arachni 0.3 → 0.4

data/lib/{module → arachni/module}/base.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -63,7 +63,7 @@ class Base
 
         @page  = page
         @http  = Arachni::HTTP.instance
-        @http.trainer.page = @page.dup
+        @http.trainer.set_page( @page )
 
         # update the cookies
         if( !@page.cookiejar.empty? )
@@ -96,7 +96,7 @@ class Base
     #
     # It provides you with a way to setup your module's data and methods.
     #
-    def prepare( )
+    def prepare
     end
 
     #
@@ -104,7 +104,7 @@ class Base
     #
     # This is used to deliver the module's payload whatever it may be.
     #
-    def run( )
+    def run
     end
 
     #
@@ -112,20 +112,14 @@ class Base
     #
     # This is called after run() has finished executing,
     #
-    def clean_up( )
+    def clean_up
     end
 
     #
-    # ABSTRACT - OPTIONAL
-    #
-    # Prevents auditting elements that have been previously
-    # logged by any of the modules returned by this method.
-    #
-    # @return   [Array]     module names
+    # Returns the framework.
     #
-    def redundant
-        # [ 'sqli', 'sqli_blind_rdiff' ]
-        []
+    def framework
+        @framework
     end
 
     #
@@ -178,10 +172,6 @@ class Base
         }
     end
 
-    def register_results( results )
-        Arachni::Module::Manager.register_results( results )
-    end
-
     def set_framework( framework )
         @framework = framework
     end

data/lib/{module → arachni/module}/element_db.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -139,7 +139,7 @@ module ElementDB
 
                 if( page_cookie.raw['name'] == cookie.raw['name'] )
                     @@cookies[i] = cookie
-                else
+                elsif !cookie_in_jar?( cookie )
                     @new_cookies << cookie
                     cookie_cnt += 1
                 end
@@ -152,6 +152,14 @@ module ElementDB
         return [ @@cookies, cookie_cnt ]
     end
 
+    def cookie_in_jar?( cookie )
+        @@cookies.each {
+            |c|
+            return true if c.raw['name'] == cookie.raw['name']
+        }
+        return false
+    end
+
 end
 
 end

data/lib/{module → arachni/module}/key_filler.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License

