w3af-svn-notify Mailing List for w3af (Page 268)
Status: Beta
Brought to you by:
andresriancho
You can subscribe to this list here.
2008 |
Jan
|
Feb
(235) |
Mar
(336) |
Apr
(280) |
May
(278) |
Jun
(159) |
Jul
(270) |
Aug
(240) |
Sep
(121) |
Oct
(110) |
Nov
(199) |
Dec
(228) |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2009 |
Jan
(251) |
Feb
(206) |
Mar
(115) |
Apr
(45) |
May
(27) |
Jun
(67) |
Jul
(49) |
Aug
(38) |
Sep
(10) |
Oct
(131) |
Nov
(89) |
Dec
(38) |
2010 |
Jan
(85) |
Feb
(71) |
Mar
(45) |
Apr
(23) |
May
(12) |
Jun
|
Jul
(11) |
Aug
(7) |
Sep
(81) |
Oct
(79) |
Nov
(165) |
Dec
(62) |
2011 |
Jan
(134) |
Feb
(73) |
Mar
(34) |
Apr
(63) |
May
(147) |
Jun
(43) |
Jul
(21) |
Aug
(26) |
Sep
(43) |
Oct
(34) |
Nov
(44) |
Dec
(112) |
2012 |
Jan
(47) |
Feb
(44) |
Mar
(72) |
Apr
(209) |
May
(54) |
Jun
(279) |
Jul
(151) |
Aug
(332) |
Sep
(39) |
Oct
(268) |
Nov
(116) |
Dec
(368) |
2013 |
Jan
(73) |
Feb
|
Mar
|
Apr
(1) |
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
From: SourceForge.net <no...@so...> - 2008-03-06 00:34:54
|
Task #146862 has been updated. Project: w3af Subproject: Plugin TODO v1.00 Summary: spiderMan show when user started to navigate Complete: 0% Status: Closed Authority : andresriancho Assigned to: andresriancho Description: spiderMan show when user started to navigate; an information message should be printed when the user sends the first request through the proxy. Follow-Ups: ------------------------------------------------------- Date: 2008-03-05 21:34 By: andresriancho Comment: Done! Fixed in revision 801. ------------------------------------------------------- For more info, visit: http://sourceforge.net/pm/task.php?func=detailtask&project_task_id=146862&group_id=170274&group_project_id=50603 |
From: SourceForge.net <no...@so...> - 2008-03-06 00:08:15
|
Task #146900 has been updated. Project: w3af Subproject: TODO v1.10 Summary: add support for test cases Complete: 0% Status: Open Authority : andresriancho Assigned to: andresriancho Description: Test cases are a group of fuzzableRequests that should be run in a specific way in order to achieve a task. Test cases would be created by users using spiderMan. ------------------------------------------------------- For more info, visit: http://sourceforge.net/pm/task.php?func=detailtask&project_task_id=146900&group_id=170274&group_project_id=54341 |
From: SourceForge.net <no...@so...> - 2008-03-05 13:38:16
|
Task #146888 has been updated. Project: w3af Subproject: Plugin TODO v1.10 Summary: Private IP address Leaked using the PROPFIND method Complete: 0% Status: Open Authority : andresriancho Assigned to: nobody Description: Private IP address Leaked using the PROPFIND method The remote web server leaks a private IP address through the WebDAV interface. If this web server is behind a Network Address Translation (NAT) firewall or proxy server, then the internal IP addressing scheme has been leaked. That address is: 10.200.1.14 This is typical of IIS 5.0 installations that are not configured properly. See also : http://www.nextgenss.com/papers/iisrconfig.pdf Solution : http://support.microsoft.com/default.aspx?scid=KB12113BEN-US12113BQ218180&ID=KB12113BEN-US12113BQ218180 Risk factor : Low CVE : CVE-2002-0422 ------------------------------------------------------- For more info, visit: http://sourceforge.net/pm/task.php?func=detailtask&project_task_id=146888&group_id=170274&group_project_id=55629 |
From: <and...@us...> - 2008-03-05 11:48:57
|
