search

infobyte / faraday

Open Source Vulnerability Management Platform
https://www.faradaysec.com
GNU General Public License v3.0
5.04k stars 915 forks source link

wapiti not working #192

Closed robertofocke closed 7 years ago

robertofocke commented 7 years ago

WELCOME TO FARADAY [+] Current Workspace: test [+] API: OK [+] Faraday path set. Aliasing fplugin faraday kali# wapiti http://testphp.vulnweb.comTraceback (most recent call last): File "", line 1, in File "/usr/lib/python2.7/json/init.py", line 291, in load **kw) File "/usr/lib/python2.7/json/init.py", line 339, in loads return _default_decoder.decode(s) File "/usr/lib/python2.7/json/decoder.py", line 364, in decode obj, end = self.raw_decode(s, idx=_w(s, 0).end()) File "/usr/lib/python2.7/json/decoder.py", line 380, in raw_decode obj, end = self.scan_once(s, idx) ValueError: Invalid control character at: line 2 column 109 (char 110)

Wapiti-2.3.0 (wapiti.sourceforge.net)

Note

Este escaneo se ha guardado en el archivo /root/.wapiti/scans/testphp.vulnweb.com.xml Puedes usarlo para realizar ataques sin escanear de nuevo el website mediante el parámetro "-k" [*] Cargando modulos: mod_crlf, mod_exec, mod_file, mod_sql, mod_xss, mod_backup, mod_htaccess, mod_blindsql, mod_permanentxss, mod_nikto

