arachni 0.2.2.1

data/lib/ui/web/server/views/log.erb

@@ -0,0 +1,40 @@
+
+        <div id="page-intro">
+            <h2>Log</h2>
+            <p>
+                This page provides information about all actions (performed using and/or by this WebUI) that are worth knowing.
+                <br/>
+                To clear the log entries you will need to delete this file: <%=settings.db%>/log.db
+                <br/>
+            </p>
+        </div>
+        <%= erb :flash, {:layout => false} %>
+
+        <% if !entries.empty? %>
+        <table>
+            <tr>
+                <th>ID</th>
+                <th>Owner</th>
+                <th>Action</th>
+                <th>Object</th>
+                <th>Client IP address</th>
+                <th>Client hostname</th>
+                <th>Datestamp</th>
+            </tr>
+        <% entries.each do |entry| %>
+            <tr>
+
+
+                <td><%=entry.id%></td>
+                <td><%=entry.owner%></td>
+                <td><%=entry.action%></td>
+                <td><%=entry.object%></td>
+                <td><%=entry.client_addr%></td>
+                <td><%=entry.client_host%></td>
+                <td><%=entry.datestamp%></td>
+            </tr>
+        <% end %>
+        </table>
+        <% else %>
+        <span class="notice"> The log is empty.</span>
+        <% end %>

data/lib/ui/web/server/views/modules.erb

@@ -0,0 +1,71 @@
+
+        <form action="/modules" method="post">
+
+            <%= csrf_tag %>
+            <div id="page-intro">
+                <h2>Modules</h2>
+                <p>
+                    Module components assert and log entities of security interest about a web application.
+                <br/><br/>
+                </p>
+                <p>
+                    <input type="button" onclick="javascript:checkAll( 'audit' );checkAll( 'recon' );" value="Check all"/>
+                    <input type="button" onclick="javascript:uncheckAll( 'audit' );uncheckAll( 'recon' );" value="Uncheck all"/>
+                    <input type="submit" value="Save" />
+                </p>
+            </div>
+
+            <%= erb :flash, {:layout => false} %>
+            <div class="left">
+                <fieldset>
+                    <h3>Audit</h3>
+                    <p>Audit modules actively test the web application via inputs like link parameters, forms, cookies and headers in order to assert the existence of security Issues.</p>
+                    <p>
+                        <input type="button" onclick="javascript:checkAll( 'audit' );" value="Check all"/>
+                        <input type="button" onclick="javascript:uncheckAll( 'audit' );" value="Uncheck all"/>
+                    </p>
+
+                    <% modules.each do |mod|%>
+                    <% next if mod['path'] =~ /recon/ %>
+                        <h4>
+                            <input type="checkbox" class="audit" name="modules[<%=mod['mod_name']%>]"
+                                <% if session['opts']['modules'] && ( session['opts']['modules'][0] == '*' || session['opts']['modules'].include?( mod['mod_name'] ) ) %> checked="checked" <% end %> />
+                                <%=escape( mod['name'] )%>
+                        </h4>
+                        <pre class="notice"> <%=prep_description( escape( mod['description'] ) )%></pre>
+                        <p>
+                            <strong>Version:</strong> <%=mod['version']%><br/>
+                            <strong>Author:</strong> <%=escape( mod['author'])%>
+                        </p>
+
+                    <% end %>
+                </fieldset>
+            </div>
+
+            <div class="right">
+                <fieldset>
+                    <h3>Recon</h3>
+                    <p>Recon modules passively test the web application, mainly analyzing server configuration, responses and looking for directories and files.</p>
+                    <p>
+                        <input type="button" onclick="javascript:checkAll( 'recon' );" value="Check all"/>
+                        <input type="button" onclick="javascript:uncheckAll( 'recon' );" value="Uncheck all"/>
+                    </p>
+
+                    <% modules.each do |mod|%>
+                    <% next if mod['path'] =~ /audit/ %>
+                        <h4>
+                            <input type="checkbox" class="recon" name="modules[<%=mod['mod_name']%>]"
+                                <% if session['opts']['modules'] && ( session['opts']['modules'][0] == '*' || session['opts']['modules'].include?( mod['mod_name'] ) ) %> checked="checked" <% end %> />
+                                <%=escape( mod['name'] )%>
+                        </h4>
+                        <pre class="notice"> <%=prep_description( escape( mod['description'] ) )%></pre>
+                        <p>
+                            <strong>Version:</strong> <%=mod['version']%><br/>
+                            <strong>Author:</strong> <%=escape( mod['author'])%>
+                        </p>
+                    <% end %>
+                </fieldset>
+            </div>
+
+
+        </form>

