arachni 0.3 → 0.4

data/modules/recon/http_put.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -9,7 +9,6 @@
 =end
 
 module Arachni
-
 module Modules
 
 #
@@ -18,22 +17,18 @@ module Modules
 # @author: Tasos "Zapotek" Laskos
 #                                      <tasos.laskos@gmail.com>
 #                                      <zapotek@segfault.gr>
-# @version: 0.1.1
+# @version: 0.1.3
 #
 class HTTP_PUT < Arachni::Module::Base
 
     include Arachni::Module::Utilities
 
-    def initialize( page )
-        super( page )
-
+    def prepare
         @@__checked ||= Set.new
     end
 
-    def run( )
-
+    def run
         path = get_path( @page.url ) + 'Arachni-' + seed.to_s[0..4].to_s
-
         return if @@__checked.include?( path )
         @@__checked << path
 
@@ -55,7 +50,7 @@ class HTTP_PUT < Arachni::Module::Base
             :description    => %q{Checks if uploading files is possible using the HTTP PUT method.},
             :elements       => [ ],
             :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.1.1',
+            :version        => '0.1.3',
             :references     => {},
             :targets        => { 'Generic' => 'all' },
             :issue   => {
@@ -73,7 +68,7 @@ class HTTP_PUT < Arachni::Module::Base
 
     def __log_results( res )
 
-        issue = Issue.new( {
+        log_issue(
             :url          => res.effective_url,
             :method       => res.request.method.to_s.upcase,
             :elem         => Issue::Element::SERVER,
@@ -82,10 +77,7 @@ class HTTP_PUT < Arachni::Module::Base
                 :request    => res.request.headers,
                 :response   => res.headers,
             }
-        }.merge( self.class.info ) )
-
-        # register our results with the system
-        register_results( [issue] )
+        )
 
         print_ok( 'File has been created: ' + res.effective_url )
     end

data/modules/recon/interesting_responses.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -11,7 +11,6 @@
 require 'digest/md5'
 
 module Arachni
-
 module Modules
 
 #
@@ -20,7 +19,7 @@ module Modules
 # @author: Tasos "Zapotek" Laskos
 #                                      <tasos.laskos@gmail.com>
 #                                      <zapotek@segfault.gr>
-# @version: 0.1.1
+# @version: 0.1.3
 #
 #
 class InterestingResponses < Arachni::Module::Base
@@ -32,14 +31,12 @@ class InterestingResponses < Arachni::Module::Base
         404
     ]
 
-    def initialize( page )
-        super( page )
-
+    def prepare
         # we need to run only once
         @@__ran ||= false
     end
 
-    def run( )
+    def run
         return if @@__ran
 
         print_status( "Listening..." )
@@ -62,7 +59,7 @@ class InterestingResponses < Arachni::Module::Base
             :description    => %q{Logs all non 200 (OK) server responses.},
             :elements       => [ ],
             :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.1.1',
+            :version        => '0.1.3',
             :targets        => { 'Generic' => 'all' },
             :issue   => {
                 :name        => %q{Interesting server response.},
@@ -94,7 +91,7 @@ class InterestingResponses < Arachni::Module::Base
         @@_loged[:paths]   << path
         @@_loged[:digests] << digest
 
-        issue = Issue.new( {
+        log_issue(
             :url          => res.effective_url,
             :method       => res.request.method.to_s.upcase,
             :id           => "Code: #{res.code.to_s}",
@@ -104,10 +101,7 @@ class InterestingResponses < Arachni::Module::Base
                 :request    => res.request.headers,
                 :response   => res.headers,
             }
-        }.merge( self.class.info ) )
-
-        # register our results with the system
-        register_results( [issue] )
+        )
 
         # inform the user that we have a match
         print_ok( "Found an interesting response (Code: #{res.code.to_s})." )

data/modules/recon/mixed_resource.rb

@@ -0,0 +1,100 @@
+=begin
+                  Arachni
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+
+  This is free software; you can copy and distribute and modify
+  this program under the term of the GPL v2.0 License
+  (See LICENSE file for details)
+
+=end
+
+module Arachni
+module Modules
+
+#
+# Mixed Resource detection module
+#
+# Looks for resources served over HTTP when the HTML code is server over HTTPS.
+#
+# @author: Tasos "Zapotek" Laskos
+#                                      <tasos.laskos@gmail.com>
+#                                      <zapotek@segfault.gr>
+# @version: 0.1.1
+#
+# @see http://googleonlinesecurity.blogspot.com/2011/06/trying-to-end-mixed-scripting.html
+#
+class MixedResource < Arachni::Module::Base
+
+    def prepare
+        @@__audited ||= Set.new
+    end
+
+    def run
+        return if !https?( @page.url )
+
+        print_status( 'Checking...' )
+
+        doc = Nokogiri::HTML( @page.html )
+        doc.xpath( './/script' ).each {
+            |script|
+
+            url = script.attributes['src'].to_s
+            next if !url || https?( url ) || url.empty?
+
+            log_resource( url )
+        }
+
+        doc.xpath( './/link' ).each {
+            |script|
+
+            url = script.attributes['href'].to_s
+            if !url || !script.attributes['rel'].to_s.downcase == 'stylesheet' ||
+                https?( url ) || url.empty?
+                next
+            end
+
+            log_resource( url )
+        }
+    end
+
+    def https?( url )
+        URI( url ).scheme == 'https'
+    end
+
+    def log_resource( url )
+        return if @@__audited.include?( url )
+
+        @@__audited << url
+
+        match_and_log( url )
+    end
+
+    def self.info
+        {
+            :name           => 'Mixed Resource',
+            :description    => %q{Looks for resources served over HTTP when the HTML code is server over HTTPS.},
+            :elements       => [
+                Issue::Element::BODY
+            ],
+            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
+            :version        => '0.1.1',
+            :references     => {
+                'Google Online Security Blog' =>
+                    'http://googleonlinesecurity.blogspot.com/2011/06/trying-to-end-mixed-scripting.html'
+            },
+            :targets        => { 'Generic' => 'all' },
+            :issue   => {
+                :name        => %q{Mixed Resource},
+                :description => %q{Serving resources over an unencrypted channel
+                    while the HTML code is served over HTTPS can lead to
+                    Man-In-The-Middle attacks and provide a false sense of security.},
+                :tags        => [ 'unencrypted', 'resource', 'javascript', 'stylesheet' ],
+                :severity    => Issue::Severity::MEDIUM,
+            }
+
+        }
+    end
+
+end
+end
+end

data/modules/recon/unencrypted_password_forms.rb

@@ -1,8 +1,6 @@
 =begin
-  $Id$
-
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -11,7 +9,6 @@
 =end
 
 module Arachni
-
 module Modules
 
 #
@@ -22,29 +19,21 @@ module Modules
 # @author: Tasos "Zapotek" Laskos
 #                                      <tasos.laskos@gmail.com>
 #                                      <zapotek@segfault.gr>
-# @version: 0.1.1
+# @version: 0.1.3
 #
 # @see http://www.owasp.org/index.php/Top_10_2010-A9-Insufficient_Transport_Layer_Protection
 #
 class UnencryptedPasswordForms < Arachni::Module::Base
 
-    def initialize( page )
-        # in this case we don't need to call the parent
-        @page = page
-
-        @results    = []
+    def prepare
         @@__audited ||= Set.new
     end
 
-    def run( )
-
+    def run
         @page.forms.each {
             |form|
             __check( form )
         }
-
-        # register our results with the system
-        register_results( @results )
     end
 
     def __check( form )
@@ -66,7 +55,7 @@ class UnencryptedPasswordForms < Arachni::Module::Base
     def __log( url, input )
 
         if @@__audited.include?( input['name'] )
-            print_info( 'Skipping already audited field \'' +
+            print_info( 'Skipping already checked form \'' +
                 input['name'] + '\' of url: ' + url )
             return
         end
@@ -74,13 +63,12 @@ class UnencryptedPasswordForms < Arachni::Module::Base
         name = input['name'] || input['id'] || 'n/a'
         @@__audited << name
 
-        # append the result to the results array
-        @results << Issue.new( {
+        log_issue(
             :var          => name,
             :url          => url,
             :elem         => Issue::Element::FORM,
             :response     => @page.html,
-        }.merge( self.class.info ) )
+        )
 
         print_ok( "Found unprotected password field '#{input['name']}' at #{url}" )
 