[+] Lanzando módulo exec

FARADAY-SERVER.py ^Croot@kali:/usr/share/python-faraday# python faraday-server.py --debug 2017-04-25 18:44:04,022 - faraday-server.server.couchdb - DEBUG - Pushing Reports DB into CouchDB 2017-04-25 18:44:04,170 - faraday-server.server.importer - INFO - Setting up workspace test 2017-04-25 18:44:04,210 - faraday-server.server.database - DEBUG - Start Query: SELECT db_metadata.id AS db_metadata_id, db_metadata.option AS db_metadata_option, db_metadata.value AS db_metadata_value FROM db_metadata WHERE db_metadata.option = ? 2017-04-25 18:44:04,210 - faraday-server.server.database - DEBUG - Parameters: ('migration',) 2017-04-25 18:44:04,211 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.75ms 2017-04-25 18:44:04,212 - faraday-server.server.database - DEBUG - Start Query: SELECT db_metadata.id AS db_metadata_id, db_metadata.option AS db_metadata_option, db_metadata.value AS db_metadata_value FROM db_metadata WHERE db_metadata.option = ? 2017-04-25 18:44:04,212 - faraday-server.server.database - DEBUG - Parameters: ('version',) 2017-04-25 18:44:04,212 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.34ms 2017-04-25 18:44:04,675 - faraday-server.main - INFO - Faraday Server is ready 2017-04-25 18:44:26,848 - faraday-server.server.web - DEBUG - -> CouchDB: GET / 2017-04-25 18:44:27,229 - faraday-server.server.web - DEBUG - -> CouchDB: GET /test/_changes?feed=continuous&heartbeat=1000&since=8 2017-04-25 18:44:27,239 - faraday-server.server.database - DEBUG - Start Query: SELECT count(service.id) AS count_1 FROM service 2017-04-25 18:44:27,240 - faraday-server.server.database - DEBUG - Parameters: () 2017-04-25 18:44:27,241 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 1.35ms 2017-04-25 18:44:27,243 - faraday-server.server.database - DEBUG - Start Query: SELECT vulnerability.vuln_type AS vulnerability_vuln_type, count() AS count_1 FROM vulnerability GROUP BY vulnerability.vuln_type 2017-04-25 18:44:27,243 - faraday-server.server.database - DEBUG - Parameters: () 2017-04-25 18:44:27,243 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.47ms 2017-04-25 18:44:27,244 - faraday-server.server.database - DEBUG - Start Query: SELECT count(host.id) AS count_1 FROM host 2017-04-25 18:44:27,245 - faraday-server.server.database - DEBUG - Parameters: () 2017-04-25 18:44:27,246 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 1.16ms 2017-04-25 18:44:27,247 - faraday-server.server.database - DEBUG - Start Query: SELECT count(interface.id) AS count_1 FROM interface 2017-04-25 18:44:27,248 - faraday-server.server.database - DEBUG - Parameters: () 2017-04-25 18:44:27,248 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.45ms 2017-04-25 18:44:27,249 - faraday-server.server.database - DEBUG - Start Query: SELECT count(note.id) AS count_1 FROM note 2017-04-25 18:44:27,249 - faraday-server.server.database - DEBUG - Parameters: () 2017-04-25 18:44:27,249 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.46ms 2017-04-25 18:44:27,261 - faraday-server.server.database - DEBUG - Start Query: SELECT count(service.id) AS count_1 FROM service 2017-04-25 18:44:27,261 - faraday-server.server.database - DEBUG - Parameters: () 2017-04-25 18:44:27,262 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.92ms 2017-04-25 18:44:27,263 - faraday-server.server.database - DEBUG - Start Query: SELECT vulnerability.vuln_type AS vulnerability_vuln_type, count() AS count_1 FROM vulnerability GROUP BY vulnerability.vuln_type 2017-04-25 18:44:27,263 - faraday-server.server.database - DEBUG - Parameters: () 2017-04-25 18:44:27,264 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.46ms 2017-04-25 18:44:27,265 - faraday-server.server.database - DEBUG - Start Query: SELECT count(host.id) AS count_1 FROM host 2017-04-25 18:44:27,265 - faraday-server.server.database - DEBUG - Parameters: () 2017-04-25 18:44:27,265 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.45ms 2017-04-25 18:44:27,266 - faraday-server.server.database - DEBUG - Start Query: SELECT count(interface.id) AS count_1 FROM interface 2017-04-25 18:44:27,266 - faraday-server.server.database - DEBUG - Parameters: () 2017-04-25 18:44:27,266 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.45ms 2017-04-25 18:44:27,267 - faraday-server.server.database - DEBUG - Start Query: SELECT count(note.id) AS count_1 FROM note 2017-04-25 18:44:27,268 - faraday-server.server.database - DEBUG - Parameters: () 2017-04-25 18:44:27,268 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.47ms 2017-04-25 18:44:27,276 - faraday-server.hosts - DEBUG - Request parameters: ImmutableMultiDict([('sort', u'vulns'), ('sort_dir', u'desc'), ('page', u'0'), ('page_size', u'20')]) 2017-04-25 18:44:27,280 - faraday-server.server.database - DEBUG - Start Query: SELECT count(DISTINCT host.id) AS count_1 FROM host LEFT OUTER JOIN metadata ON metadata.id = host.entity_metadata_id LEFT OUTER JOIN interface ON host.id = interface.host_id LEFT OUTER JOIN vulnerability ON host.id = vulnerability.host_id LEFT OUTER JOIN service ON host.id = service.host_id AND service.status IN (?, ?, ?) 