data/lib/arachni/module/manager.rb

@@ -0,0 +1,145 @@
+=begin
+                  Arachni
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+
+  This is free software; you can copy and distribute and modify
+  this program under the term of the GPL v2.0 License
+  (See LICENSE file for details)
+
+=end
+
+module Arachni
+
+
+#
+# The namespace under which all modules exist
+#
+module Modules
+end
+
+module Module
+
+#
+# Arachni::Module::Manager class
+#
+# Holds and manages the modules and their results.
+#
+# @author: Tasos "Zapotek" Laskos
+#                                      <tasos.laskos@gmail.com>
+#                                      <zapotek@segfault.gr>
+# @version: 0.1.1
+#
+class Manager < Arachni::ComponentManager
+
+    include Arachni::UI::Output
+
+    @@results             ||= []
+    @@on_register_results ||= []
+    @@issue_set           ||= Set.new
+    @@do_not_store        ||= false
+    @@issue_mutex         ||= Mutex.new
+
+    #
+    # @param    [Arachni::Options]  opts
+    #
+    def initialize( opts )
+        super( opts.dir['modules'], Arachni::Modules )
+        @opts = opts
+    end
+
+    #
+    # Runs all modules against 'page'.
+    #
+    # @param    [::Arachni::Parser::Page]   page    page to audit
+    # @param    [::Arachni::Framework]   framework  to be assigned to modules
+    #
+    def run( page, framework = nil )
+        keys.each { |mod| run_one( mod, page, framework ) }
+    end
+
+    #
+    # Runs a single module against 'page'.
+    #
+    # @param    [::Arachni::Module::Base]   mod    module to run as a class
+    # @param    [::Arachni::Parser::Page]   page    page to audit
+    # @param    [::Arachni::Framework]   framework  to be assigned to the module
+    #
+    def run_one( mod, page, framework = nil )
+        mod_new = mod.new( page )
+        mod_new.set_framework( framework ) if framework
+        mod_new.prepare
+        mod_new.run
+        mod_new.clean_up
+    end
+
+    def self.on_register_results( &block )
+        @@on_register_results << block
+    end
+    def on_register_results( &block ) self.class.on_register_results( &block ) end
+
+
+    def self.do_not_store!
+        @@do_not_store = true
+    end
+    def do_not_store!() self.class.do_not_store! end
+
+    #
+    # Class method
+    #
+    # Registers module results with...well..us.
+    #
+    # @param    [Array]
+    #
+    def self.register_results( results )
+
+        @@on_register_results.each { |block| block.call( results ) }
+        return if @@do_not_store
+
+
+        @@issue_mutex.synchronize {
+            @@results |= results
+            results.each { |issue| @@issue_set << self.issue_set_id_from_issue( issue ) }
+        }
+    end
+    def register_results( results ) self.class.register_results( results ) end
+
+    def self.issue_set_id_from_issue( issue )
+        issue_url = URI( issue.url )
+        issue_url_str = issue_url.scheme + "://" + issue_url.host + issue_url.path
+        return "#{issue.mod_name}:#{issue.elem}:#{issue.var}:#{issue_url_str}"
+    end
+    def issue_set_id_from_issue( issue ) self.class.issue_set_id_from_issue( issue ) end
+
+
+    def self.issue_set_id_from_elem( mod_name, elem )
+        elem_url  = URI( elem.action )
+        elem_url_str  = elem_url.scheme + "://" + elem_url.host + elem_url.path
+
+        return "#{mod_name}:#{elem.type}:#{elem.altered}:#{elem_url_str}"
+    end
+    def issue_set_id_from_elem( mod_name, elem ) self.class.issue_set_id_from_elem( mod_name, elem ) end
+
+    def self.issue_set
+        @@issue_mutex.synchronize {
+            @@issue_set
+        }
+    end
+    def issue_set() self.class.issue_set end
+
+    #
+    # Class method
+    #
+    # Gets module results
+    #
+    # @param    [Array]
+    #
+    def self.results
+        @@issue_mutex.synchronize {
+            @@results
+        }
+    end
+    def results() self.class.results end
+
+end
+end
+end

data/lib/{module → arachni/module}/output.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -27,6 +27,7 @@ module Output
     include Arachni::UI::Output
 
     alias :o_print_error    :print_error
+    alias :o_print_bad      :print_bad
     alias :o_print_status   :print_status
     alias :o_print_info     :print_info
     alias :o_print_ok       :print_ok
@@ -38,6 +39,10 @@ module Output
         o_print_error( self.class.info[:name] + ": " + str )
     end
 
+    def print_bad( str = '', out = $stdout )
+        o_print_bad( self.class.info[:name] + ": " + str )
+    end
+
     def print_status( str = '' )
         o_print_status( self.class.info[:name] + ": " + str )
     end

data/lib/{module → arachni/module}/trainer.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -36,6 +36,12 @@ class Trainer
     def initialize
       @opts     = Options.instance
       @updated  = false
+
+      @pages = []
+    end
+
+    def set_page( page )
+        @page = page.deep_clone
     end
 
     #
@@ -56,28 +62,23 @@ class Trainer
         @parser.url = @page.url
 
         begin
-            url = res.effective_url
-            url = URI( to_absolute( url ) )
+            url = @parser.to_absolute( res.effective_url )
 
-            return if !follow?(  url )
-            return if ( redir && !follow?(  url ) )
+            return if !follow?( url )
 
             analyze( [ res, redir ] )
 
         rescue Exception => e
             print_error( "Invalid URL, probably broken redirection. Ignoring..." )
+            print_error( "URL: #{res.effective_url}" )
+            print_error_backtrace( e )
             raise e
         end
 
     end
 
     def follow?( url )
-        @parser.url = @page.url
-
-        return false if !@parser.in_domain?( url )
-        return false if @parser.exclude?( url )
-        return false if !@parser.include?( url )
-        return true
+        !@parser.skip?( url )
     end
 
     #
@@ -105,7 +106,7 @@ class Trainer
         print_debug( 'Started for response with request ID: #' +
           res[0].request.id.to_s )
 
-        @parser.url = res[0].effective_url.clone
+        @parser.url = @parser.to_absolute( url_sanitize( res[0].effective_url ) )
 
         train_cookies( res[0] )
 
