#VERSION,1.00
###############################################################################
#  Copyright (C) 2012 Chris Sullo
#
#  This program is free software; you can redistribute it and/or
#  modify it under the terms of the GNU General Public License
#  as published by the Free Software Foundation; version 2
#  of the License only.
#
#  This program is distributed in the hope that it will be useful,
#  but WITHOUT ANY WARRANTY; without even the implied warranty of
#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#  GNU General Public License for more details.
#
#  You should have received a copy of the GNU General Public License
#  along with this program; if not, write to 
#  Free Software Foundation, 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
###############################################################################
# PURPOSE:
# Check out the crossdomain.xml file
###############################################################################
sub nikto_clientaccesspolicy_init {
    my $id = {
            name      => "clientaccesspolicy",
            full_name => "clientaccesspolicy.xml",
            author    => "Sullo, Dirk",
            description =>
              "Checks whether a client access file exists, and if it contains a wildcard entry.",
            hooks => { recon => { method => \&nikto_clientaccesspolicy,
                                  weight => 49,
                                  },
                         },
            copyright => "2012 Chris Sullo and Dr. Wetter IT-Consulting"
            };
    return $id;
}

sub nikto_clientaccesspolicy {
    my ($mark) = @_;
    my $msg;
    my $file = "/clientaccesspolicy.xml";
	
    my ($res, $content, $error, $request, $response) = nfetch($mark, $file, "GET", "", "", "", "clientaccesspolicy");

    if (($res eq 200) || ($res eq $FoF{'okay'}{'response'})) {
        if (is_404($file, $content, $res, $response->{'location'})) { return; }

        my $DISCTR = 0;
        foreach my $line (split(/\n/, $content)) {
            chomp($line);
            $line =~ s/\#.*$//;
            if ($line eq "") { next; }
            elsif (($line =~ /<domain\suri="(?:http:\/\/)?\*"/) || 
            	($line =~ /<allow-http-request-headers-from\sdomain="\*"/)) {
                add_vulnerability($mark, $mark->{'root'} . "$file contains a full wildcard entry. See http://msdn.microsoft.com/en-us/library/cc197955(v=vs.95).aspx", 999982, 0, "GET", $file, $request, $response);
            }
            else {
                $DISCTR++;
            }
        }    # end foreach my $line 

		$msg =  $mark->{'root'} . "$file contains $DISCTR " . (($DISCTR > 1)?"lines":"line") . " which should be manually viewed for improper domains or wildcards.";

        if ($msg ne '') {
            add_vulnerability($mark, $msg, 999981, 0, "GET", $file, $request, $response);
        }
    }
	
    my $file = "/crossdomain.xml" ;
    ($res, $content, $error, $request, $response) = nfetch($mark, $file, "GET", "", "", "", "crossdomain");

    if (($res eq 200) || ($res eq $FoF{'okay'}{'response'})) {
        if (is_404($file, $content, $res, $response->{'location'})) { return; }

		my $domainlist="";
        my $DISCTR = 0;
        foreach my $line (split(/\n/, $content)) {
            chomp($line);
            $line =~ s/\#.*$//;
            if ($line eq "") { next; }
            elsif ($line =~ /allow-access-from\sdomain="\*"/) {
                add_vulnerability($mark, $mark->{'root'} . "$file contains a full wildcard entry. See http://jeremiahgrossman.blogspot.com/2008/05/crossdomainxml-invites-cross-site.html", 999975, 0, "GET", $file, $request, $response);
            }
            elsif ($line =~ /allow-access-from/ && $line =~ /\*\./ ) {
                $DISCTR++;
				my $domain = $line;
				$domain =~ s/^(.*allow-access-from domain=\")//;
				$domain =~ s/\" ?\/\>.*$//;
				$domainlist .= "$domain ";
            }
        }    # end foreach my $line 

		$msg =  $mark->{'root'} . "$file contains $DISCTR ";
		$msg .= ($DISCTR > 1)?"lines":"line";
		$msg .= " which include the following domains: $domainlist";

        if ($DISCTR > 0) {
            add_vulnerability($mark, $msg, 999956, 0, "GET", $file, $request, $response);
        }
    }
}

1;
