arachni 0.3 → 0.4

data/modules/recon/common_files.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -9,7 +9,6 @@
 =end
 
 module Arachni
-
 module Modules
 
 #
@@ -18,24 +17,17 @@ module Modules
 # @author: Tasos "Zapotek" Laskos
 #                                      <tasos.laskos@gmail.com>
 #                                      <zapotek@segfault.gr>
-# @version: 0.1.3
+# @version: 0.2.1
 #
 #
 class CommonFiles < Arachni::Module::Base
 
     include Arachni::Module::Utilities
 
-    def initialize( page )
-        super( page )
-    end
-
     def prepare
         # to keep track of the requests and not repeat them
         @@__audited ||= Set.new
 
-        # our results array
-        @results = []
-
         @@__filenames ||=[]
         return if !@@__filenames.empty?
 
@@ -45,8 +37,7 @@ class CommonFiles < Arachni::Module::Base
         }
     end
 
-    def run( )
-
+    def run
         path = get_path( @page.url )
         return if @@__audited.include?( path )
 
@@ -54,23 +45,13 @@ class CommonFiles < Arachni::Module::Base
         @@__filenames.each {
             |file|
 
-            #
-            # Test for the existance of the file
-            #
-            # We're not worrying about its contents, the Trainer will
-            # analyze it and if it's HTML it'll extract any new attack vectors.
-            #
-
             url  = path + file
 
             print_status( "Checking for #{url}" )
 
-            req  = @http.get( url, :train => true )
-
-            req.on_complete {
+            log_remote_file_if_exists( url ) {
                 |res|
-                print_status( "Analyzing #{res.effective_url}" )
-                __log_results( res, file )
+                print_ok( "Found #{file} at " + res.effective_url )
             }
         }
 
@@ -84,13 +65,13 @@ class CommonFiles < Arachni::Module::Base
             :description    => %q{Tries to find common sensitive files on the server.},
             :elements       => [ ],
             :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
-            :version        => '0.1.3',
+            :version        => '0.2.1',
             :references     => {},
             :targets        => { 'Generic' => 'all' },
             :issue   => {
                 :name        => %q{A common sensitive file exists on the server.},
                 :description => %q{},
-                :tags        => [ 'common', 'path', 'file' ],
+                :tags        => [ 'common', 'path', 'file', 'discovery' ],
                 :cwe         => '',
                 :severity    => Issue::Severity::LOW,
                 :cvssv2       => '',
@@ -101,38 +82,6 @@ class CommonFiles < Arachni::Module::Base
         }
     end
 
-    #
-    # Adds an issue to the @results array<br/>
-    # and outputs an "OK" message with the filename and its url.
-    #
-    # @param  [Net::HTTPResponse]  res   the HTTP response
-    # @param  [String]  filename   the discovered filename
-    #
-    def __log_results( res, filename )
-
-        return if( res.code != 200 || @http.custom_404?( res ) )
-
-        url = res.effective_url
-        # append the result to the results array
-        @results << Issue.new( {
-            :url          => url,
-            :injected     => filename,
-            :id           => filename,
-            :elem         => Issue::Element::PATH,
-            :response     => res.body,
-            :headers      => {
-                :request    => res.request.headers,
-                :response   => res.headers,
-            }
-        }.merge( self.class.info ) )
-
-        # register our results with the system
-        register_results( @results )
-
-        # inform the user that we have a match
-        print_ok( "Found #{filename} at " + url )
-    end
-
 end
 end
 end

data/modules/recon/directory_listing.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -9,7 +9,6 @@
 =end
 
 module Arachni
-
 module Modules
 
 #
@@ -20,7 +19,7 @@ module Modules
 # @author: Tasos "Zapotek" Laskos
 #                                      <tasos.laskos@gmail.com>
 #                                      <zapotek@segfault.gr>
-# @version: 0.1
+# @version: 0.1.2
 #
 class DirectoryListing < Arachni::Module::Base
 
@@ -28,10 +27,6 @@ class DirectoryListing < Arachni::Module::Base
 
     DIFF_THRESHOLD = 1000
 
-    def initialize( page )
-        super( page )
-    end
-
     def prepare
         foo = File.basename( __FILE__, '.rb' )
         @dirs = [
@@ -44,8 +39,7 @@ class DirectoryListing < Arachni::Module::Base
        @@__checked ||= Set.new
     end
 
-    def run( )
-
+    def run
         return if @page.code != 200
         path = get_path( @page.url )
 
@@ -129,7 +123,7 @@ class DirectoryListing < Arachni::Module::Base
             :description    => %q{Tries to force directory listings.},
             :elements       => [ ],
             :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.1',
+            :version        => '0.1.2',
             :references     => {},
             :targets        => { 'Generic' => 'all' },
             :issue   => {
@@ -150,7 +144,7 @@ class DirectoryListing < Arachni::Module::Base
 
         return if res.code != 200 || res.body.empty?
 
-        issue = Issue.new( {
+        log_issue(
             :url          => res.effective_url,
             :method       => res.request.method.to_s.upcase,
             :elem         => Issue::Element::SERVER,
@@ -159,10 +153,7 @@ class DirectoryListing < Arachni::Module::Base
                 :request    => res.request.headers,
                 :response   => res.headers,
             }
-        }.merge( self.class.info ) )
-
-        # register our results with the system
-        register_results( [issue] )
+        )
 
         print_ok( 'Found: ' + res.effective_url )
     end

data/modules/recon/grep/captcha.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License

data/modules/recon/grep/credit_card.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -16,57 +16,92 @@ module Modules
 #
 # Scans every page for credit card numbers.
 #
-# @author: morpheuslaw <msidagni@nopsec.com>
-# @version: 0.1
+# @author: morpheuslaw <msidagni@nopsec.com>, Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+# @version: 0.2
+#
+# @see http://en.wikipedia.org/wiki/Bank_card_number
+# @see http://en.wikipedia.org/wiki/Luhn_algorithm
 #
 class CreditCards < Arachni::Module::Base
 
-    def initialize( page )
-        @page = page
-    end
+    def run
+        return if !text?
 
-    def run( )
-        ccNumber = /\b(((4\d{3})|(5[1-5]\d{2})|(6011))-?\d{4}-?\d{4}-?\d{4}|3[4,7][\d\s-]{15})\b/
+        ccNumber = /\b(((4\d{3})|(5[1-5]\d{2})|(6011))[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}|3[4,7][\d\s-]{15})\b/
 
         # match CC number candidates and verify matches before logging
         match_and_log( ccNumber ){
             |match|
-            __luhn_check( match )
+            valid_credit_card?( match )
+        }
+    end
+
+    def text?
+        @page.response_headers.each {
+            |k, v|
+            return true if k.downcase == 'content-type' && v.include?( 'text' )
         }
+        return false
     end
 
     #
     # Checks for a valid credit card number
     #
-    def __luhn_check( cc_number )
-      cc_number   = cc_number.gsub( /D/, '' )
-      cc_length   = cc_number.length
-      parity      = cc_length % 2
+    def valid_credit_card?( number )
+        return if !valid_association?( number )
 
-      sum = 0
-      for i in 0..cc_length
-         digit = cc_number[i].to_i - 48
+        number = number.to_s.gsub( /\D/, '' )
+        number.reverse!
 
-         if i % 2 == parity
-           digit = digit * 2
-         end
+        relative_number = {
+            '0' => 0,
+            '1' => 2,
+            '2' => 4,
+            '3' => 6,
+            '4' => 8,
+            '5' => 1,
+            '6' => 3,
+            '7' => 5,
+            '8' => 7,
+            '9' => 9
+        }
+
+        sum = 0
 
-         if digit > 9
-           digit = digit - 9
-         end
+        number.split( '' ).each_with_index {
+            |n, i|
+            sum += ( i % 2 == 0 ) ? n.to_i : relative_number[n]
+        }
+
+        sum % 10 == 0
+    end
 
-         sum = sum + digit
-      end
+    def valid_association?( number )
+        number = number.to_s.gsub( /\D/, '' )
 
