arachni 0.3 → 0.4

data/lib/{ui → arachni/ui}/web/server/public/style.css

@@ -256,7 +256,7 @@ li ol, li ul {
 #nav {
     height: 50px;
     min-width: 960px;
-    width: 68%;
+    width: 75%;
 }
 
 #nav ul {
@@ -587,6 +587,8 @@ div#footer-links p {
     color: #000;
     -moz-border-radius: 5px;
     -webkit-border-radius: 5px;
+    text-align: left;
+
 }
 
 .ok {
@@ -606,7 +608,6 @@ div#footer-links p {
 
 .notice {
     background: #ccc;
-    text-align: left;
 }
 
 .left {

data/lib/arachni/ui/web/server/views/dispatchers.erb

@@ -0,0 +1,175 @@
+
+        <div id="page-intro">
+            <h2>Dispatchers</h2>
+            <p>The dispatchers spawn RPC instances and provide relevant statistics.<br/>
+                This interface allows you to "Attach" to (see the output of), pause, resume and shutdown instances.
+            </p>
+
+            <form action="/dispatchers/edit" method="get">
+                <input type="submit" value="Edit dispatchers" />
+            </form>
+        </div>
+
+        <%= erb :flash, {:layout => false} %>
+
+        <div style="display: none" id="dialog_log" title="Log">
+            <div id="log_progress"></div>
+            <pre id="log"></pre>
+        </div>
+
+        <% i = 0 %>
+        <% stats.each_pair do |d_url, dispatcher_stats| %>
+        <h2><%=show_dispatcher_line( dispatcher_stats )%></h2>
+        <span class="notice"> <%=show_dispatcher_node_line( dispatcher_stats ) %></span>
+
+        <br/><br/>
+
+
+        <% if !dispatcher_stats['neighbours'].empty? %>
+        <div style="display: none" id="dialog_neighbours_<%=i%>" title="Neighbours">
+            <ul>
+            <% dispatcher_stats['neighbours'].each do |neighbour| %>
+            <li><%=neighbour%></li>
+            <%end%>
+            </ul>
+        </div>
+
+        <form style='display: inline' action="#" onsubmit="showDialog( '#dialog_neighbours_<%=i%>' ); return;" >
+            <input type="submit" value="Show neighbours" />
+        </form>
+        <%end%>
+
+        <form style='display: inline' action="#" onsubmit="showLog( '<%=remove_proto( d_url.dup )%>' ); return;" >
+            <input type="submit" value="Show log" />
+        </form>
+
+        <% i += 1 %>
+
+        <%if !dispatcher_stats['running_jobs'].empty? %>
+        <form style='display: inline' onsubmit="return confirm( 'Are you sure that you want to kill all running instances?' )" action="/dispatchers/<%=remove_proto( d_url.dup )%>/shutdown_all" method="post">
+            <%= csrf_tag %>
+            <input type="submit" value="Shutdown all" />
+        </form>
+        <%end%>
+
+        <% if !dispatcher_stats['running_jobs'].empty? %>
+        <table>
+            <tr>
+                <th>PID</th>
+                <th>Port</th>
+                <th>Owner</th>
+                <th>State</th>
+                <th>Progress</th>
+                <th>Start time (Server-side)</th>
+                <th>Current time (Server-side)</th>
+                <th>Runtime</th>
+                <th>Memory usage (%)</th>
+                <th>CPU usage</th>
+                <th>Action</th>
+            </tr>
+        <% dispatcher_stats['running_jobs'].each do |job| %>
+            <tr <%if job_is_slave?( job )%> style='background-color: #ccc'<%end%> >
+
+
+                <td><%=job['pid']%></td>
+                <td><%=job['port']%></td>
+                <td><%=escape( job['owner'] )%></td>
+
+                <td><%=job['status']%></td>
+                <td><%=job['progress']%>%</td>
+
+                <td><%=job['starttime'].to_time%></td>
+                <td><%=job['currtime'].to_time%></td>
+                <td><%=secs_to_hms( job['runtime'] )%></td>
+                <td><%=proc_mem( job['proc']['rss'] )%> MB (<%=job['proc']['pctmem']%>%)</td>
+                <td><%=job['proc']['pctcpu']%>%</td>
+
+                <td>
+                    <% if !( job['owner'] =~/WebUI helper/ )%>
+
+                        <% if !job_is_slave?( job ) %>
+
+                            <% status = ( job['status'] ? job['status'].downcase : '' ) %>
+                            <form style="display: inline" action="/instance/<%=job['url']%>" method="get" target="_blank">
+                                <input type="submit" value="Attach" />
+                            </form>
+
+                            <%if status == 'busy' %>
+                            <form style="display: inline" action="/dispatchers/<%=job['url']%>/pause" method="post">
+                                <%= csrf_tag %>
+                                <input type="submit" value="Pause" />
+                            </form>
+                            <%end%>
+
+                            <%if status == 'paused' %>
+                            <form style="display: inline" action="/dispatchers/<%=job['url']%>/resume" method="post">
+                                <%= csrf_tag %>
+                                <input type="submit" value="Resume" />
+                            </form>
+                            <% end %>
+
+                            <form style="display: inline" action="/dispatchers/<%=job['url']%>/shutdown" method="post">
+                                <%= csrf_tag %>
+                                <input type="submit" value="Shutdown" />
+                            </form>
+
+                        <% else %>
+
+                            This is <%=escape( job['owner'] )%>'s slave and is sharing the workload for the <%=escape( job['helpers']['target'] )%> scan.
+
+                        <% end %>
+
+                    <% end %>
+                </td>
+            </tr>
+        <% end %>
+        </table>
+        <% else %>
+        <br/><br/>
+        <span class="notice"> There are no running scans at the moment.</span>
+        <% end %>
+
+        <br/><br/>
+
+        <% end %>
+
+            <script type="text/javascript">
+                //<![CDATA[
+
+                function showLog( url ) {
+                    var log_url = "/dispatchers/" + url + "/log.json";
+
+                    document.getElementById( 'log' ).innerHTML = 'Loading...';
+                    $( '#dialog_log' ).dialog({
+                        height: 500,
+                        width: 800,
+                        modal: true
+                    });
+
+                    document.getElementById( "log_progress" ).style.display = 'block';
+                    $( "#log_progress" ).progressbar({
+                        value: 100
+                    });
+
+                    $.getJSON( log_url, function(data) {
+                        elem = document.getElementById( 'log' )
+                        if ( data.error ) {
+                            elem.innerHTML = "Error: " + data.error + "\n\n"
+                            elem.innerHTML += "Backtrace: " + data.backtrace
+                        } else {
+                            elem.innerHTML = data.log;
+                        }
+
+                        document.getElementById( "log_progress" ).style.display = 'none';
+                    });
+                }
+
+                function showDialog( id ){
+                    $( id ).dialog({
+                        height: 350,
+                        width: 300,
+                        modal: true
+                    });
+                }
+             //]]>
+            </script>

data/lib/arachni/ui/web/server/views/dispatchers_edit.erb

@@ -0,0 +1,71 @@
+        <div id='help' style='display: none' title="Help">
+            <h2>First run</h2>
+            <p>
+                If this is your first run of the WebUI then you've been
+                redirected here because you haven't specified any Dispatchers
+                for the WebUI to use.
+            </p>
+
+            <h2>Dispatchers</h2>
+            <p>
+                You can start a Dispatcher by running:
+                <pre>arachni_rpcd</pre>
+                in a terminal.
+            </p>
+            <p>
+                This command will fire-up a Dispatcher which will, by default,
+                bind to: <pre>localhost:7331</pre>
+            </p>
+            <p>
+                Input this URL in the 'URL' field and press "Add".<br/>
+                After that you should be able to use the WebUI to perform scans.
+            </p>
+
+            <p>
+                You can find more information about setting up Dispatchers <a href="https://github.com/Zapotek/arachni/wiki/RPC-server">here</a>.
+            </p>
+
+        </div>
+
+        <button onclick="$('#help').dialog( { height: 530, width: 500 } );"/>Help</button>
+
+        <div id="page-intro">
+            <h2>Edit Dispatchers</h2>
+            <p>
+                This screen allows you to add and remove Dispatchers.
+            </p>
+        </div>
+
+        <%= erb :flash, {:layout => false} %>
+
+        <% if !dispatchers.empty? %>
+        <table>
+            <tr>
+                <th>Location</th>
+                <th>Alive?</th>
+                <th>Action</th>
+            </tr>
+            <% dispatchers.each do |dispatcher| %>
+            <tr>
+                <td><%=dispatcher['url']%></td>
+                <td><%=dispatcher['alive'].to_s.capitalize%></td>
+                <td>
+                    <form action="/dispatchers/<%=dispatcher['id']%>/delete" method="post">
+                        <%= csrf_tag %>
+                        <input type="submit" value="Delete" />
+                    </form>
+                </td>
+            </tr>
+            <%end%>
+        </table>
+        <%else%>
+        <span class="notice"> There are no available Dispatchers at the moment. Add one if you want to start a scan.</span>
+        <br/><br/>
+        <%end%>
+
+        <form action="/dispatchers/add" method="post">
+            <%= csrf_tag %>
+            <label>URL:</label>
+            <input name="url" value="localhost:7331" />
+            <input type="submit" value="Add" />
+        </form>

data/lib/arachni/ui/web/server/views/error.erb

@@ -0,0 +1,22 @@
+        <div id="page-intro">
+            <h2><%= title %></h2>
+            <p>
+                <%= message if !message.empty? %>
+            </p>
+        </div>
+
+        <% if !backtrace.empty? %>
+            <a href='https://github.com/Zapotek/arachni/issues'>
+                If you could submit the gibberish you see under 'Environment' that'd really be helpful.
+            </a>
+
+            <p>
+                <h3>Backtrace</h3>
+                <pre style='max-height: 300px; overflow: auto'><%= backtrace %></pre>
+            </p>
+
+            <p>
+                <h3>Environment</h3>
+                 <pre style='max-height: 300px; overflow: auto'><%= env %></pre>
+             </p>
+        <%end%>

data/lib/{ui → arachni/ui}/web/server/views/flash.erb

@@ -1,10 +1,10 @@
 
         <% [:err, :ok, :notice ].each do |name| %>
 
-        <% if flash.has?( name ) %>
+        <% if ( msg = flash[name] ) || ( msg = params[name] ) %>
         <div class="flash">
             <div class="<%= name %>">
-                <%= flash[name] %>
+                <%= escape( msg ) %>
             </div>
         </div>
         <% end %>

data/lib/arachni/ui/web/server/views/home.erb

@@ -0,0 +1,60 @@
+        <div id='help' style='display: none' title="Help">
+            <h2>Starting a scan</h2>
+
+            <h4>Single</h4>
+            <p>
+                A single scan can be performed easily enough, you just select a Dispatcher,
+                enter the URL of your target and hit "Launch Scan".
+            </p>
+
+            <h4>High Performance</h4>
+            <p>
+                A high performance scan utilizes more than one Arachni Instance to perform the audit.<br/>
+                The master instance will perform the crawl and then calculate and distribute the workload amongst its slaves.<br/>
+                This allows scan-time to be severely decreased, by as much as n times less under ideal circumstances, where n equals the number of running instances.
+            </p>
+            <p>
+                You can find more info <a href="https://github.com/Zapotek/arachni/wiki/Web-user-interface#wiki-usage_start-a-scan_hpg">here</a>.
+            </p>
+        </div>
+
+        <button style='display: inline' onclick="$('#help').dialog( { height: 530, width: 500 } );return false;"/>Help</button>
+
+        <form action="/scan" method="post" style='display: inline' >
+
+            <%= csrf_tag %>
+            <input type="submit" value="Launch Scan" />
+
+            <div id="page-intro">
+                <div class="left">
+                    Select a Dispatcher:
+                    <select id="dispatcher" name="dispatcher">
+                    <% stats.each_pair do |d_url, d_stats| %>
+                        <option value="<%=d_url%>">
+                            <%=show_dispatcher_line( d_stats )%>
+                            <%= !d_stats['neighbours'].empty? ? '[HP]' : nil %>
+                        </option>
+                    <%end%>
+                    </select>
+
+                    <span class="hpg">
+                        <br/>
+                        Use High Performance Grid (HPG) mode <input type="checkbox" id="high_performance_checkbox" name="high_performance" />
+                        <strong>Attention:</strong> The HPG is highly unstable and experimental.
+                    </span>
+
+                    <h2>URL: <input name="url" value="<%=session['opts']['settings']['url']%>" size="50" /></h2>
+                </div>
+
+                <div class="left hpg_options">
+                    <h2>Distribution options</h2>
+                    Use a maximum of <input name="max_slaves" value="10" size="2" />
+                    slave instances with at least <input name="min_pages_per_instance" value="30" size="2" /> pages per instance.
+                </div>
+            </div>
+
+        </form>
+
+        <%= erb :'js/home', { layout: false }, stats: stats %>
+
+        <%= erb :flash, {:layout => false} %>