FEATURES: Password Verification, Signature Formatting, Credential Testing against WWW-Authenticate realms

Python/EyeWitness.py

@@ -80,6 +80,14 @@ def create_cli_parser():
                                 a timeout'.replace('    ', ''), type=int,
                                 help='Max retries on timeouts')
 
+    cred_validation_options = parser.add_argument_group('Credential Validation Options')
+    cred_validation_options.add_argument('--enable-validation',
+                                default=None, action='store_true',
+                                help='Test default credentials and validate the host is vulnerable.')
+    cred_validation_options.add_argument('--validation-output', metavar='Output log file of validated credentials',
+                                default=None,
+                                help='Specify a file to log valid credentials (for easy automation).')
+
     report_options = parser.add_argument_group('Report Output Options')
     report_options.add_argument('-d', metavar='Directory Name',
                                 default=None,
@@ -256,6 +264,8 @@ def exitsig(*args):
     if cli_parsed.web:
         create_driver = selenium_module.create_driver
         capture_host = selenium_module.capture_host
+        auth_host = selenium_module.auth_host
+        test_realm = selenium_module.test_realm
         if not cli_parsed.show_selenium:
             display = Display(visible=0, size=(1920, 1080))
             display.start()
@@ -269,8 +279,20 @@ def exitsig(*args):
     web_index_head = create_web_index_head(cli_parsed.date, cli_parsed.time)
 
     driver = create_driver(cli_parsed)
-    result, driver = capture_host(cli_parsed, http_object, driver)
-    result = default_creds_category(result)
+    result, is_protected = test_realm(cli_parsed, http_object, driver)
+    if not result:
+        result, driver = capture_host(cli_parsed, http_object, driver)
+        result = default_creds_category(result)
+        if cli_parsed.enable_validation:
+            auth_host(cli_parsed, result, driver, is_protected)
+    else:
+        print("[!] HTTP Authentication Realm Detected")
+        result, driver = capture_host(cli_parsed, result, driver)
+        if result.default_creds:
+            result = default_creds_category(result)
+            if cli_parsed.enable_validation:
+                auth_host(cli_parsed, result, driver, is_protected)
+
     if cli_parsed.resolve:
         result.resolved = resolve_host(result.remote_system)
     driver.quit()
@@ -291,6 +313,8 @@ def worker_thread(cli_parsed, targets, lock, counter, user_agent=None):
     if cli_parsed.web:
         create_driver = selenium_module.create_driver
         capture_host = selenium_module.capture_host
+        auth_host = selenium_module.auth_host
+        test_realm = selenium_module.test_realm
 
     with lock:
         driver = create_driver(cli_parsed, user_agent)
@@ -320,16 +344,42 @@ def worker_thread(cli_parsed, targets, lock, counter, user_agent=None):
 
             http_object.resolved = resolve_host(http_object.remote_system)
             if user_agent is None:
-                http_object, driver = capture_host(
-                    cli_parsed, http_object, driver)
-                if http_object.category is None and http_object.error_state is None:
+
+                # head call and detect WWW-Authenticate realm info
+                # if found, attempt manual auth
+
+                http_object2, is_protected = test_realm(cli_parsed, http_object, driver)
+                if not http_object2:
+                    http_object, driver = capture_host(cli_parsed, http_object, driver)
                     http_object = default_creds_category(http_object)
-                manager.update_http_object(http_object)
+                    if cli_parsed.enable_validation:
+                        auth_host(cli_parsed, http_object, driver, is_protected)
+                    manager.update_http_object(http_object)
+                else:
+                    print("[!] HTTP Authentication Realm Detected")
+                    http_object2, driver = capture_host(cli_parsed, http_object2, driver)
+                    if http_object2.default_creds:
+                        http_object2 = default_creds_category(http_object2)
+                        if cli_parsed.enable_validation:
+                            auth_host(cli_parsed, http_object2, driver, is_protected)
+                    manager.update_http_object(http_object2)
+
             else:
-                ua_object, driver = capture_host(
-                    cli_parsed, http_object, driver)
-                if http_object.category is None and http_object.error_state is None:
+
+                ua_object, is_protected = test_realm(cli_parsed, http_object, driver)
+                if not ua_object:
+                    ua_object, driver = capture_host(cli_parsed, http_object, driver)
                     ua_object = default_creds_category(ua_object)
+                    if cli_parsed.enable_validation:
+                        auth_host(cli_parsed, ua_object, driver, is_protected)
+                else:
+                    print("[!] HTTP Authentication Realm Detected")
+                    ua_object, driver = capture_host(cli_parsed, ua_object, driver)
+                    if ua_object.default_creds:
+                        ua_object = default_creds_category(ua_object)
+                        if cli_parsed.enable_validation:
+                            auth_host(cli_parsed, ua_object, driver, is_protected)
+
                 manager.update_ua_object(ua_object)
 