Revision: 800 http://w3af.svn.sourceforge.net/w3af/?rev=800&view=rev Author: andresriancho Date: 2008-03-05 03:48:54 -0800 (Wed, 05 Mar 2008) Log Message: ----------- Removed unneeded import that was added during some tests. Modified Paths: -------------- trunk/core/ui/gtkUi/messages.py This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <and...@us...> - 2008-03-05 11:28:19
|
Revision: 799 http://w3af.svn.sourceforge.net/w3af/?rev=799&view=rev Author: andresriancho Date: 2008-03-05 03:28:13 -0800 (Wed, 05 Mar 2008) Log Message: ----------- Debugging is enabled by default in spiderMan plugin. Modified Paths: -------------- trunk/scripts/script-spiderMan.w3af This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <and...@us...> - 2008-03-05 11:26:29
|
Revision: 798 http://w3af.svn.sourceforge.net/w3af/?rev=798&view=rev Author: andresriancho Date: 2008-03-05 03:26:26 -0800 (Wed, 05 Mar 2008) Log Message: ----------- Added two new common headers. Modified Paths: -------------- trunk/plugins/grep/strangeHeaders.py This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <and...@us...> - 2008-03-05 11:25:46
|
Revision: 797 http://w3af.svn.sourceforge.net/w3af/?rev=797&view=rev Author: andresriancho Date: 2008-03-05 03:25:39 -0800 (Wed, 05 Mar 2008) Log Message: ----------- Changed optionMap to optionsMap; it was a bug. Modified Paths: -------------- trunk/plugins/audit/frontpage.py This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <and...@us...> - 2008-03-05 01:41:04
|
Revision: 796 http://w3af.svn.sourceforge.net/w3af/?rev=796&view=rev Author: andresriancho Date: 2008-03-04 17:40:51 -0800 (Tue, 04 Mar 2008) Log Message: ----------- Starting with the logVisualization XY plot. This logVisualization XY plot is most likely to be a test and it may die sometime in the future when we find a new and better way to display information. Modified Paths: -------------- trunk/core/ui/gtkUi/logtab.py trunk/core/ui/gtkUi/messages.py Added Paths: ----------- trunk/core/ui/gtkUi/logVisualization.py This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: SourceForge.net <no...@so...> - 2008-03-05 00:26:01
|
Task #146851 has been updated. Project: w3af Subproject: Plugin TODO v1.00 Summary: error500, show a lot, save one to kb ? Complete: 0% Status: Closed Authority : andresriancho Assigned to: andresriancho Description: error500, show a lot, save one to kb ? Follow-Ups: ------------------------------------------------------- Date: 2008-03-04 21:25 By: andresriancho Comment: Fixed in gtkUi. ------------------------------------------------------- For more info, visit: http://sourceforge.net/pm/task.php?func=detailtask&project_task_id=146851&group_id=170274&group_project_id=50603 |
From: <and...@us...> - 2008-03-05 00:24:10
|
Revision: 795 http://w3af.svn.sourceforge.net/w3af/?rev=795&view=rev Author: andresriancho Date: 2008-03-04 16:24:05 -0800 (Tue, 04 Mar 2008) Log Message: ----------- Complete refactoring of all the request and response viewer; also modified the scanrun to show the request and response of every vuln/info object. Modified Paths: -------------- trunk/core/ui/gtkUi/httpLogTab.py trunk/core/ui/gtkUi/reqResViewer.py trunk/core/ui/gtkUi/scanrun.py This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <and...@us...> - 2008-03-05 00:23:15
|
Revision: 794 http://w3af.svn.sourceforge.net/w3af/?rev=794&view=rev Author: andresriancho Date: 2008-03-04 16:23:11 -0800 (Tue, 04 Mar 2008) Log Message: ----------- Fixed bug: File "/home/dz0/w3af/core/ui/gtkUi/kbtree.py", line 117, in _filterKB holdvariab.append((idobject, obj)) UnboundLocalError: local variable 'obj' referenced before assignment Modified Paths: -------------- trunk/core/ui/gtkUi/kbtree.py This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <and...@us...> - 2008-03-04 23:17:20
|
Revision: 793 http://w3af.svn.sourceforge.net/w3af/?rev=793&view=rev Author: andresriancho Date: 2008-03-04 15:17:07 -0800 (Tue, 04 Mar 2008) Log Message: ----------- HTTP Log tab refactoring. Modified Paths: -------------- trunk/core/ui/gtkUi/httpLogTab.py Added Paths: ----------- trunk/core/ui/gtkUi/reqResDBHandler.py trunk/core/ui/gtkUi/reqResViewer.py This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: SourceForge.net <no...@so...> - 2008-03-04 17:58:44
|
Task #145075 has been updated. Project: w3af Subproject: Plugin TODO v1.10 Summary: audit.sslCertificate ; get more info Complete: 0% Status: Open Authority : andresriancho Assigned to: sharadgana Description: Get more info from the certificate and validate dates, domain name, etc. Follow-Ups: ------------------------------------------------------- Date: 2008-01-11 12:19 By: andresriancho Comment: Something like this should be shown: Server certificate -----BEGIN CERTIFICATE----- MIIC0zCCAjwCCQCtz8J102gJFzANBgkqhkiG9w0BAQUFADCBrTELMAkGA1UEBhMC R0IxEzARBgNVBAgTClNvbWUtU3RhdGUxFjAUBgNVBAcTDVNvbWUtTG9jYWxpdHkx GTAXBgNVBAoTEE9uZSBPcmdhbml6YXRpb24xHjAcBgNVBAsTFU9uZSBPcmdhbml6 YXRpb24gVW5pdDESMBAGA1UEAxMJbG9jYWxob3N0MSIwIAYJKoZIhvcNAQkBFhN3 ZWJtYXN0ZXJAbG9jYWxob3N0MB4XDTA2MTIxMTE2MDQyOVoXDTA3MDExMDE2MDQy OVowga0xCzAJBgNVBAYTAkdCMRMwEQYDVQQIEwpTb21lLVN0YXRlMRYwFAYDVQQH Ew1Tb21lLUxvY2FsaXR5MRkwFwYDVQQKExBPbmUgT3JnYW5pemF0aW9uMR4wHAYD VQQLExVPbmUgT3JnYW5pemF0aW9uIFVuaXQxEjAQBgNVBAMTCWxvY2FsaG9zdDEi MCAGCSqGSIb3DQEJARYTd2VibWFzdGVyQGxvY2FsaG9zdDCBnzANBgkqhkiG9w0B AQEFAAOBjQAwgYkCgYEA72qyH0+6Bqpx4FHfEkezqPHZuE212r8nDm8//udvYPoX yiswL7H3zb7M7ZftvcTKGwisSdcg6A+IoqO6zyvjorg9dAkFZ0B8RjeEavqB/BYG oax0Ql6E9TRK9jzvz28cbz3fFi20Njuau8O6OGCxNgEqJDvLFDBVj539lOR2jtEC AwEAATANBgkqhkiG9w0BAQUFAAOBgQA1qEjGcY+9jVz635zzvLevo+S7sLROPvIp uQUPHQPfQ2xx3BEb5slSRlgUARV4/cE0OEODPOL/8xvJeTyTLBilXw4pUBeOm9tz rCsJ1ljpCNf4I2/Ecm6uK446sYIv2E0946KiMz//3esRGi5iSiNr/Aw66VOg1wbx xMyx7wAbeg== -----END CERTIFICATE----- subject=/C=GB/ST=Some-State/L=Some-Locality/O=One Organization/OU=One Organization Unit/CN=localhost/emailAddress=webmaster@localhost issuer=/C=GB/ST=Some-State/L=Some-Locality/O=One Organization/OU=One Organization Unit/CN=localhost/emailAddress=webmaster@localhost --- No client certificate CA names sent --- Ciphers common between both SSL endpoints: RC4-MD5 EXP-RC4-MD5 RC2-CBC-MD5 EXP-RC2-CBC-MD5 DES-CBC-MD5 DES-CBC3-MD5 --- SSL handshake has read 860 bytes and written 236 bytes --- New, SSLv2, Cipher is DES-CBC3-MD5 Server public key is 1024 bit Compression: NONE Expansion: NONE SSL-Session: Protocol : SSLv2 Cipher : DES-CBC3-MD5 Session-ID: 63D445918D33F99FF8B4C241427DCE04 Session-ID-ctx: Master-Key: FEE6B631E93F3768DA1ADD5F29A0E2081F8E79B0B4668AA9 Key-Arg : 48B59B5390412D47 Start Time: 1200064709 Timeout : 300 (sec) Verify return code: 10 (certificate has expired) --- ------------------------------------------------------- Date: 2008-01-11 11:41 By: andresriancho Comment: This can be done with the openssl module! The plugin that should be modified is audit.sslCertificate. Also, only perfom *one* connection to the remote server, not one for every call. Show the gathered information only one time. Finally, check that the certificate is valid. Maybe openssl can do this ?! ------------------------------------------------------- For more info, visit: http://sourceforge.net/pm/task.php?func=detailtask&project_task_id=145075&group_id=170274&group_project_id=55629 |
From: SourceForge.net <no...@so...> - 2008-03-04 17:07:15
|
Task #146806 has been updated. Project: w3af Subproject: gtkUi - Phase 2 Summary: Help with Findable (which I renamed to Searchable) Complete: 100% Status: Closed Authority : andresriancho Assigned to: facundobatista Description: I tried to remove gtk.TextView objects by Searchable objects, and I had a problem. Please contact me to tell me how to perform this task. Send me an email or something. Follow-Ups: ------------------------------------------------------- Date: 2008-03-04 14:07 By: facundobatista Comment: ScrollLines can not inherit from Searchable instead of TextView, because Searchable needs to add the little bar at the bottom, so it would need to be a VBox. But if Searchable inherits VBox, stops being a TExtView, which can not happen. And if refuse to inherit both at the same time, because this way it will be container and contained at the same time, which is worse. What I did is: - (same as bfore) The box that has the textview keeps inheriting from Searchable. - (new) The box, at Searchable's init time, gives it the TextView to extend. This way, there are no more magic names in Searchable, so it's more reusable... ------------------------------------------------------- For more info, visit: http://sourceforge.net/pm/task.php?func=detailtask&project_task_id=146806&group_id=170274&group_project_id=55112 |
From: SourceForge.net <no...@so...> - 2008-03-04 16:31:07
|
Task #146686 has been updated. Project: w3af Subproject: gtkUi - Phase 2 Summary: Remove repr() when showing messages Complete: 100% Status: Closed Authority : facundobatista Assigned to: facundobatista Description: In the Log window, when showing the messages, it should not enclose it in repr(), to show actually what it receives. If the message comes bad encoded, and it raises an exception, a bug should be opened regarding that message, not the GUI. Follow-Ups: ------------------------------------------------------- Date: 2008-03-04 13:30 By: facundobatista Comment: Finished in r792. ------------------------------------------------------- For more info, visit: http://sourceforge.net/pm/task.php?func=detailtask&project_task_id=146686&group_id=170274&group_project_id=55112 |
From: <fac...@us...> - 2008-03-04 16:30:40
|
Revision: 792 http://w3af.svn.sourceforge.net/w3af/?rev=792&view=rev Author: facundobatista Date: 2008-03-04 08:30:35 -0800 (Tue, 04 Mar 2008) Log Message: ----------- Removed the repr() around the message text, to expose any problem in the strings sent by the Core. Modified Paths: -------------- trunk/core/ui/gtkUi/messages.py This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: SourceForge.net <no...@so...> - 2008-03-04 16:19:34
|
Task #146871 has been updated. Project: w3af Subproject: Plugin TODO v1.00 Summary: interesting commands and SSI false positive Complete: 0% Status: Open Authority : andresriancho Assigned to: nobody Description: A comment with the string "pass" was found in: http://www.edesur.com.ar/grandes_clientes/fr_grandes_clientes.asp . This could be interesting. This information was found in the request with id 1812. <frame name="body" src="<!--#include file="/etc/passwd"-->" marginwidth="0" marginheight="0"> ------------------------------------------------------- For more info, visit: http://sourceforge.net/pm/task.php?func=detailtask&project_task_id=146871&group_id=170274&group_project_id=50603 |
From: SourceForge.net <no...@so...> - 2008-03-04 16:16:30
|
