Class collectCookies

This plugin greps every response for session cookies that the web app sends to the client.

Author: Andres Riancho ( andres.riancho@gmail.com )

Instance Methods

[hide private]

__init__(self)

_testResponse(self, request, response)
This method tries to find patterns on responses.

_analyzeCookie(self, request, response, cookieObj)

_sslCookieValueUsedInHTTP(self, request, response)
Analyze if a cookie value, sent in a HTTPS request, is now used for identifying the user in an insecure page.

_identifyServer(self, request, response, cookieObj)
Now we analize and try to guess the remote web server based on the cookie that was sent.

_secureOverHTTP(self, request, response, cookieObj)
Checks if a cookie marked as secure is sent over http.

_getCookieFPdb(self)

setOptions(self, OptionList)
Sets the Options given on the OptionList to self.

getOptionsXML(self)
This method returns a XML containing the Options that the plugin has.

end(self)
This method is called when the plugin wont be used anymore.

getPluginDeps(self)

getLongDesc(self)

Inherited from core.controllers.basePlugin.baseGrepPlugin.baseGrepPlugin: getType, setUrlOpener, testResponse

Inherited from core.controllers.basePlugin.baseGrepPlugin.baseGrepPlugin (private): _wasSent

Inherited from core.controllers.basePlugin.basePlugin.basePlugin: __eq__, getDesc, getName, printUniq

Inherited from core.controllers.basePlugin.basePlugin.basePlugin (private): _sendMutant

Method Details

[hide private]

init(self)
(Constructor)

None

Overrides: core.controllers.basePlugin.baseGrepPlugin.baseGrepPlugin.__init__

_testResponse(self, request, response)

This method tries to find patterns on responses.

This method MUST be implemented on every plugin.

Returns:: If something is found it must be reported to the Output Manager and the KB.

Overrides: core.controllers.basePlugin.baseGrepPlugin.baseGrepPlugin._testResponse: (inherited documentation)

_analyzeCookie(self, request, response, cookieObj)

None

_sslCookieValueUsedInHTTP(self, request, response)


Analyze if a cookie value, sent in a HTTPS request, is now used for identifying the user in an insecure page.
Example:
        Login is done over SSL
        The rest of the page is HTTP

_identifyServer(self, request, response, cookieObj)

Now we analize and try to guess the remote web server based on the cookie that was sent.

_secureOverHTTP(self, request, response, cookieObj)

Checks if a cookie marked as secure is sent over http.

_getCookieFPdb(self)

Returns:: A list of tuples with ( CookieString, WebServerType )

setOptions(self, OptionList)

Sets the Options given on the OptionList to self. The options are the result of a user entering some data on a window that was constructed using the XML Options that was retrieved from the plugin using getOptionsXML()

This method MUST be implemented on every plugin.

Returns:: No value is returned.

Overrides: core.controllers.basePlugin.basePlugin.basePlugin.setOptions: (inherited documentation)

getOptionsXML(self)

This method returns a XML containing the Options that the plugin has. Using this XML the framework will build a window, a menu, or some other input method to retrieve the info from the user. The XML has to validate against the xml schema file located at : w3af/core/output.xsd