Fix issue with passive detect

jaeles-project · Nov 15, 2020 · 1d83cbe · 1d83cbe
1 parent de187c8
commit 1d83cbe
Show file tree

Hide file tree

Showing 7 changed files with 52 additions and 15 deletions.
diff --git a/core/passive.go b/core/passive.go
@@ -16,23 +16,21 @@ import (
 func (r *Record) Passives() {
 	passiveScripts := r.GetPassivesRules()
 	if len(passiveScripts) == 0 {
-		utils.ErrorF("No passive rule selected")
+		return
 	}
-
 	r.RequestScripts("passives", passiveScripts)
 }
 
 // GetPassivesRule do passive analyzer based on default passive signature
 func (r *Record) GetPassivesRules() []string {
 	var passiveScripts []string
-	if !utils.FolderExists(r.Opt.PassiveFolder) {
-		return passiveScripts
-	}
 	passives := GetPassives(r.Opt)
 	if len(passives) <= 0 {
+		utils.ErrorF("No passive rule selected")
 		return passiveScripts
 	}
 
+	r.PassiveRules = make(map[string]libs.Rule)
 	for _, passive := range passives {
 		// filter by level
 		if passive.Level > r.Opt.Level {
@@ -58,7 +56,10 @@ func (r *Record) GetPassivesRules() []string {
 			}
 
 			passiveScripts = append(passiveScripts, rule.Detections...)
+			//spew.Dump(passiveScripts)
 			for _, passiveScript := range rule.Detections {
+				//spew.Dump(rule)
+				//spew.Dump(passiveScript)
 				r.PassiveRules[passiveScript] = rule
 			}
 		}
@@ -89,6 +90,12 @@ func (r *Record) PassiveOutput() string {
 func GetPassives(options libs.Options) []libs.Passive {
 	var passives []libs.Passive
 	passives = append(passives, defaultPassive())
+
+	utils.DebugF("Reading passive from: %s", utils.NormalizePath(options.PassiveFolder))
+	if !utils.FolderExists(options.PassiveFolder) {
+		utils.ErrorF("Error create found signatures: %s", options.PassiveFolder)
+		return passives
+	}
 	passiveFiles := utils.GetFileNames(utils.NormalizePath(options.PassiveFolder), "yaml")
 	for _, passiveFile := range passiveFiles {
 		passive, err := ParsePassive(passiveFile)

diff --git a/libs/options.go b/libs/options.go
@@ -51,7 +51,6 @@ type Options struct {
 	EnablePassive     bool
 	DisableParallel   bool
 
-
 	// Chunk Options
 	ChunkDir     string
 	ChunkRun     bool
@@ -74,11 +73,11 @@ type Scan struct {
 
 // Mics some shortcut options
 type Mics struct {
-	FullHelp bool
-	AlwaysTrue bool
-	BaseRoot   bool
-	BurpProxy  bool
-	DisableReplicate  bool
+	FullHelp         bool
+	AlwaysTrue       bool
+	BaseRoot         bool
+	BurpProxy        bool
+	DisableReplicate bool
 }
 
 // Report options for api server

diff --git a/libs/version.go b/libs/version.go
@@ -2,7 +2,7 @@ package libs
 
 const (
 	// VERSION current Jaeles version
-	VERSION = "beta v0.14.3"
+	VERSION = "beta v0.14.4"
 	// AUTHOR author of this
 	AUTHOR = "@j3ssiejjj"
 	// DOCS link to official documentation

diff --git a/sender/sender.go b/sender/sender.go
@@ -38,7 +38,6 @@ func JustSend(options libs.Options, req libs.Request) (res libs.Response, err er
 		timeout = req.Timeout
 	}
 
-
 	disableCompress := false
 	if len(headers) > 0 && strings.Contains(headers["Accept-Encoding"], "gzip") {
 		disableCompress = true

diff --git a/test-signatures/with-passive-in-dection.yaml b/test-signatures/with-passive-in-dection.yaml
@@ -0,0 +1,16 @@
+id: testing-passive
+info:
+  name: testing-passive
+  risk: Potential
+
+
+requests:
+  - method: GET
+    redirect: false
+    url: >-
+      {{.Raw}}
+    headers:
+      - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+    detections:
+      - >-
+        StatusCode() == 200 && DoPassive()
diff --git a/test-signatures/with-passive.yaml b/test-signatures/with-passive.yaml
@@ -0,0 +1,16 @@
+id: testing-passive
+passive: true
+info:
+  name: testing-passive
+  risk: Potential
+
+
+requests:
+  - method: GET
+    redirect: false
+    url: >-
+      {{.Raw}}
+    headers:
+      - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
+
+
diff --git a/test-signatures/with-prefix.yaml b/test-signatures/with-prefix.yaml
@@ -17,12 +17,12 @@ variables:
       admin
       auditevents
       caches
-      
+
 requests:
   - method: GET
     redirect: false
     url: >-
-     {{.root}}/{{.infos}}
+      {{.root}}/{{.infos}}
     headers:
       - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
     detections: