arachni 0.3 → 0.4

data/lib/arachni/ui/web/addons/autodeploy/views/index.erb

@@ -0,0 +1,291 @@
+
+        <div id='help' style='display: none' title="Help">
+            <h2>SSH Options</h2>
+            <p>Options related to the SSH protocol.</p>
+
+            <h4>Host</h4>
+            <p>Hostname or IP address of the SSH server.</p>
+
+            <h4>Port</h4>
+            <p>Port number of the SSH server -- usually 22.</p>
+
+            <h4>Username</h4>
+            <p>SSH username.</p>
+
+            <h4>Password</h4>
+            <p>SSH password.</p>
+
+            <h2>Dispatcher Options</h2>
+            <p>Options related to the operation of the Arachni Dispatcher.</p>
+
+            <h4>Port</h4>
+            <p>Port for the Dispatcher to listen on.</p>
+
+            <h4>Pool size</h4>
+            <p>Amount of Instances to have ready at any given time.</p>
+
+            <h2>Node Options</h2>
+            <p>Options related to the operation of the Grid Node.</p>
+
+            <h4>Nickname</h4>
+            <p>Identification string for the node -- useless to any sort of operation, available only for your convinience.</p>
+
+            <h4>Weight</h4>
+            <p>Metric which affects the availability of the Node.</p>
+            <p>
+                Calculated as:
+                <pre>total_resource_consumption * weight</pre>
+                <br/>
+                <i>Lowest score wins.</i>
+            </p>
+
+            <h4>Pipe ID</h4>
+            <p>
+                String used to identify different bandwidth pipes to the target.<br/>
+                Only Dispatchers with different Pipe-IDs can be used in High Performance Grid mode.
+            </p>
+
+            <h4>Neighbour</h4>
+            <p>
+                URL of a neighbouring node in the form of:
+                <pre>host:port</pre>
+                <br/>
+
+                By specifying a neighbour you can form a Grid of Dispatcher nodes and use them to perform a distributed/high-performance scan.
+            </p>
+
+            <h4>Bind address</h4>
+            <p>
+                IP address or hostname to bind to.<br/>
+                If you want the node to be part of a Grid this address must be accessible by all the other nodes.
+            </p>
+        </div>
+
+        <div id='ssl_info' style='display: none' title="SSL info">
+            In order to make key management easier, the add-on will automatically deploy and use the SSL key/certs specified in:
+            <pre>/conf/webui.yaml</pre>
+        </div>
+
+        <button onclick="$('#help').dialog( { height: 530, width: 500 } );"/>Help</button>
+        <button onclick="$('#ssl_info').dialog( { width: 820 } );"/>SSL info</button>
+
+
+        <div>
+            <form action="<%=root%>/" method="post">
+                <h2>Perform a new deployment</h2>
+                <br/>
+                <i>Parameters marked with * are mandatory.</i> <br/>
+                <fieldset class='left' style='width: 30%'>
+                    <legend>SSH options:</legend>
+                    <table>
+                        <tr>
+                            <td>*Host:</td>
+                            <td><input name="host" /></td>
+                        </tr>
+                        <tr>
+                            <td>
+                                *Port:
+                            </td>
+                            <td>
+                                <input name="port" value="22" size="4" />
+                            </td>
+                        </tr>
+                        <tr>
+                            <td>
+                                *Username:
+                            </td>
+                            <td>
+                                <input name="user" />
+                            <td>
+                        </tr>
+                        <tr>
+                            <td>
+                                *Password (will not be stored):
+                            </td>
+                            <td>
+                                <input name="password" type="password" />
+                            </td>
+                        </tr>
+                    </table>
+                </fieldset>
+
+                <fieldset class='left' style='width: 30%'>
+                    <legend>Dispatcher options:</legend>
+                    <table>
+                        <tr>
+                            <td>
+                                *Port:
+                            </td>
+                            <td>
+                                <input name="dispatcher_port" value="7331" />
+                            </td>
+                        </tr>
+                        <tr>
+                            <td>
+                                Pool size:
+                            </td>
+                            <td>
+                                <input name="pool_size" value="5" />
+                            </td>
+                        </tr>
+                    </table>
+                </fieldset>
+
+                <fieldset class='left' style='width: 30%'>
+                    <legend>Node options:</legend>
+                    <table>
+                        <tr>
+                            <td>
+                                Nickname:
+                            </td>
+                            <td>
