arachni 0.3 → 0.4

data/reports/html/default/css/jquery.jqplot.min.css

@@ -0,0 +1 @@
+.jqplot-target{position:relative;color:#666;font-family:"Trebuchet MS",Arial,Helvetica,sans-serif;font-size:1em;}.jqplot-axis{font-size:.75em;}.jqplot-xaxis{margin-top:10px;}.jqplot-x2axis{margin-bottom:10px;}.jqplot-yaxis{margin-right:10px;}.jqplot-y2axis,.jqplot-y3axis,.jqplot-y4axis,.jqplot-y5axis,.jqplot-y6axis,.jqplot-y7axis,.jqplot-y8axis,.jqplot-y9axis,.jqplot-yMidAxis{margin-left:10px;margin-right:10px;}.jqplot-axis-tick,.jqplot-xaxis-tick,.jqplot-yaxis-tick,.jqplot-x2axis-tick,.jqplot-y2axis-tick,.jqplot-y3axis-tick,.jqplot-y4axis-tick,.jqplot-y5axis-tick,.jqplot-y6axis-tick,.jqplot-y7axis-tick,.jqplot-y8axis-tick,.jqplot-y9axis-tick,.jqplot-yMidAxis-tick{position:absolute;white-space:pre;}.jqplot-xaxis-tick{top:0;left:15px;vertical-align:top;}.jqplot-x2axis-tick{bottom:0;left:15px;vertical-align:bottom;}.jqplot-yaxis-tick{right:0;top:15px;text-align:right;}.jqplot-yaxis-tick.jqplot-breakTick{right:-20px;margin-right:0;padding:1px 5px 1px 5px;z-index:2;font-size:1.5em;}.jqplot-y2axis-tick,.jqplot-y3axis-tick,.jqplot-y4axis-tick,.jqplot-y5axis-tick,.jqplot-y6axis-tick,.jqplot-y7axis-tick,.jqplot-y8axis-tick,.jqplot-y9axis-tick{left:0;top:15px;text-align:left;}.jqplot-yMidAxis-tick{text-align:center;white-space:nowrap;}.jqplot-xaxis-label{margin-top:10px;font-size:11pt;position:absolute;}.jqplot-x2axis-label{margin-bottom:10px;font-size:11pt;position:absolute;}.jqplot-yaxis-label{margin-right:10px;font-size:11pt;position:absolute;}.jqplot-yMidAxis-label{font-size:11pt;position:absolute;}.jqplot-y2axis-label,.jqplot-y3axis-label,.jqplot-y4axis-label,.jqplot-y5axis-label,.jqplot-y6axis-label,.jqplot-y7axis-label,.jqplot-y8axis-label,.jqplot-y9axis-label{font-size:11pt;margin-left:10px;position:absolute;}.jqplot-meterGauge-tick{font-size:.75em;color:#999;}.jqplot-meterGauge-label{font-size:1em;color:#999;}table.jqplot-table-legend{margin-top:12px;margin-bottom:12px;margin-left:12px;margin-right:12px;}table.jqplot-table-legend,table.jqplot-cursor-legend{background-color:rgba(255,255,255,0.6);border:1px solid #ccc;position:absolute;font-size:.75em;}td.jqplot-table-legend{vertical-align:middle;}td.jqplot-seriesToggle:hover,td.jqplot-seriesToggle:active{cursor:pointer;}.jqplot-table-legend .jqplot-series-hidden{text-decoration:line-through;}div.jqplot-table-legend-swatch-outline{border:1px solid #ccc;padding:1px;}div.jqplot-table-legend-swatch{width:0;height:0;border-top-width:5px;border-bottom-width:5px;border-left-width:6px;border-right-width:6px;border-top-style:solid;border-bottom-style:solid;border-left-style:solid;border-right-style:solid;}.jqplot-title{top:0;left:0;padding-bottom:.5em;font-size:1.2em;}table.jqplot-cursor-tooltip{border:1px solid #ccc;font-size:.75em;}.jqplot-cursor-tooltip{border:1px solid #ccc;font-size:.75em;white-space:nowrap;background:rgba(208,208,208,0.5);padding:1px;}.jqplot-highlighter-tooltip,.jqplot-canvasOverlay-tooltip{border:1px solid #ccc;font-size:.75em;white-space:nowrap;background:rgba(208,208,208,0.5);padding:1px;}.jqplot-point-label{font-size:.75em;z-index:2;}td.jqplot-cursor-legend-swatch{vertical-align:middle;text-align:center;}div.jqplot-cursor-legend-swatch{width:1.2em;height:.7em;}.jqplot-error{text-align:center;}.jqplot-error-message{position:relative;top:46%;display:inline-block;}div.jqplot-bubble-label{font-size:.8em;padding-left:2px;padding-right:2px;color:rgb(20%,20%,20%);}div.jqplot-bubble-label.jqplot-bubble-label-highlight{background:rgba(90%,90%,90%,0.7);}div.jqplot-noData-container{text-align:center;background-color:rgba(96%,96%,96%,0.3);}

