arachni 0.3 → 0.4

data/modules/audit/xss_event.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -9,7 +9,6 @@
 =end
 
 module Arachni
-
 module Modules
 
 #
@@ -19,7 +18,7 @@ module Modules
 # @author: Tasos "Zapotek" Laskos
 #                                      <tasos.laskos@gmail.com>
 #                                      <zapotek@segfault.gr>
-# @version: 0.1.1
+# @version: 0.1.2
 #
 # @see http://cwe.mitre.org/data/definitions/79.html
 # @see http://ha.ckers.org/xss.html
@@ -52,11 +51,7 @@ class XSSEvent < Arachni::Module::Base
         'src' # not an event but it fits the module structure
     ]
 
-    def initialize( page )
-        super( page )
-    end
-
-    def prepare( )
+    def prepare
         @_injection_strs = [
             ";arachni_xss_in_element_event=" + seed + '//',
             "\";arachni_xss_in_element_event=" + seed + '//',
@@ -68,7 +63,7 @@ class XSSEvent < Arachni::Module::Base
         }
     end
 
-    def run( )
+    def run
         @_injection_strs.each {
             |str|
             audit( str, @_opts ) {
@@ -106,7 +101,7 @@ class XSSEvent < Arachni::Module::Base
                 Issue::Element::HEADER
             ],
             :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
-            :version        => '0.1.1',
+            :version        => '0.1.2',
             :references     => {
                 'ha.ckers' => 'http://ha.ckers.org/xss.html',
                 'Secunia'  => 'http://secunia.com/advisories/9716/'

data/modules/audit/xss_path.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -9,7 +9,6 @@
 =end
 
 module Arachni
-
 module Modules
 
 #
@@ -18,7 +17,7 @@ module Modules
 # @author: Tasos "Zapotek" Laskos
 #                                      <tasos.laskos@gmail.com>
 #                                      <zapotek@segfault.gr>
-# @version: 0.1.2
+# @version: 0.1.6
 #
 # @see http://cwe.mitre.org/data/definitions/79.html
 # @see http://ha.ckers.org/xss.html
@@ -28,37 +27,52 @@ class XSSPath < Arachni::Module::Base
 
     include Arachni::Module::Utilities
 
-    def initialize( page )
-        super( page )
-
-        @results    = []
-    end
-
-    def prepare( )
-        @str = '/<arachni_xss_path_' + seed
+    def prepare
+        @_tag_name = 'my_tag_' + seed
+        @str = '<' + @_tag_name + ' />'
         @__injection_strs = [
             @str,
+            '?' + @str,
             '?>"\'>' + @str,
             '?=>"\'>' + @str
         ]
-    end
 
-    def run( )
+        @@audited ||= Set.new
+    end
 
+    def run
         path = get_path( @page.url )
 
+        return if @@audited.include?( path )
+        @@audited << path
+
         @__injection_strs.each {
             |str|
 
             url  = path + str
+
+            print_status( "Checking for: #{url}" )
+
             req  = @http.get( url )
 
             req.on_complete {
                 |res|
-                __log_results( res, str )
+                check_and_log( res, str )
             }
         }
+    end
+
+    def check_and_log( res, str )
+        # check for the existence of the tag name before parsing to verify
+        # no reason to waste resources...
+        return if ! res.body.substring?( @_tag_name )
+
+        doc = Nokogiri::HTML( res.body )
 
+        # see if we managed to successfully inject our element
+        if !doc.xpath( "//#{@_tag_name}" ).empty?
+            __log_results( res, str )
+        end
     end
 
 
@@ -68,7 +82,7 @@ class XSSPath < Arachni::Module::Base
             :description    => %q{Cross-Site Scripting module for path injection},
             :elements       => [ ],
             :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
-            :version        => '0.1.2',
+            :version        => '0.1.6',
             :references     => {
                 'ha.ckers' => 'http://ha.ckers.org/xss.html',
                 'Secunia'  => 'http://secunia.com/advisories/9716/'
@@ -90,33 +104,25 @@ class XSSPath < Arachni::Module::Base
     end
 
     def __log_results( res, id )
+        url = res.effective_url
+        log_issue(
+            :var          => 'n/a',
+            :url          => url,
+            :injected     => id,
+            :id           => id,
+            :regexp       => 'n/a',
+            :regexp_match => 'n/a',
+            :elem         => Issue::Element::PATH,
+            :response     => res.body,
+            :headers      => {
+                :request    => res.request.headers,
+                :response   => res.headers,
+            }
+        )
 