2017-04-25 18:44:27,280 - faraday-server.server.database - DEBUG - Parameters: ('open', 'running', 'opened') 2017-04-25 18:44:27,280 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.88ms 2017-04-25 18:44:27,284 - faraday-server.server.database - DEBUG - Start Query: SELECT host.id AS host_id, host.name AS host_name, host.os AS host_os, host.description AS host_description, host.owned AS host_owned, host.default_gateway_ip AS host_default_gateway_ip, host.default_gateway_mac AS host_default_gateway_mac, metadata.couchdb_id AS metadata_couchdb_id, metadata.revision AS metadata_revision, metadata.update_time AS metadata_update_time, metadata.update_user AS metadata_update_user, metadata.update_action AS metadata_update_action, metadata.creator AS metadata_creator, metadata.create_time AS metadata_create_time, metadata.update_controller_action AS metadata_update_controller_action, metadata.owner AS metadata_owner, metadata.command_id AS metadata_command_id, group_concat(DISTINCT interface.id) AS interfaces, count(DISTINCT vulnerability.id) AS vuln_count, count(DISTINCT service.id) AS open_services_count FROM host LEFT OUTER JOIN metadata ON metadata.id = host.entity_metadata_id LEFT OUTER JOIN interface ON host.id = interface.host_id LEFT OUTER JOIN vulnerability ON host.id = vulnerability.host_id LEFT OUTER JOIN service ON host.id = service.host_id AND service.status IN (?, ?, ?) GROUP BY host.id ORDER BY vuln_count DESC LIMIT ? OFFSET ? 2017-04-25 18:44:27,284 - faraday-server.server.database - DEBUG - Parameters: ('open', 'running', 'opened', 20, 0) 2017-04-25 18:44:27,285 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.85ms 2017-04-25 18:44:27,298 - faraday-server.server.database - DEBUG - Start Query: SELECT count(service.id) AS count_1 FROM service 2017-04-25 18:44:27,299 - faraday-server.server.database - DEBUG - Parameters: () 2017-04-25 18:44:27,300 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 1.55ms 2017-04-25 18:44:27,302 - faraday-server.server.database - DEBUG - Start Query: SELECT vulnerability.vuln_type AS vulnerability_vuln_type, count(*) AS count_1 FROM vulnerability GROUP BY vulnerability.vuln_type 2017-04-25 18:44:27,302 - faraday-server.server.database - DEBUG - Parameters: () 2017-04-25 18:44:27,302 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.44ms 2017-04-25 18:44:27,304 - faraday-server.server.database - DEBUG - Start Query: SELECT count(host.id) AS count_1 FROM host 2017-04-25 18:44:27,304 - faraday-server.server.database - DEBUG - Parameters: () 2017-04-25 18:44:27,304 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.45ms 2017-04-25 18:44:27,306 - faraday-server.server.database - DEBUG - Start Query: SELECT count(interface.id) AS count_1 FROM interface 2017-04-25 18:44:27,306 - faraday-server.server.database - DEBUG - Parameters: () 2017-04-25 18:44:27,307 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.66ms 2017-04-25 18:44:27,308 - faraday-server.server.database - DEBUG - Start Query: SELECT count(note.id) AS count_1 FROM note 2017-04-25 18:44:27,308 - faraday-server.server.database - DEBUG - Parameters: () 2017-04-25 18:44:27,308 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.50ms 2017-04-25 18:45:04,150 - faraday-server.server.database - DEBUG - Start Query: INSERT INTO metadata (update_time, update_user, update_action, create_time, update_controller_action, creator, owner, command_id, couchdb_id, revision, document_type) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) 2017-04-25 18:45:04,151 - faraday-server.server.database - DEBUG - Parameters: (None, None, None, None, None, None, None, None, 'fdf0bf5d9d10467cb2a78d2e9cc7c4a3', '1-23150335b562b47c933e60f701f8c797', u'CommandRunInformation') 2017-04-25 18:45:04,151 - faraday-server.server.web - DEBUG - -> CouchDB: GET /test/fdf0bf5d9d10467cb2a78d2e9cc7c4a3 2017-04-25 18:45:04,153 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 2.09ms 2017-04-25 18:45:04,155 - faraday-server.server.database - DEBUG - Start Query: INSERT INTO command (command, duration, itime, ip, hostname, params, user, workspace, entity_metadata_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?) 2017-04-25 18:45:04,155 - faraday-server.server.database - DEBUG - Parameters: (u'wapiti', None, 1493156704.126204, u'192.168.1.36\n', u'kali', u'http://testphp.vulnweb.com', u'root', u'test', 1) 2017-04-25 18:45:04,156 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.78ms 2017-04-25 18:45:04,267 - faraday-server.server.database - DEBUG - Start Query: SELECT command.id AS command_id, command.command AS command_command, command.duration AS command_duration, command.itime AS command_itime, command.ip AS command_ip, command.hostname AS command_hostname, command.params AS command_params, command.user AS command_user, command.workspace AS command_workspace, command.entity_metadata_id AS command_entity_metadata_id FROM command WHERE command.id = ? 2017-04-25 18:45:04,268 - faraday-server.server.database - DEBUG - Parameters: (1,) 2017-04-25 18:45:04,268 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.67ms 2017-04-25 18:45:04,269 - faraday-server.server.database - DEBUG - Start Query: SELECT metadata.id AS metadata_id, metadata.update_time AS metadata_update_time, metadata.update_user AS metadata_update_user, metadata.update_action AS metadata_update_action, metadata.create_time AS metadata_create_time, metadata.update_controller_action AS metadata_update_controller_action, metadata.creator AS metadata_creator, metadata.owner AS metadata_owner, metadata.command_id AS metadata_command_id, metadata.couchdb_id AS metadata_couchdb_id, metadata.revision AS metadata_revision, metadata.document_type AS metadata_document_type FROM metadata WHERE metadata.id = ? 