data/reports/html/default/css/main.css

@@ -0,0 +1,391 @@
+    body {
+        background: #ddd;
+        margin:0;
+        padding:0;
+        font-family: Verdana, Geneva, sans-serif;
+        font-size: 12px;
+        color: #333;
+    }
+
+    .wrapper {
+        background: #ddd url('bodybg.png') repeat-x scroll top left;
+    }
+
+    .subpage {
+        background-image: url('bodybg-small.png');
+    }
+
+    * {
+        margin:0;
+        padding:0;
+    }
+
+    /** element defaults **/
+    table {
+        width: 100%;
+        text-align: left;
+    }
+
+    th, td {
+        padding: 10px 10px;
+    }
+
+    th {
+        color: #fff;
+        background: #2978A1 none repeat-x scroll -15px 0;
+    }
+
+    td {
+        color: #111;
+        vertical-align: top
+    }
+
+    code, blockquote {
+        display: block;
+        border-left: 5px solid #ddd;
+        padding: 10px;
+        margin-bottom: 20px;
+    }
+    code {
+        background-color: #ddd;
+        border: none;
+    }
+    blockquote {
+        border-left: 5px solid #333;
+    }
+
+    blockquote p {
+        font-style: italic;
+        font-family: Georgia, "Times New Roman", Times, serif;
+        margin: 0;
+        height: 1%;
+    }
+
+    p {
+        line-height: 1.9em;
+        margin-bottom: 20px;
+    }
+
+    a, .issue a {
+        color: #256F94;
+        text-decoration: none
+    }
+
+    a:hover, .issue a:hover {
+        color: #BC6637;
+    }
+
+    a:focus {
+        outline: none;
+    }
+
+    fieldset {
+        display: block;
+        border: none;
+        border-top: 1px solid #ccc;
+    }
+
+    fieldset legend {
+        font-weight: bold;
+        font-size: 13px;
+        padding-right: 10px;
+        color: #666;
+    }
+
+    fieldset form {
+        padding-top: 15px;
+    }
+
+    fieldset p label {
+        float: left;
+        width: 150px;
+    }
+
+    form input, form select, form textarea {
+        padding: 5px;
+        color: #333333;
+        border: 1px solid #999;
+        font-family: Arial, Helvetica, sans-serif;
+        font-size: 12px;
+        -moz-border-radius: 5px;
+        -webkit-border-radius: 5px;
+    }
+
+    form input.formbutton {
+        border: none;
+        background: #FFFFFF url(bodybg.png) repeat-x scroll 0 -160px;
+        color: #ffffff;
+        font-weight: bold;
+        padding: 5px 10px;
+        font-size: 12px;
+        font-family: Tahoma, Geneva, sans-serif;
+        letter-spacing: 1px;
+        width: auto;
+        overflow: visible;
+        -moz-border-radius: 5px;
+        -webkit-border-radius: 5px;
+    }
+
+    form.searchform p {
+        margin: 5px 0;
+    }
+
+    form.searchform input.s {
+        border: 1px solid #000;
+    }
+
+    form.settings input, textarea {
+        float: right;
+        margin-right: 10px
+    }
+
+    .options input, textarea {
+        float: right;
+        margin-right: 10px
+    }
+
+    form.reset input {
+        float: left;
+    }
+
+
+    span.required {
+        font-family: Verdana, Arial, Helvetica, sans-serif;
+        color: #ff0000;
+    }
+
+    h1 {
+        color: #1F5D7C;
+        font-family: Arial, Helvetica, sans-serif;
+        font-size: 35px;
+    }
+
+    h2 {
+        color: #111;
+        font-family: Arial, Helvetica, sans-serif;
+        font-size: 28px;
+        letter-spacing: -0.5px;
+        padding: 0 0 5px;
+        margin: 0;
+        font-weight: normal;
+    }
+
+    h3 {
+        color: #BC6637;