-        if res.body.substring?( id )
-
-            url = res.effective_url
-            # append the result to the results hash
-            @results << Issue.new( {
-                :var          => 'n/a',
-                :url          => url,
-                :injected     => id,
-                :id           => id,
-                :regexp       => 'n/a',
-                :regexp_match => 'n/a',
-                :elem         => Issue::Element::LINK,
-                :response     => res.body,
-                :headers      => {
-                    :request    => res.request.headers,
-                    :response   => res.headers,
-                }
-            }.merge( self.class.info ) )
-
-            # inform the user that we have a match
-            print_ok( "Match at #{url}" )
-            print_verbose( "Inected string: #{id}" )
-
-            # register our results with the system
-            register_results( @results )
-        end
+        # inform the user that we have a match
+        print_ok( "Match at #{url}" )
+        print_verbose( "Injected string: #{id}" )
     end
 
 

data/modules/audit/xss_script_tag.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -9,7 +9,6 @@
 =end
 
 module Arachni
-
 module Modules
 
 #
@@ -19,7 +18,7 @@ module Modules
 # @author: Tasos "Zapotek" Laskos
 #                                      <tasos.laskos@gmail.com>
 #                                      <zapotek@segfault.gr>
-# @version: 0.1.1
+# @version: 0.1.2
 #
 # @see http://cwe.mitre.org/data/definitions/79.html
 # @see http://ha.ckers.org/xss.html
@@ -29,11 +28,7 @@ class XSSScriptTag < Arachni::Module::Base
 
     include Arachni::Module::Utilities
 
-    def initialize( page )
-        super( page )
-    end
-
-    def prepare( )
+    def prepare
         @_injection_strs = [
             "arachni_xss_in_script_tag_" + seed + "",
             "\"arachni_xss_in_script_tag_" + seed + "\"",
@@ -45,7 +40,7 @@ class XSSScriptTag < Arachni::Module::Base
         }
     end
 
-    def run( )
+    def run
         @_injection_strs.each {
             |str|
             audit( str, @_opts ) {
@@ -84,7 +79,7 @@ class XSSScriptTag < Arachni::Module::Base
                 Issue::Element::HEADER
             ],
             :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
-            :version        => '0.1.1',
+            :version        => '0.1.2',
             :references     => {
                 'ha.ckers' => 'http://ha.ckers.org/xss.html',
                 'Secunia'  => 'http://secunia.com/advisories/9716/'

data/modules/audit/xss_tag.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -9,7 +9,6 @@
 =end
 
 module Arachni
-
 module Modules
 
 #
@@ -19,7 +18,7 @@ module Modules
 # @author: Tasos "Zapotek" Laskos
 #                                      <tasos.laskos@gmail.com>
 #                                      <zapotek@segfault.gr>
-# @version: 0.1.1
+# @version: 0.1.2
 #
 # @see http://cwe.mitre.org/data/definitions/79.html
 # @see http://ha.ckers.org/xss.html
@@ -31,11 +30,7 @@ class XSSHTMLTag < Arachni::Module::Base
 
     TAG_NAME = 'arachni_xss_in_tag'
 
-    def initialize( page )
-        super( page )
-    end
-
-    def prepare( )
+    def prepare
         @_injection_strs = [
             " #{TAG_NAME}=" + seed,
             "\" #{TAG_NAME}=\"" + seed,
@@ -47,7 +42,7 @@ class XSSHTMLTag < Arachni::Module::Base
         }
     end
 
