siberas/watobo

WATOBO - THE Web Application Toolbox

WATABO is a security tool for testing web applications. It is intended to enable security professionals to perform efficient (semi-automated) web application security audits.

Most important features:

• WATOBO has Session Management capabilities! You can define login scripts as well as logout signatures. So you don’t have to login manually each time you get logged out.
• WATOB can act as a transparent proxy (requires nfqueue)
• WATOBO can perform vulnerability checks out of the box
• WATOBO can perform checks on functions which are protected by Anti-CSRF-/One-Time-Tokens
• WATOBO supports Inline De-/Encoding, so you don’t have to copy strings to a transcoder and back again. Just do it inside the request/response window with a simple mouse click.
• WATOBO has smart filter functions, so you can find and navigate to the most interesting parts of the application easily.
• WATOBO is written in (FX)Ruby and enables you to easily define your own checks
• WATOBO runs on Windows, Linux, MacOS ... every OS supporting (FX)Ruby
• WATOBO is free software ( licensed under the GNU General Public License Version 2)
• It’s by siberas ;)

Documentation

Check out the online documentation and video tutorials at http://watobo.sourceforge.net

Tips & Tricks

• On Linux you should use RVM to install Ruby (http://beginrescueend.com/rvm/install/)
• Use FoxyProxy or SwitchProxy to easily change your proxy settings

watobo's Issues

Scope is not saved

The defined scope is currently not saved in the session file. If a user re-opens the session, he has to redefine the scope.

watobo (and Gnome) freezes when I select "Window-> Use small fonts"

I work on Ubuntu 16.04 with a Gnome minimal installation. When I select "Use small fonts", Watobo (and Gnome) seems to freeze. I can still use tabs to switch to other windows, however using the mouse is no longer possible. This seems to be more a "RubyFX" than a watobo issue.

The issue doesn't happen always making the generation of test cases difficult :-(

Conversation-settings are not saved in the session

The conversation settings (for example show only project scope) are not saved on disk. If the user closes watobo, he must update these settings manually.

run watobo get error:

I run watobo and input "https://www.google.com"in firefox , then get the erros:

:port: 8081
:proxy_mode: 2
:bind_addr: 127.0.0.1
CREATE NEW CERTIFICATE FOR >> http://www.google.com:443www.google.com:443 <<
CN=http://www.google.com:443www.google.com
! Could not write keypair
No such file or directory @ rb_sysopen - ~/.watobo/CA/fake_certs/http://www.google.com:443www.google.com_keypair.pem

add rewrite information to interceptor

• add log tab
• num rewrites
• show match/replace

watobo fails to start (ArgumentError)

Hello,
I'm trying to update the watobo package in Kali (the current package in Kali is broken).
But I have this issue:

/var/lib/gems/2.3.0/gems/fxruby-1.6.29/lib/fox16/kwargs.rb:972:in `initialize': wrong number of arguments (given 8, expected 0) (ArgumentError)

I have the same issue when installing the gems in a fresh install of kali-rolling:

$ apt install g++ libxrandr-dev libfox-1.6-dev
[...]
$ gem install watobo
[...]
$ gem install selenium-driver
[...]
$ watobo
#############################################################

     W A T O B O - THE Web Application Toolbox
     brought to you by siberas http://www.siberas.de

#############################################################
NFQUEUE not available on this system
---
uninitialized constant Watobo::Modules::Active::Sap::Business_objects
when loading module file /var/lib/gems/2.3.0/gems/watobo-0.9.23/modules/active/sap/business_objects.rb
---