2017-04-25 18:45:04,269 - faraday-server.server.database - DEBUG - Parameters: (1,) 2017-04-25 18:45:04,270 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.32ms 2017-04-25 18:45:04,270 - faraday-server.server.database - INFO - New CommandRunInformation () was added in Workspace test 2017-04-25 18:51:20,277 - faraday-server.server.database - DEBUG - Start Query: INSERT INTO metadata (update_time, update_user, update_action, create_time, update_controller_action, creator, owner, command_id, couchdb_id, revision, document_type) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) 2017-04-25 18:51:20,277 - faraday-server.server.database - DEBUG - Parameters: (None, None, None, None, None, None, None, None, '2265238e4c834f539d6a720898569e7c', '1-680a5bcd5ee115c0632131b349536207', u'CommandRunInformation') 2017-04-25 18:51:20,279 - faraday-server.server.web - DEBUG - -> CouchDB: GET /test/2265238e4c834f539d6a720898569e7c 2017-04-25 18:51:20,280 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 2.82ms 2017-04-25 18:51:20,282 - faraday-server.server.database - DEBUG - Start Query: INSERT INTO command (command, duration, itime, ip, hostname, params, user, workspace, entity_metadata_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?) 2017-04-25 18:51:20,283 - faraday-server.server.database - DEBUG - Parameters: (u'Import Wapiti:', None, 1493157079.951189, u'192.168.1.36\n', u'kali', u'/root/Descargas/scan', u'root', u'test', 2) 2017-04-25 18:51:20,284 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 1.71ms 2017-04-25 18:51:20,404 - faraday-server.server.database - DEBUG - Start Query: SELECT command.id AS command_id, command.command AS command_command, command.duration AS command_duration, command.itime AS command_itime, command.ip AS command_ip, command.hostname AS command_hostname, command.params AS command_params, command.user AS command_user, command.workspace AS command_workspace, command.entity_metadata_id AS command_entity_metadata_id FROM command WHERE command.id = ? 2017-04-25 18:51:20,405 - faraday-server.server.database - DEBUG - Parameters: (2,) 2017-04-25 18:51:20,406 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 1.28ms 2017-04-25 18:51:20,408 - faraday-server.server.database - DEBUG - Start Query: SELECT metadata.id AS metadata_id, metadata.update_time AS metadata_update_time, metadata.update_user AS metadata_update_user, metadata.update_action AS metadata_update_action, metadata.create_time AS metadata_create_time, metadata.update_controller_action AS metadata_update_controller_action, metadata.creator AS metadata_creator, metadata.owner AS metadata_owner, metadata.command_id AS metadata_command_id, metadata.couchdb_id AS metadata_couchdb_id, metadata.revision AS metadata_revision, metadata.document_type AS metadata_document_type FROM metadata WHERE metadata.id = ? 2017-04-25 18:51:20,408 - faraday-server.server.database - DEBUG - Parameters: (2,) 2017-04-25 18:51:20,408 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.66ms 2017-04-25 18:51:20,409 - faraday-server.server.database - INFO - New CommandRunInformation () was added in Workspace test 2017-04-25 18:51:20,441 - faraday-server.server.web - DEBUG - -> CouchDB: GET /test/2265238e4c834f539d6a720898569e7c 2017-04-25 18:51:20,482 - faraday-server.server.database - DEBUG - Start Query: SELECT metadata.id AS metadata_id, metadata.update_time AS metadata_update_time, metadata.update_user AS metadata_update_user, metadata.update_action AS metadata_update_action, metadata.create_time AS metadata_create_time, metadata.update_controller_action AS metadata_update_controller_action, metadata.creator AS metadata_creator, metadata.owner AS metadata_owner, metadata.command_id AS metadata_command_id, metadata.couchdb_id AS metadata_couchdb_id, metadata.revision AS metadata_revision, metadata.document_type AS metadata_document_type FROM metadata WHERE metadata.couchdb_id = ? 2017-04-25 18:51:20,482 - faraday-server.server.database - DEBUG - Parameters: ('2265238e4c834f539d6a720898569e7c',) 2017-04-25 18:51:20,483 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.68ms 2017-04-25 18:51:20,484 - faraday-server.server.database - DEBUG - Start Query: SELECT command.id AS command_id, command.command AS command_command, command.duration AS command_duration, command.itime AS command_itime, command.ip AS command_ip, command.hostname AS command_hostname, command.params AS command_params, command.user AS command_user, command.workspace AS command_workspace, command.entity_metadata_id AS command_entity_metadata_id FROM command JOIN metadata ON metadata.id = command.entity_metadata_id WHERE metadata.couchdb_id = ? 