+        font-family: Arial, Helvetica, sans-serif;
+        font-size: 18px;
+        font-weight: bold;
+        margin-bottom: 10px;
+    }
+
+    h4 {
+        padding-bottom: 10px;
+        font-size: 15px;
+        color: #666;
+    }
+
+    h5 {
+        padding-bottom: 10px;
+        font-size: 13px;
+        color: #666;
+    }
+
+    ul, ol {
+        margin: 0 0 35px 35px;
+    }
+
+    li {
+        padding-bottom: 5px;
+    }
+
+    li ol, li ul {
+        font-size: 1.0em;
+        margin-bottom: 0;
+        padding-top: 5px;
+    }
+
+    iframe {
+        border: 1px solid
+    }
+
+    .clear {
+        clear: both;
+    }
+
+    .notice {
+      color: #222;
+      background: #e3e4e3;
+      border: 1px solid #d5d5d5;
+      padding: 7px 10px;
+      display: block;
+      text-align: left
+      -moz-border-radius: 5px;
+      -webkit-border-radius: 5px;
+    }
+
+    .left {
+        float: left;
+        width: 49%;
+        padding-right: 5px
+    }
+
+    .right {
+        float: right;
+        width: 50%;
+        border-left: 1px
+    }
+
+    .variation{
+        display: none;
+        padding: 20px;
+        padding-left: 40px;
+        padding-top: 0px
+    }
+
+    .hidden {
+        display: none
+    }
+
+    .separator {
+        min-width: 100%;
+        border-bottom: 1px solid #333333
+    }
+
+    .ui-widget-bg { border-top: 1px dotted #aed0ea; font-size:9px;   }
+    .ui-widget-bar {position:absolute;zIndex:10;bottom:0;font-size:10px; }
+
+    .graphs li{
+         list-style-type:none;
+    }
+
+    /* Security Reports Style */
+
+    header, nav, article, section, footer, address {display:block;}
+
+    header{
+        height: 38px;
+        overflow:hidden;
+        background:#e1e1e1;
+        background:-webkit-gradient(linear, left top, left bottom, from(#cccccc), to(#e1e1e1));
+        background:-moz-linear-gradient(top,  #cccccc,  #e1e1e1);
+        padding:0 5px;
+        }
+    header h1{
+        line-height:32px;
+        font-size:14px;
+        text-shadow:#fff 0 1px 0;
+        text-align:center;
+        display: inline
+        }
+
+    nav{
+        height:34px;
+        overflow:hidden;
+        }
+    nav ul{
+        margin:0;
+        padding:0 5px;
+        width:100%;
+        height:34px;
+        -moz-box-shadow:inset -2px 2px 2px #999;
+        -webkit-box-shadow:inset -2px 2px 2px #999;
+        box-shadow:inset -2px 0px 2px #999;
+        background:#ddd;
+        }
+    nav li{
+        list-style:none;
+        float:left;
+        height:24px;
+        line-height:24px;
+        -moz-box-shadow:0 0 3px #888;
+        -webkit-box-shadow:0 0 3px #888;
+        box-shadow:0 0 3px #888;
+        -webkit-border-bottom-right-radius:3px;
+        -webkit-border-bottom-left-radius:3px;
+        -moz-border-radius-bottomright:3px;
+        -moz-border-radius-bottomleft:3px;
+        border-bottom-right-radius:3px;
+        border-bottom-left-radius:3px;
+        margin:0 2px;
+        width:200px;
+        overflow:hidden;
+        position:relative;
+        background:#ccc;
+        background:-webkit-gradient(linear, left top, left bottom, from(#ccc), to(#aaa));
+        background:-moz-linear-gradient(top,  #ccc,  #aaa);
+        }
+    nav li a, nav li a:visited, nav li a:hover{
+        list-style:none;
+        display:block;
+        position:absolute;
+        top:0;
+        left:-2px;
+        height:24px;
+        line-height:24px;
+        width:204px;
+        text-align:center;
+        color:#333;
+        font-size:13px;
+        text-shadow:#e8e8e8 0 1px 0;
