arachni 0.2.4 → 0.3

data/lib/ui/web/addons/autodeploy/views/index.erb

@@ -0,0 +1,124 @@
+
+        <div>
+
+            <form action="<%=root%>/" method="post">
+                <h2>Perform a new deployment</h2>
+                <br/>
+
+                <fieldset>
+                    <legend>SSH options:</legend>
+                    Host: <input name="host" />
+                    Port: <input name="port" value="22" size="4" />
+                    Username: <input name="username" />
+                    Password (will not be stored): <input name="password" type="password" />
+                </fieldset>
+                <br/>
+
+                <fieldset>
+                    <legend>Dispatcher options:</legend>
+                    Port: <input name="dispatcher_port" value="7331" />
+                </fieldset>
+                <br/>
+
+                <%= csrf_tag %>
+                <input type="submit" value="Add" />
+            </form>
+
+            <% if show_output || !ret.empty? %>
+            <br/>
+            <h3>Output</h3>
+            <b>Status: <span id="status"><%=ret[:status]%></span></b>
+            <br/>
+            <pre id="output" style="max-height: 400px; overflow: scroll"><%=ret[:output]%></pre>
+            <% end %>
+
+        </div>
+
+
+        <% if !deployments.empty? %>
+        <br/>
+        <br/>
+
+        <i>(Shutting down a Dispatcher will terminate all its running scans.)</i>
+        <table>
+            <tr>
+                <th>ID</th>
+                <th>Host</th>
+                <th>SSH Port</th>
+                <th>Dispatcher port</th>
+                <th>Username</th>
+                <th>Password</th>
+                <th>Running?</th>
+                <th>Created at</th>
+                <th>Action</th>
+            </tr>
+        <% deployments.each do |dep| %>
+            <tr>
+
+                <form action="<%=root%>/<%=dep.id%>" method="post">
+                    <td><%=dep.id%></td>
+                    <td><%=dep.host%></td>
+                    <td><%=dep.port%></td>
+                    <td><%=dep.dispatcher_port%></td>
+                    <td><%=dep.user%></td>
+                    <td><input name="password" type="password" /></td>
+                    <td><%=is_alive = dispatchers.alive?( 'https://' + dep.host + ':' + dep.dispatcher_port )%></td>
+                    <td><%=dep.created_at%></td>
+                    <td>
+                        <%= csrf_tag %>
+                        <input type="hidden" name="id" value="<%=dep.id%>">
+
+                        <% if !is_alive%>
+                            <input type="radio" name="action" value="run"> Run <br/>
+                        <%else%>
+                            <input type="radio" name="action" value="shutdown"> Shutdown <br/>
+                        <%end%>
+                        <input type="radio" name="action" value="delete"> Uninstall & Delete <br/>
+
+                        <input type="submit" value="Submit">
+                    </td>
+                </form>
+            </tr>
+        <% end %>
+        </table>
+        <% else %>
+        <p class="notice">There are no deployments at the moment.</p>
+        <% end %>
+
+        <% if show_output%>
+        <script type="text/javascript">
+            //<![CDATA[
+
+            function updateOutput() {
+                if( !document.getElementById( 'output' ) ) return;
+
+                var output_url = "<%=root%>/channel/<%=channel%>";
+                $.getJSON( output_url, function(data) {
+                    if( data.status == 'finished' ) {
+                        window.location.replace( "<%=root%>/channel/<%=channel%>/finalize" );
+                    } if( data.status == 'failed' ) {
+                        document.getElementById( 'status' ).innerHTML = data.status;
+                        obj = document.getElementById( 'output' );
+                        obj.innerHTML = data.output;
+                    } else {
+
+                        document.getElementById( 'status' ).innerHTML = data.status;
+
+                        obj = document.getElementById( 'output' );
+                        obj.innerHTML = data.output;
+                        obj.scrollTop = obj.scrollHeight;
+                    }
+                });
+            }
+
+            $( document ).ready(function() {
+
+                updateOutput( );
+                setInterval( function() {
+                      updateOutput( );
+                }, 1500 );
+
+            })
+             //]]>
+        </script>
+        <%end%>

