Merge pull request #453 from kimocoder/claude/fix-security-vulnerability-gQwUM

fix: mask sensitive credentials in log output (CWE-312)

Author: kimocoder

wifite/attack/eviltwin.py

@@ -19,7 +19,7 @@
 from ..config import Configuration
 from ..util.color import Color
 from ..util.timer import Timer
-from ..util.logger import log_info, log_error, log_warning, log_debug
+from ..util.logger import log_info, log_error, log_warning, log_debug, mask_sensitive
 from ..util.client_monitor import ClientMonitor, ClientConnection
 from ..util.cleanup import CleanupManager
 from ..util.adaptive_deauth import AdaptiveDeauthManager
@@ -1412,7 +1412,7 @@ def on_credential_submission(self, mac_address: str, password: str, success: boo
 
             # Log the attempt
             if success:
-                log_info('EvilTwin', f'Valid credentials from {mac_address}: {password}')
+                log_info('EvilTwin', f'Valid credentials from {mac_address}: {mask_sensitive(password)}')
                 Color.pl('\n{+} {G}SUCCESS! Valid credentials captured:{W}')
                 Color.pl('    {C}From:{W} {G}%s{W}' % mac_address)
                 Color.pl('    {C}Password:{W} {G}%s{W}' % password)
@@ -1457,7 +1457,7 @@ def create_result(self, password: str, validation_time: float = 0.0) -> CrackRes
             portal_template=getattr(Configuration, 'evil_twin_portal_template', 'generic')
         )
 
-        log_info('EvilTwin', f'Created result for {self.target.essid}: {password}')
+        log_info('EvilTwin', f'Created result for {self.target.essid}: {mask_sensitive(password)}')
         return result
 
     def _setup_client_monitor(self, hostapd_log: str, dnsmasq_log: str):

wifite/attack/pmkid.py

@@ -10,7 +10,7 @@
 from ..model.pmkid_result import CrackResultPMKID
 from ..tools.airodump import Airodump
 from ..util.wpasec_uploader import WpaSecUploader
-from ..util.logger import log_debug, log_info, log_warning, log_error
+from ..util.logger import log_debug, log_info, log_warning, log_error, mask_sensitive
 from threading import Thread, active_count
 import os
 import time
@@ -479,7 +479,7 @@ def crack_pmkid_file(self, pmkid_file):
             key = Hashcat.crack_pmkid(pmkid_file)
 
         if key is not None:
-            log_info('AttackPMKID', f'PMKID cracked successfully! Password: {key}')
+            log_info('AttackPMKID', f'PMKID cracked successfully! Password: {mask_sensitive(key)}')
             return self._handle_pmkid_crack_success(key, pmkid_file)
         # Failed to crack.
         if Configuration.wordlist is not None:
@@ -495,7 +495,7 @@ def _handle_pmkid_crack_success(self, key, pmkid_file):
         # Successfully cracked.
         if self.view:
             self.view.add_log(f"Successfully cracked PMKID!")
-            self.view.add_log(f"Password: {key}")
+            self.view.add_log(f"Password: {mask_sensitive(key)}")
             self.view.update_progress({
                 'progress': 1.0,
                 'status': 'PMKID cracked successfully!',

wifite/tools/bully.py

@@ -326,7 +326,8 @@ def parse_crack_result(self, line):
 
         if self.cracked_pin and self.cracked_key:
             if self.attack_view:
-                self.attack_view.add_log(f"SUCCESS! Cracked WPS Key: {self.cracked_key}")
+                from ..util.logger import mask_sensitive
+                self.attack_view.add_log(f"SUCCESS! Cracked WPS Key: {mask_sensitive(self.cracked_key)}")
                 self.attack_view.update_progress({
                     'progress': 1.0,
                     'status': 'WPS Cracked!',

wifite/tools/reaver.py

@@ -288,7 +288,8 @@ def parse_crack_result(self, stdout):
                 # Reaver provided PSK
                 if self.attack_view:
                     self.attack_view.add_log(f"SUCCESS! Cracked WPS PIN: {pin}")
-                    self.attack_view.add_log(f"PSK (Password): {psk}")
+                    from ..util.logger import mask_sensitive
+                    self.attack_view.add_log(f"PSK (Password): {mask_sensitive(psk)}")
                     self.attack_view.update_progress({
                         'progress': 1.0,
                         'status': 'WPS Cracked!',

wifite/ui/attack_view.py

@@ -1152,7 +1152,8 @@ def add_credential_attempt(self, mac_address: str, password: str, success: bool)
         if success:
             self.successful_attempts += 1
             # Use rich text formatting for success
-            self.add_log(f"[bold green]✓[/bold green] Valid credentials from {mac_address}: [bold]{password}[/bold]", timestamp=True)
+            from ..util.logger import mask_sensitive
+            self.add_log(f"[bold green]✓[/bold green] Valid credentials from {mac_address}: [bold]{mask_sensitive(password)}[/bold]", timestamp=True)
             # Update phase to show success
             self.set_attack_phase("Validating")
 

wifite/util/logger.py

@@ -365,3 +365,22 @@ def log_critical(module: str, message: str, exc: Optional[Exception] = None):
 def log_exception(module: str, message: str):
     """Log current exception."""
     Logger.exception(module, message)
+
+
+def mask_sensitive(value: str) -> str:
+    """Mask a sensitive value (e.g. password, key) for safe logging.
+
+    Shows the first 2 characters followed by asterisks.  Values of
+    2 characters or fewer are fully masked.
+
+    Args:
+        value: The sensitive string to mask.
+
+    Returns:
+        A masked version of *value* that is safe to include in logs.
+    """
+    if not value:
+        return '****'
+    if len(value) <= 2:
+        return '*' * len(value)
+    return value[:2] + '*' * (len(value) - 2)