From 1d83cbe9c2e340ba00a4d09149127de67bfbe8f2 Mon Sep 17 00:00:00 2001 From: j3ssie Date: Sun, 15 Nov 2020 16:39:44 +0700 Subject: [PATCH] Fix issue with passive detect --- core/passive.go | 17 ++++++++++++----- libs/options.go | 11 +++++------ libs/version.go | 2 +- sender/sender.go | 1 - test-signatures/with-passive-in-dection.yaml | 16 ++++++++++++++++ test-signatures/with-passive.yaml | 16 ++++++++++++++++ test-signatures/with-prefix.yaml | 4 ++-- 7 files changed, 52 insertions(+), 15 deletions(-) create mode 100644 test-signatures/with-passive-in-dection.yaml create mode 100644 test-signatures/with-passive.yaml diff --git a/core/passive.go b/core/passive.go index ce4173a..cba0bad 100644 --- a/core/passive.go +++ b/core/passive.go @@ -16,23 +16,21 @@ import ( func (r *Record) Passives() { passiveScripts := r.GetPassivesRules() if len(passiveScripts) == 0 { - utils.ErrorF("No passive rule selected") + return } - r.RequestScripts("passives", passiveScripts) } // GetPassivesRule do passive analyzer based on default passive signature func (r *Record) GetPassivesRules() []string { var passiveScripts []string - if !utils.FolderExists(r.Opt.PassiveFolder) { - return passiveScripts - } passives := GetPassives(r.Opt) if len(passives) <= 0 { + utils.ErrorF("No passive rule selected") return passiveScripts } + r.PassiveRules = make(map[string]libs.Rule) for _, passive := range passives { // filter by level if passive.Level > r.Opt.Level { @@ -58,7 +56,10 @@ func (r *Record) GetPassivesRules() []string { } passiveScripts = append(passiveScripts, rule.Detections...) + //spew.Dump(passiveScripts) for _, passiveScript := range rule.Detections { + //spew.Dump(rule) + //spew.Dump(passiveScript) r.PassiveRules[passiveScript] = rule } } @@ -89,6 +90,12 @@ func (r *Record) PassiveOutput() string { func GetPassives(options libs.Options) []libs.Passive { var passives []libs.Passive passives = append(passives, defaultPassive()) + + utils.DebugF("Reading passive from: %s", utils.NormalizePath(options.PassiveFolder)) + if !utils.FolderExists(options.PassiveFolder) { + utils.ErrorF("Error create found signatures: %s", options.PassiveFolder) + return passives + } passiveFiles := utils.GetFileNames(utils.NormalizePath(options.PassiveFolder), "yaml") for _, passiveFile := range passiveFiles { passive, err := ParsePassive(passiveFile) diff --git a/libs/options.go b/libs/options.go index 3911c60..f89c5ca 100644 --- a/libs/options.go +++ b/libs/options.go @@ -51,7 +51,6 @@ type Options struct { EnablePassive bool DisableParallel bool - // Chunk Options ChunkDir string ChunkRun bool @@ -74,11 +73,11 @@ type Scan struct { // Mics some shortcut options type Mics struct { - FullHelp bool - AlwaysTrue bool - BaseRoot bool - BurpProxy bool - DisableReplicate bool + FullHelp bool + AlwaysTrue bool + BaseRoot bool + BurpProxy bool + DisableReplicate bool } // Report options for api server diff --git a/libs/version.go b/libs/version.go index 928f5e5..2d45acc 100644 --- a/libs/version.go +++ b/libs/version.go @@ -2,7 +2,7 @@ package libs const ( // VERSION current Jaeles version - VERSION = "beta v0.14.3" + VERSION = "beta v0.14.4" // AUTHOR author of this AUTHOR = "@j3ssiejjj" // DOCS link to official documentation diff --git a/sender/sender.go b/sender/sender.go index 0f227bb..a3c3983 100644 --- a/sender/sender.go +++ b/sender/sender.go @@ -38,7 +38,6 @@ func JustSend(options libs.Options, req libs.Request) (res libs.Response, err er timeout = req.Timeout } - disableCompress := false if len(headers) > 0 && strings.Contains(headers["Accept-Encoding"], "gzip") { disableCompress = true diff --git a/test-signatures/with-passive-in-dection.yaml b/test-signatures/with-passive-in-dection.yaml new file mode 100644 index 0000000..63bd1f0 --- /dev/null +++ b/test-signatures/with-passive-in-dection.yaml @@ -0,0 +1,16 @@ +id: testing-passive +info: + name: testing-passive + risk: Potential + + +requests: + - method: GET + redirect: false + url: >- + {{.Raw}} + headers: + - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55 + detections: + - >- + StatusCode() == 200 && DoPassive() diff --git a/test-signatures/with-passive.yaml b/test-signatures/with-passive.yaml new file mode 100644 index 0000000..6929314 --- /dev/null +++ b/test-signatures/with-passive.yaml @@ -0,0 +1,16 @@ +id: testing-passive +passive: true +info: + name: testing-passive + risk: Potential + + +requests: + - method: GET + redirect: false + url: >- + {{.Raw}} + headers: + - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55 + + diff --git a/test-signatures/with-prefix.yaml b/test-signatures/with-prefix.yaml index bdebe72..6d93f7b 100644 --- a/test-signatures/with-prefix.yaml +++ b/test-signatures/with-prefix.yaml @@ -17,12 +17,12 @@ variables: admin auditevents caches - + requests: - method: GET redirect: false url: >- - {{.root}}/{{.infos}} + {{.root}}/{{.infos}} headers: - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55 detections: