arachni 0.3 → 0.4

data/modules/recon/allowed_methods.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -9,7 +9,6 @@
 =end
 
 module Arachni
-
 module Modules
 
 #
@@ -18,7 +17,7 @@ module Modules
 # @author: Tasos "Zapotek" Laskos
 #                                      <tasos.laskos@gmail.com>
 #                                      <zapotek@segfault.gr>
-# @version: 0.1
+# @version: 0.1.1
 #
 # @see http://en.wikipedia.org/wiki/WebDAV
 # @see http://www.webdav.org/specs/rfc4918.html
@@ -27,16 +26,11 @@ class AllowedMethods < Arachni::Module::Base
 
     include Arachni::Module::Utilities
 
-    def initialize( page )
-        super( page )
-    end
-
     def prepare
         @@__ran ||= false
     end
 
-    def run( )
-
+    def run
         return if @@__ran
 
         print_status( "Checking..." )
@@ -57,7 +51,7 @@ class AllowedMethods < Arachni::Module::Base
             :description    => %q{Checks for supported HTTP methods.},
             :elements       => [ ],
             :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.1',
+            :version        => '0.1.1',
             :references     => {
             },
             :targets        => { 'Generic' => 'all' },
@@ -80,7 +74,7 @@ class AllowedMethods < Arachni::Module::Base
 
         return if !methods || methods.empty?
 
-        issue = Issue.new( {
+        log_issue(
             :url          => res.effective_url,
             :method       => res.request.method.to_s.upcase,
             :regexp_match => methods,
@@ -90,10 +84,7 @@ class AllowedMethods < Arachni::Module::Base
                 :request    => res.request.headers,
                 :response   => res.headers,
             }
-        }.merge( self.class.info ) )
-
-        # register our results with the system
-        register_results( [issue] )
+        )
 
         # inform the user that we have a match
         print_ok( methods )

data/modules/recon/backdoors.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -9,7 +9,6 @@
 =end
 
 module Arachni
-
 module Modules
 
 #
@@ -18,24 +17,17 @@ module Modules
 # @author: Tasos "Zapotek" Laskos
 #                                      <tasos.laskos@gmail.com>
 #                                      <zapotek@segfault.gr>
-# @version: 0.1
+# @version: 0.2.1
 #
 #
 class Backdoors < Arachni::Module::Base
 
     include Arachni::Module::Utilities
 
-    def initialize( page )
-        super( page )
-    end
-
     def prepare
         # to keep track of the requests and not repeat them
         @@__audited ||= Set.new
 
-        # our results array
-        @results = []
-
         @@__filenames ||=[]
         return if !@@__filenames.empty?
 
@@ -45,7 +37,7 @@ class Backdoors < Arachni::Module::Base
         }
     end
 
-    def run( )
+    def run
 
         path = get_path( @page.url )
         return if @@__audited.include?( path )
@@ -57,13 +49,10 @@ class Backdoors < Arachni::Module::Base
             url  = path + file
 
             print_status( "Checking for #{url}" )
-
-            req  = @http.get( url, :train => true )
-
-            req.on_complete {
+            log_remote_file_if_exists( url ) {
                 |res|
-                print_status( "Analyzing #{res.effective_url}" )
-                __log_results( res, file )
+                # inform the user
+                print_ok( "Found #{file} at " + res.effective_url )
             }
         }
 
@@ -77,13 +66,16 @@ class Backdoors < Arachni::Module::Base
             :description    => %q{Tries to find common backdoors on the server.},
             :elements       => [ ],
             :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
-            :version        => '0.1',
+            :version        => '0.2.1',
             :references     => {},
             :targets        => { 'Generic' => 'all' },
             :issue   => {
                 :name        => %q{A backdoor file exists on the server.},
-                :description => %q{},
-                :tags        => [ 'path', 'backdoor', 'file' ],
+                :description => %q{ The server response indicates that a file matching
+                    the name of a common backdoor is publicly accessible.
+                    This indicates that the server has been compromised and can
+                    (to some extent) be remotely controled by unauthorised users.},
+                :tags        => [ 'path', 'backdoor', 'file', 'discovery' ],
                 :cwe         => '',
                 :severity    => Issue::Severity::HIGH,
                 :cvssv2       => '',
@@ -94,38 +86,6 @@ class Backdoors < Arachni::Module::Base
         }
     end
 
