Here's patch(against SVN trunk of w3af) for new plugin to perform
favicon identification.
In order to learn more about it to, refer to:
http://kost.com.hr/favicon.phpiimplement mplement
http://www.owasp.org/index.php/Category:OWASP_Favicon_Database_Project
Kost
Index: plugins/discovery/favicon/favicon-md5
===================================================================
--- plugins/discovery/favicon/favicon-md5 (revision 0)
+++ plugins/discovery/favicon/favicon-md5 (revision 0)
@@ -0,0 +1,31 @@
+6399cc480d494bf1fcd7d16c42b1c11b:penguin
+09b565a51e14b721a323f0ba44b2982a:Google web server
+506190fc55ceaa132f1bc305ed8472ca:SocialText
+2cc15cfae55e2bb2d85b57e5b5bc3371:PHPwiki
+389a8816c5b87685de7d8d5fec96c85b:XOOPS cms
+e6a9dc66179d8c9f34288b16a02f987e:Drupal cms
+f1876a80546b3986dbb79bad727b0374:NetScreen WebUI
+226ffc5e483b85ec261654fe255e60be:Netscape 4.1
+b25dbe60830705d98ba3aaf0568c456a:Netscape iPlanet 6.0
+41e2c893098b3ed9fc14b821a2e14e73:Netscape 6.0 (AOL)
+a28ebcac852795fe30d8e99a23d377c1:SunOne 6.1
+71e30c507ca3fa005e2d1322a5aa8fb2:Apache on Redhat
+d41d8cd98f00b204e9800998ecf8427e:Zero byte favicon
+dcea02a5797ce9e36f19b7590752563e:Apache (seen on CentOS/Debian/Fedora)
+6f767458b952d4755a795af0e4e0aa17:Yahoo!
+5b0e3b33aa166c88cee57f83de1d4e55:DotNetNuke (http://www.dotnetnuke.com)
+7dbe9acc2ab6e64d59fa67637b1239df:Lotus-Domino
+fa54dbf2f61bd2e0188e47f5f578f736:Wordpress
+6cec5a9c106d45e458fc680f70df91b0:Wordpress - obsolete version
+81ed5fa6453cf406d1d82233ba355b9a:E-zekiel
+ecaa88f7fa0bf610a5a26cf545dcd3aa:3-byte invalid favicon: domain sellers
+4eb846f1286ab4e7a399c851d7d84cca:Plone cms
+c1201c47c81081c7f0930503cae7f71a:vBulletin forum
+edaaef7bbd3072a3a0c3fb3b29900bcb:Powered by Reynolds Web Solutions (Car sales CMS)
+d99217782f41e71bcaa8e663e6302473:Apache on Red Hat/Fedora
+4644f2d45601037b8423d45e13194c93:Apache Tomcat
+a8fe5b8ae2c445a33ac41b33ccc9a120:Arris Touchstone Device
+d16a0da12074dae41980a6918d33f031:ST 605
+befcded36aec1e59ea624582fcb3225c:SpeedTouch
+e4a509e78afca846cd0e6c0672797de5:i3micro VRG
+
Index: plugins/discovery/faviconIdentification.py
===================================================================
--- plugins/discovery/faviconIdentification.py (revision 0)
+++ plugins/discovery/faviconIdentification.py (revision 0)
@@ -0,0 +1,161 @@
+'''
+faviconIdentification.py
+http://www.owasp.org/index.php/Category:OWASP_Favicon_Database_Project
+http://kost.com.hr/favicon.php
+
+Copyright 2009 Vlatko Kosturjak
+Plugin based on wordpress_fingerprint.py and pykto.py
+
+This file is part of w3af, w3af.sourceforge.net .
+
+w3af is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation version 2 of the License.