data/lib/ui/web/server/views/options.erb

@@ -0,0 +1,23 @@
+
+        <% if !component['options'].empty?  && !plugin_has_required_file_option?( component['options'] )%> <h5>Options</h5>
+        <% component['options'].each do |opt| %>
+            <p class="options">
+
+                <%=escape(opt['desc'])%> <% if opt['required'] %> <strong>*</strong> <%end%>
+
+                <input name="options[<%=component['plug_name']%>][<%=opt['name']%>]"
+
+                <% if opt['type'] == 'path' %>
+                disabled="disabled" type="file" value="<%=opt['default']%>"
+                <% elsif opt['type'] == 'bool' %>
+                type="checkbox" <% if opt['default']%> checked="checked" <%end%>
+                <% else %>
+                 value="<%=opt['default']%>"
+                <%end%>
+
+                />
+
+
+            </p>
+        <%end%>
+        <%end%>

data/lib/ui/web/server/views/output_results.erb

@@ -0,0 +1,51 @@
+        <% if issues.size > 0 %>
+
+            <h4>Total: <%=issues.size%></h4>
+            <% issues.each_with_index do |issue, i|%>
+            <p>
+                <h5>[<%=i+1%>] <%= issue.name %> ( Severity: <%= issue.severity %> )</h5>
+                     In <%= issue.elem %>
+
+                     <% if issue.var%>
+                     input <em><%= issue.var %></em>
+                     <%end%>
+
+                     <% if issue.method %>
+                     using <%= issue.method %>
+                     <%end%>
+
+                     at <a href="<%= issue.url %>"><%= issue.url %></a>.
+                     <br/>
+
+                 <% if (issue.variations[0]['response'] && !issue.variations[0]['response'].empty?) && issue.variations[0]['regexp_match'] %>
+
+                 <div style="display: none" id="inspection-dialog_<%=i%>" title="Relevant content is shown in red.">
+                     <% match = CGI.escapeHTML( issue.variations[0]['regexp_match'] )%>
+                     <pre> <%=CGI.escapeHTML( issue.variations[0]['response'] ).gsub( match, '<strong style="color: red">' + match + '</strong>' ) %> </pre>
+                 </div>
+
+                 <form style="display:inline" action="#">
+                     <input onclick="javascript:inspect( '#inspection-dialog_<%=i%>')" type="button" value="Inspect" />
+                 </form>
+
+                 <%end%>
+
+
+                 <% if issue.method && (issue.elem.downcase == 'form' || issue.elem.downcase == 'link' ) &&
+                       ( issue.method.downcase == 'get' || issue.method.downcase == 'post' ) %>
+                    <form style="display:inline" action="<%=issue.url%>" target="_blank" method="<%=issue.method.downcase%>">
+                        <% if issue.variations[0]['opts'][:combo]%>
+                            <%issue.variations[0]['opts'][:combo].each_pair do |name, value|%>
+                                <input type="hidden" name="<%=escape(name)%>" value="<%=escape( value )%>" />
+                            <%end%>
+                        <%end%>
+                        <input type="submit" value="Replay" />
+                    </form>
+                 <%end%>
+
+            </p>
+            <%end%>
+
+        <%else%>
+            <h4> Nothing yet, once something is found you'll be the first to know...</h4>
+        <%end%>