             counter[0].value += 1

Python/modules/helpers.py

@@ -648,7 +648,7 @@ def do_jitter(cli_parsed):
         sleep_value = sleep_value * .01
         sleep_value = 1 - sleep_value
         sleep_value = sleep_value * cli_parsed.jitter
-        print("[*] Sleeping for " + str(sleep_value) + " seconds..")
+        print("[*] Sleeping for " + "{:.2f}".format(sleep_value) + " seconds..")
         try:
             time.sleep(sleep_value)
         except KeyboardInterrupt:
@@ -726,9 +726,24 @@ def default_creds_category(http_object):
             for sig in signatures:
                 # Find the signature(s), split them into their own list if needed
                 # Assign default creds to its own variable
+                # !! added support for description field and cred field, so that creds can be 
+                # !! automatically checked
+                sig = sig.rstrip("\n")
                 sig_cred = sig.split('|')
+                if len(sig_cred) > 3:
+                  # character '|' is contained in the page_sig, rejoin and work backwards
+                  tmp_sig = sig_cred[0:len(sig_cred)-2]
+                  sig = "|".join(tmp_sig)
+                  sig_cred2 = [ sig, sig_cred[len(sig_cred) - 2], sig_cred[len(sig_cred) - 1] ]
+                  sig_cred = sig_cred2
+
                 page_sig = sig_cred[0].split(";")
-                cred_info = sig_cred[1].strip()
+                desc = sig_cred[1].strip()
+                try:
+                  cred_info = sig_cred[2]
+                except Exception as e:
+                  # default to description, assume description is missing
+                  cred_info = desc
 
                 # Set our variable to 1 if the signature was not identified.  If it is
                 # identified, it will be added later on.  Find total number of
@@ -739,10 +754,12 @@ def default_creds_category(http_object):
                 # web page needed to make a signature Delimete the "signature"
                 # by ";" before the "|", and then have the creds after the "|"
                 if all([x.lower() in http_object.source_code.decode().lower() for x in page_sig]):
+                    http_object._description = desc
+
                     if http_object.default_creds is None:
                         http_object.default_creds = cred_info
                     else:
-                        http_object.default_creds += '\n' + cred_info
+                        http_object.default_creds += ';' + cred_info
 
             for cat in categories:
                 # Find the signature(s), split them into their own list if needed

Python/modules/objects.py

@@ -1,6 +1,7 @@
 import html
 import os
 import re
+import traceback
 
 from modules.helpers import strip_nonalphanum
 
@@ -30,6 +31,10 @@ def __init__(self):
         self._ua_left = None
         self._resolved = None
 
+        # parsed authentication, tuple of username and password, if username is empty it will be None
+        self._description = ""
+        self._parsed_creds = [ ]
+
     def set_paths(self, outdir, suffix=None):
         file_name = self.remote_system.replace('://', '.')
         for char in [':', '/', '?', '=', '%', '+']:
@@ -179,6 +184,44 @@ def default_creds(self):
 
     @default_creds.setter
     def default_creds(self, default_creds):
+        if not default_creds: return
+
+        # attempt to parse
+        # filter out those without '/' or start with '(' # save as comment only
+        if not '/' in default_creds or default_creds[0] == '(':
+          self._parsed_creds = [ (None, None, default_creds, None, '') ] # no user or pass, only comment
+          self._default_creds = default_creds
+          return
+
+        try:
+          creds = default_creds.split(';')
+          # parse out those with comments if present
+          # else split /
+          for c in creds:
+            user = passwd = comment = None
+            if ' (' in c:
+              x = c.split(' (')
+              comment = x[1][:-1].strip() # assuming ending ) and removing it
+              y = x[0].split('/')
+              user = y[0].strip()
+              try:
+                passwd = y[1].strip()
+              except:
+                # Only 1 value found
+                passwd = None
+            else:
+              y = c.split('/')
+              user = y[0].strip()
+              try:
+                passwd = y[1].strip()
+              except:
+                # Only 1 value found
+                passwd = None
+            self._parsed_creds = self._parsed_creds + [ (user,passwd,comment,None, '') ]
+        except Exception as e:
+          print("[!] Failed to parse credentials: ", e)
+          print("    ", default_creds)
+          print(traceback.format_exc())
         self._default_creds = default_creds
 
     @property
@@ -203,12 +246,12 @@ def create_table_html(self):
         html = u""
         if self._remote_login is not None:
             html += ("""<tr>
-            <td><div style=\"display: inline-block; width: 300px; word-wrap: break-word\">
+            <td valign="top"><div style=\"display: inline-block; width: 300px; word-wrap: break-word\">
             <a href=\"{address}\" target=\"_blank\">{address}</a><br>
             """).format(address=self._remote_login)
         else:
             html += ("""<tr>
-            <td><div style=\"display: inline-block; width: 300px; word-wrap: break-word\">
+            <td valign="top"><div style=\"display: inline-block; width: 300px; word-wrap: break-word\">
             <a href=\"{address}\" target=\"_blank\">{address}</a><br>
             """).format(address=self.remote_system)
 
@@ -227,13 +270,51 @@ def create_table_html(self):
                 self.remote_system)
 
         if self.default_creds is not None:
-            try:
-                html += "<br><b>Default credentials:</b> {0}<br>".format(
-                    self.sanitize(self.default_creds))
-            except UnicodeEncodeError:
-                html += u"<br><b>Default credentials:</b> {0}<br>".format(
-                    self.sanitize(self.default_creds))
-
+            if type(self.default_creds) is list:
+                try:
+                    html += "<br><b>Default credentials:</b> {0} ({1})<br>".format(
+                        self.sanitize(self._description), self.sanitize(", ".join(self.default_creds)))
+                except UnicodeEncodeError:
+                    try:
+                        html += u"<br><b>Default credentials:</b> {0} ({1})<br>".format(
+                            self.sanitize(self._description), self.sanitize(self.default_creds))
+                    except:
+                        print('[!] Failed to format default credentials: ')
+                        # print(json.dumps(self.default_creds))
+            else:
+                try:
+                    html += "<br><b>Default credentials:</b> {0} ({1})<br>".format(
+                        self.sanitize(self._description), self.sanitize(self.default_creds))
+                except UnicodeEncodeError:
+                    try:
+                        html += u"<br><b>Default credentials:</b> {0} ({1})<br>".format(
+                            self.sanitize(self._description), self.sanitize(self.default_creds))
+                    except:
+                        print('[!] Failed to format default credentials: ')
+                        # print(json.dumps(self.default_creds))
+
+        if self._parsed_creds is not None and type(self._parsed_creds) is list and len(self._parsed_creds) > 0:
+            html += "<br /><table width=\"100%\" style=\"padding-left: 5px; padding-right: 5px;\"><thead><td>User</td><td>Password</td><td>Status</td></thead>"
+            for cred in self._parsed_creds:
+                html += "<tr>"
+                if cred[0] and cred[1]:
+                    html += "<td>{0}</td><td>{1}</td>".format(cred[0], cred[1])
+                elif cred[0]: 
+                    html += "<td>{0}</td><td></td>".format(cred[0])
+                elif cred[1]: 
+                    html += "<td></td><td>{0}</td>".format(cred[0])
+                if cred[3] == True:
+                    if len(cred[4]) > 0:
+                        a_scr_path = os.path.relpath(cred[4], self.root_path)
+                        html += '<td bgcolor="green"><a href=\"{0}\" target=\"_blank\">Success</a></td>'.format(a_scr_path)
+                    else:
+                        html += '<td bgcolor="green">Success</td>'
+                else:
+                    html += '<td bgcolor="red">Failed</td>'
+                html+= "</tr>"
+            html += "</table><br />"
+
+
         if self.error_state is None:
             try:
                 html += "\n<br><b> Page Title: </b>{0}\n".format(
@@ -286,6 +367,13 @@ def create_table_html(self):
                 target=\"_blank\"><img style=\"max-height:400px;height: expression(this.height > 400 ? 400: true);\"
                 src=\"{1}\"></a></div></td></tr>""").format(
                 src_path, scr_path)
+            if self._parsed_creds is not None and type(self._parsed_creds) is list and len(self._parsed_creds) > 0:
+                for cred in self._parsed_creds:
+                    if len(cred[4]) > 0:
+                        a_scr_path = os.path.relpath(cred[4], self.root_path)
+                        html += "<br /><a href=\"{0}\" target=\"_blank\"><img src=\"{0}\" height=\"400\" /></a><br />".format(a_scr_path)
+
+            html += ("""</td></tr>""")
 