data/lib/ui/web/addons/sample.rb

@@ -0,0 +1,78 @@
+=begin
+                  Arachni
+  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+
+  This is free software; you can copy and distribute and modify
+  this program under the term of the GPL v2.0 License
+  (See LICENSE file for details)
+
+=end
+
+module Arachni
+module UI
+module Web
+module Addons
+
+#
+#
+# Sample add-on, see the code for examples.
+#
+# @author: Tasos "Zapotek" Laskos
+#                                      <tasos.laskos@gmail.com>
+#                                      <zapotek@segfault.gr>
+#
+# @see http://www.sinatrarb.com/intro.html
+#
+# @version: 0.1
+#
+class Sample < Base
+
+    #
+    # This method gets fired when the plugin is loaded.
+    #
+    def run
+
+        #
+        # You can work with get/post/put/delete handlers just like
+        # when using Sinatra.
+        #
+        get '/' do
+
+            #
+            # From inside the block you have access to regular Sinatra stuff
+            # like sessions, helpers etc.
+            #
+
+            # session   => Direct access to the session, *be careful!*.
+            # settings  => Direct access to the Sinatra methods, attributes, etc.
+
+            # You can treat 'present' just like 'erb' with a default layout.
+            present :index, :msg => 'world'
+        end
+
+    end
+
+    #
+    # This optional method allows you to specify the title which will be
+    # used for the menu (in case you want it to be dynamic).
+    #
+    def title
+        'Sample'
+    end
+
+    def self.info
+        {
+            :name           => 'Sample add-on',
+            :description    => %q{This add-on serves as an example/tutorial.},
+            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
+            :version        => '0.1'
+        }
+    end
+
+
+end
+
+end
+end
+end
+end

data/lib/ui/web/addons/sample/views/index.erb

@@ -0,0 +1,4 @@
+
+<p>
+    Hello <%=msg%>!
+</p>

data/lib/ui/web/addons/scheduler.rb

@@ -0,0 +1,139 @@
+=begin
+                  Arachni
+  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+
+  This is free software; you can copy and distribute and modify
+  this program under the term of the GPL v2.0 License
+  (See LICENSE file for details)
+
+=end
+
+module Arachni
+module UI
+module Web
+module Addons
+
+#
+#
+# Scheduler add-on.
+#
+# @author: Tasos "Zapotek" Laskos
+#                                      <tasos.laskos@gmail.com>
+#                                      <zapotek@segfault.gr>
+#
+# @version: 0.1
+#
+class Scheduler < Base
+
+    def run
+
+        get "/" do
+            present :index,
+                :jobs => scheduler.jobs( :order => :created_at.desc ),
+                # we need to get our context via "addons.running['scheduler']"
+                # which is, essentially, this class.
+                :root => current_addon.path_root
+        end
+
+        post '/' do
+            valid = true
+
+            begin
+                URI.parse( params['url'] )
+            rescue
+                valid = false
+            end
+
+            if !params['url'] || params['url'].empty? || !valid
+                flash[:err] = "Invalid URL."
+            elsif !params['dispatcher'] || params['dispatcher'].empty?
+                flash[:err] = "Please select a Dispatcher."
+            else
+
+                session['opts']['settings']['url'] = params[:url]
+
+                unescape_hash( session['opts'] )
+                session['opts']['settings']['audit_links']   = true if session['opts']['settings']['audit_links']
+                session['opts']['settings']['audit_forms']   = true if session['opts']['settings']['audit_forms']
+                session['opts']['settings']['audit_cookies'] = true if session['opts']['settings']['audit_cookies']
+                session['opts']['settings']['audit_headers'] = true if session['opts']['settings']['audit_headers']
+
+                opts = {}
+                opts['settings'] = prep_opts( session['opts']['settings'] )
+                opts['plugins']  = YAML::load( session['opts']['plugins'] )
+                opts['modules']  = session['opts']['modules']
+
+                if params[:datetime] && !params[:datetime].empty?
+
+                    job = Arachni::UI::Web::Scheduler::Job.new(
+                        :dispatcher  => params[:dispatcher],
+                        :url         => params[:url],
+                        :opts        => opts.to_yaml,
+                        :owner_addr  => env['REMOTE_ADDR'],
+                        :owner_host  => env['REMOTE_HOST'],
+                        :created_at  => Time.now
+                    )
+
+                    begin
+                        job.datetime = parse_datetime( params[:datetime] )
+
+                        if !job.valid?
+                            flash[:err] = 'Job holds invalid data, skipping...'
+                        else
+                            job.save
+                            flash[:ok] = "Job saved."
+                        end
+                    rescue Exception => e
+                        flash[:err] = 'Could not parse date (' + e.to_s + ').'
+                    end
+
+                else
+                    flash[:err] = 'Date cannot be empty.'
+                end
+            end
+
+            present :index,
+                :jobs => scheduler.jobs( :order => :created_at.desc ),
+                # we need to get our context via "addons.running['scheduler']"
+                # which is, essentially, this class.
+                :root => current_addon.path_root
+
+
+        end
+
+        post '/delete' do
+            scheduler.delete_all
+            log.scheduler_jobs_deleted( env )
+
+            redirect addons.running['scheduler'].path_root + '/'
+        end
+
+        post '/:id/delete' do
+            scheduler.delete( params[:id] )
+            log.scheduler_job_deleted( env, params[:id] )
+
+            redirect addons.running['scheduler'].path_root + '/'
+        end
+
+    end
+
+    def title
+        "Scheduler [#{settings.scheduler.jobs.size}]"
+    end
+
+    def self.info
+        {
+            :name           => 'Scheduler',
+            :description    => %q{Schedules and runs scan jobs.},
+            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
+            :version        => '0.1'
+        }
+    end
+
+
+end
+
+end
+end
+end
+end