+        -moz-box-shadow:inset 0 1px 1px #888;
+        -webkit-box-shadow:inset 0 1px 1px #888;
+        box-shadow:inset 0 1px 1px #888;
+        }
+    nav li.selected {background:#e1e1e1;background:-webkit-gradient(linear, left top, left bottom, from(#e1e1e1), to(#d1d1d1));background:-moz-linear-gradient(top,  #e1e1e1,  #d1d1d1);}
+    nav li.selected a {-moz-box-shadow:none;-webkit-box-shadow:none;box-shadow:none;}
+    nav li a:focus {outline:none;}
+
+    /* style your sections here */
+    section {padding:20px;background:#ddd;}
+    section hr {margin:10px 0;}
+    section h2 {border-bottom:1px solid #444;margin:0 0 20px 0;padding:0 0 10px 0;}
+    section p.notice {
+      white-space: -moz-pre-wrap !important;  /* Mozilla, since 1999 */
+      white-space: -pre-wrap;      /* Opera 4-6 */
+      white-space: -o-pre-wrap;    /* Opera 7 */
+      white-space: pre-wrap;       /* css-3 */
+      word-wrap: break-word;       /* Internet Explorer 5.5+ */
+    }
+    section div.variations form input {cursor:pointer;}
+
+#graphs div {
+    -moz-border-radius: 5px;
+    -webkit-border-radius: 5px;
+    background-color: rgb( 204, 204, 204 );
+    color: rgb( 62, 87, 111 ),
+    font-family: Verdana, sans-serif;
+}
+
+#chart-issues {
+    width: 100%;
+    height: 400px
+}
+
+.jqplot-xaxis-tick {
+    font-family: Verdana;
+}
+
+.jqplot-yaxis-tick {
+    font-family: Verdana;
+    font-size: 12px;
+}
+
+table.jqplot-table-legend {
+    float: right;
+    width: 50px;
+    font-family: Verdana;
+}
+
+#chart-issues-container {
+    height: 400px;
+    padding: 10px;
+}
+
+.jqplot-title {
+    top: 0;
+    left: 0;
+    padding-bottom: .5em;
+    font-size: 1.2em;
+    font-family: Verdana;
+    color: #3E5786;
+}

data/reports/html/default/issue.erb

@@ -0,0 +1,189 @@
+            <div class="issue">
+
+                <h3 id="issue_<%=idx%>">
+                    <a href="#issue_<%=idx%>">[<%=idx%>] <%=escapeHTML(issue.name)%></a>
+                </h3>
+
+                <% if crypto_issues.is_a?( Array ) && crypto_issues[idx-1] %>
+                <p>
+                    <form name="false_positive_<%=j%>" id="false_positive_<%=idx%>">
+                        <input type="hidden" name="module" value="<%=escapeHTML(issue.internal_modname)%>" />
+                        <input type="hidden" name="url" value="<%=escapeHTML(issue.url)%>" />
+                        <input type="hidden" name="issue" value="<%=crypto_issues[idx-1]%>" />
+                        <input onclick="javascript:report_fp( <%=idx%> );" type="button" value="Report false positive" />
+                    </form>
+                </p>
+                <% end %>
+
+
+                <div class="left">
+                    <ul>
+                    <li><strong>Module name</strong>: <%=escapeHTML(issue.mod_name)%> <br/>
+                    (Internal module name: <strong><%=escapeHTML(issue.internal_modname)%></strong>)</li>
+
+                    <% if issue.var %>
+                    <li><strong>Affected variable</strong>: <%=escapeHTML(issue.var)%></li>
+                    <%end%>
+
+                    <li><strong>Affected URL</strong>: <a href="<%=escapeHTML(issue.url)%>"><%=escapeHTML(issue.url)%></a> </li>
+                    <li><strong>HTML Element</strong>: <%=issue.elem%></li>
+                    <li><strong>Requires manual verification?</strong>: <%=issue.verification ? 'Yes' : 'No'%></li>
+                    <hr/>
+
+                    <% if issue.cwe %>
+                    <li><strong>CWE</strong>: <%=issue.cwe%><br/>
+                    (<a target="_blank" href="<%=issue.cwe_url%>"><%=issue.cwe_url%></a>)</li>
+                    <%end%>
+
+                    <li><strong>Severity</strong>: <%=issue.severity%></li>
+                    <li><strong>CVSSV2</strong>: <%=issue.cvssv2%></li>
+
+                    </ul>
+
+                    <p>
+                        <h3>References</h3>
+                        <ul>
+                            <% if issue.references && !issue.references.empty? %>
+                            <% issue.references.each_pair do |source, url| %>
+
+                            <li><%=escapeHTML(source)%> - <a target="_blank" href="<%=url%>"><%=url%></a></li>
+
+                            <%end%>
+                            <%else%>
+                                <li>N/A</li>
+                            <%end%>
+                        </ul>
+                    </p>
+
+                </div>
+
+                <div class="right">
+                    <p>
+                        <h3>Description</h3>
+                        <blockquote><p><%=escapeHTML(issue.description)%></p></blockquote>
+                    </p>
+
+                    <% if issue.remedy_guidance && !issue.remedy_guidance.empty? %>
+                    <p>
+                        <h3>Remedial guidance</h3>
+                        <blockquote><p><%=escapeHTML(issue.remedy_guidance)%></p></blockquote>
+                    </p>
+                    <%end%>
+
+                    <% if issue.remedy_code && !issue.remedy_code.empty? %>
+                    <p>
+                        <h3>Remedial code</h3>
+                        <pre class="code notice"><%=escapeHTML(issue.remedy_code)%></pre>
+                    </p>
+                    <%end%>
+
+
+                </div>
+
+                <div class="clear variations" style="display: block;">
+                    <% issue.variations.each_with_index do |variation, j| %>
+                    <% var_idx = j + 1%>
+
+                    <h5 class="variation_header">
+                        <a href='javascript:toggleElem( "var_<%=var_idx%>_<%=idx%>" )'>
+                            <span id="var_<%=var_idx%>_<%=idx%>_sign">[+]</span>
+                            Variation <%=var_idx%>
+                        </a>
+                    </h5>
+
+                    <strong>Affected URL</strong>:
+                    <p class="notice"><a href="<%=escapeHTML(variation['url'])%>"><%=escapeHTML(variation['url'])%></a></p>
+
+                    <% if (variation['response'] && !variation['response'].empty?) && variation['regexp_match'] %>
+
+                    <div class="hidden" id="inspection-dialog_<%=var_idx%>_<%=idx%>" title="Relevant content is shown in red. (Hit Esc to close)">
+                        <% match = escapeHTML( variation['regexp_match'] )%>
+                        <pre> <%=escapeHTML( variation['response'] ).gsub( match, '<strong style="color: red">' + match + '</strong>' ) %> </pre>
+                    </div>
+
+                    <form style="display:inline" action="#">
+                        <input onclick="javascript:inspect( '#inspection-dialog_<%=var_idx%>_<%=idx%>')" type="button" value="Inspect" />
+                    </form>
+
+                    <%end%>
+
+                    <% if issue.method && (issue.elem.downcase == 'form' || issue.elem.downcase == 'link' ) &&
+                        ( issue.method.downcase == 'get' || issue.method.downcase == 'post' ) %>
+                    <form style="display:inline" action="<%=variation['opts'][:action]%>" target="_blank" method="<%=issue.method.downcase%>">
