Passive Scanning Scripts

ps.newAlert()
    .setPluginId(1000015)          // REQUIRED - ID from registration
    .setRisk(2)
    .setName("Sensitive Data Disclosure")
    .setMessage(msg)
    .raise()

import net.htmlparser.jericho.Source
import org.parosproxy.paros.network.HttpMessage
import com.stackhawk.hste.extension.scripts.scanrules.ScriptsPassiveScanner
import org.apache.log4j.LogManager
import kotlin.text.Regex

val logger = LogManager.getLogger("sensitiveDataDisclosure")

// Static values for all findings
val cweId = 200 // CWE-200 Exposure of Sensitive Information
val wascId = 13 // WASC-13 Information Leakage
val pluginId = 1000058

// Data class for sensitive data patterns
class SensitiveDataBlob(
    val slug: String,
    val title: String,
    val description: String,
    val pattern: Regex,
    val solution: String = "Don't disclose sensitive information of type $slug",
    val reference: String = "",
    val other: String = "",
    val risk: Int = 2, // 0: info, 1: low, 2: medium, 3: high
    val confidence: Int = 3 // 0: falsePositive, 1: low, 2: medium, 3: high, 4: confirmed
)

// Unwanted file types to skip for performance
val unwantedFiletypes = arrayOf(
    "image/png",
    "image/jpeg",
    "image/gif",
    "application/x-shockwave-flash",
    "application/pdf"
)

// Define patterns to search for
fun defineSearchParams(): List<SensitiveDataBlob> {
    val blobs = mutableListOf<SensitiveDataBlob>()

    blobs.add(
        SensitiveDataBlob(
            slug = "email",
            title = "Information Disclosure - Email Addresses",
            description = "User email addresses discovered in HTTP message body. " +
                         "Public disclosure of user emails can be a minor violation of PII, " +
                         "but can also disclose potential usernames or other internal state.",
            pattern = Regex("([a-zA-Z0-9_.+-]+@[a-zA-Z0-9]+[a-zA-Z0-9-]*[.][a-zA-Z0-9-.]*[a-zA-Z0-9]{2,})"),
            risk = 1
        )
    )

    blobs.add(
        SensitiveDataBlob(
            slug = "internalIPs",
            title = "Information Disclosure - Internal IP Addresses",
            description = "Internal IP addresses discovered in HTTP message body. " +
                         "This could reveal internal network topology and aid reconnaissance.",
            pattern = Regex("((172[.]\\d{1,3}[.]\\d{1,3}[.]\\d{1,3})|(192[.]168[.]\\d{1,3}[.]\\d{1,3})|(10[.]\\d{1,3}[.]\\d{1,3}[.]\\d{1,3})|([fF][eE][89aAbBcCdDeEfF]0?::))"),
            risk = 1
        )
    )

    blobs.add(
        SensitiveDataBlob(
            slug = "phoneNumbers",
            title = "Information Disclosure - Phone Numbers",
            description = "Potential PII in the form of personal phone numbers disclosed.",
            pattern = Regex("([+]\\d{1,2}\\s)?[(]?\\d{3}[)]?[\\s.-]\\d{3}[\\s.-]\\d{4}"),
            risk = 1
        )
    )

    blobs.add(
        SensitiveDataBlob(
            slug = "creditCard",
            title = "Information Disclosure - Credit Card Numbers",
            description = "Potential credit card numbers found in response. This is a serious " +
                         "PCI DSS violation and could lead to compliance penalties.",
            pattern = Regex("\\b(?:\\d{4}[\\s-]?){3}\\d{4}\\b"),
            solution = "Never transmit or log full credit card numbers. Use tokenization and " +
                      "only display last 4 digits for verification.",
            risk = 3,
            confidence = 2 // Lower confidence as pattern could match other number sequences
        )
    )

    return blobs
}

fun scan(ps: ScriptsPassiveScanner, msg: HttpMessage, src: Source) {
    val dataTypes: List<SensitiveDataBlob> = defineSearchParams()

