#VERSION,2.01
# $Id$
###############################################################################
#  Copyright (C) 2010 CIRT, Inc.
#
#  This program is free software; you can redistribute it and/or
#  modify it under the terms of the GNU General Public License
#  as published by the Free Software Foundation; version 2
#  of the License only.
#
#  This program is distributed in the hope that it will be useful,
#  but WITHOUT ANY WARRANTY; without even the implied warranty of
#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#  GNU General Public License for more details.
#
#  You should have received a copy of the GNU General Public License
#  along with this program; if not, write to 
#  Free Software Foundation, 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
###############################################################################
# PURPOSE:
# Test certificate information
###############################################################################
sub nikto_ssl_init {
    my $id = { name        => "ssl",
               full_name   => "SSL and cert checks",
               author      => "Sullo",
               description => "Perform checks on SSL/Certificates",
               hooks       => { scan => { method => \&nikto_ssl, } },
               copyright   => "2010 CIRT Inc."
               };
    return $id;
}

sub nikto_ssl {
    my ($mark) = @_;

    if ($mark->{ssl}) {
        $mark->{'ssl_cert_subject'} =~ /CN=([^$\/ ]+)/;
        my $cn_name = $1;
	my $cn_display_name = $cn_name;
	my $match=1;

	# wildcard cert
	if ($cn_name =~ /^\*/) { 
		$cn_name =~ s/([\.\?\-\(\)\{\}\+\$\@\!\\\|])/\\$1/g;
		$cn_name =~ s/\*/\.\*/g;
		my $name = $mark->{'hostname'};
		if ($name !~ /^\./) { $name = '.' . $name; } 
		if ($name !~ /^$cn_name$/i) { $match=0; }
            	add_vulnerability($mark, "Server is using a wildcard certificate: '$cn_display_name'", 999992, 0);
		}
	# normal cert
	else { 
        	if (($mark->{'hostname'} ne $cn_name) && ($cn_name ne '')) {
			$match=0;
			}
		}
	if (!$match) { 
            add_vulnerability($mark, "Hostname '$mark->{'hostname'}' does not match certificate's CN '$cn_display_name'", 999993, 0);
		 }
    }
}

1;