Task #146870 has been updated. Project: w3af Subproject: Plugin TODO v1.00 Summary: strangeParameter false positive Complete: 0% Status: Open Authority : andresriancho Assigned to: nobody Description: The URI : http://www.edesur.com.ar/servicios_cliente/fr_servicios_cliente.asp?direccion=pop_accidentes_electr has a parameter named: "direccion" with value: "pop_accidentes_electr", which is quite odd. This information was found in the request with id 55. The URI : http://www.edesur.com.ar/grandes_clientes/fr_grandes_clientes.asp?direccion=consultas_habituales.htm has a parameter named: "direccion" with value: "consultas_habituales.htm", which is quite odd. This information was found in the request with id 95. The URI : http://www.edesur.com.ar/servicios_empresas/fr_servicios_empresas.asp?direccion=nuevos_prodyserv.htm has a parameter named: "direccion" with value: "nuevos_prodyserv.htm", which is quite odd. This information was found in the request with id 95. The URI : http://www.edesur.com.ar/servicios_municipios/fr_servicios_municipios.asp?direccion=afavor_MA.htm has a parameter named: "direccion" with value: "afavor_MA.htm", which is quite odd. This information was found in the request with id 116. ------------------------------------------------------- For more info, visit: http://sourceforge.net/pm/task.php?func=detailtask&project_task_id=146870&group_id=170274&group_project_id=50603 |
From: SourceForge.net <no...@so...> - 2008-03-04 14:48:59
|
Task #146862 has been updated. Project: w3af Subproject: Plugin TODO v1.00 Summary: spiderMan show when user started to navigate Complete: 0% Status: Open Authority : andresriancho Assigned to: andresriancho Description: spiderMan show when user started to navigate; an information message should be printed when the user sends the first request through the proxy. ------------------------------------------------------- For more info, visit: http://sourceforge.net/pm/task.php?func=detailtask&project_task_id=146862&group_id=170274&group_project_id=50603 |
From: <fac...@us...> - 2008-03-04 14:34:03
|
Revision: 791 http://w3af.svn.sourceforge.net/w3af/?rev=791&view=rev Author: facundobatista Date: 2008-03-04 06:33:44 -0800 (Tue, 04 Mar 2008) Log Message: ----------- Bug 1906934. Now the items in the KBTree that have the same name are not trimmed. Modified Paths: -------------- trunk/core/ui/gtkUi/kbtree.py This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: SourceForge.net <no...@so...> - 2008-03-04 13:32:07
|
Task #146857 has been updated. Project: w3af Subproject: Plugin TODO v1.10 Summary: Detect source code leak Complete: 0% Status: Open Authority : andresriancho Assigned to: nobody Description: Note that there is a grep plugin that already performs this task, I just should add the signatures: One === <%@ include file="/crm/crm_header_inc.jsp" %> Two === <jsp:include page="linksHB.jsp" flush="true"/> ------------------------------------------------------- For more info, visit: http://sourceforge.net/pm/task.php?func=detailtask&project_task_id=146857&group_id=170274&group_project_id=55629 |
From: SourceForge.net <no...@so...> - 2008-03-04 12:33:45
|
