diff --git a/.gitignore b/.gitignore deleted file mode 100644 index 425b550..0000000 --- a/.gitignore +++ /dev/null @@ -1,230 +0,0 @@ -################# -## Taipan -################# - -ES.Taipan.Infrastructure/Network/Windows/* -ES.Taipan.Infrastructure/Network/Unix32/* -ES.Taipan.Infrastructure/Network/Unix64/* -Bins/* - - -################# -## Eclipse -################# - -*.pydevproject -.project -.metadata -bin/ -tmp/ -.fake/ -*.tmp -*.bak -*.swp -*~.nib -local.properties -.classpath -.settings/ -.loadpath - -# External tool builders -.externalToolBuilders/ - -# Locally stored "Eclipse launch configurations" -*.launch - -# CDT-specific -.cproject - -# PDT-specific -.buildpath - - -################# -## Visual Studio -################# - -## Ignore Visual Studio temporary files, build results, and -## files generated by popular Visual Studio add-ons. - -# User-specific files -*.suo -*.user -*.sln.docstates -.vs/ -Data/Signatures/PHP/*.zip - -# Build results - -[Dd]ebug/ -[Rr]elease/ -x64/ -build/ -[Bb]in/ -[Oo]bj/ -packages/ -deploy/ - -# MSTest test Results -[Tt]est[Rr]esult*/ -[Bb]uild[Ll]og.* - -*_i.c -*_p.c -*.ilk -*.meta -*.obj -*.pch -*.pdb -*.pgc -*.pgd -*.rsp -*.sbr -*.tlb -*.tli -*.tlh -*.tmp -*.tmp_proj -*.log -*.vspscc -*.vssscc -.builds -*.pidb -*.log -*.scc - -# Visual C++ cache files -ipch/ -*.aps -*.ncb -*.opensdf -*.sdf -*.cachefile - -# Visual Studio profiler -*.psess -*.vsp -*.vspx - -# Guidance Automation Toolkit -*.gpState - -# ReSharper is a .NET coding add-in -_ReSharper*/ -*.[Rr]e[Ss]harper - -# TeamCity is a build add-in -_TeamCity* - -# DotCover is a Code Coverage Tool -*.dotCover - -# NCrunch -*.ncrunch* -.*crunch*.local.xml - -# Installshield output folder -[Ee]xpress/ - -# DocProject is a documentation generator add-in -DocProject/buildhelp/ -DocProject/Help/*.HxT -DocProject/Help/*.HxC -DocProject/Help/*.hhc -DocProject/Help/*.hhk -DocProject/Help/*.hhp -DocProject/Help/Html2 -DocProject/Help/html - -# Click-Once directory -publish/ - -# Publish Web Output -*.Publish.xml -*.pubxml - -# NuGet Packages Directory -## TODO: If you have NuGet Package Restore enabled, uncomment the next line -#packages/ - -# Windows Azure Build Output -csx -*.build.csdef - -# Windows Store app package directory -AppPackages/ - -# Others -sql/ -*.Cache -ClientBin/ -[Ss]tyle[Cc]op.* -~$* -*~ -*.dbmdl -*.[Pp]ublish.xml -*.pfx -*.publishsettings - -# RIA/Silverlight projects -Generated_Code/ - -# Backup & report files from converting an old project file to a newer -# Visual Studio version. Backup files are not needed, because we have git ;-) -_UpgradeReport_Files/ -Backup*/ -UpgradeLog*.XML -UpgradeLog*.htm - -# SQL Server files -App_Data/*.mdf -App_Data/*.ldf - -############# -## Windows detritus -############# - -# Windows image file caches -Thumbs.db -ehthumbs.db - -# Folder config file -Desktop.ini - -# Recycle Bin used on file shares -$RECYCLE.BIN/ - -# Mac crap -.DS_Store - - -############# -## Python -############# - -*.py[co] - -# Packages -*.egg -*.egg-info -dist/ -build/ -eggs/ -parts/ -var/ -sdist/ -develop-eggs/ -.installed.cfg - -# Installer logs -pip-log.txt - -# Unit test / coverage reports -.coverage -.tox - -#Translations -*.mo - -#Mr Developer -.mr.developer.cfg diff --git a/Doc/Authentication.md b/Doc/Authentication.md deleted file mode 100644 index ea035a0..0000000 --- a/Doc/Authentication.md +++ /dev/null @@ -1,52 +0,0 @@ -# Run an authenticated Scan - -By modifiying the profile file, it is possible to create an authenticated scan. There are various kind of Authentication: - -* Add to Taipan an authenticated cookie -* Configure an HTTP Basic/Digest authentication -* Configure a Bearer (token based) authentication -* Web form authentication - -## Add an authenticated cookie -This method is probably the easier one. The first step is to obtain a cookie that was authenticated. In order to do you can login into your web application and then extracts the value of the coookie that was returned by server in order to identify your session. To grab the cookie you can use one the many available HTTP proxy. - -Once that you have the cookie you have to modify the given scan profile. In the profile you have to identify the XML element **AdditionalCookies** which is a children of the XML element **HttpRequestorSettings**. Once identified you have