2017-04-25 18:51:20,484 - faraday-server.server.database - DEBUG - Parameters: ('2265238e4c834f539d6a720898569e7c',) 2017-04-25 18:51:20,484 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.38ms 2017-04-25 18:51:20,485 - faraday-server.server.database - DEBUG - Start Query: SELECT metadata.id AS metadata_id, metadata.update_time AS metadata_update_time, metadata.update_user AS metadata_update_user, metadata.update_action AS metadata_update_action, metadata.create_time AS metadata_create_time, metadata.update_controller_action AS metadata_update_controller_action, metadata.creator AS metadata_creator, metadata.owner AS metadata_owner, metadata.command_id AS metadata_command_id, metadata.couchdb_id AS metadata_couchdb_id, metadata.revision AS metadata_revision, metadata.document_type AS metadata_document_type FROM metadata WHERE metadata.id = ? 2017-04-25 18:51:20,485 - faraday-server.server.database - DEBUG - Parameters: (2,) 2017-04-25 18:51:20,485 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.33ms 2017-04-25 18:51:20,486 - faraday-server.server.database - DEBUG - Start Query: UPDATE metadata SET revision=? WHERE metadata.id = ? 2017-04-25 18:51:20,486 - faraday-server.server.database - DEBUG - Parameters: ('2-892433a31fde4ac8ff111de3db523bc0', 2) 2017-04-25 18:51:20,487 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.34ms 2017-04-25 18:51:20,487 - faraday-server.server.database - DEBUG - Start Query: UPDATE command SET duration=? WHERE command.id = ? 2017-04-25 18:51:20,487 - faraday-server.server.database - DEBUG - Parameters: (0.46960997581481934, 2) 2017-04-25 18:51:20,487 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.30ms 2017-04-25 18:51:20,593 - faraday-server.server.database - DEBUG - Start Query: SELECT command.id AS command_id, command.command AS command_command, command.duration AS command_duration, command.itime AS command_itime, command.ip AS command_ip, command.hostname AS command_hostname, command.params AS command_params, command.user AS command_user, command.workspace AS command_workspace, command.entity_metadata_id AS command_entity_metadata_id FROM command WHERE command.id = ? 2017-04-25 18:51:20,593 - faraday-server.server.database - DEBUG - Parameters: (2,) 2017-04-25 18:51:20,594 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.63ms 2017-04-25 18:51:20,595 - faraday-server.server.database - DEBUG - Start Query: SELECT metadata.id AS metadata_id, metadata.update_time AS metadata_update_time, metadata.update_user AS metadata_update_user, metadata.update_action AS metadata_update_action, metadata.create_time AS metadata_create_time, metadata.update_controller_action AS metadata_update_controller_action, metadata.creator AS metadata_creator, metadata.owner AS metadata_owner, metadata.command_id AS metadata_command_id, metadata.couchdb_id AS metadata_couchdb_id, metadata.revision AS metadata_revision, metadata.document_type AS metadata_document_type FROM metadata WHERE metadata.id = ? 2017-04-25 18:51:20,595 - faraday-server.server.database - DEBUG - Parameters: (2,) 2017-04-25 18:51:20,595 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.34ms 2017-04-25 18:51:20,595 - faraday-server.server.database - INFO - A CommandRunInformation () was updated in Workspace test 2017-04-25 18:51:47,091 - faraday-server.server.database - DEBUG - Start Query: INSERT INTO metadata (update_time, update_user, update_action, create_time, update_controller_action, creator, owner, command_id, couchdb_id, revision, document_type) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) 2017-04-25 18:51:47,091 - faraday-server.server.database - DEBUG - Parameters: (None, None, None, None, None, None, None, None, 'd632b26661c0491aa3fb8f084496309e', '1-ed6347461b5ce547c31c072fcb5a8023', u'CommandRunInformation') 2017-04-25 18:51:47,092 - faraday-server.server.web - DEBUG - -> CouchDB: GET /test/d632b26661c0491aa3fb8f084496309e 2017-04-25 18:51:47,093 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 1.43ms 2017-04-25 18:51:47,093 - faraday-server.server.database - DEBUG - Start Query: INSERT INTO command (command, duration, itime, ip, hostname, params, user, workspace, entity_metadata_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?) 2017-04-25 18:51:47,094 - faraday-server.server.database - DEBUG - Parameters: (u'Import Wapiti:', None, 1493157107.074799, u'192.168.1.36\n', u'kali', u'/root/.wapiti/scans/testphp.vunlweb.com.xml', u'root', u'test', 3) 2017-04-25 18:51:47,094 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.68ms 2017-04-25 18:51:47,228 - faraday-server.server.database - DEBUG - Start Query: SELECT command.id AS command_id, command.command AS command_command, command.duration AS command_duration, command.itime AS command_itime, command.ip AS command_ip, command.hostname AS command_hostname, command.params AS command_params, command.user AS command_user, command.workspace AS command_workspace, command.entity_metadata_id AS command_entity_metadata_id FROM command WHERE command.id = ? 2017-04-25 18:51:47,229 - faraday-server.server.database - DEBUG - Parameters: (3,) 2017-04-25 18:51:47,229 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.76ms 2017-04-25 18:51:47,230 - faraday-server.server.database - DEBUG - Start Query: SELECT metadata.id AS metadata_id, metadata.update_time AS metadata_update_time, metadata.update_user AS metadata_update_user, metadata.update_action AS metadata_update_action, metadata.create_time AS metadata_create_time, metadata.update_controller_action AS metadata_update_controller_action, metadata.creator AS metadata_creator, metadata.owner AS metadata_owner, metadata.command_id AS metadata_command_id, metadata.couchdb_id AS metadata_couchdb_id, metadata.revision AS metadata_revision, metadata.document_type AS metadata_document_type FROM metadata WHERE metadata.id = ? 