""" server_status.py Copyright 2006 Andres Riancho This file is part of w3af, http://w3af.org/ . w3af is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License. w3af is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with w3af; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA """ import re import w3af.core.controllers.output_manager as om import w3af.core.data.kb.knowledge_base as kb import w3af.core.data.constants.severity as severity from w3af.core.controllers.plugins.infrastructure_plugin import InfrastructurePlugin from w3af.core.controllers.core_helpers.fingerprint_404 import is_404 from w3af.core.controllers.exceptions import RunOnce from w3af.core.controllers.misc.decorators import runonce from w3af.core.data.parsers.doc.url import URL from w3af.core.data.kb.vuln import Vuln from w3af.core.data.kb.info import Info from w3af.core.data.request.fuzzable_request import FuzzableRequest class server_status(InfrastructurePlugin): """ Find new URLs from the Apache server-status cgi. :author: Andres Riancho (andres.riancho@gmail.com) """ def __init__(self): InfrastructurePlugin.__init__(self) # Internal variables self._shared_hosting_hosts = [] @runonce(exc_class=RunOnce) def discover(self, fuzzable_request, debugging_id): """ Get the server-status and parse it. :param debugging_id: A unique identifier for this call to discover() :param fuzzable_request: A fuzzable_request instance that contains (among other things) the URL to test. """ base_url = fuzzable_request.get_url().base_url() server_status_url = base_url.url_join('server-status') response = self._uri_opener.GET(server_status_url, cache=True) if not is_404(response) and response.get_code() not in range(400, 404): if 'apache' in response.get_body().lower(): msg = 'Apache server-status module is enabled and accessible.' msg += ' The URL is: "%s"' % response.get_url() om.out.information(msg) self._extract_server_version(fuzzable_request, response) self._extract_urls(fuzzable_request, response) self._report_shared_hosting(fuzzable_request, response) def _extract_server_version(self, fuzzable_request, response): """ Get the server version from the HTML:

Server Version: Apache/2.2.9 (Unix)

Query Builder