Loading FXRuby ... this may take some time ... [OK]
Ruby Version: 2.3.3
Ruby Platform: x86_64-linux-gnu
FXRuby Version: 1.6.29
Fox Version: 1.6.53
Watobo Version: 0.9.23
>> Starting GUI ...
/var/lib/gems/2.3.0/gems/fxruby-1.6.29/lib/fox16/kwargs.rb:972:in `initialize': wrong number of arguments (given 8, expected 0) (ArgumentError)
        from /var/lib/gems/2.3.0/gems/fxruby-1.6.29/lib/fox16/kwargs.rb:972:in `initialize'
        from /var/lib/gems/2.3.0/gems/watobo-0.9.23/lib/watobo/gui/html_viewer.rb:26:in `initialize'
        from /var/lib/gems/2.3.0/gems/watobo-0.9.23/lib/watobo/gui/html_viewer.rb:147:in `new'
        from /var/lib/gems/2.3.0/gems/watobo-0.9.23/lib/watobo/gui/html_viewer.rb:147:in `initialize'
        from /var/lib/gems/2.3.0/gems/watobo-0.9.23/lib/watobo/gui/chatviewer_frame.rb:436:in `new'
        from /var/lib/gems/2.3.0/gems/watobo-0.9.23/lib/watobo/gui/chatviewer_frame.rb:436:in `initialize'
        from /var/lib/gems/2.3.0/gems/watobo-0.9.23/lib/watobo/gui/main_window.rb:1678:in `new'
        from /var/lib/gems/2.3.0/gems/watobo-0.9.23/lib/watobo/gui/main_window.rb:1678:in `initialize'
        from /var/lib/gems/2.3.0/gems/watobo-0.9.23/lib/watobo/gui.rb:64:in `new'
        from /var/lib/gems/2.3.0/gems/watobo-0.9.23/lib/watobo/gui.rb:64:in `start'
        from /var/lib/gems/2.3.0/gems/watobo-0.9.23/bin/watobo_gui.rb:21:in `<top (required)>'
        from /usr/lib/ruby/2.3.0/rubygems/core_ext/kernel_require.rb:55:in `require'
        from /usr/lib/ruby/2.3.0/rubygems/core_ext/kernel_require.rb:55:in `require'
        from /var/lib/gems/2.3.0/gems/watobo-0.9.23/bin/watobo:9:in `<top (required)>'
        from /usr/local/bin/watobo:22:in `load'
        from /usr/local/bin/watobo:22:in `<main>'

(it fails even if nfqueue is installed)

Watobo crashes in comment function

When I try to add a comment (via shortcut or by using the menu function), watobo crashes.

Output from the command line

FXComposeContext: illegal window parameter
Aborted

Conversation table is not updated when scope changes

If the user selects "scope only" in the conversation settings, and changes the scope, the conversation table is not updated automatically.

Steps to reproduce

• Define a page in the scope settings
• Select "scope only" in the conversation view
• Add a second site to the scope

The expectation would be that the conversation table is updated, however this is not the case....

reflected XSS scan doesn't work for POST requests

Here is the test case:

<?php
echo $_POST['xss'];
?>

Doing a quickscan for XSS didn't reveal any results. It seems that only POST requests are affected, XSS in URL parameters gets detected

Crash while using proxy

Hi,

Waboto 0.9.21 crashes as soon as I use it as a proxy server with Firefox. Basically, I cannot use Waboto at all. Output of Ruby is below.
My OS is Windows 10, with Ruby 2.3.1 x64 and DevKit 4.7.2 x64.

Thanks.

Fred

---

Request RAW (HEX):
!!! Error reading client request
undefined method unpack' for nil:NilClass C:/Ruby23-x64/lib/ruby/gems/2.3.0/gems/watobo-0.9.21/lib/watobo/sockets/client_socket.rb:107:inrequest'
C:/Ruby23-x64/lib/ruby/gems/2.3.0/gems/watobo-0.9.21/lib/watobo/interceptor/proxy.rb:184:in block (3 levels) in start' C:/Ruby23-x64/lib/ruby/gems/2.3.0/gems/watobo-0.9.21/lib/watobo/interceptor/proxy.rb:179:inloop'
C:/Ruby23-x64/lib/ruby/gems/2.3.0/gems/watobo-0.9.21/lib/watobo/interceptor/proxy.rb:179:in block (2 levels) in start' C:/Ruby23-x64/lib/ruby/gems/2.3.0/gems/watobo-0.9.21/lib/watobo/utils/secure_eval.rb:18:inblock in secure_eval': $SAFE=2 to 4 are obsolete (ArgumentError)

change "generell" to "general"

Generell is a german word :-)

watobo crashes in sqlmap plugin

I get a crash when i try to use the sqlmap plugin. It happens when i try to start the sqlmap scan.

watobo output:

Start SQLMap with file /home/h0ng10/.watobo/tmp/sqlmap/sqlmap_1494332696.req
/home/h0ng10/watobo/plugins/sqlmap/gui/main.rb:197:in `system': no implicit conversion of false into String (TypeError)
	from /home/h0ng10/watobo/plugins/sqlmap/gui/main.rb:197:in `block in run_sqlmap'

no close window button in interceptor window (linux only)

Watobo automatically closes when I scan an IP address

The application in the CLI closes everytime it opens and I give an IP address to scan.

New Project Window issues

I noticed a small bug in the "New project" window:

If you create a new project and press on the new button, the "project name" text field gets inresponsive.
You can still select between existing projects, however you can't create a second new project inside the
dialog. The user must close the dialog first (via cancel) and reopen it again..