@@ -120,57 +121,60 @@ class Trainer
         train_links( res[0], res[1] )
 
         if( @updated )
-            @page.html = res[0].body.dup
 
             begin
-                url           = res[0].request.url
+                url         = res[0].request.url
                 # prepare the page url
-                @parser.url = to_absolute( url )
+                @parser.url = @parser.to_absolute( url )
             rescue Exception => e
                 print_error( "Invalid URL, probably broken redirection. Ignoring..." )
-                # raise e
+
+                begin
+                    print_error( "URL: #{res[0].request.url}" )
+                rescue
+                end
+
+                print_error_backtrace( e )
+                return
             end
 
+            @page.html = res[0].body.dup
             @page.response_headers    = res[0].headers_hash
             @page.query_vars = @parser.link_vars( @parser.url ).dup
             @page.url        = @parser.url.dup
             @page.code       = res[0].code
             @page.method     = res[0].request.method.to_s.upcase
 
+            @page.forms      ||= []
+            @page.links      ||= []
+            @page.cookies    ||= []
+
+            @pages << @page
+
+            @updated = false
         end
 
         print_debug( 'Training complete.' )
     end
 
-    private
-
-    def to_absolute( url )
-        effective_url = url_sanitize( url )
-        @page.url     = url_sanitize( @page.url )
-
-        begin
-            # prepare the page url
-            return (URI.parse( @page.url ).merge( URI( effective_url ) )).to_s.dup
-        rescue
-            # worst case scenario
-            return @page.url
-        end
+    def flush_pages
+        pages = @pages.dup
+        @pages = []
+        pages
     end
 
+    private
+
     def train_forms( res )
         return [], 0 if !@opts.audit_forms
 
-        # @parser.url = res.effective_url.clone
-        forms = @parser.forms( ).clone
-        cforms, form_cnt = update_forms( forms )
+        cforms, form_cnt = update_forms( @parser.forms )
 
         if ( form_cnt > 0 )
-            @page.forms = cforms.flatten
+            @page.forms = cforms.flatten.map{ |elem| elem.override_instance_scope!; elem }
             @updated = true
 
-            print_debug( 'Found ' + form_cnt.to_s + ' new forms.' )
-        else
-            @page.forms = forms
+            print_info( 'Found ' + form_cnt.to_s + ' new forms.' )
         end
 
     end
@@ -178,12 +182,10 @@ class Trainer
     def train_links( res, redir = false )
         return [], 0  if !@opts.audit_links
 
-        # @parser.url = res.effective_url.clone
-
-        links   = @parser.links.clone
-
+        links = @parser.links.deep_clone
         if( redir )
-            url = to_absolute( res.effective_url )
+
+            url = @parser.to_absolute( url_sanitize( res.effective_url ) )
             links << Arachni::Parser::Element::Link.new( url, {
                 'href' => url,
                 'vars' => @parser.link_vars( url )
@@ -193,33 +195,27 @@ class Trainer
         clinks, link_cnt = update_links( links )
 
         if ( link_cnt > 0 )
-            @page.links = clinks.flatten
+            @page.links = clinks.flatten.map{ |elem| elem.override_instance_scope!; elem }
             @updated = true
 
-            print_debug( 'Found ' + link_cnt.to_s + ' new links.' )
-        else
-            @page.links = links
+            print_info( 'Found ' + link_cnt.to_s + ' new links.' )
         end
 
     end
 
     def train_cookies( res )
 
-        cookies = @parser.cookies.clone
-        ccookies, cookie_cnt = update_cookies( cookies )
+        ccookies, cookie_cnt = update_cookies( @parser.cookies )
 
         if ( cookie_cnt > 0 )
-            @page.cookies = ccookies.flatten
+            @page.cookies = ccookies.flatten.map{ |elem| elem.override_instance_scope!; elem }
             @updated = true
 
-            print_debug( 'Found ' + cookie_cnt.to_s + ' new cookies.' )
-        else
-            @page.cookies = cookies
+            print_info( 'Found ' + cookie_cnt.to_s + ' new cookies.' )
         end
 
     end
 
-
     def self.info
       { :name  => 'Trainer' }
     end