jaeles-project / jaeles

The Swiss Army knife for automated Web Application Testing
https://jaeles-project.github.io/
MIT License
2.17k stars 318 forks source link

Signatures still not loaded #13

Open retpoline opened 4 years ago

retpoline commented 4 years ago

Apologies for opening a new issue, but the previous one https://github.com/jaeles-project/jaeles/issues/12 was closed before I had a chance to test the changes.

After pulling the new Jaeles and running a config -a update, still says "No signatures loaded".

Is there a specific directory or environment in which Jaeles should be run? For some reason it's not locating signatures when running a simple scan command.

j3ssie commented 4 years ago

Is there any signature file in your ~/.jaeles/base-signatures folder?

retpoline commented 4 years ago

No, that directory does not exist.

I've even tried manually cloning https://github.com/jaeles-project/jaeles-signatures to ~/.jaeles/base-signatures but still get "No signature loaded".

j3ssie commented 4 years ago

It's weird. What is your OS and Jaeles version? Can you delete ~/.jaeles/ folder then run jaeles config -a init --debug too see if it correct clone the signature repo?

For manual install, you need to copy all signature from https://github.com/jaeles-project/jaeles-signatures to ~/.jaeles/base-signatures then run jaeles config -a reload.

Otherwise, you need to select the signature manually by running jaeles scan -s "/tmp/jaeles-signatures/cves/.*" -u your_url

retpoline commented 4 years ago

Ubuntu; even with a reload and all the signatures in ~/.jaeles/base-signatures directory, it says No signature loaded.

However, if I do -s ~/.jaeles/base-signatures/*, it only runs the first yaml signature in alphabetical order. It was expected that it would run all of them in the directory, so maybe this is a feature to implement.

Strange indeed..

j3ssie commented 4 years ago

You need to do -s ~/.jaeles/base-signatures/.* with the . before *.

what your output after delete ~/.jaeles/ folder then run jaeles config -a init --debug too see if it correct clone the signature repo?

retpoline commented 4 years ago

Yes they appear after removing ~/.jaeles and running init again.

One other potential bug I noticed @j3ssie -- when specifying -o for output directory, it says "Summary output: ..../jaeles-summary.txt", but after the run the .txt file isn't created.

Is it only supposed to be created when bugs are found, or always even for every execution? I assumed for every execution.

Mitooooo commented 4 years ago

I had the same problem.System is windows10

blshkv commented 4 years ago

hit this bug too. What is the solution? (Pentoo Linux) dev-lang/go-1.13.9

j3ssie commented 4 years ago

You need to delete old config or signatures with this command rm -rf ~/.jaeles/ Then run this command

jaeles config -a update --repo http://github.com/jaeles-project/jaeles-signatures

to reload the default signatures.

blshkv commented 4 years ago

I did not have any old config, it was created during runtime. But anyway, done that, did not help. (using the latest git and the latest release ./jaeles-v0.7-amd64):

blshkv@pt ~ $ rm -rf ~/.jaeles/
blshkv@pt ~ $ ./go/bin/jaeles config -a update --repo http://github.com/jaeles-project/jaeles-signatures
Jaeles beta v0.7 by @j3ssiejjj
[+] Cloning Plugins from: https://github.com/jaeles-project/jaeles-plugins
[+] Cloning Signature from: https://github.com/jaeles-project/jaeles-signatures
Enumerating objects: 55, done.
Counting objects: 100% (55/55), done.
Compressing objects: 100% (46/46), done.
Total 55 (delta 7), reused 32 (delta 3), pack-reused 0
[+] Cloning Plugins from: https://github.com/jaeles-project/jaeles-plugins
[+] Cloning Signature from: http://github.com/jaeles-project/jaeles-signatures
blshkv@pt ~ $ ./go/bin/jaeles scan -s 'jira' -u target.com --debug
Jaeles beta v0.7 by @j3ssiejjj
[0000]  INFO Load config from: /home/blshkv/.jaeles/config.yaml
[0000]  INFO Summary output: out/jaeles-summary.txt
[Error] No signature loaded
blshkv@pt ~ $ 
blshkv commented 4 years ago

this is weird, but "~/.jaeles/base-signatures/ folder is getting deleted after the update command. I can see it while command is still running. Also, 'base-signatures' folder is NOT getting created if the .jaeles folder exists. What's going on?

blshkv commented 4 years ago

The workaround is to specify a full path: ./go/bin/jaeles scan -s '~/.jaeles/base-signatures/.*' -u target

j3ssie commented 4 years ago

Try to clone signatures folder to somewhere like this

git clone https://github.com/jaeles-project/jaeles-signatures /tmp/jaeles-signatures/

then reload them in the DB with this command.

jaeles config -a reload --signDir /tmp/jaeles-signatures
blshkv commented 4 years ago

can you fix that so it works by default without all these woodoo please? There is some logic error in the code too, since it does not create/update required files if the home directory exists.

shaolinint commented 3 years ago

had the same problem. tried all the suggestion but still.