    // Check content type to avoid scanning unwanted file types
    val contentType = msg.responseHeader.getHeader("Content-Type") ?: ""
    if (unwantedFiletypes.any { contentType.contains(it) }) {
        logger.debug("Skipping scan - unwanted content type: $contentType")
        return
    }

    // Scan response body for sensitive data patterns
    val body = msg.responseBody.toString()

    dataTypes.forEach { entry ->
        if (entry.pattern.containsMatchIn(body)) {
            logger.debug("Found match for ${entry.slug} using ${entry.pattern}")

            // Find all instances of the pattern
            val foundDisclosures = entry.pattern.findAll(body, 0)
            raiseAlert(ps, msg, src, entry, foundDisclosures)
        }
    }
}

fun raiseAlert(
    ps: ScriptsPassiveScanner,
    msg: HttpMessage,
    src: Source,
    blob: SensitiveDataBlob,
    foundDisclosures: Sequence<MatchResult>
) {
    logger.debug("Raising alert for ${blob.slug}")

    // Collect all found instances
    val evidence = mutableListOf<String>()
    foundDisclosures.forEach { entry -> evidence.add(entry.value) }

    // Build and raise the alert
    ps.newAlert()
        .setPluginId(pluginId)
        .setRisk(blob.risk)
        .setConfidence(blob.confidence)
        .setName(blob.title)
        .setDescription(blob.description)
        .setEvidence(evidence[0]) // First match as evidence
        .setOtherInfo("${blob.other}\n\nFound ${evidence.size} instance(s):\n${evidence.take(5).joinToString("\n")}")
        .setSolution(blob.solution)
        .setReference(blob.reference)
        .setCweId(cweId)
        .setWascId(wascId)
        .setMessage(msg)
        .raise()

    logger.info("Raised alert for ${blob.slug}: found ${evidence.size} instances in ${msg.requestHeader.uri}")
}

fun appliesToHistoryType(historyType: Int): Boolean {
    // Use default history types (spider, proxy, ajax spider, etc.)
    return ScriptsPassiveScanner.getDefaultHistoryTypes().contains(historyType)
}

import net.htmlparser.jericho.Source
import org.parosproxy.paros.network.HttpMessage
import com.stackhawk.hste.extension.scripts.scanrules.ScriptsPassiveScanner
import org.apache.log4j.LogManager

val logger = LogManager.getLogger("securityHeadersCheck")
val pluginId = 1000060

data class HeaderCheck(
    val headerName: String,
    val required: Boolean,
    val expectedValues: List<String>? = null,
    val description: String,
    val risk: Int = 1
)

fun defineHeaderChecks(): List<HeaderCheck> {
    return listOf(
        HeaderCheck(
            headerName = "X-Content-Type-Options",
            required = true,
            expectedValues = listOf("nosniff"),
            description = "X-Content-Type-Options header missing or incorrect. " +
                         "This header prevents MIME-sniffing attacks.",
            risk = 1
        ),
        HeaderCheck(
            headerName = "X-Frame-Options",
            required = true,
            expectedValues = listOf("DENY", "SAMEORIGIN"),
            description = "X-Frame-Options header missing or incorrect. " +
                         "This header prevents clickjacking attacks.",
            risk = 2
        ),
        HeaderCheck(
            headerName = "Strict-Transport-Security",
            required = true,
            expectedValues = null, // Any value acceptable
            description = "Strict-Transport-Security (HSTS) header missing. " +
                         "This header enforces HTTPS connections.",
            risk = 2
        ),
        HeaderCheck(
            headerName = "Content-Security-Policy",
            required = true,
            expectedValues = null,
            description = "Content-Security-Policy header missing. " +
                         "CSP helps prevent XSS and data injection attacks.",
            risk = 2
        )
    )
}

fun scan(ps: ScriptsPassiveScanner, msg: HttpMessage, src: Source) {
    // Only check responses (not requests)
    if (!msg.responseHeader.isHeader) {
        return
    }

