#
# Configuration file for sara; limits, policies, etc. go here
#
#
# version 1, Mon Mar 20 19:16:55 1995, last mod by wietse
# version 2, Fri Mar 26 23:30:00 1999, last mod by toddr
# version 3, Wed Jun 14 21:00:00 2000, last mod by toddr
# version 4, Mon Aug 14 09:00:00 2000, last mod by toddr
# version 5, Mon Oct 02 17:00:00 2000, last mod by toddr
# version 6, Tue Dec 19 17:00:00 2000, last mod by toddr
# version 7, Tue Jul 26 00:00:00 2005, last mod by toddr
#

#
# NOTE - "" or 0 means false, in this config file
#
# Where do we keep the data? This is just a default.
$sara_data   = "sara-data";
# Default location for the false positive corrections file
$correction_file = "rules/corrections";
# Names of the reports that will be generated in the current $sara-data dir
$report_xml    = "report.xml";
$report_csv    = "report.csv";
$report_htm    = "report.html";
$sara_tmp = $$;

# Default attack level (0=light,1=normal,2=heavy,3=extreme,4=custom0,5=custom1).
$attack_level = 2;
@attack_name=('light','normal','heavy','extreme','custom0','custom1','custom2','fw');

# Probes by attack level.
#
# ? Means conditional, proposed by rules.todo.
# With heavy scans, replace 1-9999 by 1-65535 to find all non-standard
# telnet, ftp, www or gopher servers.

@light = (
	'dns.sara',
	'rpc.sara',
	'showmount.sara?',
	'hosttype.sara',
	);

@normal = (
	@light,
	'finger.sara',
	'tcpscan.sara 70,80,ftp,telnet,smtp,nntp,uucp,6000',
	'udpscan.sara 53,177',
	'rusers.sara?',
	'boot.sara?',
	'yp-chk.sara?',
	);

@heavy= (
	@light,
	'finger.sara',
	'rusers.sara?',
	'boot.sara?',
	'yp-chk.sara?',
	'backdoor.sara',
	$heavy_tcp_scan = 'tcpscan.sara 1-5404,5406-5899,5901-7099,7101-9999,12345,16600,20000-30000,31337,31785,33567,33568,60008,65000',
	$heavy_udp_scan = 'udpscan.sara 1-1760,1763-2050,6500,31335,31337,27444,32767-33500',
	'*?',
	);
	$heavy_tcp_scan_old = $heavy_tcp_scan;
	$heavy_udp_scan_old = $heavy_udp_scan;

@extreme= (
	@light,
	'finger.sara',
	'rusers.sara?',
	'boot.sara?',
	'yp-chk.sara?',
        'backdoor.sara',
# Avoiding ports 1521,1523,1534, and 1526 due to Oracle flaws
        'tcpscan.sara 1-9999',
        'tcpscan.sara 10000-19999', 
        'tcpscan.sara 20000-29999',
        'tcpscan.sara 30000-39999',
        'tcpscan.sara 40000-49999',
        'tcpscan.sara 50000-59999',
        'tcpscan.sara 60000-65535',
#	$heavy_tcp_scan = 'tcpscan.sara 1-1520,1522-1525,1527-65535',
	$heavy_udp_scan = 'udpscan.sara 1-2050,6500,27444,31335,31337,32767-33500',
	'*?',
	);

@fw = (
        @light,
        $fw_tcp_scan = 'tcpscan.sara 1-25,53,80,110,111,135-139,143,443,445,1433,1521,1524,6000,3306,3389,5901',
        'udpscan.sara 53,161,177',
        );

# ***********************
# SARA Custom probe configuration
# ***********************

# This is a configuration management updated custom scan definition.
# Update through the Configuration Management button, not through
# this file!
# 
$custom0_mode = 1;
$dns0 = "off";
$smb0 = "on";
$http0 = "on";
$mail0 = "on";
$tel0 = "on";
$ftp0 = "on";
$rpc0 = "off ";
$custom0_tcp = "21,79";
$custom0_udp = "137,53";
$custom0_cmd = "udpscan.sara 137|tcpscan.sara 139|tcpscan.sara 80,139|tcpscan.sara 25|tcpscan.sara 23|tcpscan.sara 21|*?|";
@custom0= split(/\|/,$custom0_cmd);
$custom0_string = "Custom(SMB,Web,Mail,Telnet,FTP)";
#
#  Custom 1 (-a5) inherits all of extreme mode options for the
# port(s) being scanned
#
$custom1_mode = 2;
$dns1 = "off";
$smb1 = "off";
$http1 = "off";
$mail1 = "off";
$tel1 = "on";
$ftp1 = "on";
$rpc1 = "off";
$custom1_tcp = "";
$custom1_cmd = "tcpscan.sara 25|*?|";
@custom1= split(/\|/,$custom1_cmd);
$custom1_string = "Custom(TCP scan for SMTP";

