arachni 0.3 → 0.4

data/plugins/{healthmap.rb → defaults/healthmap.rb}

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -17,31 +17,18 @@ module Plugins
 # @author: Tasos "Zapotek" Laskos
 #                                      <tasos.laskos@gmail.com>
 #                                      <zapotek@segfault.gr>
-# @version: 0.1
+# @version: 0.1.1
 #
 class HealthMap < Arachni::Plugin::Base
 
     include Arachni::Module::Utilities
 
-    #
-    # @param    [Arachni::Framework]    framework
-    # @param    [Hash]        options    options passed to the plugin
-    #
-    def initialize( framework, options )
-        @framework = framework
-        @options   = options
-    end
-
     def prepare
-        while( @framework.running? )
-            ::IO.select( nil, nil, nil, 1 )
-        end
-
+        wait_while_framework_running
         @audit_store = @framework.audit_store( true )
     end
 
-    def run( )
-
+    def run
         sitemap  = @audit_store.sitemap.map{ |url| normalize( url ) }.uniq
         sitemap |= issue_urls = @audit_store.issues.map { |issue| issue.url }.uniq
 
@@ -79,12 +66,37 @@ class HealthMap < Arachni::Plugin::Base
         url.gsub( '?' + query, '' )
     end
 
+    def self.distributable?
+        true
+    end
+
+    def self.merge( results )
+        merged = {
+            :map    => [],
+            :total  => 0,
+            :safe   => 0,
+            :unsafe => 0,
+            :issue_percentage => 0
+        }
+
+        results.each {
+            |healthmap|
+            merged[:map]    |= healthmap[:map]
+            merged[:total]  += healthmap[:total]
+            merged[:safe]   += healthmap[:safe]
+            merged[:unsafe] += healthmap[:unsafe]
+        }
+        merged[:issue_percentage] = ( ( Float( merged[:unsafe] ) / merged[:total] ) * 100 ).round
+        return merged
+    end
+
+
     def self.info
         {
             :name           => 'Health map',
             :description    => %q{Generates a simple list of safe/unsafe URLs.},
             :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.1',
+            :version        => '0.1.1',
         }
     end
 