+                                <input name="nickname" value="" />
+                            </td>
+                        </tr>
+                        <tr>
+                            <td>
+                                Weight:
+                            </td>
+                            <td>
+                                <input name="weight" value="" />
+                            </td>
+                        </tr>
+                        <tr>
+                            <td>
+                                Pipe ID:
+                            </td>
+                            <td>
+                                <input name="pipe_id" value="" />
+                            </td>
+                        </tr>
+                        <tr>
+                            <td>
+                                Neighbour:
+                            </td>
+                            <td>
+                                <input name="neighbour" value="" />
+                            </td>
+                        </tr>
+                        <tr>
+                            <td>
+                                Bind address:
+                            </td>
+                            <td>
+                                <input name="address" value="" />
+                            </td>
+                        </tr>
+                    </table>
+                </fieldset>
+                <br/>
+
+                <%= csrf_tag %>
+                <input type="submit" value="Add" />
+            </form>
+
+            <% if show_output || !ret.empty? %>
+            <div class='clear'>
+                <h3>Output</h3>
+                <strong>Status: <span id="status"><%=ret[:status]%></span></strong>
+                <br/>
+                <pre id="output" style="max-height: 400px; overflow: scroll"><%=ret[:output]%></pre>
+            </div>
+            <% end %>
+
+        </div>
+
+        <div class='clear'>
+            <ul>
+            <% flash[:errors] && flash[:errors].each do |k, v| %>
+                <li> <%=k%> - <%=v%></li>
+            <% end %>
+            </ul>
+        </div>
+
+
+        <% if !deployments.empty? %>
+        <br/>
+        <br/>
+
+        <i>(Shutting down a Dispatcher will terminate all its running scans.)</i>
+        <table>
+            <tr>
+                <th>ID</th>
+                <th>Host</th>
+                <th>SSH Port</th>
+                <th>Dispatcher port</th>
+                <th>Username</th>
+                <th>Password</th>
+                <th>Running?</th>
+                <th>Created at</th>
+                <th>Action</th>
+            </tr>
+        <% deployments.each do |dep| %>
+            <tr>
+
+                <form action="<%=root%>/<%=dep.id%>" method="post">
+                    <td><%=dep.id%></td>
+                    <td><%=dep.host%></td>
+                    <td><%=dep.port%></td>
+                    <td><%=dep.dispatcher_port%></td>
+                    <td><%=dep.user%></td>
+                    <td><input name="password" type="password" /></td>
+                    <td><%=dep.alive%></td>
+                    <td><%=dep.created_at.to_time%></td>
+                    <td>
+                        <%= csrf_tag %>
+                        <input type="hidden" name="id" value="<%=dep.id%>">
+
+                        <% if !dep.alive%>
+                            <input type="radio" name="action" value="run"> Run <br/>
+                        <%else%>
+                            <input type="radio" name="action" value="shutdown"> Shutdown <br/>
+                        <%end%>
+                        <input type="radio" name="action" value="delete"> Uninstall & Delete <br/>
+
+                        <input type="submit" value="Submit">
+                    </td>
+                </form>
+            </tr>
+        <% end %>
+        </table>
+        <% else %>
+        <p class="notice">There are no deployments at the moment.</p>
+        <% end %>
+
+        <% if show_output%>
+        <script type="text/javascript">
+            //<![CDATA[
+
+            function updateOutput() {
+                if( !document.getElementById( 'output' ) ) return;
+
+                var output_url = "<%=root%>/channel/<%=channel%>";
+                $.getJSON( output_url, function(data) {
+                    if( data.status == 'finished' ) {
+                        window.location.replace( "<%=root%>/channel/<%=channel%>/finalize" );
+                    } if( data.status == 'failed' ) {
+                        document.getElementById( 'status' ).innerHTML = data.status;
+                        obj = document.getElementById( 'output' );
+                        obj.innerHTML = data.output;
+                    } else {
+
+                        document.getElementById( 'status' ).innerHTML = data.status;
+
+                        obj = document.getElementById( 'output' );
+                        obj.innerHTML = data.output;
+                        obj.scrollTop = obj.scrollHeight;
+                    }
+                });
+            }
+
+            $( document ).ready(function() {
+
+                updateOutput( );
+                setInterval( function() {
+                      updateOutput( );
+                }, 1500 );
+
+            })
+             //]]>
+        </script>
+        <%end%>