data/lib/ui/web/addons/scheduler/views/index.erb

@@ -0,0 +1,131 @@
+
+            <% if !jobs.empty? %>
+                <form action="<%=root%>/delete" method="post">
+                    <%= csrf_tag %>
+                    <input type="submit" value="Delete all" />
+                </form>
+            <% end %>
+
+        <div>
+
+            <form action="<%=root%>/" method="post">
+                <h2>Schedule a scan</h2>
+
+                <i>You can configure the scan parameters just like you normally would.</i>
+                <br/>
+
+                Select a Dispatcher:
+                <select name="dispatcher">
+                <% if !dispatchers.first_alive%>
+                        <option value="">None available, please add a Dispatcher to continue.</option>
+                <%else%>
+                    <% dispatcher_stats.each_pair do |d_url, stats| %>
+                        <% next if !dispatchers.alive?( d_url ) %>
+                        <option value="<%=d_url%>">
+                            @<%=escape( d_url )%> - <%=stats['running_jobs'].size%> running scans,
+                             <%=i=0;stats['running_jobs'].each{ |job| i+= proc_mem( job['proc']['rss'] ).to_i }; i.to_s%>MB RAM usage.
+                        </option>
+                    <%end%>
+                <%end%>
+                </select>
+
+                URL: <input name="url" value="<%=session['opts']['settings']['url']%>" size="50" <% if !dispatchers.first_alive%>  disabled="disabled"<%end%> />
+                Schedule for: <input id="datetime" name="datetime" <% if !dispatchers.first_alive%>  disabled="disabled"<%end%> />
+
+                <%= csrf_tag %>
+                <input type="submit" value="Add" <% if !dispatchers.first_alive%>  disabled="disabled"<%end%> />
+
+            </form>
+        </div>
+
+
+        <% if !jobs.empty? %>
+        <table>
+            <tr>
+                <th>ID</th>
+                <th>Dispatcher</th>
+                <th>Target</th>
+                <th>Starts at</th>
+                <th>Created by</th>
+                <th>Created at</th>
+            </tr>
+        <% jobs.each do |job| %>
+            <tr>
+
+
+                <td><%=job.id%></td>
+                <td><%=job.dispatcher%></td>
+                <td><%=job.url%></td>
+                <td><%=job.datetime%></td>
+                <td><%=job.owner_host%> (<%=job.owner_addr%>)</td>
+                <td><%=job.created_at%></td>
+                <td>
+                    <form action="<%=root%>/<%=job.id%>/delete" method="post">
+                        <%= csrf_tag %>
+                        <input type="submit" value="Delete" />
+                    </form>
+
+                    <form action="#" onsubmit="showDialog( '#dialog_options_<%=job.id%>' ); return;" >
+                        <input type="submit" value="Options" />
+                    </form>
+
+                    <form action="#" onsubmit="showDialog( '#dialog_modules_<%=job.id%>' ); return;" >
+                        <input type="submit" value="Modules" />
+                    </form>
+
+                    <form action="#" onsubmit="showDialog( '#dialog_plugins_<%=job.id%>' ); return;" >
+                        <input type="submit" value="Plugins" />
+                    </form>
+
+                </td>
+            </tr>
+            <tr>
+
+                <% stored_opts = YAML::load( job.opts ); opts = stored_opts['settings'] %>
+
+                <%=partial :options, :job => job, :opts => opts %>
+
+                <div style="display: none" id="dialog_modules_<%=job.id%>" title="Modules">
+                    <p>
+                        <ul>
+                            <% stored_opts['modules'].each do |name| %>
+                            <li><%=name%></li>
+                            <%end%>
+                        </ul>
+                    </p>
+
+                </div>
+
+                <div style="display: none" id="dialog_plugins_<%=job.id%>" title="Plugins">
+                    <p>
+                        <ul>
+                            <% stored_opts['plugins'].each do |plugin| %>
+                            <li><%=plugin[0]%></li>
+                            <%end%>
+                        </ul>
+                    </p>
+
+                </div>
+
+
+            </tr>
+        <% end %>
+        </table>
+        <% else %>
+        <p class="notice"> There are no scheduled scans at the moment.</p>
+        <% end %>
+
+            <script type="text/javascript">
+                //<![CDATA[
+
+                $('#datetime').datetimepicker();
+
+                function showDialog( id ){
+                    $( id ).dialog({
+                        height: 500,
+                        width: 1000,
+                        modal: true
+                    });
+                }
+             //]]>
+            </script>