Web Application Information Disclosure

#!/usr/bin/env python3
# check_path_disclosure.py
# Probe a web application for path / stack-trace disclosure via malformed requests.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / error

import re
import sys
import requests
from urllib.parse import urljoin

TIMEOUT = 10
HEADERS = {
    'User-Agent': 'noisgate-path-disclosure-check/1.0',
    'Accept': '*/*'
}

PATH_PATTERNS = [
    re.compile(r'[A-Za-z]:\\\\(?:[^\\\\\r\n]+\\\\)*[^\\\\\r\n]*'),   # Windows path
    re.compile(r'/(?:var|srv|opt|home|usr|etc|tmp|app|www)/(?:[^\s"<>:]*)'),         # Unix path
    re.compile(r'inetpub\\\\wwwroot', re.I),
    re.compile(r'/var/www', re.I),
    re.compile(r'/usr/local/', re.I),
]

STACK_PATTERNS = [
    re.compile(r'Traceback \(most recent call last\):'),
    re.compile(r' at [A-Za-z0-9_$.]+\([A-Za-z0-9_$.]+:\d+\)'),      # Java-ish stack trace
    re.compile(r'System\.[A-Za-z0-9_.]+Exception', re.I),
    re.compile(r'Fatal error:', re.I),
    re.compile(r'Warning: .* on line \d+', re.I),
    re.compile(r'<b>Stack trace</b>', re.I),
]

PROBES = [
    ('GET', ''),
    ('GET', "'\"<>{}..;/"),
    ('GET', 'nonexistent-noisgate-__trigger__-404'),
    ('GET', '?id=%27%22%3C%3E%7B%7D'),
]


def fetch(url, method='GET'):
    try:
        if method == 'GET':
            r = requests.get(url, headers=HEADERS, timeout=TIMEOUT, allow_redirects=True, verify=True)
        else:
            r = requests.request(method, url, headers=HEADERS, timeout=TIMEOUT, allow_redirects=True, verify=True)
        return r
    except requests.RequestException:
        return None


def analyze(body):
    findings = []
    for pat in PATH_PATTERNS:
        m = pat.search(body)
        if m:
            findings.append(f'path:{m.group(0)[:160]}')
    for pat in STACK_PATTERNS:
        m = pat.search(body)
        if m:
            findings.append(f'stack:{m.group(0)[:160]}')
    return findings


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 check_path_disclosure.py https://target/')
        sys.exit(2)

    base = sys.argv[1].strip()
    if not base.startswith('http://') and not base.startswith('https://'):
        print('UNKNOWN - target must start with http:// or https://')
        sys.exit(2)

    hits = []
    tested = 0

    for method, suffix in PROBES:
        target = urljoin(base if base.endswith('/') else base + '/', suffix)
        r = fetch(target, method=method)
        if r is None:
            continue
        tested += 1
        body = r.text[:200000]
        findings = analyze(body)
        if findings:
            hits.append({'url': target, 'status': r.status_code, 'findings': findings[:5]})

    if hits:
        print('VULNERABLE')
        for hit in hits:
            print(f"URL={hit['url']} STATUS={hit['status']} FINDINGS={'; '.join(hit['findings'])}")
        sys.exit(1)

    if tested == 0:
        print('UNKNOWN - no successful HTTP responses received')
        sys.exit(2)

    print('PATCHED')
    print('No obvious path or stack-trace disclosure detected in tested responses.')
    sys.exit(0)


if __name__ == '__main__':
    main()