data/lib/ui/web/server/views/plugins.erb

@@ -0,0 +1,42 @@
+
+        <form action="/plugins" method="post">
+
+            <%= csrf_tag %>
+            <div id="page-intro">
+                <h2>Plugins</h2>
+                <p>
+                    Plugin components extend the functionality of the framework in abstract ways.
+                <br/>
+                <br/>
+                </p>
+                <p>
+                    <input type="button" onclick="javascript:checkAll( 'plugin' );" value="Check all"/>
+                    <input type="button" onclick="javascript:uncheckAll( 'plugin' );" value="Uncheck all"/>
+                    <input type="submit" value="Save" />
+                </p>
+            </div>
+
+            <%= erb :flash, {:layout => false} %>
+            <% plugins.each do |plugin|%>
+                <fieldset>
+                    <legend>
+                        <input <%if plugin_has_required_file_option?( plugin['options'] )%> disabled="disabled" <%end%> type="checkbox" class="plugin" name="plugins[<%=plugin['plug_name']%>]"
+                        <% if session['opts']['plugins'] && session['opts']['plugins'].include?( plugin['plug_name'] ) %> checked="checked" <% end %> />
+                        <%=plugin['name']%>
+                        <%if plugin_has_required_file_option?( plugin['options'] )%>
+                        <em> (This plugin requires an option type which is not yet supported by the WebUI)</em>
+                        <%end%>
+                    </legend>
+                <h5>Description</h5>
+                <pre class="notice"> <%=prep_description( escape( plugin['description'] ) )%></pre>
+
+                <%= erb :options, { :layout => false }, :component => plugin%>
+
+                <p>
+                    <strong>Version:</strong> <%=plugin['version']%><br/>
+                    <strong>Author:</strong> <%=escape( plugin['author'])%>
+                </p>
+                </fieldset>
+            <% end %>
+
+        </form>

data/lib/ui/web/server/views/report_formats.erb

@@ -0,0 +1,30 @@
+
+            <%= erb :flash, {:layout => false} %>
+
+            <%= csrf_tag %>
+            <div id="page-intro">
+                <h2>Report formats</h2>
+                <p>
+                    This page lists all available report formats.
+                <br/>
+                <br/>
+                </p>
+
+                <form action="/reports" method="get">
+                    <input type="submit" value="Back to reports" />
+                </form>
+
+            </div>
+
+            <% reports.each do |report|%>
+                <fieldset>
+                <h3><%=escape( report['name'] )%></h3>
+                <h4>Description</h4>
+                <div class="notice"> <%=escape( report['description'] )%></div>
+
+                <p>
+                    <strong>Version:</strong> <%=report['version']%><br/>
+                    <strong>Author:</strong> <%=escape( report['author'])%>
+                </p>
+                </fieldset>
+            <% end %>

data/lib/ui/web/server/views/reports.erb

@@ -0,0 +1,55 @@
+
+        <div id="page-intro">
+            <h2>Reports</h2>
+            <p>This page allows you to review the results of the scans you have performed and export them in various formats.
+            <br/><br/>
+            </p>
+
+            <% if report_count > 0 %>
+                <form action="/reports/formats" method="get">
+                    <input type="submit" value="View formats" />
+                </form>
+
+                <form action="/reports/delete" method="post">
+                    <%= csrf_tag %>
+                    <input type="submit" value="Delete all" />
+                </form>
+            <% end %>
+
+        </div>
+        <%= erb :flash, {:layout => false} %>
+
+        <% if !reports.empty? %>
+        <table>
+            <tr>
+                <th>Host</th>
+                <th>Audit date</th>
+                <th>Report formats</th>
+            </tr>
+        <% reports.each do |report| %>
+            <tr>
+
+
+                <td><%=report['host']%></td>
+                <td><%=report['date']%></td>
+
+                <td>
+                    <ul class="reports">
+                    <% available.each do |avail| %>
+                    <li><a href="/report/<%=CGI.escape(report['name'])%>.<%=avail['rep_name']%>"><%=escape(avail['name'])%></a></li>
+                    <%end%>
+                    </ul>
+                </td>
+
+                <td>
+                    <form action="/report/<%=CGI.escape(report['name'])%>/delete" method="post">
+                        <%= csrf_tag %>
+                        <input type="submit" value="Delete" />
+                    </form>
+                </td>
+            </tr>
+        <% end %>
+        </table>
+        <% else %>
+        <span class="notice"> There are no available reports at the moment.</span>
+        <% end %>

