Merge branch 'white/master'

Author: micabot

AUTHORS

@@ -18,3 +18,4 @@ Project contributors
     * Andres Tarantini
     * Ezequiel Tavella
     * Martin Tartarelli
+    * Ronald Iraheta

RELEASE.md

@@ -10,6 +10,23 @@ Please run ./faraday.py --update
 New features in the latest update
 =====================================
 
+Feb 26, 2016:
+---
+* Fixed bug in pip debian
+* BugFix pip install.
+* Checks additionals about dependencies in installation.
+* Warning about a upgrade to experimental in debian installation.
+* Fixed small bug in CSV importing
+* Fixed styles for Status Report
+* Fixed bug on Status Report filter after editing
+* Added support for Kali Rolling Edition
+* Notify user when the current Workspace doesn't exist
+* Show all evidence files in Status Report
+* Added script to remove all vulns with a specific severity value (parameterized)
+* Fixed Arachni Plugin bugs
+* Added new version for Maltego Plugin
+* Added support for Mint 17 
+
 Dec 18, 2015:
 ---
 * Immunity Canvas plugin added

VERSION

@@ -1 +1 @@
-1.0.16
+1.0.17

config/default.xml

@@ -2,7 +2,7 @@
 <faraday>
 
     <appname>Faraday - Penetration Test IDE</appname>
-    <version>1.0.16</version>
+    <version>1.0.17</version>
     <debug_status>0</debug_status>
     <font>-Misc-Fixed-medium-r-normal-*-12-100-100-100-c-70-iso8859-1</font>
     <home_path>~/</home_path>

faraday.py

@@ -17,7 +17,6 @@
 import argparse
 import platform
 import subprocess
-import pip
 import json
 
 from utils.logs import getLogger, setUpLogger
@@ -28,7 +27,6 @@
 from utils.user_input import query_yes_no
 
 
-
 USER_HOME = os.path.expanduser(CONST_USER_HOME)
 FARADAY_BASE = os.path.dirname(os.path.realpath(__file__))
 QTDIR=os.path.join(FARADAY_BASE, 'external_libs', 'qt')
@@ -125,11 +123,6 @@ def getParserArgs():
         help="Disable the application exception hook that allows to send error \
         reports to developers.")
 
-    parser.add_argument('--disable-login', action="store_true",
-        dest="disable_login",
-        default=False,
-        help="Disable the auth splash screen.")
-
     parser.add_argument('--dev-mode', action="store_true", dest="dev_mode",
         default=False,
         help="Enable dev mode. This will use the user config and plugin folder.")
@@ -153,7 +146,7 @@ def getParserArgs():
 
     parser_gui_ex.add_argument('--cli', '--console', action="store_true",
         dest="cli",
-        default="false",
+        default=False,
         help="Set this flag to avoid gui and use faraday as a cli.")
 
     #args = parser.parse_args(['@parser_args.cfg'])
@@ -208,30 +201,32 @@ def checkDependencies():
     """
 
     if not args.ignore_deps:
-
-        modules = []
-        f = open(CONST_REQUIREMENTS_FILE)
-        for line in f:
-            if not line.find('#'):
-                break
-            else:
-                modules.append([line[:line.index('=')], (line[line.index('=')+2:]).strip()])
-        f.close()
-
-        pip_dist = [dist.project_name.lower() for dist in pip.get_installed_distributions()]
-
-        for module in modules:
-            if module[0].lower() not in pip_dist:
-                try:
-                    __import__(module[0])
-                except ImportError:
-                    if query_user_bool("Missing module %s."
-                        " Do you wish to install it?" % module[0]):
-                        pip.main(['install', "%s==%s" %
-                                 (module[0], module[1]), '--user'])
-
-                    else:
-                        return False
+        try:
+            import pip
+            modules = []
+            f = open(CONST_REQUIREMENTS_FILE)
+            for line in f:
+                if not line.find('#'):
+                    break
+                else:
+                    modules.append([line[:line.index('=')], (line[line.index('=')+2:]).strip()])
+            f.close()
+            pip_dist = [dist.project_name.lower() for dist in pip.get_installed_distributions()]
+
+            for module in modules:
+                if module[0].lower() not in pip_dist:
+                    try:
+                        __import__(module[0])
+                    except ImportError:
+                        if query_user_bool("Missing module %s."
+                            " Do you wish to install it?" % module[0]):
+                            pip.main(['install', "%s==%s" %
+                                     (module[0], module[1]), '--user'])
+
+                        else:
+                            return False
+        except ImportError:
+            pass
 
     return True
 
@@ -283,8 +278,6 @@ def setConf():
     CONF.setApiConInfoPort(port_xmlrpc)
     CONF.setApiRestfulConInfoPort(port_rest)
 