-    def run( )
+    def run
         @_injection_strs.each {
             |str|
             audit( str, @_opts ) {
@@ -85,7 +80,7 @@ class XSSHTMLTag < Arachni::Module::Base
                 Issue::Element::HEADER
             ],
             :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
-            :version        => '0.1.1',
+            :version        => '0.1.2',
             :references     => {
                 'ha.ckers' => 'http://ha.ckers.org/xss.html',
                 'Secunia'  => 'http://secunia.com/advisories/9716/'

data/modules/audit/xss_uri.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -9,117 +9,45 @@
 =end
 
 module Arachni
-
 module Modules
 
 #
-# XSS in URI audit module.
+# Left here for compatibility reasons, has been obsoleted by the xss_path module.
 #
 # @author: Tasos "Zapotek" Laskos
 #                                      <tasos.laskos@gmail.com>
 #                                      <zapotek@segfault.gr>
-# @version: 0.1.3
-#
-# @see http://cwe.mitre.org/data/definitions/79.html
-# @see http://ha.ckers.org/xss.html
-# @see http://secunia.com/advisories/9716/
 #
 class XSSURI < Arachni::Module::Base
 
-    include Arachni::Module::Utilities
-
-    def initialize( page )
-        super( page )
-
-        @results    = []
-
-        # since we'll bypass the Auditor we need to keep track of our audits
-        @@__audited  ||= Set.new
-    end
-
-    def prepare( )
-        @str = '/<arachni_xss_uri_' + seed
+    def prepare
+        if @framework && !@framework.modules.keys.include?( 'xss_path' )
+            @mod = @framework.modules['xss_path'].new( @page )
+            @mod.set_framework( @framework )
+            @mod.prepare
+        end
     end
 
-    def run( )
-
-    uri  = URI( normalize_url( @page.url ) )
-    url  = uri.scheme + '://' + uri.host + uri.path  + @str
-
-    if @@__audited.include?( url )
-        print_info( 'Skipping already audited url: ' + url )
-        return
+    def run
+        print_bad( 'Module has been obsoleted and will eventually be removed.' )
+        print_bad( 'Please remove it from any profiles or scripts you may have created.' )
+        print_bad( '-- Running \'xss_path\' instead.' )
+        @mod.run if @mod
     end
 
-    @@__audited << url
-
-    req  = @http.get( url )
-
-    req.on_complete {
-        |res|
-        __log_results( res )
-    }
-
+    def clean_up
+        @mod.clean_up if @mod
     end
 
-
     def self.info
         {
             :name           => 'XSSURI',
-            :description    => %q{Cross-Site Scripting module for path injection},
-            :elements       => [ ],
+            :description    => %q{Compatibility module, will load and run xss_path instead.},
             :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
-            :version        => '0.1.3',
-            :references     => {
-                'ha.ckers' => 'http://ha.ckers.org/xss.html',
-                'Secunia'  => 'http://secunia.com/advisories/9716/'
-            },
-            :targets        => { 'Generic' => 'all' },
-            :issue   => {
-                :name        => %q{Cross-Site Scripting (XSS) in URI},
-                :description => %q{Client-side code, like JavaScript, can
-                    be injected into the web application.},
-                :tags        => [ 'xss', 'uri', 'path', 'regexp', 'injection', 'script' ],
-                :cwe         => '79',
-                :severity    => Issue::Severity::HIGH,
-                :cvssv2       => '9.0',
-                :remedy_guidance    => '',
-                :remedy_code => '',
-            }
-
+            :version        => '0'
         }
     end
 
-    def __log_results( res )
-
-        if res.body.substring?( @str )
-
-            url = res.effective_url
-            # append the result to the results hash
-            @results << Issue.new( {
-                :url          => url,
-                :injected     => @str,
-                :id           => @str,
-                :regexp       => @str,
-                :regexp_match => @str,
-                :elem         => Issue::Element::PATH,
-                :response     => res.body,
-                :headers      => {
-                    :request    => res.request.headers,
-                    :response   => res.headers,
-                }
-            }.merge( self.class.info ) )
-
-            # inform the user that we have a match
-            print_ok( "In #{@page.url} at " + url )
-
-            # register our results with the system
-            register_results( @results )
-
-        end
-    end
-
-
 end
 end
 end