data/lib/ui/web/server/views/settings.erb

@@ -0,0 +1,120 @@
+    <script type="text/javascript">
+        $(function() {
+            $( "#slider" ).slider({
+                value: <%=session['opts']['settings']['http_req_limit']%>,
+                min: 1,
+                max: 200,
+                step: 1,
+                slide: function( event, ui ) {
+                    $( "#http_req_limit" ).val( ui.value );
+                }
+            });
+            $( "#http_req_limit" ).val( $( "#slider" ).slider( "value" ) );
+        });
+    </script>
+
+        <form action="/settings" method="post" enctype="multipart/form-data">
+
+                <%= csrf_tag %>
+                <div id="page-intro">
+                    <h2>Settings</h2>
+                    <p>General settings regarding the internals of the Arachni Framework.
+                        <br/>
+                        <br/>
+                     </p>
+                    <p>
+                        <input type="submit" class="reset" value="Save" />
+                    </p>
+                </div>
+
+            <%= erb :flash, {:layout => false} %>
+
+            <div class="left options">
+                <fieldset>
+                    <legend>Auditor</legend>
+                    <p>
+                        Audit links: <input type="checkbox" name="audit_links" <% if session['opts']['settings']['audit_links'] == true %> checked="checked" <% end %> />
+                    </p>
+                    <p>
+                        Audit forms: <input type="checkbox" name="audit_forms" <% if session['opts']['settings']['audit_forms'] == true %> checked="checked" <% end %> />
+                    </p>
+                    <p>
+                        Audit cookies: <input type="checkbox" name="audit_cookies" <% if session['opts']['settings']['audit_cookies'] == true %> checked="checked" <% end %> />
+                    </p>
+                    <p>
+                        Audit headers: <input type="checkbox" name="audit_headers" <% if session['opts']['settings']['audit_headers'] == true %> checked="checked" <% end %> />
+                    </p>
+                    <p>
+                        Cookies to exclude: <textarea rows="2" cols="20" name="exclude_cookies"><%=session['opts']['settings']['exclude_cookies']%></textarea>
+                        <br/>(Newline separated)
+                    </p>
+                </fieldset>
+
+                <fieldset>
+                    <legend>HTTP options</legend>
+                    <p>
+                        Cocurrent HTTP request limit: <label for="http_req_limit"></label>
+                                                      <input id="http_req_limit" name="http_req_limit"/>
+                        <div id="slider"></div>
+                        <br/>
+                    </p>
+                    <p>
+                        HTTP harvest last: <input type="checkbox" name="http_harvest_last" <% if session['opts']['settings']['http_harvest_last'] == true %> checked="checked" <% end %> />
+                    </p>
+                    <p>
+                        Cookie jar: <input type="file" name="cookiejar" size="25" />
+                    </p>
+                    <p>
+                        User agent: <input name="user_agent" value="<%=session['opts']['settings']['user_agent']%>"/>
+                    </p>
+                    <p>
+                        Authorized by: <input name="authed_by" value="<%=session['opts']['settings']['authed_by']%>"/>
+                    </p>
+
+                </fieldset>
+            </div>
+
+            <div class="right options">
+
+                <fieldset>
+                    <legend>Crawler options</legend>
+                    <p>
+                        Exclude rules: <textarea rows="2" cols="20" name="exclude"><% if session['opts']['settings']['exclude']%><%=session['opts']['settings']['exclude'].join( "\r\n" )%><%end%></textarea>
+                        <br/>(Newline separated)
+                    </p>
+                    <p>
+                    Include rules: <textarea rows="2" cols="20" name="include"><% if session['opts']['settings']['include']%><%=session['opts']['settings']['include'].join( "\r\n" )%><%end%></textarea>
+                        <br/>(Newline separated)
+                    </p>
+                    <p>
+                        Redundant rules: <textarea rows="2" cols="20" name="redundant"><%=format_redundants( session['opts']['settings']['redundant'] )%></textarea>
+                    <br/>(Newline separated)
+                    <br/>(<em>regexp:counter</em>)
+                    </p>
+                    <p>
+                        Depth: <input name="depth_limit" value="<%=session['opts']['settings']['depth_limit']%>"/>
+                        <br/>(Default: infinite)
+                    </p>
+                    <p>
+                        Link count limit: <input name="link_count_limit" value="<%=session['opts']['settings']['link_count_limit']%>"/>
+                        <br/>(Default: infinite)
+                    </p>
+                    <p>
+                        Redirect limit: <input name="redirect_limit" value="<%=session['opts']['settings']['redirect_limit']%>"/>
+                        <br/>(Default: infinite)
+                    </p>
+                    <p>
+                        Follow subdomain: <input type="checkbox" name="follow_subdomains" <% if session['opts']['settings']['follow_subdomains'] == true %> checked="checked" <% end %> />
+                    </p>
+                    <p>
+                        Obey robot.txt file: <input type="checkbox" name="obey_robots_txt" <% if session['opts']['settings']['obey_robots_txt'] == true %> checked="checked" <% end %> />
+                    </p>
+                    <p>
+                        Spider first: <input type="checkbox" name="spider_first" <% if session['opts']['settings']['spider_first'] == true %> checked="checked" <% end %> />
+                    </p>
+                </fieldset>
+
+            </div>
+
+        </form>
+