data/plugins/defaults/metamodules/remedies/discovery.rb

@@ -0,0 +1,164 @@
+=begin
+                  Arachni
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+
+  This is free software; you can copy and distribute and modify
+  this program under the term of the GPL v2.0 License
+  (See LICENSE file for details)
+
+=end
+
+module Arachni
+module Plugins
+
+#
+# Catches custom 404 or similar server behavior that can confuse discovery
+# modules.
+#
+# This is relatively easy to determine since valid responses to discovery modules
+# should vary wildly while custom 404 responses will have many comonalities
+# every time.
+#
+# This is a sort of baseline implementation/anomaly detection.
+#
+# @author: Tasos "Zapotek" Laskos
+#                                      <tasos.laskos@gmail.com>
+#                                      <zapotek@segfault.gr>
+# @version: 0.1.1
+#
+class Discovery < Arachni::Plugin::Base
+
+    include Arachni::Module::Utilities
+
+    # look for issues containing the following tags
+    TAGS = [ [ 'file', 'discovery' ], [ 'directory', 'discovery' ] ]
+
+    # valid responses to discovery modules should vary *wildly*
+    # especially considereing the types of directories and files that
+    # these modules look for
+    #
+    # on the other hand custom 404 or such responses will have many things
+    # in common which makes it possible to spot them without much bother
+    SIMILARITY_TOLERANCE = 0.25
+
+    def prepare
+        wait_while_framework_running
+    end
+
+    def run
+        # URL path => issue array
+        issues_per_path = {}
+
+        # URL path => rdiff of response bodies
+        diffs_per_path  = {}
+
+        # URL path => size of responses
+        response_size_per_path  = {}
+
+        on_relevant_issues {
+            |issue, idx|
+
+            # discovery issues only have 1 variation
+            variation = issue.variations.first
+
+            # grab the URL path of the issue which will actually be the
+            # parent of the logged page because whatever is under the parent path
+            # will control the behavior under that path
+            #
+            # did that make any sense?
+            path = File.dirname( URI( normalize_url( variation['url'] ) ).path )
+
+            # gathering total response sizes for issues per path
+            response_size_per_path[path] ||= 0
+            response_size_per_path[path] += variation['response'].size
+
+            # categorize issues per path as well
+            issues_per_path[path] ||= []
+            issues_per_path[path] << {
+                'hash'   => issue._hash,
+                'index'  => idx + 1,
+                'url'    => issue.url,
+                'name'   => issue.name,
+            }
+
+            # extract the static parts of the responses in order to determine
+            # how much of them doesn't change between requests
+            #
+            # large deviations between responses are good because it means that
+            # we're not dealing with some custom not-found response (or something similar)
+            # as these types of responses are pretty much similar to each other
+            #
+            # on the other hand, valid responses will be dissimilar since the
+            # discovery modules look for different things.
+            if !diffs_per_path[path]
+                diffs_per_path[path] = variation['response']
+            else
+                diffs_per_path[path] = diffs_per_path[path].rdiff( variation['response'] )
+            end
+        }
+
+        issues = []
+        diffs_per_path.each_pair {
+            |path, diff|
+
+            # calculate the similarity factor of the responses under the current path
+            similarity = Float( diff.size * issues_per_path[path].size ) / response_size_per_path[path]
+
+            # gotcha!
+            if similarity >= SIMILARITY_TOLERANCE
+                issues |= issues_per_path[path]
+            end
+        }
+
+        register_results( issues ) if !issues.empty?
+    end
+
+    #
+    # Passes each issue that was logged by a discovery module to the block.
+    #
+    # @param    [Proc]   &block
+    #
+    def on_relevant_issues( &block )
+        @framework.audit_store.issues.each_with_index {
+            |issue, idx|
+
+            if includes_tags?( issue.tags )
+                block.call( issue, idx )
+            end
+        }
+    end
+
+    #
+    # Checks if 'tags' contain any item in {TAGS}
+    #
+    # @param    [Array]     tags
+    #
+    # @return   [Bool]
+    #
+    def includes_tags?( tags )
+        TAGS.each {
+            |tag_pair|
+            intersection = (tags & tag_pair)
+            return true if intersection && (intersection.size  == tag_pair.size)
+        }
+        return false
+    end
+
+    def self.info
+        {
+            :name           => 'Discovery module response anomalies',
+            :description    => %q{Analyzes the scan results and identifies issues logged by discovery modules
+                (i.e. modules that look for certain files and folders on the server),
+                while the server responses were exhibiting an anomalous factor of similarity.
+
+                There's a good chance that these issues are false positives.},
+            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
+            :version        => '0.1.1',
+            :tags           => [ 'anomaly' , 'discovery', 'file', 'directories', 'meta']
+        }
+    end
+
+end
+
+end
+end

data/plugins/defaults/metamodules/remedies/manual_verification.rb

@@ -0,0 +1,65 @@
+=begin
+                  Arachni
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+
+  This is free software; you can copy and distribute and modify
+  this program under the term of the GPL v2.0 License
+  (See LICENSE file for details)
+
+=end
+
+module Arachni
+module Plugins
+
+#
+# Gathers all issues that require manual verification into an array.
+#
+# @author: Tasos "Zapotek" Laskos
+#                                      <tasos.laskos@gmail.com>
+#                                      <zapotek@segfault.gr>
+# @version: 0.1.1
+#
+class ManualVerification < Arachni::Plugin::Base
+
+    def prepare
+        wait_while_framework_running
+    end
+
+    def run
+        # will hold the hash IDs of inconclusive issues
+        inconclusive = []
+        @framework.audit_store.issues.each.with_index {
+            |issue, idx|
+            next if !issue.verification
+
+            inconclusive << {
+                'hash'   => issue._hash,
+                'index'  => idx + 1,
+                'url'    => issue.url,
+                'name'   => issue.name,
+                'var'    => issue.var,
+                'elem'   => issue.elem,
+                'method' => issue.method
+            }
+        }
+
+        register_results( inconclusive ) if !inconclusive.empty?
+    end
+
+    def self.info
+        {
+            :name           => 'Issues requiring manual verification',
+            :description    => %q{The HTTP responses of the issues logged by this plugin exhibit a suspicious pattern
+                even before any audit action has taken place -- this challenges the relevance of the audit procedure.
+
+                Thus, these issues require manual verification.},
+            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
+            :version        => '0.1.1',
+            :tags           => [ 'anomaly' , 'verification', 'meta' ]
+        }
+    end
+
+end
+
+end
+end

data/{metamodules/timeout_notice.rb → plugins/defaults/metamodules/remedies/timing_attacks.rb}