+
+w3af is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with w3af; if not, write to the Free Software
+Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
+
+'''
+
+import core.controllers.outputManager as om
+
+# Import options
+import re
+import md5
+import os.path
+
+from core.data.options.option import option
+from core.data.options.optionList import optionList
+
+from core.controllers.basePlugin.baseDiscoveryPlugin import baseDiscoveryPlugin
+
+import core.data.kb.knowledgeBase as kb
+import core.data.kb.vuln as vuln
+import core.data.kb.info as info
+import core.data.constants.severity as severity
+
+import core.data.parsers.urlParser as urlParser
+from core.controllers.w3afException import w3afException, w3afRunOnce
+
+
+# Main class
+class faviconIdentification (baseDiscoveryPlugin):
+ '''
+ Identify server software using favicon.
+ @author: Vlatko Kosturjak <k...@linux.hr> http://kost.com.hr
+ '''
+
+ def __init__(self):
+ baseDiscoveryPlugin.__init__(self)
+
+ # Internal variables
+ self._exec = True
+ self._version = None
+
+ # User configured parameters
+ self._db_file = 'plugins' + os.path.sep + 'discovery' + os.path.sep + 'favicon'
+ self._db_file += os.path.sep + 'favicon-md5'
+
+ def discover(self, fuzzableRequest ):
+ '''
+ Identify server software using favicon.
+ @parameter fuzzableRequest: A fuzzableRequest instance that contains
+ (among other things) the URL to test.
+ '''
+ dirs = []
+
+ if not self._exec :
+ # This will remove the plugin from the discovery plugins to be runned.
+ raise w3afRunOnce()
+
+ else:
+
+ # 404 error messages
+ is_404 = kb.kb.getData( 'error404page', '404' )
+
+ self._fuzzableRequests = []
+
+ domain_path = urlParser.getDomainPath( fuzzableRequest.getURL() )
+
+ def_favicon_url = urlParser.urlJoin( domain_path, 'favicon.ico' )
+ response = self._urlOpener.GET( def_favicon_url, useCache=True )
+
+ if not is_404( response ):
+ favmd5=md5.new(response.getBody()).hexdigest()
+
+ try:
+ # read MD5 database.
+ db_file_1 = open(self._db_file, "r")
+ except Exception, e:
+ raise w3afException('Failed to open the MD5 database. Exception: "' + str(e) + '".')
+ else:
+ favicon_list = db_file_1.readlines()
+ db_file_1.close()
+
+ repstr=''
+ # check if MD5 is matched in database/list
+ for fmd5 in favicon_list:
+ dbline=fmd5.split( ":", 2 );
+ md5part=dbline[0].split();
+ if dbline[0]==favmd5:
+ if len(dbline)>1:
+ favname=dbline[1].rstrip()
+ repstr += 'Favicon identified as ' + favname + '.\n'
+ repstr += 'Favicon MD5: "'+ favmd5 +'".'
+ # Save it to the kb!
+ i = info.info()
+ i.setName('Favicon identification')
+ i.setURL( def_favicon_url )
+ i.setId( response.id )
+ i.setDesc( repstr )
+ kb.kb.append( self, 'info', i )
+ om.out.information( i.getDesc() )
+
+ # Only run once
+ self._exec = False
+
+ return dirs
+
+ # W3af options and output
+ def getOptions( self ):
+ '''
+ @return: A list of option objects for this plugin.
+ '''
+ ol = optionList()
+ return ol
+
+ def setOptions( self, OptionList ):
+ '''
+ This method sets all the options that are configured using the user interface
+ generated by the framework using the result of getOptions().
+
+ @parameter OptionList: A dictionary with the options for the plugin.
+ @return: No value is returned.
+ '''
+ pass
+
+ def getPluginDeps( self ):
+ '''
+ @return: A list with the names of the plugins that should be runned before the
+ current one.
+ '''
+ return []
+
+ def getLongDesc( self ):
+ '''
+ @return: A DETAILED description of the plugin functions and features.
+ '''
+ return '''
+ This plugin identifies software version using favicon.
+
+ It checks MD5 of favicon against the MD5 database of favicons.
+ See also:
+ http://www.owasp.org/index.php/Category:OWASP_Favicon_Database_Project
+ http://kost.com.hr/favicon.php
+ '''
------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
_______________________________________________
W3af-develop mailing list
W3af-develop@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/w3af-develop
