Fixed #369. Added RHOST info and second round to determine error page

git-svn-id: file:///home/svn/framework3/trunk@7202 4d416f70-5f16-0410-b530-b9f4589650da

modules/auxiliary/scanner/http/wmap_vhost_scanner.rb

@@ -39,8 +39,8 @@ require 'cgi'
 			
 			register_options(
 			[
-				OptString.new('URI', [ true,  "The URL to use while testing", '/']),
-				OptString.new('GET_QUERY', [ false,  "HTTP URI Query", '']),
+				OptString.new('PATH', [ true,  "The PATH to use while testing", '/']),
+				OptString.new('QUERY', [ false,  "HTTP URI Query", '']),
 				OptString.new('DOMAIN', [ true,  "Domain name", '']),
 				OptString.new('HEADERS', [ false,  "HTTP Headers", '']),
 			], self.class)	
@@ -58,30 +58,47 @@ require 'cgi'
 				"mail",
 				"intranet",
 				"intra",
+				"spool",
 				"corporate",
 				"www",
 				"web"
 			]
 		
-			datastore['GET_QUERY'] ? tquery = queryparse(datastore['GET_QUERY']): nil
+			datastore['QUERY'] ? tquery = queryparse(datastore['QUERY']): nil
 			datastore['HEADERS'] ? thead = headersparse(datastore['HEADERS']) : nil
 
-			randhost = Rex::Text.rand_text_alpha(5)+"."+datastore['DOMAIN']
+			noexistsres = nil
+			resparr = []
 			
-			begin
-				noexistsres = send_request_cgi({
-					'uri'  		=>  datastore['URI'],
-					'vars_get' 	=>  tquery,
-					'headers' 	=>  thead,
-					'vhost'		=>  randhost,   
-					'method'   	=> 'GET',
-					'ctype'		=> 'text/plain'
-				}, 20)
+			2.times do |n|
 			
-				print_status("Sending request with random domain #{randhost} ")
+				randhost = Rex::Text.rand_text_alpha(5)+"."+datastore['DOMAIN']
 
-			rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
-			rescue ::Timeout::Error, ::Errno::EPIPE			
+		
+				begin
+					noexistsres = send_request_cgi({
+						'uri'  		=>  datastore['PATH'],
+						'vars_get' 	=>  tquery,
+						'headers' 	=>  thead,
+						'vhost'		=>  randhost,   
+						'method'   	=> 'GET',
+						'ctype'		=> 'text/plain'
+					}, 20)
+
+					print_status("[#{ip}] Sending request with random domain #{randhost} ")
+				
+					if noexistsres
+						resparr[n] = noexistsres.body
+					end
+	
+				rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
+				rescue ::Timeout::Error, ::Errno::EPIPE			
+				end
+			end
+			
+			if resparr[0] != resparr[1]
+				print_error("[#{ip}] Unable to identify error response")
+				return
 			end
 			
 			valstr.each do |astr|
@@ -89,7 +106,7 @@ require 'cgi'
 				
 				begin
 					res = send_request_cgi({
-						'uri'  		=>  datastore['URI'],
+						'uri'  		=>  datastore['PATH'],
 						'vars_get' 	=>  tquery,
 						'headers' 	=>  thead, 
 						'vhost'		=>  thost,   
@@ -97,10 +114,11 @@ require 'cgi'
 						'ctype'		=> 'text/plain'
 					}, 20)
 					
+			
 					if res and noexistsres
 
 						if res.body !=  noexistsres.body 
-							print_status("Vhost found  #{thost} ")
+							print_status("[#{ip}] Vhost found  #{thost} ")
 							
 							rep_id = wmap_base_report_id(
 										rhost,
@@ -113,7 +131,7 @@ require 'cgi'
 							print_status("NOT Found #{thost}") 
 						end
 					else
-						print_status("NO Response")  	
+						print_status("[#{ip}] NO Response")  	
 					end
 
 				rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout