arachni 0.2.2.1

data/modules/recon/backdoors/filenames.txt

@@ -0,0 +1,16 @@
+r57shell.php
+r57.php
+c99shell.php
+c99.php
+nstview.php
+nst.php
+rst.php
+r57eng.php
+shell.php
+r.php
+lol.php
+zehir.php
+c-h.v2.php
+php-backdoor.php
+simple-backdoor.php
+cmdasp.asp

data/modules/recon/backup_files.rb

@@ -0,0 +1,177 @@
+=begin
+                  Arachni
+  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+
+  This is free software; you can copy and distribute and modify
+  this program under the term of the GPL v2.0 License
+  (See LICENSE file for details)
+
+=end
+
+module Arachni
+
+module Modules
+
+#
+# Backup file discovery module.
+#
+# Appends common backup extesions to the filename of the page under audit<br/>
+# and checks for its existence.
+#
+# @author: Tasos "Zapotek" Laskos
+#                                      <tasos.laskos@gmail.com>
+#                                      <zapotek@segfault.gr>
+# @version: 0.1.5
+#
+#
+class BackupFiles < Arachni::Module::Base
+
+    include Arachni::Module::Utilities
+
+    def initialize( page )
+        super( page )
+    end
+
+    def prepare
+        # to keep track of the requests and not repeat them
+        @@__audited ||= Set.new
+
+        # our results array
+        @results = []
+
+        @@__extensions ||=[]
+        return if !@@__extensions.empty?
+
+        read_file( 'extensions.txt' ) {
+            |file|
+            @@__extensions << file
+        }
+    end
+
+    def run( )
+
+        filename = File.basename( URI( normalize_url( @page.url ) ).path )
+        path     = get_path( @page.url )
+
+        return if @@__audited.include?( path )
+
+        print_status( "Scanning..." )
+
+        if( !filename  )
+            print_info( 'Backing out. ' +
+              'Can\'t extract filename from url: ' + @page.url )
+            return
+        end
+
+        @@__extensions.each {
+            |ext|
+
+            #
+            # Test for the existance of the file + extension.
+            #
+
+            file = ext % filename # Example: index.php.bak
+            url  = path + file
+            next if !( req1 = __request_once( url ) )
+
+
+            req1.on_complete {
+                |res|
+                __log_results( res, file )
+            }
+
+            file = ext % filename.gsub( /\.(.*)/, '' ) # Example: index.bak
+            url  = path + file
+            next if !( req2 = __request_once( url ) )
+
+            req2.on_complete {
+                |res|
+                __log_results( res, file )
+            }
+        }
+
+        @@__audited << path
+    end
+
+
+    def self.info
+        {
+            :name           => 'BackupFiles',
+            :description    => %q{Tries to find sensitive backup files.},
+            :elements       => [ ],
+            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
+            :version        => '0.1.5',
+            :references     => {},
+            :targets        => { 'Generic' => 'all' },
+            :issue   => {
+                :name        => %q{A backup file exists on the server.},
+                :description => %q{},
+                :tags        => [ 'path', 'backup', 'file' ],
+                :cew         => '530',
+                :severity    => Issue::Severity::HIGH,
+                :cvssv2       => '',
+                :remedy_guidance    => '',
+                :remedy_code => '',
+            }
+
+        }
+    end
+
+    #
+    # Adds an issue to the @results array<br/>
+    # and outputs an "OK" message with the filename and its url.
+    #
+    # @param  [Net::HTTPResponse]  res   the HTTP response
+    # @param  [String]  filename   the discovered filename
+    #
+    def __log_results( res, filename )
+
+        # some webapps disregard the extension and load the page anyway
+        # which will lead to false positives, take care of that.
+        return if res.body == @page.html
+
+        return if( res.code != 200 || @http.custom_404?( res ) )
+
+        url = res.effective_url
+        # append the result to the results array
+        @results << Issue.new( {
+            :url          => url,
+            :injected     => filename,
+            :id           => filename,
+            :elem         => Issue::Element::PATH,
+            :response     => res.body,
+            :headers      => {
+                :request    => res.request.headers,
+                :response   => res.headers,
+            }
+        }.merge( self.class.info ) )
+
+        # register our results with the system
+        register_results( @results )
+
+        # inform the user that we have a match
+        print_ok( "Found #{filename} at " + url )
+    end
+
+    #
+    # Gets a URL only once
+    #
+    # @param  [String]  url   the url to get
+    #
+    # @return  [FalseClass/HTTPResponse]   false if the url has been
+    #                                          previously requested,<br/>
+    #                                          the HTTPResponse otherwise
+    #
+    def __request_once( url )
+
+        print_status( "Checking for #{url}" )
+
+        # force the Trainer to analyze it and if it's HTML it'll extract any new attack vectors.
+        req  = @http.get( url, :train => true )
+
+        return req
+    end
+
+end
+end
+end

data/modules/recon/backup_files/extensions.txt

@@ -0,0 +1,28 @@
+%s.old
+%s.OLD
+%s.bak
+%s.BAK
+%s.zip
+%s.ZIP
+%s.gz
+%s.tar.gz
+%s.temp
+%s.save
+%s.orig
+%s.backup
+%s.000
+%s~
+%s~1
+%s.cs
+%s.pas
+%s.vb
+%s.java
+%s.class
+%s.sav
+%s.saved
+%s.rar
+%s.src
+%s.tmp
+%s.inc
+%s.copy
+Copy%%20of%%20%s

data/modules/recon/common_directories.rb

@@ -0,0 +1,138 @@
+=begin
+                  Arachni
+  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+
+  This is free software; you can copy and distribute and modify
+  this program under the term of the GPL v2.0 License
+  (See LICENSE file for details)
+
+=end
+
+require 'digest/sha1'
+
+module Arachni
+
+module Modules
+
+#
+# Common directories discovery module.
+#
+# Looks for common, possibly sensitive, directories on the server.
+#
+# @author: Tasos "Zapotek" Laskos
+#                                      <tasos.laskos@gmail.com>
+#                                      <zapotek@segfault.gr>
+# @version: 0.1.4
+#
+# @see http://cwe.mitre.org/data/definitions/538.html
+#
+#
+class CommonDirectories < Arachni::Module::Base
+
+    include Arachni::Module::Utilities
+
+    def initialize( page )
+        super( page )
+    end
+
+    def prepare
+        # to keep track of the requests and not repeat them
+        @@__audited ||= Set.new
+
+        # our results array
+        @results = []
+
+        @@__directories ||=[]
+        return if !@@__directories.empty?
+
+        read_file( 'directories.txt' ) {
+            |file|
+            @@__directories << file
+        }
+    end
+
+    def run( )
+
+        path = get_path( @page.url )
+        return if @@__audited.include?( path )
+
+        print_status( "Scanning..." )
+
+        @@__directories.each {
+            |dirname|
+
+            url  = path + dirname + '/'
+            print_status( "Checking for #{url}" )
+
+            req  = @http.get( url, :train => true )
+
+            req.on_complete {
+                |res|
+                print_status( "Analyzing #{res.effective_url}" )
+                __log_results( res, dirname )
+            }
+        }
+
+        @@__audited << path
+    end
+
+    def self.info
+        {
+            :name           => 'CommonDirectories',
+            :description    => %q{Tries to find common directories on the server.},
+            :elements       => [ ],
+            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
+            :version        => '0.1.4',
+            :references     => {},
+            :targets        => { 'Generic' => 'all' },
+            :issue   => {
+                :name        => %q{A common directory exists on the server.},
+                :description => %q{},
+                :tags        => [ 'path', 'directory', 'common' ],
+                :cwe         => '538',
+                :severity    => Issue::Severity::MEDIUM,
+                :cvssv2       => '',
+                :remedy_guidance    => '',
+                :remedy_code => '',
+            }
+
+        }
+    end
+
+    #
+    # Adds an issue to the @results array<br/>
+    # and outputs an "OK" message with the dirname and its url.
+    #
+    # @param  [Net::HTTPResponse]  res   the HTTP response
+    # @param  [String]  dirname   the discovered dirname
+    # @param  [String]  url   the url of the discovered file
+    #
+    def __log_results( res, dirname )
+
+        return if( res.code != 200 || @http.custom_404?( res ) )
+
+        url = res.effective_url
+        # append the result to the results array
+        @results << Issue.new( {
+            :url          => url,
+            :injected     => dirname,
+            :id           => dirname,
+            :elem         => Issue::Element::PATH,
+            :response     => res.body,
+            :headers      => {
+                :request    => res.request.headers,
+                :response   => res.headers,
+            }
+        }.merge( self.class.info ) )
+
+        # inform the user that we have a match
+        print_ok( "Found #{dirname} at " + url )
+
+        # register our results with the system
+        register_results( @results )
+
+    end
+
+end
+end
+end

data/modules/recon/common_directories/directories.txt

@@ -0,0 +1,265 @@
+_private
+_vti_bin
+cgi-bin
+cgi-sys
+mailman
+iishelp
+iisadmin
+uploader
+uploads
+tsweb
+query
+recent
+cache
+common
+wp-content
+shell
+readme
+main
+logfiles
+index
+default
+details
+example
+examples
+send
+settings
+feedback
+global
+globals
+guestbook
+admin_
+admin_login
+admin_logon
+adminlogon
+client
+clients
+cmd
+INSTALL_admin
+incomming
+upload
+backend
+webmail
+WebService
+aspnet
+Exchange
+usage
+WebApplication1
+WebApplication2
+WebApplication3
+sign
+signup
+scans
+webaccess
+restricted
+blog
+pics
+_logs
+_errors
+_tests
+.adm
+.admin
+~admin
+secret
+owa
+db2
+mrtg
+other
+accounts
+warez
+my
+cc
+creditcards
+contact
+press
+p0rn
+pron
+pron
+new%20folder
+New%20Folder
+oldfiles
+old_files
+sysbackup
+temp
+code
+secure
+secured
+staff
+src
+manage
+personal
+publish
+system
+work
+tests
+stuff
+mail
+email
+php
+jsp
+dev
+devel
+development
+tools
+share
+update
+updates
+util
+utils
+register
+search
+service
+services
+report
+reports
+purchase
+retail
+reseller
+app
+beta
+boot
+bug
+bugs
+buy
+auth
+authadmin
+import
+apps
+application
+access-log
+catalog
+cert
+crypto
+cfdocs
+classes
+cdrom
+css
+doc
+docs
+download
+downloads
+down
+excel
+forum
+etc
+help
+prv
+source
+backup
+bak
+old
+include
+inc
+info
+dat
+data
+test
+tmp
+save
+archive
+marketing
+pass
+passwd
+passwords
+password
+jdbc
+files
+site
+files
+sales
+log
+logs
+login
+logon
+logfile
+guests
+root
+htdocs
+account
+sql
+file
+setup
+website
+conf
+config
+install
+installer
+shop
+private
+fpadmin
+administrator
+intranet
+inventory
+webadmin
+employees
+accounting
+tree
+pages
+users
+access
+library
+database
+html
+bin
+Admin_files
+credit
+public
+dbase
+priv
+customer
+customers
+asp
+java
+jdbc
+jrun
+job
+zipfiles
+pw
+public
+admin
+new
+adm
+oracle
+odbc
+mall_log_files
+WebTrend
+order
+support
+msql
+user
+demo
+demos
+bkup
+mp3
+db
+ftp
+ibill
+incoming
+member
+members
+orders
+sample
+samples
+scripts
+stats
+sitestats
+support
+www
+errors
+siteadmin
+backups
+testing
+internal
+~home
+home
+~guest
+~nobody
+export
+testweb
+~log
+error_log
+ccbill
+network
+xamp
+xampp
+lamp