-    CONF.setAuth(args.disable_login)
-
 
 def startFaraday():
     """Application startup.
@@ -548,7 +541,7 @@ def checkUpdates():
         getInstanceConfiguration().setAppname("Faraday - Penetration Test IDE Community")
         parameter = {"version": getInstanceConfiguration().getVersion()}
 
-        f.close
+        f.close()
         resp = requests.get(uri, params=parameter, timeout=1, verify=True)
         resp = resp.text.strip()
     except Exception as e:

gui/qt3/hostsbrowser.py

@@ -758,8 +758,7 @@ def _importVulnsCvs(self,item):
                     continue
 
                 d = l.split("|")
-                
-                if len(d) <=8:
+                if len(d) <8:
                     api.log("Error vuln line: ("+l+")" )
                 else:
                     self._newVulnImport(d[1],d[2],d[3],d[4],d[5],d[6],d[7])

helpers/removeBySeverity.py

@@ -0,0 +1,89 @@
+#!/usr/bin/env python2.7
+'''
+Faraday Penetration Test IDE
+Copyright (C) 2014  Infobyte LLC (http://www.infobytesec.com/)
+See the file 'doc/LICENSE' for the license information
+
+'''
+'''
+This script either updates or removes Interfaces, Services and Vulnerabilities in case their parent property is null.
+If the property is null but a parent is found in Couch, the document is updated.
+If the parent is not found in Couch the document is deleted, since it is an invalid one.
+'''
+
+import argparse
+import json
+import requests
+import os
+
+def main():
+    #arguments parser
+    parser = argparse.ArgumentParser(prog='removeBySeverity', epilog="Example: ./%(prog)s.py")
+    parser.add_argument('-c', '--couchdburi', action='store', type=str,
+                        dest='couchdb',default="http://127.0.0.1:5984",
+                        help='Couchdb URL as http://user:password@couch_ip:couch_port (defaults to http://127.0.0.1:5984)')
+    parser.add_argument('-d', '--db', action='store', type=str, required=True,
+                        dest='db', help='DB to process')
+    parser.add_argument('-s', '--severity', action='store', type=str, required=True,
+                        dest='severity', help='Vulnerability severity')
+    parser.add_argument('-t', '--test', action='store_true', 
+                        dest='test', help='Dry run, does everything except updating the DB')
+    parser.add_argument('-v', '--verbose', action='store_true', 
+                        dest='verbose', help='Extended output')
+
+    #arguments put in variables
+    args = parser.parse_args()
+    db = args.db
+    severity = args.severity
+    test = args.test
+    verbose = args.verbose
+
+    #default value from ENV COUCHDB
+    couchdb = os.environ.get('COUCHDB')
+    #Else from argument
+    if not couchdb:
+        couchdb = args.couchdb
+
+    fixDb(couchdb, db, severity, test, verbose)
+
+def fixDb(couchdb, db, severity, test, verbose):
+    couchdb = str(couchdb)
+    db = str(db)
+
+    #get all broken elements from CouchDB
+    headers = {'Content-Type': 'application/json'}
+    payload = { "map" : """function(doc) { if((doc.type == \"Vulnerability\" && doc.severity == \""""+severity+"""\") ||
+                                            (doc.type == \"VulnerabilityWeb\" && doc.severity == \""""+severity+"""\")){ emit(doc._id, doc._rev); }}""" }
+
+    r = requests.post(couchdb + '/' + db + '/_temp_view', headers=headers, data=json.dumps(payload))
+    response_code = r.status_code
+
+    if response_code == 200:
+        response = r.json()
+        rows = response['rows']
+        # ID is ID, value is REV
+
+        if len(rows) > 0:
+            print " [*[ Processing " + str(len(rows)) + " documents for " + db + " ]*]"
+
+            for row in rows:
+                id = str(row['id'])
+                rev = str(row['value'])
+
+                # delete vuln
+                if verbose:
+                    print " - Deleting vulnerability with ID " + id
+                if not test:
+                    delete = requests.delete(couchdb + '/' + db + '/' + id + '?rev=' + rev)
+                    if verbose:
+                        print " -- " + delete.reason + " (" + str(delete.status_code) + ")"
+            print " Done"
+        else:
+            print "No vulns were found in DB " + db + " with severity " + severity + "!"
+    elif response_code == 401:
+        print " Autorization required to access " + db + ", make sure to add user:pwd to Couch URI using --couchdburi"
+    else:
+        print "Error connecting to CouchDB, please verify the service is up"
+
+if __name__ == "__main__":
+    main()

install.sh

@@ -5,7 +5,6 @@
 ## See the file 'doc/LICENSE' for the license information
 ###
 
-
 #Check if is it root
 if [ $EUID -ne 0 ]; then
  echo "You must be root."
@@ -41,13 +40,19 @@ else
         os="$(uname -s) $(uname -r)"
 fi
 
