-the-rescue
30+
risk: info
31+
confidence: high
32+
cweId: 352 # CWE-352: Cross-Site Request Forgery (CSRF)
33+
wascId: 9 # WASC-9: Cross Site Request Forgery
34+
status: alpha
35+
`);
36+
}
2437

25-
//Common variables
26-
var cweId = 352;
27-
var wascId = 9;
28-
var url = msg.getRequestHeader().getURI().toString();
38+
function scan(helper, msg, src) {
2939
var cookieHeaderNames = ["Set-Cookie", "Set-Cookie2"];
3040
var cookieSameSiteAttributeNameLower = "samesite";
3141

@@ -57,25 +67,13 @@ function scan(ps, msg, src) {
5767
"', value is set to '" +
5868
sameSiteAttrValue +
5969
"' protection level.";
60-
var infoLinkRef =
61-
"https://tools.ietf.org/html/draft-west-first-party-cookies\nhttps://chloe.re/2016/04/13/goodbye-csrf-samesite-to-the-rescue";
62-
var solution =
63-
"CSRF possible vulnerabilities presents on the site will be mitigated depending on the browser used by the user (browser defines the support level for this cookie attribute).";
64-
ps.raiseAlert(
65-
0,
66-
3,
67-
"SameSite cookie attribute protection used",
68-
description,
69-
url,
70-
"Cookie named: '" + cookieName + "'",
71-
"",
72-
infoLinkRef,
73-
solution,
74-
sameSiteAttrValue,
75-
cweId,
76-
wascId,
77-
msg
78-
);
70+
helper
71+
.newAlert()
72+
.setDescription(description)
73+
.setParam("Cookie named: '" + cookieName + "'")
74+
.setEvidence(sameSiteAttrValue)
75+
.setMessage(msg)
76+
.raise();
7977
break;
8078
}
8179
}

0 commit comments

Comments
 (0)