@@ -95,7 +83,7 @@ class UnencryptedPasswordForms < Arachni::Module::Base
                 Issue::Element::FORM
             ],
             :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
-            :version        => '0.1',
+            :version        => '0.1.3',
             :references     => {
                 'OWASP Top 10 2010' => 'http://www.owasp.org/index.php/Top_10_2010-A9-Insufficient_Transport_Layer_Protection'
             },

data/modules/recon/webdav.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -9,7 +9,6 @@
 =end
 
 module Arachni
-
 module Modules
 
 #
@@ -21,7 +20,7 @@ module Modules
 # @author: Tasos "Zapotek" Laskos
 #                                      <tasos.laskos@gmail.com>
 #                                      <zapotek@segfault.gr>
-# @version: 0.1
+# @version: 0.1.2
 #
 # @see http://en.wikipedia.org/wiki/WebDAV
 # @see http://www.webdav.org/specs/rfc4918.html
@@ -30,10 +29,6 @@ class WebDav < Arachni::Module::Base
 
     include Arachni::Module::Utilities
 
-    def initialize( page )
-        super( page )
-    end
-
     def prepare
         #
         # Because Dav may be enabled on a per directory basis we will check
@@ -51,10 +46,8 @@ class WebDav < Arachni::Module::Base
         @@__auditted ||= Set.new
     end
 
-    def run( )
-
+    def run
         path = get_path( @page.url )
-
         return if @@__found || @@__auditted.include?( path )
 
         print_status( "Checking: #{path}" )
@@ -77,7 +70,7 @@ class WebDav < Arachni::Module::Base
             :description    => %q{Checks for WebDAV enabled directories.},
             :elements       => [ ],
             :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.1',
+            :version        => '0.1.2',
             :references     => {
                 'WebDAV.org'    => 'http://www.webdav.org/specs/rfc4918.html',
                 'Wikipedia'    => 'http://en.wikipedia.org/wiki/WebDAV',
@@ -103,7 +96,7 @@ class WebDav < Arachni::Module::Base
 
         @@__found = true
 
-        issue = Issue.new( {
+        log_issue(
             :url          => res.effective_url,
             :method       => res.request.method.to_s.upcase,
             :elem         => Issue::Element::SERVER,
@@ -112,10 +105,7 @@ class WebDav < Arachni::Module::Base
                 :request    => res.request.headers,
                 :response   => res.headers,
             }
-        }.merge( self.class.info ) )
-
-        # register our results with the system
-        register_results( [issue] )
+        )
 
         # inform the user that we have a match
         print_ok( "Enabled for: #{res.effective_url}" )

data/modules/recon/xst.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -9,7 +9,6 @@
 =end
 
 module Arachni
-
 module Modules
 
 #
@@ -20,7 +19,7 @@ module Modules
 # @author: Tasos "Zapotek" Laskos
 #                                      <tasos.laskos@gmail.com>
 #                                      <zapotek@segfault.gr>
-# @version: 0.1.1
+# @version: 0.1.3
 #
 # @see http://cwe.mitre.org/data/definitions/693.html
 # @see http://capec.mitre.org/data/definitions/107.html
@@ -30,14 +29,12 @@ class XST < Arachni::Module::Base
 
     include Arachni::Module::Utilities
 
-    def initialize( page )
-        super( page )
-
+    def prepare
         # we need to run only once
         @@__ran ||= false
     end
 
-    def run( )
+    def run
         return if @@__ran
 
         print_status( "Checking..." )
@@ -61,7 +58,7 @@ class XST < Arachni::Module::Base
             :description    => %q{Sends an HTTP TRACE request and checks if it succeeded.},
             :elements       => [ ],
             :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.1.1',
+            :version        => '0.1.3',
             :references     => {
                 'CAPEC'     => 'http://capec.mitre.org/data/definitions/107.html',
                 'OWASP'     => 'http://www.owasp.org/index.php/Cross_Site_Tracing'
@@ -84,7 +81,7 @@ class XST < Arachni::Module::Base
 
     def __log_results( res )
 
-        issue = Issue.new( {
+        log_issue(
             :url          => res.effective_url,
             :method       => res.request.method.to_s.upcase,
             :elem         => Issue::Element::SERVER,
@@ -93,10 +90,7 @@ class XST < Arachni::Module::Base
                 :request    => res.request.headers,
                 :response   => res.headers,
             }
-        }.merge( self.class.info ) )
-
-        # register our results with the system
-        register_results( [issue] )
+        )
 
         # inform the user that we have a match
         print_ok( "TRACE is enabled." )