-      return (sum % 10) == 0
+        return :dinners  if number.length == 14 && number =~ /^3(0[0-5]|[68])/
+        return :amex     if number.length == 15 && number =~ /^3[47]/
+        return :visa     if [13,16].include?(number.length) && number =~ /^4/
+        return :master   if number.length == 16 && number =~ /^5[1-5]/
+        return :discover if number.length == 16 && number =~ /^6011/
+        return nil
     end
 
     def self.info
         {
             :name           => 'Credit card number disclosure',
             :description    => %q{Scans pages for credit card numbers.},
-            :author         => 'morpheuslaw <msidagni@nopsec.com>',
-            :version        => '0.1',
+            :author         => [
+                'morpheuslaw <msidagni@nopsec.com>', # original
+                # updated number checks and regexp
+                'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>'
+            ],
+            :version        => '0.2',
+            :references     => {
+                'Wikipedia - Bank card number' => 'http://en.wikipedia.org/wiki/Bank_card_number',
+                'Wikipedia - Luhn algorithm' => 'http://en.wikipedia.org/wiki/Luhn_algorithm',
+                'Luhn Ruby implementation'   => 'https://gist.github.com/1182499'
+            },
             :targets        => { 'Generic' => 'all' },
             :issue   => {
                 :name        => %q{Credit card number disclosure.},

data/modules/recon/grep/cvs_svn_users.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License

data/modules/recon/grep/emails.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License

data/modules/recon/grep/html_objects.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License

data/modules/recon/grep/private_ip.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License

data/modules/recon/grep/ssn.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -12,11 +12,8 @@ module Arachni
 module Modules
 
 #
-#
-# @author: Tasos "Zapotek" Laskos
-#                                      <tasos.laskos@gmail.com>
-#                                      <zapotek@segfault.gr>
-# @version: 0.1
+# @author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>, haliphax
+# @version: 0.1.1
 #
 class SSN < Arachni::Module::Base
 
@@ -25,7 +22,7 @@ class SSN < Arachni::Module::Base
     end
 
     def run( )
-        regexp = /^(?!000)([0-6]\d{2}|7([0-6]\d|7[012]))([ -]?)(?!00)\d\d\3(?!0000)\d{4}$/
+        regexp = /\b(?!000)([0-6]\d{2}|7([0-6]\d|7[012]))([ -]?)(?!00)\d\d\3(?!0000)\d{4}\b/
         match_and_log( regexp )
     end
 
@@ -33,8 +30,11 @@ class SSN < Arachni::Module::Base
         {
             :name           => 'SSN',
             :description    => %q{Greps pages for disclosed US Social Security Numbers.},
-            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.1',
+            :author         => [
+                'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>', # original
+                'haliphax' # tweaked regexp
+            ],
+            :version        => '0.1.1',
             :targets        => { 'Generic' => 'all' },
             :issue   => {
                 :name        => %q{Disclosed US Social Security Number.},

data/modules/recon/htaccess_limit.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -9,24 +9,19 @@
 =end
 
 module Arachni
-
 module Modules
 
 #
 # @author: Tasos "Zapotek" Laskos
 #                                      <tasos.laskos@gmail.com>
 #                                      <zapotek@segfault.gr>
-# @version: 0.1
+# @version: 0.1.2
 #
 class Htaccess < Arachni::Module::Base
 
     include Arachni::Module::Utilities
 
-    def initialize( page )
-        super( page )
-    end
-
-    def run( )
+    def run
         return if @page.code != 401
 
         @http.post( @page.url ).on_complete {
@@ -42,7 +37,7 @@ class Htaccess < Arachni::Module::Base
                 GET requests but allows POST.},
             :elements       => [ ],
             :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.1',
+            :version        => '0.1.2',
             :references     => {},
             :targets        => { 'Generic' => 'all' },
             :issue   => {
@@ -60,7 +55,7 @@ class Htaccess < Arachni::Module::Base
 
     def __log_results( res )
 
-        issue = Issue.new( {
+        log_issue(
             :url          => res.effective_url,
             :method       => res.request.method.to_s.upcase,
             :elem         => Issue::Element::SERVER,
@@ -69,10 +64,7 @@ class Htaccess < Arachni::Module::Base
                 :request    => res.request.headers,
                 :response   => res.headers,
             }
-        }.merge( self.class.info ) )
-
-        # register our results with the system
-        register_results( [issue] )
+        )
 
         print_ok( 'Request was accepted: ' + res.effective_url )
     end