-    #
-    # Adds an issue to the @results array<br/>
-    # and outputs an "OK" message with the filename and its url.
-    #
-    # @param  [Net::HTTPResponse]  res   the HTTP response
-    # @param  [String]  filename   the discovered filename
-    #
-    def __log_results( res, filename )
-
-        return if( res.code != 200 || @http.custom_404?( res ) )
-
-        url = res.effective_url
-        # append the result to the results array
-        @results << Issue.new( {
-            :url          => url,
-            :injected     => filename,
-            :id           => filename,
-            :elem         => Issue::Element::PATH,
-            :response     => res.body,
-            :headers      => {
-                :request    => res.request.headers,
-                :response   => res.headers,
-            }
-        }.merge( self.class.info ) )
-
-        # register our results with the system
-        register_results( @results )
-
-        # inform the user that we have a match
-        print_ok( "Found #{filename} at " + url )
-    end
-
 end
 end
 end

data/modules/recon/backup_files.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -9,7 +9,6 @@
 =end
 
 module Arachni
-
 module Modules
 
 #
@@ -21,24 +20,17 @@ module Modules
 # @author: Tasos "Zapotek" Laskos
 #                                      <tasos.laskos@gmail.com>
 #                                      <zapotek@segfault.gr>
-# @version: 0.1.5
+# @version: 0.2.1
 #
 #
 class BackupFiles < Arachni::Module::Base
 
     include Arachni::Module::Utilities
 
-    def initialize( page )
-        super( page )
-    end
-
     def prepare
         # to keep track of the requests and not repeat them
         @@__audited ||= Set.new
 
-        # our results array
-        @results = []
-
         @@__extensions ||=[]
         return if !@@__extensions.empty?
 
@@ -48,12 +40,11 @@ class BackupFiles < Arachni::Module::Base
         }
     end
 
-    def run( )
+    def run
+        path = get_path( @page.url )
+        return if @@__audited.include?( path )
 
         filename = File.basename( URI( normalize_url( @page.url ) ).path )
-        path     = get_path( @page.url )
-
-        return if @@__audited.include?( path )
 
         print_status( "Scanning..." )
 
@@ -71,28 +62,26 @@ class BackupFiles < Arachni::Module::Base
             #
 
             file = ext % filename # Example: index.php.bak
-            url  = path + file
-            next if !( req1 = __request_once( url ) )
-
+            check!( path, file )
 
-            req1.on_complete {
-                |res|
-                __log_results( res, file )
-            }
-
-            file = ext % filename.gsub( /\.(.*)/, '' ) # Example: index.bak
-            url  = path + file
-            next if !( req2 = __request_once( url ) )
-
-            req2.on_complete {
-                |res|
-                __log_results( res, file )
-            }
+            cfile = ext % filename.gsub( /\.(.*)/, '' ) # Example: index.bak
+            check!( path, file ) if file != cfile
         }
 
         @@__audited << path
     end
 
+    def check!( path, file )
+
+        url = path + file
+
+        print_status( "Checking for #{url}" )
+
+        log_remote_file_if_exists( url ) {
+            |res|
+            print_ok( "Found #{file} at " + res.effective_url )
+        }
+    end
 
     def self.info
         {
@@ -100,13 +89,16 @@ class BackupFiles < Arachni::Module::Base
             :description    => %q{Tries to find sensitive backup files.},
             :elements       => [ ],
             :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
-            :version        => '0.1.5',
+            :version        => '0.2.1',
             :references     => {},
             :targets        => { 'Generic' => 'all' },
             :issue   => {
                 :name        => %q{A backup file exists on the server.},
-                :description => %q{},
-                :tags        => [ 'path', 'backup', 'file' ],
+                :description => %q{ The server response indicates that a file matching
+                    the name of a common naming scheme for file backups can be publicly accessible.
+                    A developer has probably forgotten to remove this file after testing.
+                    This can lead to source code disclosure and privileged information leaks.},
+                :tags        => [ 'path', 'backup', 'file', 'discovery' ],
                 :cew         => '530',
                 :severity    => Issue::Severity::HIGH,
                 :cvssv2       => '',
@@ -117,61 +109,6 @@ class BackupFiles < Arachni::Module::Base
         }
     end
 
-    #
-    # Adds an issue to the @results array<br/>
-    # and outputs an "OK" message with the filename and its url.
-    #
-    # @param  [Net::HTTPResponse]  res   the HTTP response
-    # @param  [String]  filename   the discovered filename
-    #
-    def __log_results( res, filename )
-
-        # some webapps disregard the extension and load the page anyway
-        # which will lead to false positives, take care of that.
-        return if res.body == @page.html
-
-        return if( res.code != 200 || @http.custom_404?( res ) )
-
-        url = res.effective_url
-        # append the result to the results array
-        @results << Issue.new( {
-            :url          => url,
-            :injected     => filename,
-            :id           => filename,
-            :elem         => Issue::Element::PATH,
-            :response     => res.body,
-            :headers      => {
-                :request    => res.request.headers,
-                :response   => res.headers,
-            }
-        }.merge( self.class.info ) )
-
-        # register our results with the system
-        register_results( @results )
-
-        # inform the user that we have a match
-        print_ok( "Found #{filename} at " + url )
-    end
-
-    #
-    # Gets a URL only once
-    #
-    # @param  [String]  url   the url to get
-    #
-    # @return  [FalseClass/HTTPResponse]   false if the url has been
-    #                                          previously requested,<br/>
-    #                                          the HTTPResponse otherwise
-    #
-    def __request_once( url )
-
-        print_status( "Checking for #{url}" )
-
-        # force the Trainer to analyze it and if it's HTML it'll extract any new attack vectors.
-        req  = @http.get( url, :train => true )
-
-        return req
-    end
-
 end
 end
 end

data/modules/recon/common_directories.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -8,8 +8,6 @@
 
 =end
 
-require 'digest/sha1'
-
 module Arachni
 
 module Modules
@@ -22,7 +20,7 @@ module Modules
 # @author: Tasos "Zapotek" Laskos
 #                                      <tasos.laskos@gmail.com>
 #                                      <zapotek@segfault.gr>
-# @version: 0.1.4
+# @version: 0.2.1
 #
 # @see http://cwe.mitre.org/data/definitions/538.html
 #
@@ -31,17 +29,10 @@ class CommonDirectories < Arachni::Module::Base
 
     include Arachni::Module::Utilities
 
-    def initialize( page )
-        super( page )
-    end
-
     def prepare
         # to keep track of the requests and not repeat them
         @@__audited ||= Set.new
 
-        # our results array
-        @results = []
-
         @@__directories ||=[]
         return if !@@__directories.empty?
 
@@ -51,8 +42,7 @@ class CommonDirectories < Arachni::Module::Base
         }
     end
 
-    def run( )
-
+    def run
         path = get_path( @page.url )
         return if @@__audited.include?( path )
 
@@ -62,14 +52,12 @@ class CommonDirectories < Arachni::Module::Base
             |dirname|
 
             url  = path + dirname + '/'
-            print_status( "Checking for #{url}" )
 
-            req  = @http.get( url, :train => true )
+            print_status( "Checking for #{url}" )
 
-            req.on_complete {
+            log_remote_directory_if_exists( url ) {
                 |res|
-                print_status( "Analyzing #{res.effective_url}" )
-                __log_results( res, dirname )
+                print_ok( "Found #{dirname} at " + res.effective_url )
             }
         }
 
@@ -82,13 +70,13 @@ class CommonDirectories < Arachni::Module::Base
             :description    => %q{Tries to find common directories on the server.},
             :elements       => [ ],
             :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
-            :version        => '0.1.4',
+            :version        => '0.2.1',
             :references     => {},
             :targets        => { 'Generic' => 'all' },
             :issue   => {
                 :name        => %q{A common directory exists on the server.},
                 :description => %q{},
-                :tags        => [ 'path', 'directory', 'common' ],
+                :tags        => [ 'path', 'directory', 'common', 'discovery' ],
                 :cwe         => '538',
                 :severity    => Issue::Severity::MEDIUM,
                 :cvssv2       => '',
@@ -99,40 +87,6 @@ class CommonDirectories < Arachni::Module::Base
         }
     end
 
-    #
-    # Adds an issue to the @results array<br/>
-    # and outputs an "OK" message with the dirname and its url.
-    #
-    # @param  [Net::HTTPResponse]  res   the HTTP response
-    # @param  [String]  dirname   the discovered dirname
-    # @param  [String]  url   the url of the discovered file
-    #
-    def __log_results( res, dirname )
-
-        return if( res.code != 200 || @http.custom_404?( res ) )
-
-        url = res.effective_url
-        # append the result to the results array
-        @results << Issue.new( {
-            :url          => url,
-            :injected     => dirname,
-            :id           => dirname,
-            :elem         => Issue::Element::PATH,
-            :response     => res.body,
-            :headers      => {
-                :request    => res.request.headers,
-                :response   => res.headers,
-            }
-        }.merge( self.class.info ) )
-
-        # inform the user that we have a match
-        print_ok( "Found #{dirname} at " + url )
-
-        # register our results with the system
-        register_results( @results )
-
-    end
-
 end
 end
 end