data/lib/{ui → arachni/ui}/web/addons/sample.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License

data/lib/{ui → arachni/ui}/web/addons/scheduler.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -21,23 +21,27 @@ module Addons
 #                                      <tasos.laskos@gmail.com>
 #                                      <zapotek@segfault.gr>
 #
-# @version: 0.1
+# @version: 0.1.1
 #
 class Scheduler < Base
 
     def run
 
-        get "/" do
-            present :index,
-                :jobs => scheduler.jobs( :order => :created_at.desc ),
-                # we need to get our context via "addons.running['scheduler']"
-                # which is, essentially, this class.
-                :root => current_addon.path_root
+        aget "/" do
+            prep_session
+            settings.dispatchers.stats {
+                |stats|
+                async_present :index,
+                    :jobs => scheduler.jobs( :order => :created_at.desc ),
+                    :root => current_addon.path_root,
+                    :d_stats => stats
+            }
         end
 
         post '/' do
             valid = true
 
+            prep_session
             begin
                 URI.parse( params['url'] )
             rescue
@@ -60,6 +64,16 @@ class Scheduler < Base
 
                 opts = {}
                 opts['settings'] = prep_opts( session['opts']['settings'] )
+                opts['settings'] = session['opts']['settings']
+
+                if params['high_performance']
+                    opts['settings']['grid_mode'] = 'high_performance'
+                    opts['settings']['min_pages_per_instance'] =
+                        params['min_pages_per_instance']
+
+                    opts['settings']['max_slaves'] = params['max_slaves']
+                end
+
                 opts['plugins']  = YAML::load( session['opts']['plugins'] )
                 opts['modules']  = session['opts']['modules']
 
@@ -78,41 +92,35 @@ class Scheduler < Base
                         job.datetime = parse_datetime( params[:datetime] )
 
                         if !job.valid?
-                            flash[:err] = 'Job holds invalid data, skipping...'
+                            msg = [ :err, 'Job holds invalid data, skipping...' ]
                         else
                             job.save
-                            flash[:ok] = "Job saved."
+                            msg = [ :ok, "Job saved." ]
                         end
                     rescue Exception => e
-                        flash[:err] = 'Could not parse date (' + e.to_s + ').'
+                        msg = [ :err, 'Could not parse date (' + e.to_s + ').' ]
                     end
 
                 else
-                    flash[:err] = 'Date cannot be empty.'
+                    msg = [ :err, 'Date cannot be empty.' ]
                 end
             end
 
-            present :index,
-                :jobs => scheduler.jobs( :order => :created_at.desc ),
-                # we need to get our context via "addons.running['scheduler']"
-                # which is, essentially, this class.
-                :root => current_addon.path_root
-
-
+            redirect  '/', :flash => { msg[0] => msg[1] }
         end
 
         post '/delete' do
             scheduler.delete_all
             log.scheduler_jobs_deleted( env )
 
-            redirect addons.running['scheduler'].path_root + '/'
+            redirect  '/'
         end
 
         post '/:id/delete' do
             scheduler.delete( params[:id] )
             log.scheduler_job_deleted( env, params[:id] )
 
-            redirect addons.running['scheduler'].path_root + '/'
+            redirect '/'
         end
 
     end
@@ -126,7 +134,7 @@ class Scheduler < Base
             :name           => 'Scheduler',
             :description    => %q{Schedules and runs scan jobs.},
             :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
-            :version        => '0.1'
+            :version        => '0.2'
         }
     end
 

data/lib/{ui → arachni/ui}/web/addons/scheduler/views/index.erb

@@ -14,30 +14,64 @@
                 <i>You can configure the scan parameters just like you normally would.</i>
                 <br/>
 
-                Select a Dispatcher:
-                <select name="dispatcher">
-                <% if !dispatchers.first_alive%>
-                        <option value="">None available, please add a Dispatcher to continue.</option>
-                <%else%>
-                    <% dispatcher_stats.each_pair do |d_url, stats| %>
-                        <% next if !dispatchers.alive?( d_url ) %>
-                        <option value="<%=d_url%>">
-                            @<%=escape( d_url )%> - <%=stats['running_jobs'].size%> running scans,
-                             <%=i=0;stats['running_jobs'].each{ |job| i+= proc_mem( job['proc']['rss'] ).to_i }; i.to_s%>MB RAM usage.
-                        </option>
-                    <%end%>
-                <%end%>
-                </select>
-
-                URL: <input name="url" value="<%=session['opts']['settings']['url']%>" size="50" <% if !dispatchers.first_alive%>  disabled="disabled"<%end%> />
-                Schedule for: <input id="datetime" name="datetime" <% if !dispatchers.first_alive%>  disabled="disabled"<%end%> />
-
+                <table>
+                    <tr>
+                        <td>
+                            Select a Dispatcher:
+                        </td>
+                        <td>
+                            <select id="dispatcher" name="dispatcher">
+                            <% if d_stats.empty?%>
+                                    <option value="">None available, please add a Dispatcher to continue.</option>
+                            <%else%>
+                                <% d_stats.each_pair do |d_url, stats| %>
+                                    <option value="<%=d_url%>"><%=show_dispatcher_line( stats ) %>
+                                        <%= !stats['neighbours'].empty? ? '[HP]' : nil %>
+                                    </option>
+                                <%end%>
+                            <%end%>
+                            </select>
+                        </td>
+                    </tr>
+                    <tr class="hpg">
+                        <td>
+                            Use High Performance Grid (HPG) mode
+                         </td>
+                         <td>
+                            <input type="checkbox" id="high_performance_checkbox" name="high_performance" />
+                         </td>
+                    </tr>
+                    <tr class="hpg_options">
+                        <td></td>
+                        <td>
+                            Use a maximum of
+                            <input name="max_slaves" value="10" size="1" /> slave instances with at least <input name="min_pages_per_instance" value="30" size="1" /> pages per instance.
+                        </td>
+                    </tr>
+                    <tr>
+                        <td>
+                            URL
+                        </td>
+                        <td>
+                            <input name="url" value="<%=session['opts']['settings']['url']%>" size="50" <% if d_stats.empty?%>  disabled="disabled"<%end%> />
+                        </td>
+                    </tr>
+                    <tr>
+                        <td>
+                            Schedule for:
+                        </td>
+                        <td>
+                            <input id="datetime" name="datetime" <% if d_stats.empty?%>  disabled="disabled"<%end%> />
+                        </td>
+                    </tr>
+                </table>
+
+                <input type="submit" value="Add" <% if d_stats.empty?%>  disabled="disabled"<%end%> />
                 <%= csrf_tag %>
-                <input type="submit" value="Add" <% if !dispatchers.first_alive%>  disabled="disabled"<%end%> />
-
             </form>
         </div>
 
+        <%= erb :'js/home', { layout: false }, stats: d_stats %>
 
         <% if !jobs.empty? %>
         <table>
@@ -56,9 +90,9 @@
                 <td><%=job.id%></td>
                 <td><%=job.dispatcher%></td>
                 <td><%=job.url%></td>
-                <td><%=job.datetime%></td>
+                <td><%=job.datetime.to_time%> (<%= secs_to_hms( job.datetime.to_time - Time.now ) %>)</td>
                 <td><%=job.owner_host%> (<%=job.owner_addr%>)</td>
-                <td><%=job.created_at%></td>
+                <td><%=job.created_at.to_time%></td>
                 <td>
                     <form action="<%=root%>/<%=job.id%>/delete" method="post">
                         <%= csrf_tag %>