Task #146853 has been updated. Project: w3af Subproject: Plugin TODO v1.10 Summary: frontpage Complete: 0% Status: Open Authority : andresriancho Assigned to: nobody Description: frontpage plugin should get the version of frontpage that is installed on the remote site, and then perform the upload. POST /_vti_bin/shtml.dll/_vti_rpc HTTP/1.1 Date: Wed, 08 Sep 2004 18:19:49 GMT Host: www.farmacity.com.ar MIME-Version: 1.0 User-Agent: MSFrontPage/5.0 Host: localhost:8088 Accept: auth/sicily Content-Length: 41 Content-Type: application/x-www-form-urlencoded X-Vermeer-Content-Type: application/x-www-form-urlencoded Connection: Keep-Alive Cache-Control: no-cache method=server+version Response ======== <html><head><title>vermeer RPC packet</title></head> <body> <p>method=server version <p>server version= <ul> <li>major ver=5 <li>minor ver=0 <li>phase ver=2 <li>ver incr=6790 </ul> </body> </html> ------------------------------------------------------- For more info, visit: http://sourceforge.net/pm/task.php?func=detailtask&project_task_id=146853&group_id=170274&group_project_id=55629 |
From: SourceForge.net <no...@so...> - 2008-03-04 11:57:06
|
Task #146852 has been updated. Project: w3af Subproject: TODO v1.00 Summary: Bad request; 400 code is never is404() == False. Complete: 0% Status: Open Authority : andresriancho Assigned to: andresriancho Description: HTTP/1.1 400 Bad Request date: Mon, 03 Mar 2008 20:51:08 GMT connection: close content-type: text/html content-length: 20 ------------------------------------------------------- For more info, visit: http://sourceforge.net/pm/task.php?func=detailtask&project_task_id=146852&group_id=170274&group_project_id=48542 |
From: SourceForge.net <no...@so...> - 2008-03-04 11:44:39
|
Task #146851 has been updated. Project: w3af Subproject: Plugin TODO v1.00 Summary: error500, show a lot, save one to kb ? Complete: 0% Status: Open Authority : andresriancho Assigned to: andresriancho Description: error500, show a lot, save one to kb ? ------------------------------------------------------- For more info, visit: http://sourceforge.net/pm/task.php?func=detailtask&project_task_id=146851&group_id=170274&group_project_id=50603 |
From: SourceForge.net <no...@so...> - 2008-03-04 11:34:08
|
Task #146850 has been updated. Project: w3af Subproject: Plugin TODO v1.00 Summary: one comment in one URL, repeated messages of finding it Complete: 0% Status: Open Authority : andresriancho Assigned to: andresriancho Description: The comment : "MAPA\r\n\t\t<td valign="middle">\t\t\r\n\t\t\t \r\n\t\t\t\t <a href="javascript:mapa(\'-58.473387\',\'-34.541948\',\'76\');">\r\n\t\t\t\t <img src="images/icon-map.jpg" alt="Ver el Mapa de la Sucursal ARIAS" width="21" height="21" border="0" /></a>\r\n\t\t\t \r\n\t\t\t\t </td>\r\n <td valign="middle">\t\t\t\t \r\n\t\t \r\n\t\t\t\t<a href="javascript:buscaRecorrido(\'76\');">\r\n\t\t\t\t\t<img src="images/icon-como.jpg" width="21" height="21" border="0" alt="Vea c\xf3mo llegar a la Sucursal ARIAS" />\t\t\t\t</a>\r\n\t\t\t\r\n\t\t\t\r\n\t\t\t</td>FIN COMO LLEGAR " was found on this URL(s): - http://www.farmacity.com.ar/ar/rrhh.asp (with id:6290) - http://www.farmacity.com.ar/ar/rrhh.asp (with id:12013) - http://www.farmacity.com.ar/ar\\rrhh.asp (with id:6434) - http://www.farmacity.com.ar/ar/rrhh.asp (with id:11222) - http://www.farmacity.com.ar/ar/rrhh.asp (with id:11850) - http://www.farmacity.com.ar/ar/rrhh.asp (with id:9340) - http://www.farmacity.com.ar/ar/rrhh.asp (with id:6247) - http://www.farmacity.com.ar/ar/rrhh.asp (with id:9769) - http://www.farmacity.com.ar/ar/rrhh.asp (with id:11555) - http://www.farmacity.com.ar/ar/rrhh.asp (with id:10588) - http://www.farmacity.com.ar/ar/rrhh.asp (with id:11488) - http://www.farmacity.com.ar/ar/rrhh.asp (with id:11557) - http://www.farmacity.com.ar/ar/rrhh.asp (with id:6306) ------------------------------------------------------- For more info, visit: http://sourceforge.net/pm/task.php?func=detailtask&project_task_id=146850&group_id=170274&group_project_id=50603 |