Unicode character in contributions

[flibustier]

Hi guys!

I'm newbie in Metasploit contribution and the last one I wrote was the refactoring of the tree printing in wmap plugin

I reproduced the beautiful output of the tree command on linux
This is the result (without colors):

    [10.0.1.103] (10.0.1.103)
    ├── bodgeit (11)
    │   ├── about.jsp
    │   ├── advanced.jsp
    │   ├── basket.jsp
    │   ├── contact.jsp
    │   ├── home.jsp
    │   ├── login.jsp
    │   ├── product.jsp
    │   ├── register.jsp
    │   ├── score.jsp
    │   ├── search.jsp
    │   └── style.css
    └── webgoat (8)
        ├── css (3)
        │   ├── animate.css
        │   ├── font-awesome.min.css
        │   └── main.css
        ├── j_spring_security_check
        ├── j_spring_security_check;jsessionid=FBF114C8E278BA1017B3276CE69E3855
        ├── login.mvc
        ├── login.mvc;jsessionid=17FA6F8E8FDDE3AEFB2C757A53C58243
        ├── login.mvc;jsessionid=FBF114C8E278BA1017B3276CE69E3855
        ├── plugins (1)
        │   └── bootstrap (1)
        │       └── css (1)
        │           └── bootstrap.min.css
        └── start.mvc

It’s more pleasant but my problem is this…

plugins/wmap.rb:1595 - [ERROR] Unicode detected: " print (bool ? ' ' : '\xE2\x94\x82') + (' ' * 3)\n"
plugins/wmap.rb:1599 - [ERROR] Unicode detected: " print (is_last ? '\xE2\x94\x94' : '\xE2\x94\x9C') + ('\xE2\x94\x80' * 2) + ' '\n"

So, my questions are: how can I do?
And why Unicode is banished?

Thanks to all for reading me and your fantastic job!

(And sorry for my english)

[wvu]

Did you run msftidy against the WMAP plugin? msftidy is usually run against modules.

[flibustier]

Thank you for your reply!
Yes I run it against the WMAP plugin that I modified, I did not know that it was only for the modules!
So thanks, I will prepare my pull request!

[wvu]

Reviewing your Unicode characters:

wvu@kharak:~$ echo $'\xE2\x94\x82' $'\xE2\x94\x94' $'\xE2\x94\x9C' $'\xE2\x94\x80'
│ └ ├ ─
wvu@kharak:~$ 

You should use the ASCII equivalents. Even though I would hope most of us are using Unicode, you can't guarantee that for every setup. I'll leave what characters we use to your artistic liberty.

[wvu]

Actually, I assume you used Unicode to improve the current tree output. Can you show the original tree output to compare against?

WMAP isn't very well supported, btw. I don't think it's been touched in years, other than for bug fixes.

[flibustier]

Sadly, there is no equivalent in the ASCII table (there are in the 'extended ascii' which is Unicode too)

This is the old output :

    [10.0.1.103] (10.0.1.103)
		|-----/webgoat (8)
				|-----/css (3)
					|-----/animate.css
					|-----/font-awesome.min.css
					|-----/main.css
				|-----/j_spring_security_check
				|-----/j_spring_security_check;jsessionid=FBF114C8E278BA1017B3276CE69E3855
				|-----/login.mvc
				|-----/login.mvc;jsessionid=17FA6F8E8FDDE3AEFB2C757A53C58243
				|-----/login.mvc;jsessionid=FBF114C8E278BA1017B3276CE69E3855
				|-----/plugins (1)
					|-----/bootstrap (1)
						|-----/css (1)
							|-----/bootstrap.min.css
				|-----/start.mvc

Yes you're right, I take the character from the tree command on linux/dos

What you said is interesting. Why WMAP isn't very well supported ? Is there a better way to scan a web application ?

Thanks

[wvu]

What I meant is to use characters from the ASCII set to build a similar-looking tree. Like ps f or pstree. I won't lose any sleep over using Unicode, though, since it's 2017.

Your new tree looks awesome, but if you look at how tree does it, Unicode is just one of many supported charsets:

static const struct linedraw cstable[]={
  { latin1_3,    "|  ",              "|--",            "·--",     "©"   },
  { iso8859_789, "|  ",              "|--",            "·--",     "(c)"      },
  { shift_jis,   "\204\240 ",        "\204\245",       "\204\244",       "(c)"      },
  { euc_jp,      "\250\242 ",        "\250\247",       "\250\246",       "(c)"      },
  { euc_kr,      "\246\242 ",        "\246\247",       "\246\246",       "(c)"      },
  { iso2022jp,   "\033$B(\"\033(B ", "\033$B('\033(B", "\033$B(&\033(B", "(c)"      },
  { ibm_pc,      "\263  ",           "\303\304\304",   "\300\304\304",   "(c)"      },
  { ibm_ps2,     "\263  ",           "\303\304\304",   "\300\304\304",   "\227"     },
  { ibm_gr,      "\263  ",           "\303\304\304",   "\300\304\304",   "\270"     },
  { gb,          "\251\246 ",        "\251\300",       "\251\270",       "(c)"      },
  { utf8,        "\342\224\202\302\240\302\240",
  "\342\224\234\342\224\200\342\224\200", "\342\224\224\342\224\200\342\224\200", "\302\251" },
  { big5,        "\242x ",           "\242u",          "\242|",          "(c)"      },
  { viscii,      "|  ",              "|--",            "`--",            "\371"     },
  { koi8ru,      "\201  ",           "\206\200\200",   "\204\200\200",   "\277"     },
  { windows,     "|  ",              "|--",            "`--",            "\251"     },
  { NULL,        "|  ",              "|--",            "`--",            "(c)"      }
};

Perhaps you should have a compat mode.

[wvu]

Metasploit isn't really a web scanner. It never was. We support WMAP insofar as we'll maintain it, but no new features are being added to it. Until now. ^^

[wvu]

Looks like you already added a compat mode! Thanks!!

[wvu]

Consider this matter resolved. Moving to #8104.