findVulnerability.py

import os
from subprocess import Popen
import timeit
import time
import sys
import signal
import logging
from count import countVulns
from run_tools import run_tool
from mongo_connection import mongo_client

def vulnerabilityScan(ip,domain,type):
	cwd = os.getcwd()
	client = mongo_client()
	db = client.config
	cursor = db.external.find()
	# type = sys.argv[3]
	if(type == "selfServe"):
	        logFile = cursor[0]['SELF_SERVE_PATH_LOGFILE']
	        database = cursor[0]['SELF_SERVE_DATABASE']
		skipfishPath  = cursor[0]['SELF_SERVE_PATH_SKIPFISH']
		wapitiPath = cursor[0]['SELF_SERVE_PATH_WAPITI']
	else:
	        logFile = cursor[0]['PATH_LOGFILE']
	        database = cursor[0]['DATABASE']
		skipfishPath  = cursor[0]['PATH_SKIPFISH']
		wapitiPath = cursor[0]['PATH_WAPITI']
	TIMEOUT = int(cursor[0]['TIMEOUT_VUL'])
	db = client[database]


	logging.basicConfig(filename = logFile,format='%(levelname)s:%(message)s',level=logging.DEBUG)

	logging.info("Finding Vulnerability")
	serv = db.services
	# ip = sys.argv[1]
	# domain = sys.argv[2]
	host = ip
	if domain == "null":
		domain = ""
	if serv.find({"ip":ip,"80":{"$exists":True}}).count() > 0:
		prefix = "http://"
	elif serv.find({"ip":ip,"443":{"$exists":True}}).count() > 0:
		prefix = "https://"
	try:
		if os.path.exists(wapitiPath+"wapiti"+host):
			print "deleting "+wapitiPath+"wapiti"+host
			cmd = "sudo rm -r "+wapitiPath+"wapiti"+host
			run_tool(cmd=cmd)
	except:
		pass
	try:
		if os.path.exists(skipfishPath+"skipfish"+host):
			print "deleting "+skipfishPath+"skipfish"+host
			cmd = "sudo rm -r "+skipfishPath+"skipfish"+host
			run_tool(cmd=cmd)
	except:
		pass
	try:
		if os.path.exists(cwd+"/Tools/skipfish/new_dict_"+host+".wl"):
			print cwd+"Tools/skipfish/new_dict_"+host+".wl"
			cmd="sudo rm -r "+cwd+"Tools/skipfish/new_dict_"+host+".wl"
			run_tool(cmd=cmd)
	except:
		pass

	logging.info("Wapiti web scanner started for: "+str(host))
	try:
		print "running wapiti on "+prefix+host
		try:
			p = run_tool(process=True,name="wapiti",prefix=prefix,domain=host,path=wapitiPath+"wapiti"+host+"/",timeout=TIMEOUT)
		except:
			pass
	except:
		pass

	logging.info("Skipfish web scanner started for: "+str(host))

	try:
		cmd="touch "+cwd+"/Tools/skipfish/new_dict_"+host+".wl"
		run_tool(cmd=cmd)
	except:
		pass

	try:
			print "running skipfish on "+prefix+host
			p1 = run_tool(process=True,name="skipfish",prefix=prefix,domain=host,path=skipfishPath+"skipfish"+host+"/",timeout=TIMEOUT)
	except Exception as e:
		logging.error("Skipfish not working. Issue: "+str(e))