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -9,7 +9,7 @@
 =end
 
 module Arachni
-module MetaModules
+module Plugins
 
 #
 # Provides a notice for issues uncovered by timing attacks when the affected audited
@@ -18,9 +18,9 @@ module MetaModules
 # @author: Tasos "Zapotek" Laskos
 #                                      <tasos.laskos@gmail.com>
 #                                      <zapotek@segfault.gr>
-# @version: 0.1
+# @version: 0.1.3
 #
-class TimeoutNotice < Base
+class TimingAttacks < Arachni::Plugin::Base
 
     include Arachni::Module::Utilities
 
@@ -31,17 +31,12 @@ class TimeoutNotice < Base
     # in order to be considered
     TIME_THRESHOLD = 0.6
 
-    def initialize( framework )
-        @framework = framework
-        @http = framework.http
-
+    def prepare
         @times = {}
         @counter = {}
-    end
 
-    def prepare
         # run for each response as it arrives
-        @http.add_on_complete {
+        @framework.http.add_on_complete {
             |res|
 
             # we don't care about non OK responses
@@ -57,10 +52,11 @@ class TimeoutNotice < Base
             # add up all requests for each path
             @counter[path] += 1
         }
+
+        wait_while_framework_running
     end
 
     def run
-
         avg = get_avg
 
         # will hold the hash IDs of inconclusive issues
@@ -82,7 +78,7 @@ class TimeoutNotice < Base
             end
         }
 
-        return inconclusive
+        register_results( inconclusive ) if !inconclusive.empty?
     end
 
     def get_avg
@@ -97,19 +93,27 @@ class TimeoutNotice < Base
         return avg
     end
 
+    def self.distributable?
+        true
+    end
+
+    def self.merge( results )
+        results.flatten
+    end
+
     def self.info
-        super.merge( {
-            :description    => %q{These logged issues used timing attacks.
-                However, the affected web pages demonstrated an unusually high response time rendering
-                these results inconclusive or (possibly) false positives.
+        {
+            :name           => 'Timing attack anomalies',
+            :description    => %q{Analyzes the scan results and logs issues that used timing attacks
+                while the affected web pages demonstrated an unusually high response time.
+                A situation which renders the logged issues inconclusive or (possibly) false positives.
 
                 Pages with high response times usually include heavy-duty processing
-                which makes them prime targets for Denial-of-Service attacks.
-
-                Nomatter the case, please do look into the situation further.},
+                which makes them prime targets for Denial-of-Service attacks.},
             :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.1',
-        } )
+            :version        => '0.1.3',
+            :tags           => [ 'anomaly' , 'timing', 'attacks', 'meta' ]
+        }
     end
 
 end

data/{metamodules → plugins/defaults/metamodules}/uniformity.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -9,7 +9,7 @@
 =end
 
 module Arachni
-module MetaModules
+module Plugins
 
 #
 # Goes through all the issues and checks for signs of uniformity using
@@ -23,9 +23,9 @@ module MetaModules
 # @author: Tasos "Zapotek" Laskos
 #                                      <tasos.laskos@gmail.com>
 #                                      <zapotek@segfault.gr>
-# @version: 0.1
+# @version: 0.1.1
 #
-class Uniformity < Base
+class Uniformity < Arachni::Plugin::Base
 
     include Arachni::Module::Utilities
 
@@ -38,12 +38,11 @@ class Uniformity < Base
         Issue::Element::HEADER
     ]
 
-    def initialize( framework )
-        @framework = framework
+    def prepare
+        wait_while_framework_running
     end
 
     def run
-
         # will hold the hash IDs of inconclusive issues
         uniformals = {}
         pages      = {}
@@ -79,17 +78,19 @@ class Uniformity < Base
         pages.reject!{ |k, v| v.size == 1 }
 
         return if pages.empty?
-        return { 'uniformals' => uniformals, 'pages' => pages }
+        register_results(  { 'uniformals' => uniformals, 'pages' => pages } )
     end
 
     def self.info
-        super.merge( {
-            :description    => %q{The same issue(s) persist(s) across different pages.
-                This is usually a sign for a lack of a central/single point of input
-                sanitization, a bad coding practise.},
+        {
+            :name           => 'Uniformity (Lack of central sanitization)',
+            :description    => %q{Analyzes the scan results and logs issues which persist across different pages.
+                This is usually a sign for a lack of a central/single point of input sanitization,
+                a bad coding practise.},
             :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.1',
-        } )
+            :tags           => [ 'meta' ],
+            :version        => '0.1.1'
+        }
     end
 
 end