$custom2_mode = 0;
$dns2 = "off";
$smb2 = "off";
$http2 = "on";
$mail2 = "off";
$tel2 = "off";
$ftp2 = "off";
$rpc2 = "on";
$custom2_tcp = "";
$custom2_udp = "";
$custom2_cmd = "";
$custom2_cmd = "";
$custom2_string = "Custom(discovery only)";

# status_dir; directory for all status file (7.0.3+)
$status_dir = "status";
# status file; keeps track of what SARA is doing.
$status_file = "$status_dir/status_file";

#
# timeout values. -t option chooses one of these.
#
$short_timeout = 20;
$med_timeout = 120;
$long_timeout = 480;
$huge_timeout = 1200;


#
#  Two parameters for working in firewall environment and reduced performance
#  fw_timeout		No. of seconds before dropping connection request
#  fw_loadlimit		Max No. of concurrent connection requests
#  fw__tcp_ttl		~ (10000 * fw_timeout)/fw_loadlimit
#
$fw_timeout = 10;
$fw_loadlimit = 50;
$fw_tcp_ttl = 2000;

#
# Some tools need more time, as specified in the timeouts array.
#
%timeouts = (
	'nfs-chk.sara', $med_timeout,
	'login.sara', 45,
	'hosttype.sara', $med_timeout,
	'snmpscan.sara', $med_timeout,
	'relay.sara', 120,
	'http.sara', 120,
	'smb.sara', 240,
	'inject.sara', $huge_timeout,
	'oracletns.sara', $short_timeout,
	$heavy_tcp_scan, $long_timeout,
	$heavy_tcp_scan_old, $long_timeout,
	$heavy_udp_scan, $long_timeout,
	$heavy_udp_scan_old, $long_timeout
	);

# what signal we send to nuke things when they timeout (35072 is a kludge):
@timeout_kill = (9,137,256,35072);

#
# Proximity variables; how far out do we attack, does severity go down, etc.
#
# How far out from the original target do we attack? Zero means that we only
# look at the hosts or network that you specify. One means look at neighboring
# hosts, too. Anything over two is asking for problems, unless you are on the
# inside of a firewall.
$max_proximity_level = 0;

# Attack level drops by this much each proximity level change
$proximity_descent = 1;

# when we go below zero attack, do we stop (0) or go on (1)?
$sub_zero_proximity = 0;

# a question; do we attack subnets when we nuke a target?
# 0 = no; 1 = primary target subnet
$attack_proximate_subnets = 0;

#
# Does SARA run on an untrusted host? (0=no; 1=yes, this host may appear
# in the rhosts, hosts.equiv or NFS export files of hosts that are being
# probed).
#
$untrusted_host = 0;

#
# Any exceptions on who we want to hit?	 E.g., stay away from the mil sites?
# Also, you can specify *only* hit sites of a certain type; e.g. edu sites.
#

#
# If $only_attack_these is non-null, *only* hit sites if they are of this
# type.	 You can specify a domain (podunk.edu) or network number
# (192.9.9). You can specify a list of shell-like patterns with domains
# or networks, separated by whitespace or commas.
#
# Examples:
#
# $only_attack_these = "podunk.edu";
# $only_attack_these = "192.9.9";
# $only_attack_these = "podunk.edu, 192.9.9";
#
$only_attack_these = "";

#
# Stay away from anyone that matches these patterns.
#
#  Example - leave government and military sites alone:
#
# $dont_attack_these = "gov, mil";
$dont_attack_these = "";

#
# Set the following to nonzero if DNS (internet name service) is unavailable.
#
$dont_use_nslookup = 0;

#
# Reduce packet density for slower networks and hosts
# Use the packet density and timing parameters for firewall option
#
$reduce_packet_density = 0;
#
# ***********************
# SARA Reporter Options
#
# Default options for reporter
#
# $report_type = "full          Report standard enterprise level scan
# $report_type = "full_subnet"  Report scan by subnet
# $report_type = "summary"      Report bar chart and table only
# $report_type = "comma"        Report a comma delimited list