    // Only check HTML/API responses
    val contentType = msg.responseHeader.getHeader("Content-Type") ?: ""
    if (!contentType.contains("html") && !contentType.contains("json") && !contentType.contains("xml")) {
        logger.debug("Skipping non-HTML/API response")
        return
    }

    val headerChecks = defineHeaderChecks()

    headerChecks.forEach { check ->
        val headerValue = msg.responseHeader.getHeader(check.headerName)

        if (headerValue == null && check.required) {
            // Required header is missing
            raiseHeaderAlert(ps, msg, check, "Header not present")
        } else if (headerValue != null && check.expectedValues != null) {
            // Check if value matches expected values
            val valueMatches = check.expectedValues.any {
                headerValue.contains(it, ignoreCase = true)
            }
            if (!valueMatches) {
                raiseHeaderAlert(
                    ps,
                    msg,
                    check,
                    "Header present but value '$headerValue' does not match expected values: ${check.expectedValues.joinToString(", ")}"
                )
            }
        }
    }
}

fun raiseHeaderAlert(
    ps: ScriptsPassiveScanner,
    msg: HttpMessage,
    check: HeaderCheck,
    evidence: String
) {
    logger.info("Security header issue: ${check.headerName} - $evidence")

    ps.newAlert()
        .setPluginId(pluginId)
        .setRisk(check.risk)
        .setConfidence(3) // High confidence
        .setName("Missing or Incorrect Security Header: ${check.headerName}")
        .setDescription(check.description)
        .setEvidence(evidence)
        .setSolution("Add the ${check.headerName} header to all responses with appropriate values. " +
                    "Configure this at the web server or application framework level.")
        .setReference("https://owasp.org/www-project-secure-headers/")
        .setCweId(693) // CWE-693: Protection Mechanism Failure
        .setMessage(msg)
        .raise()
}

fun appliesToHistoryType(historyType: Int): Boolean {
    return ScriptsPassiveScanner.getDefaultHistoryTypes().contains(historyType)
}

// Always filter unwanted content types early for performance
val contentType = msg.responseHeader.getHeader("Content-Type") ?: ""
if (contentType.contains("image/") || contentType.contains("application/pdf")) {
    return // Skip binary files
}

import net.htmlparser.jericho.*

fun scan(ps: ScriptsPassiveScanner, msg: HttpMessage, src: Source) {
    // Use Jericho Source to parse HTML elements efficiently
    val scriptTags = src.getAllElements(HTMLElementName.SCRIPT)

    scriptTags.forEach { scriptTag ->
        val scriptContent = scriptTag.content?.toString() ?: ""

        // Check for hardcoded API keys in JavaScript
        if (scriptContent.contains("api_key", ignoreCase = true)) {
            ps.addHistoryTag("potential-hardcoded-secret")
            // Raise alert...
        }
    }
}

// Track alerts raised to avoid flooding
val alertsRaisedPerType = mutableMapOf<String, Int>()
val maxAlertsPerType = 10

fun raiseAlert(ps: ScriptsPassiveScanner, msg: HttpMessage, alertType: String) {
    val count = alertsRaisedPerType.getOrDefault(alertType, 0)

    if (count < maxAlertsPerType) {
        ps.newAlert()
            // ... build alert
            .raise()

        alertsRaisedPerType[alertType] = count + 1
    } else {
        logger.debug("Alert limit reached for $alertType, skipping")
    }
}

import org.parosproxy.paros.core.scanner.Plugin

fun scan(ps: ScriptsPassiveScanner, msg: HttpMessage, src: Source) {
    val threshold = ps.getAlertThreshold()

    // Raise lower-confidence alerts only in LOW threshold mode
    if (threshold == Plugin.AlertThreshold.LOW) {
        // Check for potential issues with lower confidence
        checkForPotentialIssues(ps, msg)
    }

    // Always check for high-confidence issues
    checkForDefiniteIssues(ps, msg)
}