+#Check if python2 is already installed
+if ! which python2 > /dev/null; then
+    echo "[-] Please install Python2 or make sure it is in your path"
+    exit 1
+fi
+
 echo "[+] Install $os $arch"
 down=0
 if [ "$os" = "Ubuntu 10.04.2 LTS" ]; then
     version="ubuntu10-04.02$arch"
-elif [[ "$os" =~ "Kali GNU/Linux 2."* ]]; then
+elif [[ "$os" =~ "Kali GNU/Linux 2."*|"Kali GNU/Linux Rolling".* ]]; then
     version="kali2-$arch"
-    down=1    
+    down=1
 elif [[ "$os" =~ .*Kali.* ]]; then
     version="kali-$arch"
     down=1
@@ -60,6 +65,13 @@ elif [ "$os" = "Ubuntu 13.04" ]; then
     version="ubuntu13-04-$arch"
     down=1
 elif [[ "$os" =~ "Ubuntu 14.04".*|"Ubuntu 14.10".*|"Ubuntu Vivid Vervet (development branch)"|"Ubuntu 15".* ]]; then
+    version="ubuntu13-10-$arch"
+    down=1
+    # Install pip from github.
+    # Bug: https://bugs.launchpad.net/ubuntu/+source/python-pip/+bug/1306991
+    wget https://bootstrap.pypa.io/get-pip.py
+    python get-pip.py
+elif [[ "$os" =~ "Mint 17".* ]]; then
     version="ubuntu13-10-$arch"
     down=1
     # Install pip from github.
@@ -69,38 +81,49 @@ elif [[ "$os" =~ "Ubuntu 14.04".*|"Ubuntu 14.10".*|"Ubuntu Vivid Vervet (develop
 elif [[ "$os" =~ "Debian 7".*|"Debian 8".*|"stretch/sid".* ]]; then
     version="ubuntu13-10-$arch"
     down=1
-    wget https://raw.github.com/pypa/pip/master/contrib/get-pip.py
-    python get-pip.py    
+    # Install pip from github.
+    # Bug: https://bugs.launchpad.net/ubuntu/+source/python-pip/+bug/1306991
+    wget https://bootstrap.pypa.io/get-pip.py
+    python get-pip.py
+
+    #Check if user agree with change to experimental
+    read -r -p "We need change your debian to experimental - sid branch (If you are not). You agree?[Y/n] " input
+
+    case $input in
+
+        [nN][oO]|[nN])
+                    echo "[!]Faraday install: Aborted"
+                    echo "[!]You need agree the update to experimental - sid"
+                    exit 1;;
+    esac
+
     echo "deb http://ftp.debian.org/debian experimental main" >> /etc/apt/sources.list
     echo "deb http://ftp.debian.org/debian sid main" >> /etc/apt/sources.list
     apt-get update
 
     if [[ "$os" =~ "Debian 7".* ]]; then
         apt-get -t experimental -y install libc6-dev
-        sed -i 's/deb http:\/\/ftp.debian.org\/debian experimental main//' /etc/apt/sources.list
-        sed -i 's/deb http:\/\/ftp.debian.org\/debian sid main//' /etc/apt/sources.list
-        apt-get update
     fi
 else
     echo "[-] Could not find a install for $os ($arch $kernel)"
     exit
 fi
 
 if [ "$down" -eq 1 ]; then
-    
+
     if [ -e lib-$version.tgz ]; then
         echo "[+] QT Libs already downloaded"
     else
         echo "[+] Download QT Libs"
         wget "https://www.faradaysec.com/down/faraday/lib-$version.tgz" -O lib-$version.tgz
     fi
-    
+
     shav="sha_${version//-/_}"
     echo `sha256sum lib-$version.tgz`
     if [ -e lib-$version.tgz ]; then
         if [ "`echo ${!shav}`" = "`sha256sum lib-$version.tgz | awk -F\" \" \{'print $1'\}`" ]; then
             echo "[+] SHA256 ok"
-            tar -xvzf lib-$version.tgz 
+            tar -xvzf lib-$version.tgz
             mv lib-$version/ external_libs
         else
             rm lib-$version.tgz
@@ -119,7 +142,23 @@ if [ "$update" -eq 0 ]; then
     apt-get update
     update=1
 fi
+
 apt-get --ignore-missing -y install ipython python-pip python-dev libpq-dev couchdb
+
+#Check if python-setuptools not exists.
+python -c "import setuptools" > /dev/null 2>&1
+
+if [ "$?" -eq 1 ]; then
+    apt-get install python-setuptools
+fi
+
+#Delete debian experimental from sources.
+if [[ "$os" =~ "Debian 7".*|"Debian 8".*|"stretch/sid".* ]]; then
+  sed -i 's/deb http:\/\/ftp.debian.org\/debian experimental main//' /etc/apt/sources.list
+  sed -i 's/deb http:\/\/ftp.debian.org\/debian sid main//' /etc/apt/sources.list
+  apt-get update
+fi
+
 pip install -r requirements.txt
 
 echo "You can now run Faraday, enjoy!"