2017-04-25 18:51:47,230 - faraday-server.server.database - DEBUG - Parameters: (3,) 2017-04-25 18:51:47,230 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.34ms 2017-04-25 18:51:47,231 - faraday-server.server.database - INFO - New CommandRunInformation () was added in Workspace test 2017-04-25 18:51:47,257 - faraday-server.server.web - DEBUG - -> CouchDB: GET /test/d632b26661c0491aa3fb8f084496309e 2017-04-25 18:51:47,299 - faraday-server.server.database - DEBUG - Start Query: SELECT metadata.id AS metadata_id, metadata.update_time AS metadata_update_time, metadata.update_user AS metadata_update_user, metadata.update_action AS metadata_update_action, metadata.create_time AS metadata_create_time, metadata.update_controller_action AS metadata_update_controller_action, metadata.creator AS metadata_creator, metadata.owner AS metadata_owner, metadata.command_id AS metadata_command_id, metadata.couchdb_id AS metadata_couchdb_id, metadata.revision AS metadata_revision, metadata.document_type AS metadata_document_type FROM metadata WHERE metadata.couchdb_id = ? 2017-04-25 18:51:47,299 - faraday-server.server.database - DEBUG - Parameters: ('d632b26661c0491aa3fb8f084496309e',) 2017-04-25 18:51:47,299 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.71ms 2017-04-25 18:51:47,301 - faraday-server.server.database - DEBUG - Start Query: SELECT command.id AS command_id, command.command AS command_command, command.duration AS command_duration, command.itime AS command_itime, command.ip AS command_ip, command.hostname AS command_hostname, command.params AS command_params, command.user AS command_user, command.workspace AS command_workspace, command.entity_metadata_id AS command_entity_metadata_id FROM command JOIN metadata ON metadata.id = command.entity_metadata_id WHERE metadata.couchdb_id = ? 2017-04-25 18:51:47,301 - faraday-server.server.database - DEBUG - Parameters: ('d632b26661c0491aa3fb8f084496309e',) 2017-04-25 18:51:47,301 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.37ms 2017-04-25 18:51:47,302 - faraday-server.server.database - DEBUG - Start Query: SELECT metadata.id AS metadata_id, metadata.update_time AS metadata_update_time, metadata.update_user AS metadata_update_user, metadata.update_action AS metadata_update_action, metadata.create_time AS metadata_create_time, metadata.update_controller_action AS metadata_update_controller_action, metadata.creator AS metadata_creator, metadata.owner AS metadata_owner, metadata.command_id AS metadata_command_id, metadata.couchdb_id AS metadata_couchdb_id, metadata.revision AS metadata_revision, metadata.document_type AS metadata_document_type FROM metadata WHERE metadata.id = ? 2017-04-25 18:51:47,302 - faraday-server.server.database - DEBUG - Parameters: (3,) 2017-04-25 18:51:47,303 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.33ms 2017-04-25 18:51:47,303 - faraday-server.server.database - DEBUG - Start Query: UPDATE metadata SET revision=? WHERE metadata.id = ? 2017-04-25 18:51:47,304 - faraday-server.server.database - DEBUG - Parameters: ('2-b77964853039440953a37e26747c3473', 3) 2017-04-25 18:51:47,304 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.37ms 2017-04-25 18:51:47,304 - faraday-server.server.database - DEBUG - Start Query: UPDATE command SET duration=? WHERE command.id = ? 2017-04-25 18:51:47,304 - faraday-server.server.database - DEBUG - Parameters: (0.1650550365447998, 3) 2017-04-25 18:51:47,304 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.28ms 2017-04-25 18:51:47,384 - faraday-server.server.database - DEBUG - Start Query: SELECT command.id AS command_id, command.command AS command_command, command.duration AS command_duration, command.itime AS command_itime, command.ip AS command_ip, command.hostname AS command_hostname, command.params AS command_params, command.user AS command_user, command.workspace AS command_workspace, command.entity_metadata_id AS command_entity_metadata_id FROM command WHERE command.id = ? 2017-04-25 18:51:47,384 - faraday-server.server.database - DEBUG - Parameters: (3,) 2017-04-25 18:51:47,384 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.67ms 2017-04-25 18:51:47,385 - faraday-server.server.database - DEBUG - Start Query: SELECT metadata.id AS metadata_id, metadata.update_time AS metadata_update_time, metadata.update_user AS metadata_update_user, metadata.update_action AS metadata_update_action, metadata.create_time AS metadata_create_time, metadata.update_controller_action AS metadata_update_controller_action, metadata.creator AS metadata_creator, metadata.owner AS metadata_owner, metadata.command_id AS metadata_command_id, metadata.couchdb_id AS metadata_couchdb_id, metadata.revision AS metadata_revision, metadata.document_type AS metadata_document_type FROM metadata WHERE metadata.id = ? 2017-04-25 18:51:47,385 - faraday-server.server.database - DEBUG - Parameters: (3,) 2017-04-25 18:51:47,385 - faraday-server.server.database - DEBUG - Query Complete. Total Time: 0.33ms 2017-04-25 18:51:47,386 - faraday-server.server.database - INFO - A CommandRunInformation () was updated in Workspace test