         if len(self._uadata) > 0:
             divid = strip_nonalphanum(self.remote_system)
@@ -389,7 +477,7 @@ def create_table_html(self, divid):
         src_path = os.path.relpath(self.source_path, self.root_path)
         html = u""
         html += ("""<tr class="hide {0}">
-        <td><div style=\"display: inline-block; width: 300px; word-wrap: break-word\">
+        <td valign="top"><div style=\"display: inline-block; width: 300px; word-wrap: break-word\">
         <a href=\"{1}\" target=\"_blank\">{1}</a><br>
         """).format(divid, self.remote_system)
 
@@ -407,12 +495,49 @@ def create_table_html(self, divid):
                 self.remote_system)
 
         if self.default_creds is not None:
-            try:
-                html += "<br><b>Default credentials:</b> {0}<br>".format(
-                    self.sanitize(self.default_creds))
-            except UnicodeEncodeError:
-                html += u"<br><b>Default credentials:</b> {0}<br>".format(
-		    self.sanitize(self.default_creds))
+            if type(self.default_creds) is list:
+                try:
+                    html += "<br><b>Default credentials:</b> {0} ({1})<br>".format(
+                        self.sanitize(self._description), self.sanitize(", ".join(self.default_creds)))
+                except UnicodeEncodeError:
+                    try:
+                        html += u"<br><b>Default credentials:</b> {0} ({1})<br>".format(
+                            self.sanitize(self._description), self.sanitize(self.default_creds))
+                    except:
+                        print('[!] Failed to format default credentials: ')
+                        # print(json.dumps(self.default_creds))
+            else:
+                try:
+                    html += "<br><b>Default credentials:</b> {0} ({1})<br>".format(
+                        self.sanitize(self._description), self.sanitize(self.default_creds))
+                except UnicodeEncodeError:
+                    try:
+                        html += u"<br><b>Default credentials:</b> {0} ({1})<br>".format(
+                            self.sanitize(self._description), self.sanitize(self.default_creds))
+                    except:
+                        print('[!] Failed to format default credentials: ')
+                        # print(json.dumps(self.default_creds))
+
+        if self._parsed_creds is not None and type(self._parsed_creds) is list and len(self._parsed_creds) > 0:
+            html += "<br /><table width=\"100%\" style=\"padding-left: 5px; padding-right: 5px;\"><thead><td>User</td><td>Password</td><td>Status</td></thead>"
+            for cred in self._parsed_creds:
+                html += "<tr>"
+                if cred[0] and cred[1]:
+                    html += "<td>{0}</td><td>{1}</td>".format(cred[0], cred[1])
+                elif cred[0]: 
+                    html += "<td>{0}</td><td></td>".format(cred[0])
+                elif cred[1]: 
+                    html += "<td></td><td>{0}</td>".format(cred[0])
+                if cred[3] == True:
+                    if len(cred[4]) > 0:
+                        a_scr_path = os.path.relpath(cred[4], self.root_path)
+                        html += '<td bgcolor="green"><a href=\"{0}\" target=\"_blank\">Success</a></td>'.format(a_scr_path)
+                    else:
+                        html += '<td bgcolor="green">Success</td>'
+                else:
+                    html += '<td bgcolor="red">Failed</td>'
+                html+= "</tr>"
+            html += "</table><br />"
 
         try:
             html += "\n<br><b> Page Title: </b>{0}\n".format(
@@ -446,7 +571,12 @@ def create_table_html(self, divid):
                 target=\"_blank\">Source Code</a></div></td>
                 <td><div id=\"screenshot\"><a href=\"{1}\"
                 target=\"_blank\"><img style=\"max-height:400px;height: expression(this.height > 400 ? 400: true);\"
-                src=\"{1}\"></a></div></td></tr>""").format(
-                src_path, scr_path)
+                src=\"{1}\"></a></div></td></tr>""").format(src_path, scr_path)
+            if self._parsed_creds is not None and type(self._parsed_creds) is list and len(self._parsed_creds) > 0:
+                for cred in self._parsed_creds:
+                    if len(cred[4]) > 0:
+                        a_scr_path = os.path.relpath(cred[4], self.root_path)
+                        html += "<br /><a href=\"{0}\" target=\"_blank\"><img src=\"{0}\" height=\"400\" /></a><br />".format(a_scr_path)
+            html += ("""</td></tr>""")
         return html