# $option="default"   Ignore options below
# $option="selected"  Honor options below
# $novul="off"        Report host with no vulnerabilities
# $novul="on"         Report host with vulnerabilities only
# $correction="off"    Do not use config/corrections to adjust Reporter output
# $correction="on"     Use config/corrections to adjust Reporter output
# $disable_old_scan_appendix="1"  Don't insert old scan appendix in ReportWriter
$reportwriter = 1;
$report_type  = "full";
$option       = "selected";
$novul        = "on";
$correction   = "on";

$disable_old_scan_appendix = 1;

#
# Enable installed SARA extensions (0 = no, 1 = yes)
#
$enable_extensions = 0;

# ***********************
# SARA daemon configuration
# ***********************

# set to 1 to run SARA as a daemon ias the default
# recommend leaving this as "0", start daemon mode on command line (./sara -D)

$daemon = 0;

# a comma delimited list of allowable addresses or subnets, etc.
# to allow all connections, set to '*' (very bad idea)
# if set to "", only localhost addresses will be allowed
# $allowable hosts = "192.168.0,xxx.yyy.zzz.,127.0.0.1
# IPs must be delimited with commas (starting with v 3.1.7) !!!!!

$allowable_hosts = "192.168.0.,127.0.0.1";

# This is the port the daemon server will run on.
# This port number is only used if SARA is running as a daemon

$daemon_port = "666";

# This is the password file for the daemon authentication
$password_file = "config/password";

# Allow remote user to initiate a scan (1)
# Recommend against scanning in daemon mode

$allow_scan = 0;

# Amount of time before remote authentication is cleared

$idle_close = 240;

# Number of concurrent processes allowed

$concurrent_processes = 5;

#  Set to 1 if you want to apply adminstrators database to ReportWriter

$get_admins = 0;

#
# Proxy Server address to convert ip address to mac address.
# Proxy Server is not part of SARA and must be developed by
# user.  Protocol definition is provided in perl/misc.pl (ip2mac).
#
#$mac_proxy = "192.168.0.1";
$mac_proxy = "192.168.25.54";
#
#  Use the rules/passwords file to guess passwords for telnet, ssh,
#  pop, imap, ftp.  There are only three passwords tested unless this
#  value is "1".  If set to "1", you might want to change the line
#  above from "'ssh.sara', 120," to "ssh.sara', 360,". 
$use_passwords = 0;

# To disable password guessing for smb enumerated accounts (e.g., null 
# Session acount discovery), set dont_smb_guess=1.  Otherwise, password
# guessing will use all discovered smb account
$dont_smb_guess=0;

#
#  Use the rules/smbpasswords file to guess passwords.  Deactivated 
#  by default to avoid account lockouts.  There only two passwords
#  tested unless this value is "1".  If set to "1", you might want
#  to change the line above from "'smb.sara', 120," to 
#  "smb.sara', 600,".
$use_smbpasswords = 0;

# For stealth smbpassword=1 tests, delay_smbpasswords identifies
# the number of seconds to wait between login requests
# Where account lockouts are used, recommend using bin/smb-sspg to
# avoid the lockouts.  Note that it will not update the reports.
$delay_smbpasswords = 0;

#
#  The normal vulnerability test Windows Messaging Service (MS-043)
#  causes a popup to be displayed.  Under normal SARA operations, 
#  this popup will be supressed.  If you want it to appear on vulnerable
#  system, change $enable_wms_popup to "1"
$enable_wms_popup = 0;

#
# For SQL injection module
#
#  Normally the SQL Injection function is disabled 'cause it takes up to
#  30 minutes to run.  It can be enabled by changing the variable below
#  or including on the command line <-c "$sql_inject=1">
#
#  The timeout below addresses the web crawling function of sql injection.
#  The whole process amy take $huge_timeout to complete.
#
$sql_inject = 0;
$sql_inject_timeout = 900;
$sql_inject_dump = "yes";

#
# Define the ports that fwping will use to try and determine whether a host
# is behind a firewall
#
$fw_ports="22 23 53 111 139 143 443 445 3306 3389 4000 5901 6000";
#
# port to be used by binshell tests (e.g., pnp.sara)
#
$bindport = 5346;

# FIFO variable for SSS
$sara_in = "/tmp/sara-in";
$sara_out = "/tmp/sara-out";
1;