FARADAY.PY root@kali:/usr/share/python-faraday# python faraday.py --debug

__ . / \ ____ | _/___ .. \ \ _ \ _ __ \ / | __ \ < | | | | / _ \| | \// _/ /_/ | / __ | || (__ /|| (__ /__ | (__ // ____| \/ \/ \/ \/ \/

[[ Open Source Penetration Test IDE ]] Where pwnage goes multiplayer

2017-04-25 18:44:26,817 - faraday.launcher - INFO - Starting Faraday IDE. 2017-04-25 18:44:26,817 - faraday.launcher - INFO - Checking configuration. 2017-04-25 18:44:26,817 - faraday.launcher - INFO - Setting up plugins. 2017-04-25 18:44:26,817 - faraday.launcher - INFO - Removing old plugins folder. 2017-04-25 18:44:26,837 - faraday.launcher - INFO - Setting up ZSH integration. 2017-04-25 18:44:26,838 - faraday.launcher - INFO - Setting up user configuration. 2017-04-25 18:44:26,838 - faraday.launcher - INFO - Using custom user configuration. 2017-04-25 18:44:26,838 - faraday.launcher - INFO - Setting up icons for GTK interface. 2017-04-25 18:44:26,842 - faraday.launcher - INFO - Setting configuration. 2017-04-25 18:44:26,933 - faraday.launcher - INFO - All done. Opening environment. 2017-04-25 18:44:27,045 - faraday.launcher - INFO - Main application ExceptHook enabled. 2017-04-25 18:44:27,046 - faraday.launcher - INFO - Starting main application.

2017-04-25 18:44:27,046 - faraday - DEBUG - Starting application... 2017-04-25 18:44:27,046 - faraday - DEBUG - Setting up remote API's... 2017-04-25 18:44:27,046 - faraday - DEBUG - starting XMLRPCServer with api_conn_info = ('localhost', 9877) 2017-04-25 18:44:27,046 - faraday - INFO - XMLRPC API server configured on ('localhost', 9877) 2017-04-25 18:44:27,047 - faraday - DEBUG - Starting model controller daemon... 2017-04-25 18:44:27,047 - faraday - DEBUG - starting xmlrpc api server... 2017-04-25 18:44:27,053 - faraday - INFO - REST API server configured on ('localhost', 9978) 2017-04-25 18:44:27,054 - faraday - DEBUG - Faraday ready... host = testphp.vulnweb.com, port = 80 2017-04-25 18:51:19,950 - faraday.ReportProcessor - INFO - The file is /root/Descargas/scan, Wapiti 2017-04-25 18:51:20,413 - faraday.PluginController - DEBUG - Created plugin_process (140632472343376) for plugin instance (140633316946640) 2017-04-25 18:51:20,417 - faraday - DEBUG - ---------------------------------------- 2017-04-25 18:51:20,418 - faraday - DEBUG - proc_name = PluginProcess-1 2017-04-25 18:51:20,418 - faraday - DEBUG - Starting run method on PluginProcess 2017-04-25 18:51:20,418 - faraday - DEBUG - parent process: 8379 2017-04-25 18:51:20,419 - faraday - DEBUG - process id: 8508 2017-04-25 18:51:20,419 - faraday - DEBUG - ---------------------------------------- 2017-04-25 18:51:20,419 - faraday - DEBUG - PluginProcess-1: New Output 2017-04-25 18:51:20,419 - faraday - DEBUG - PluginProcess run _pending_actions queue Empty. Breaking loop 2017-04-25 18:51:20,419 - faraday - DEBUG - PluginProcess-1: Exiting 2017-04-25 18:51:20,420 - faraday.PluginController - DEBUG - _processAction - 3000 - parameters = ['Wapiti'] 2017-04-25 18:51:20,420 - faraday.PluginController - DEBUG - _processAction - 3001 - parameters = ['Wapiti'] 2017-04-25 18:51:20,468 - faraday - DEBUG - _processAction - 3000 - parameters = ('Wapiti',) 2017-04-25 18:51:20,468 - faraday.ModelController - INFO - Plugin Started: Wapiti 2017-04-25 18:51:20,468 - faraday - DEBUG - _processAction - 3001 - parameters = ('Wapiti',) 2017-04-25 18:51:20,469 - faraday.ModelController - INFO - Plugin Ended: Wapiti 2017-04-25 18:51:47,074 - faraday.ReportProcessor - INFO - The file is /root/.wapiti/scans/testphp.vunlweb.com.xml, Wapiti 2017-04-25 18:51:47,233 - faraday.PluginController - DEBUG - Created plugin_process (140632472345104) for plugin instance (140633316946640) 2017-04-25 18:51:47,237 - faraday - DEBUG - ---------------------------------------- 2017-04-25 18:51:47,237 - faraday - DEBUG - proc_name = PluginProcess-2 2017-04-25 18:51:47,237 - faraday - DEBUG - Starting run method on PluginProcess 2017-04-25 18:51:47,238 - faraday - DEBUG - parent process: 8379 2017-04-25 18:51:47,238 - faraday - DEBUG - process id: 8529 2017-04-25 18:51:47,238 - faraday - DEBUG - ---------------------------------------- 2017-04-25 18:51:47,238 - faraday - DEBUG - PluginProcess-2: New Output 2017-04-25 18:51:47,238 - faraday - DEBUG - PluginProcess run _pending_actions queue Empty. Breaking loop 2017-04-25 18:51:47,238 - faraday - DEBUG - PluginProcess-2: Exiting 2017-04-25 18:51:47,239 - faraday.PluginController - DEBUG - _processAction - 3000 - parameters = ['Wapiti'] 2017-04-25 18:51:47,239 - faraday.PluginController - DEBUG - _processAction - 3001 - parameters = ['Wapiti'] 2017-04-25 18:51:47,287 - faraday - DEBUG - _processAction - 3000 - parameters = ('Wapiti',) 2017-04-25 18:51:47,288 - faraday.ModelController - INFO - Plugin Started: Wapiti 2017-04-25 18:51:47,288 - faraday - DEBUG - _processAction - 3001 - parameters = ('Wapiti',) 2017-04-25 18:51:47,288 - faraday.ModelController - INFO - Plugin Ended: Wapiti 2017-04-25 18:56:38,539 - faraday - INFO - Closing Faraday... 2017-04-25 18:56:38,539 - faraday - DEBUG - stopping model controller thread... 2017-04-25 18:56:38,540 - faraday - DEBUG - server stopping... 2017-04-25 18:56:38,540 - faraday - DEBUG - called stop on xmlrpc server 2017-04-25 18:56:39,808 - faraday - DEBUG - server forever stopped by flag 2017-04-25 18:56:39,809 - faraday - DEBUG - serve_forever ended 2017-04-25 18:56:39,809 - faraday - DEBUG - xmlrpc thread joined 2017-04-25 18:56:41,321 - faraday - DEBUG - Waiting for controller threads to end...