+                    <% if variation['opts'][:combo]%>
+                    <%variation['opts'][:combo].each_pair do |name, value|%>
+                        <input type="hidden" name="<%=escapeHTML(name)%>" value="<%=escapeHTML( value )%>" />
+                    <%end%>
+                    <%end%>
+                        <input type="submit" value="Replay" />
+                    </form>
+                    <%end%>
+
+                    <br/><br/>
+
+                    <div class="variation" id="var_<%=var_idx%>_<%=idx%>">
+
+                        <% if variation['injected'] %>
+                        <strong>Injected value</strong>:
+                        <pre> <%=escapeHTML(variation['injected'])%> </pre>
+                        <br/>
+                        <%end%>
+
+                        <% if variation['id'] %>
+                        <strong>ID</strong>:
+                        <pre><%=escapeHTML(variation['id'])%></pre>
+                        <br/>
+                        <%end%>
+
+                        <% if variation['regexp'] %>
+                        <strong>Regular expression</strong>:
+                        <pre><%=escapeHTML(variation['regexp'])%></pre>
+                        <br/>
+                        <%end%>
+
+                        <% if variation['regexp_match'] %>
+                        <strong>Matched by the regular expression</strong>:
+                        <pre><%=escapeHTML(variation['regexp_match'])%> </pre>
+                        <%end%>
+
+                        <br/>
+
+                        <table>
+                            <tr>
+                                <th colspan="2" style="text-align: center">Headers</th>
+                            </tr>
+                            <tr>
+                                <th>Request</th>
+                                <th>Response</th>
+                            </tr>
+                            <tr>
+                                <td>
+                                    <% if variation['headers']['request'].is_a?( Hash ) %>
+                                    <pre class="notice"><% variation['headers']['request'].each_pair do |name, val| %><strong><%=name%></strong><%="\t" + escapeHTML(val) + "\n"%><%end%></pre>
+                                    <%end%>
+                                </td>
+                                <td>
+                                    <% if variation['headers']['response'].is_a?( Hash ) %>
+                                    <pre class="notice"><% variation['headers']['response'].each_pair do |name, val| %><strong><%=name%></strong><%="\t" + escapeHTML(val) + "\n"%><%end%></pre>
+                                    <%end%>
+                                </td>
+                            </tr>
+                        </table>
+
+                        <% if variation['escaped_response']%>
+                        <form style="display:inline" action="#">
+                            <input onclick="javascript:renderResponse( 'res_<%=var_idx%>_<%=idx%>', 'data:text/html;base64, <%= variation['escaped_response']%>' )"
+                            type="button" value="Render HTML response" />
+                        </form>
+                        <div id="res_<%=var_idx%>_<%=idx%>"></div>
+                        <%end%>
+
+                    </div>
+                    <%end%>
+
+                </div>
+
+                <p class="clear separator">&nbsp;</p>
+
+            </div>
+