'''
collectCookies.py

Copyright 2006 Andres Riancho

This file is part of w3af, w3af.sourceforge.net .

w3af is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation version 2 of the License.

w3af is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with w3af; if not, write to the Free Software
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA

'''

import core.data.parsers.htmlParser as htmlParser
import core.controllers.outputManager as om
from core.controllers.basePlugin.baseGrepPlugin import baseGrepPlugin
import core.data.kb.knowledgeBase as kb
import core.data.kb.info as info
import Cookie
import core.data.parsers.urlParser as urlParser

class collectCookies(baseGrepPlugin):
	'''
	This plugin greps every response for session cookies that the web app sends to the client.
	  
	@author: Andres Riancho ( andres.riancho@gmail.com )
	'''

	def __init__(self):
		baseGrepPlugin.__init__(self)
		self._alreadyReportedServer = []
		self._cookieHeaders = ['Set-Cookie'.upper(),'Cookie'.upper(),'Cookie2'.upper()]
	
	def _testResponse(self, request, response):
		
		url = urlParser.uri2url(response.getURL())
		headers = response.getHeaders()
		
		for key in headers.keys():	
			if key.upper() in self._cookieHeaders:
				
				# Load the cookie in the kb
				i = info.info()
				i.setURL( response.getURL() )
				i['cookie-string'] = headers['Set-Cookie']
				
				C = Cookie.SimpleCookie()
				C.load( headers[ key ] )
				i['cookie-object'] = C
				
				'''
				The expiration date tells the browser when to delete the cookie. If no expiration date is provided, the cookie is 
				deleted at the end of the user session, that is, when the user quits the browser. As a result, specifying an expiration 
				date is a means for making cookies to survive across browser sessions. For this reason, cookies that have an expiration
				date are called persistent.
				'''
				i['persistent'] = False
				if 'expires' in C:
					i['persistent'] = True
					
				i.setId( response.id )
				i.setDesc( 'The URL : ' + i.getURL() + ' sent the cookie: ' + i['cookie-string'] )
				kb.kb.append( self, 'cookies', i )
				
				# Find if the cookie introduces any vulnerability, or discloses information
				self._analyzeCookie( request, response, C )
		
		# do this check everytime
		self._sslCookieValueUsedInHTTP( request, response )
	
	def _analyzeCookie( self, request, response, cookieObj ):
		self._identifyServer( request, response, cookieObj )
		self._secureOverHTTP( request, response, cookieObj )
		
	def _sslCookieValueUsedInHTTP( self, request, response ):
		'''
		Analyze if a cookie value, sent in a HTTPS request, is now used for identifying the user in an insecure page.
		Example:
			Login is done over SSL
			The rest of the page is HTTP
		'''
		if request.getURL().startswith('http://'):
			for cookie in kb.kb.getData( 'collectCookies', 'cookies' ):
				if cookie.getURL().startswith('https://') and \
				urlParser.getDomain( request.getURL() ) == urlParser.getDomain( cookie.getURL() ):
					# The cookie was sent using SSL, I'll check if the current 
					# request, is using this values in the POSTDATA / QS / COOKIE
					for key in cookie['cookie-object'].keys():
						# This if is to create less false positives
						if len( cookie['cookie-object'][key] ) > 4:
							for item in request.getDc().items():
								# The first statement of this if is to make this algorithm faster
								if len( item[1] ) > 4 and item[1] == cookie['cookie-object'][key]:
									v = vuln.vuln()
									v.setURL( response.getURL() )
									v['cookie-string'] = cookie.output(header='')
									v['cookie-object'] = cookie
									v.setDesc( 'Cookie values that were set over HTTPS, are sent over an insecure channel when requesting URL: ' + request.getURL() + ' , parameter ' + item[0] )
									kb.kb.append( self, 'cookies', v )
			
	def _identifyServer( self, request, response, cookieObj ):
		'''
		Now we analize and try to guess the remote web server based on the
		cookie that was sent.
		'''
		for cookie in self._getCookieFPdb():
			if cookieObj.output(header='').count( cookie[0] ):
				if cookie[1] not in self._alreadyReportedServer:
					v = vuln.vuln()
					v.setURL( response.getURL() )
					v['cookie-string'] = cookieObj.output(header='')
					v['cookie-object'] = cookieObj
					v['httpd'] = cookie[1]
					v.setDesc( 'A cookie matching the cookie fingerprint DB ' +
					'has been found when requesting ' + response.getURL() + ' . The remote server is: ' + cookie[1] )
					kb.kb.append( self, 'cookies', v )
					self._alreadyReportedServer.append( cookie[1] )

	def _secureOverHTTP( self, request, response, cookieObj ):
		'''
		Checks if a cookie marked as secure is sent over http.
		'''
		if 'secure' in cookieObj and response.getURL().startswith('http://'):
			v = vuln.vuln()
			v.setURL( response.getURL() )
			v.setId( response.getId() )
			v['cookie-string'] = cookieObj.output(header='')
			v['cookie-object'] = cookieObj
			v.setDesc( 'A cookie marked as secure was sent over an insecure channel when requesting the URL: ' + response.getURL() )
			kb.kb.append( self, 'cookies', v )
		
	def _getCookieFPdb(self):
		'''
		@return: A list of tuples with ( CookieString, WebServerType )
		'''
		# This is a simplificated version of ramon's cookie db.
		cookieDB = []
		
		cookieDB.append( ('WebLogicSession=','BEA Logic') )
		cookieDB.append( ('SaneID=','Sane NetTracker') )
		cookieDB.append( ('ssuid=','Vignette') )
		cookieDB.append( ('vgnvisitor=','Vignette') )
		cookieDB.append( ('ASPSESSIONID','IIS') )
		cookieDB.append( ('SESSION_ID=','IBM Net.Commerce') )
		cookieDB.append( ('NSES40Session=','Netscape Enterprise Server') )
		cookieDB.append( ('iPlanetUserId=','iPlanet') )
		cookieDB.append( ('RMID=','RealMedia OpenADStream') )
		cookieDB.append( ('JSESSIONID=','Jakarta Tomcat / Apache') )
		cookieDB.append( ('JServSessionIdroot=','Apache JServ') )
		cookieDB.append( ('WEBTRENDS_ID=','WebTrends') )
		cookieDB.append( ('sesessionid=','IBM WebSphere') )
		cookieDB.append( ('CGISESSID=','Perl CGI::Session') )
		cookieDB.append( ('GX_SESSION_ID','GeneXus') )
		
		return cookieDB
		
	def setOptions( self, OptionList ):
		pass
	
	def getOptionsXML(self):
		'''
		This method returns a XML containing the Options that the plugin has.
		Using this XML the framework will build a window, a menu, or some other input method to retrieve
		the info from the user. The XML has to validate against the xml schema file located at :
		w3af/core/output.xsd
		'''
		return	'<?xml version="1.0" encoding="ISO-8859-1"?>\
		<OptionList>\
		</OptionList>\
		'

	def end(self):
		'''
		This method is called when the plugin wont be used anymore.
		'''
		self.printUniq( kb.kb.getData( 'collectCookies', 'cookies' ), 'URL' )	
			
	def getPluginDeps( self ):
		'''
		@return: A list with the names of the plugins that should be runned before the
		current one.
		'''
		return []
	
	def getLongDesc( self ):
		'''
		@return: A DETAILED description of the plugin functions and features.
		'''
		return '''
		This plugin greps every response for session cookies that the web app sends to the client.
		'''