Ezequieltbh commented 7 years ago

Hola! Esto es un problema con nuestro cliente zsh, el servidor por alguna razon le esta enviando un JSON invalido que nuestro cliente python no puede decodificar. Te recomendaria revisar si el comando que ejecutaste es correcto, asi como tambien revisar la respuesta devuelta por el server utilizando Wireshark.

robertofocke commented 7 years ago

Hola @Ezequieltbh No sé mucho (no saber mucho es un eufemismo: ignoro casi todo ) sobre como interpretar el pcap. Te paso el pcap por si alguien tiene este mismo problema. Lo más probable, como bien decis, es que yo este usando el comando equivocado, pero probé diferentes alternativas y no funcionaron. https://mega.nz/#!P5R0lZhS!dHWfhFanYeT4e3Xu9ul5hxv0hHL1dovOcoH30hnevKU

WinnaZ commented 7 years ago

Hola @robertofocke, Seguís teniendo este problema o lo pudiste resolver? Saludos!

robertofocke commented 7 years ago

hola @WinnaZ, nunca descifré cómo funciona el plugin. Si sabes como funciona te lo agradeceria.

WinnaZ commented 7 years ago

Hola Robert, Podrías mandarnos el XML que estas usando? Por favor envíalo a esta dirección devel email . Gracias.

WinnaZ commented 7 years ago

Hola Robert, Mirá estuvimos testeando la herramienta en sí, y no parece estar funcionando bien. En cualquier caso, los reportes que mandaste no parecían tener ninguna vulnerabilidad para ser cargada. saludos.

robertofocke commented 7 years ago

yo lanzaba este comando "wapiti http://testphp.vulnweb.com -f xml "y hacia el final wapiti (no faraday) tiraba un error pero como el archivo estaba creado imaginé que escribia las vulnerabilidades encontradas hasta el momento pero por lo que comentas parece que no. mmm habría que ver si no es wapiti el del error.

De: WinnaZ notifications@github.com Enviado: viernes, 21 de julio de 2017 04:11:12 p.m. Para: infobyte/faraday Cc: Roberto Focke; Mention Asunto: Re: [infobyte/faraday] wapiti not working (#192)

Hola Robert, Mirá estuvimos testeando la herramienta en sí, y no parece estar funcionando bien. En cualquier caso, los reportes que mandaste no parecían tener ninguna vulnerabilidad para ser cargada. saludos.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHubhttps://github.com/infobyte/faraday/issues/192#issuecomment-317088141, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AM4v1q9NbhbyQ_1ofUwzwF5s9yg7PuRwks5sQPfQgaJpZM4NIHHi.