	st = timeit.default_timer()
	flag = True
	flag1 = True
	while 1:
		cur = timeit.default_timer()
		try:
			if flag and (p.poll() is not None or cur-st > TIMEOUT/8):
				flag = False
				count = 7
				while count and p.poll() is None:
					count -= 1
					time.sleep(TIMEOUT/8)
					try:
						p.send_signal(signal.SIGINT)
					except:
						pass
				vuln = db.vulnerabilities
				if vuln.find({"ip":ip}).count() == 0:
					vul = {"ip":ip,"domain":domain}
					vuln.insert_one(vul)
				vuln.update({"ip":ip},{"$set":{"wapiti":wapitiPath+"wapiti"+str(host)}})
				logging.info("*************************Wapiti Finished*******************************")
				logging.info("Time Taken = "+str(cur-st))
		except Exception as e:
			print "Issues with wapiti: "+str(e)
			flag = false
		if flag1 and p1.poll() is not None:
			flag1 = False
	               	vuln = db.vulnerabilities
	                if vuln.find({"ip":ip}).count() == 0:
	       	                vul = {"ip":ip,"domain":domain}
	               	        vuln.insert_one(vul)
	                vuln.update({"ip":ip},{"$set":{"skipfish":skipfishPath+"skipfish"+str(host)}})
			logging.info("*************************Skipfish Finished******************************")
			logging.info("Time Taken = "+str(cur-st))
		if flag == False and flag1 == False:
			break
		time.sleep(10)


	#update wapiti file
	try: 
		if os.path.exists(wapitiPath+"wapiti"+str(host)+"/index.html"):
			f = open(wapitiPath+"wapiti"+str(host)+"/index.html","r")
			tt = f.readlines()
			f.close()

			f = open(wapitiPath+"wapiti"+str(host)+"/index.html","w")
			for i in range(len(tt)):
				if tt[i].strip() ==  "var nb_vulns = report_data[flaw_name][vuln_name].length;":
					f.write(tt[i])
					f.write("if(nb_vulns == 0){\ncount++;\ncontinue;\n}\n")
				elif tt[i].strip() == "kube_tabs_js = document.createElement('script');":
					f.write("if(count == 11){\nvar newDiv = document.createElement('h1');\nvar vul = document.createElement('b');\nvar newContent =  document.createTextNode('woohoo! you are free from this vulnerabilities');\nnewDiv.appendChild(newContent);\nnewDiv.appendChild(document.createElement('br'));\nvul.appendChild(document.createTextNode('Cross Site Scripting'));\nvul.appendChild(document.createElement('br'));\nvul.appendChild(document.createTextNode('Htaccess Bypass'));\nvul.appendChild(document.createElement('br'));\nvul.appendChild(document.createTextNode('Backup file'));\nvul.appendChild(document.createElement('br'));\nvul.appendChild(document.createTextNode('SQL Injection'));\nvul.appendChild(document.createElement('br'));\nvul.appendChild(document.createTextNode('Blind SQL Injection'));\nvul.appendChild(document.createElement('br'));\nvul.appendChild(document.createTextNode('File Handling'));\nvul.appendChild(document.createElement('br'));\nvul.appendChild(document.createTextNode('Potentially dangerous file'));\nvul.appendChild(document.createElement('br'));\nvul.appendChild(document.createTextNode('CRLF Injection'));\nvul.appendChild(document.createElement('br'));\nvul.appendChild(document.createTextNode('Commands execution'));\nvul.appendChild(document.createElement('br'));\nvul.appendChild(document.createTextNode('Resource consumption'));\nvul.appendChild(document.createElement('br'));\nvul.appendChild(document.createTextNode('Internal Server Error'));\nvul.appendChild(document.createElement('br'));\nsummary.appendChild(newDiv);\nsummary.appendChild(vul);\n}\n")
					f.write(tt[i])
				elif tt[i].strip() == "var vuln_count = 0;":
					f.write(tt[i])
					f.write("var count = 0;\n")
				else:
					f.write(tt[i])
			f.close()
		else:
			print "WAPITI FILE "+wapitiPath+"wapiti"+str(host)+"/index.html does not exisit"
	except Exception as e:
		print "Issues with wapiti file: "+str(e)

	if domain == "":
		domain = "null"

	countVulns(ip,domain,type)


if __name__== "__main__":
	vulnerabilityScan(sys.argv[1],sys.argv[2],sys.argv[3])