to add a new XML child named **Cookie** with two other childrens named **Name** and **Value**. An example of configuration is the following: - - - - Cookie Name - Cookie Value - - - -If you need more than one cookie for the authentication just add more **Cookie** elements to the **AdditionalCookies** element. Once done that, *Taipan* will send the configured cookie in all its requests. - -## Configure an HTTP Basic/Digest authentication -To configure an HTTP Basic/Digest authentication is necessary to modify the used scan profile. You have to identify the XML element **AuthenticationInfo** which is a children of the XML element **HttpRequestorSettings**. Once identified you have to add the childrens **Type**, **Username** and **Password**, where *Type* must assume the value **Basic** or **Digest**. All the other items must be empty. An example of configuration is the following: - - - Basic - admin - admin - - true - - - - - -## Configure a Bearer (token based) authentication -To configure an Bearer authentication (also known as token based authentication) is necessary to modify the used scan profile. You have to identify the XML element **AuthenticationInfo** which is a children of the XML element **HttpRequestorSettings**. Once identified you have to add the childrens **Type** and **Token**, where *Type* must assume the value **Bearer**. All the other items must be empty. An example of configuration is the following: - - - Bearer - - - 1234567890qwertyuiop - true - - - - - -## Web form authentication diff --git a/Doc/Hidden resource discovery.md b/Doc/Hidden resource discovery.md deleted file mode 100644 index 0486041..0000000 --- a/Doc/Hidden resource discovery.md +++ /dev/null @@ -1,6 +0,0 @@ -# Hidden resource discovery -Taipan allows to identify hidden resources. With hidden resource I mean any content that is not directly accessible by direct web application navigation. Example of hidden content are -test pages, backup files or any URLs which is not directly navigable. - -This process is based on _wordlist_ of keywords. Taipan allwos to customize this process by specifing a possible extension to use during the scan. The profile that you must use in order -to execute an hidden discovery scan is *Identify hidden resources* (you can see it by running Taipan with the command _--show-profiles_). \ No newline at end of file diff --git a/Doc/Http and Web Form bruteforcing.md b/Doc/Http and Web Form bruteforcing.md deleted file mode 100644 index cc10bba..0000000 --- a/Doc/Http and Web Form bruteforcing.md +++ /dev/null @@ -1,7 +0,0 @@ -# Http and Web Form bruteforcing -This AddOn allows to execute an HTTP or Web Form authentication bruteforcing. In order to do so it verify the response code (in case of HTTP bruteforcing) or use a custom heuristic in order to identify if the page returned an authenticated content or not (in case of Web Form authentication). - -Under the folder _Data\AddOnStorage\Web Form Bruteforcer AddOn_ you will find three XML files (the file format is self explanatory): - * **Combinations.xml** contains the combination of user/password to use. This is useful to test for default account - * **Usernames.xml** contaions the list of username to bruteforce. It is suggested to not include a long list, since for each username the entire password list is used in order to bruteforce it - * **Passwords.xml** contains the password to use in order to bruteforce all usernames diff --git a/Doc/LuaScript.md b/Doc/LuaScript.md deleted file mode 100644 index 367f94d..0000000 --- a/Doc/LuaScript.md +++ /dev/null @@ -1,28 +0,0 @@ -# Implements a new Luca script to fingerprint web applications -The identification of a given Web Application is done through two diferent processes. The first one is signature based and the second one is via custom LUA script. It is possible to add new script by following some simple guidelines. - -All LUA scripts are stored in **Data\Scripts\** folder. Inside this folder there are the script that identify a specific directory. Each script is sotred in afolder with the same name as the identified application. For example the LUA script to fingerprint Wordpress is stored in the folder: **Data\Scripts\Php\Wordpress**. - -To create a new script is necessary to create a new application folder insider the corresponding *language folder*. There are two files that must be defined, the first one is the descriptor file, which is an XML file that describe the script. Find below the script for theWordpress application: - - - 10BEAE33-CAC7-4862-BD07-9E42A12258E6 - Wordpress - Php - - -The parameters meaning are: - * **Id** is a GUID and if the identifier of the script - * **ApplicationName** The application name that is identified. This name will be displayed in the result report - * **TargetLanguage** The language that was used to develop the application. For Wordpress is PHP - -## Global vars -In order to report to Taipan the Application that was identified and its version, the script must set a couple of global vars that will be later used by the Taipan scanner. Each script must return a _Boolean_ result after its execution. The result meaning is: - -* True: if the script was able to identify a given application version -* False: otherwise - -If the script is able to identify the application, the version must be placed in a global vaiables named *appVersion*. - -The format of this variable must be compliant to the Semantic Version standard. For a sample of LUA script take a look at the Joomla fingeprintg script. - diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md deleted file mode 100644 index 08690a9..0000000 --- a/RELEASE_NOTES.md +++ /dev/null @@ -1,78 +0,0 @@ -### 2.1.0 - 05/01/2019 -* Improved profile displaying -* Improved Error page detection by identifying JBoss error pages -* Added Web Form authentication bruteforcer -* Minor bug fixing - -### 2.0.0 - 04/11/2018 -* Improved error reporting and enabled saving a txt format of the generated report -* Improved testing of multipart input, included file input -* Added integrity check when testing web form with password fields. If the values of the password fields is different there may be false negative -* Added HTTP Basic bruteforce plugin - -### 1.7.0 - 06/08/2018 -* Created Vulnerability Editor in order to create application vulnerabilities -* Improved system metrics generation -* Improved code to load signature by decreasing the load time -* Added more signatures and improved discovery process -* Fixed minor bug in Fingerprinter and Vulnerability Scanner -* Added web vulnerabilities -* Added support to Brotli decompression -* Updated TestSSL AddOn - -### 1.6.0 - 28/03/2018 -* Resolved resource leak in ChromeDriver usage -* Fixed some bugs (FPs, Mem leak, ...) -* Improved Reflected XSS AddOn -* Authentication HTTP Basic, Digest, Bearer -* Authentication via WebForm -* Adjusted versioning - -### 1.2.5 - 06/02/2018 -* Implemented Re-Crawling of identified web pages -* Minor bug fixes -* Added Stored Cross Site Scripting check -* Added Exposed Session Variables check - -### 1.2.4 - 21/12/2017 -* Added Blind SQL Injection check -* Added Missing HttpOnly cookie flag check -* Added Missing Secure cookie flag check -* Added Password sent over insecure channel check -* Added Password field with autocomplete enabled check - -### 1.2.3 - 06/09/2017 -* Implemented Javascript Engine -* Improved Scan information section -* Bug fixing -* Vulnerabilities added: - - Woocommerce: Reflected XSS vulnerability in vendor_description parameter - -### 1.2.2 - 25/07/2017 -* Journey Scan implemented -* SQL Injection addOn -* Availability of HTML and JSON Report -* Added feature to set default value for specific parameters -* Added info on the connected Scan Managers and enabled the editing of specific properties -* Improved UX -* Improved resource discovery process -* Implemented process to satify anti-CSRF token submission during SQL Injection and Cross Site Scripting testing -* Vulnerabilities added: - - Joomla: CVE-2015-8564, CVE-2015-8769, CVE-2016-8869, CVE-2016-8870, CVE-2016-9081, CVE-2016-9836, CVE-2017-8917 - - Wordpress: CVE-2015-2213, CVE-2016-6896, CVE-2017-9064, CVE-2017-5611, CVE-2016-7169 -* Bug fixing and testing - -### 1.2.0 - 22/09/2016 -* Added more vulnerability AddOn checks -* Added more signatures -* General imrpovements - -### 1.1.0 - 28/07/2016 -* Added Crawler component -* Added vulnerability scanner component -* Added Directory Listing vulnerability addon -* Added more signature to the web application fingerprinter -* Improved hidden resource discoverer - -### 1.0.0 - 10/06/2016 -* First Beta Release. \ No newline at end of file