data/lib/ui/web/server/views/welcome.erb

@@ -0,0 +1,38 @@
+
+            <div id="page-intro">
+                <h2>Welcome to the Arachni WebUI v<%=Arachni::UI::Web::VERSION%>.</h2>
+                <p>Pardon the splash-screen, it's an one-time thing, but you really <strong>should</strong> read this stuff.</p>
+            </div>
+
+            <h2>General</h2>
+            <p>
+                This is the first version of this UI, scratch that, it's not even a real version..hence the "pre".<br/>
+                In the software world this means that the WebUI may empty your fridge, drink all your coffee, eat your puppy, slash your tires and/or burn down your house.<br/>
+                Nevertheless, I'd appreciate it if you gave it a shot and <a href="https://github.com/Zapotek/arachni/issues">let me know</a> if you find anything wrong with it.
+            </p>
+
+            <h2>What it is</h2>
+            <p>
+                It is a way to:
+                <ul>
+                    <li>make working with Arachni easier</li>
+                    <li>make report management easier</li>
+                    <li>run and manage multiple scans at the same time <em>(each scan will try its best for maximum bandwidth utilization so it'll be like lions fighting in a cage -- make sure you have sufficient resources)</em></li>
+                </ul>
+            </p>
+
+            <h2>What it isn't (yet)</h2>
+            <p>
+                It isn't:
+                <ul>
+                    <li>stable</li>
+                    <li>a way to make Arachni's goodies available to multiple users <em>(you could but it wouldn't be safe)</em></li>
+                    <li>a way to work with and manage multiple Dispatchers <em>(you can clear your session cookies to force the WebUI to ask you for a new Dispatcher to connect to but there are no guarantees)</em></li>
+                </ul>
+            </p>
+
+            <h2>What now</h2>
+            <p>
+                Now you can enjoy this system, everything is fairly user friendly and intuitive so you shouldn't have a problem.<br/>
+                This page won't bother you again, go ahead and take a look around.
+            </p>