arachni 0.3 → 0.4

data/reports/plugin_formatters/html/http_dicattack.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -13,41 +13,33 @@ module Arachni
 module Reports
 
 class HTML
-    module PluginFormatters
-
-        #
-        # XML formatter for the results of the HTTPDicattack plugin
-        #
-        # @author: Tasos "Zapotek" Laskos
-        #                                      <tasos.laskos@gmail.com>
-        #                                      <zapotek@segfault.gr>
-        # @version: 0.1
-        #
-        class HTTPDicattack < Arachni::Plugin::Formatter
-
-            def initialize( plugin_data )
-                @results     = plugin_data[:results]
-                @description = plugin_data[:description]
-            end
-
-            def run
-                return ERB.new( tpl ).result( binding )
-            end
-
-            def tpl
-                %q{
-                    <h3>HTTP dictionary attacker</h3>
-                    <blockquote><%=@description%></blockquote>
-
-                    <h4>Credentials</h4>
-                    <strong>Username</strong>: <%=CGI.escapeHTML(@results[:username])%> <br/>
-                    <strong>Password</strong>: <%=CGI.escapeHTML(@results[:password])%>
-                }
-            end
+module PluginFormatters
+
+    #
+    # XML formatter for the results of the HTTPDicattack plugin
+    #
+    # @author: Tasos "Zapotek" Laskos
+    #                                      <tasos.laskos@gmail.com>
+    #                                      <zapotek@segfault.gr>
+    # @version: 0.1
+    #
+    class HTTPDicattack < Arachni::Plugin::Formatter
+
+        def run
+            return ERB.new( tpl ).result( binding )
+        end
 
+        def tpl
+            %q{
+                <h3>Credentials</h3>
+                <strong>Username</strong>: <%=CGI.escapeHTML(@results[:username])%> <br/>
+                <strong>Password</strong>: <%=CGI.escapeHTML(@results[:password])%>
+            }
         end
 
     end
+
+end
 end
 
 end

data/reports/plugin_formatters/html/profiler.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -15,56 +15,25 @@ module Arachni
 module Reports
 
 class HTML
-    module PluginFormatters
-
-        #
-        # HTML formatter for the results of the Profiler plugin
-        #
-        # @author: Tasos "Zapotek" Laskos
-        #                                      <tasos.laskos@gmail.com>
-        #                                      <zapotek@segfault.gr>
-        # @version: 0.1
-        #
-        class Profiler < Arachni::Plugin::Formatter
-
-            def initialize( plugin_data )
-                @results     = plugin_data[:results]
-                @description = plugin_data[:description]
-            end
-
-            def run
-
-                @results['times'].each_with_index {
-                    |itm, i|
-                    @results['times'][i] = escape_hash( itm )
-                }
-
-                times      = @results['times'].map{ |item| item['time'] }
-                total_time = 0
-                times.each {
-                    |time|
-                    total_time += time
-                }
-
-                avg_time = total_time / times.size
-                times.reject!{ |time| time < avg_time }
-
-                return ERB.new( IO.read( File.dirname( __FILE__ ) + '/profiler/template.erb' ) ).result( binding )
-            end
-
-            def escape_hash( hash )
-                hash.each_pair {
-                    |k, v|
-                    hash[k] = CGI.escape( v ) if v.is_a?( String )
-                    hash[k] = escape_hash( v ) if v.is_a? Hash
-                }
-
-                return hash
-            end
-
+module PluginFormatters
+
+    #
+    # HTML formatter for the results of the Profiler plugin
+    #
+    # @author: Tasos "Zapotek" Laskos
+    #                                      <tasos.laskos@gmail.com>
+    #                                      <zapotek@segfault.gr>
+    # @version: 0.2
+    #
+    class Profiler < Arachni::Plugin::Formatter
+
+        def run
+            return ERB.new( IO.read( File.dirname( __FILE__ ) + '/profiler/template.erb' ) ).result( binding )
         end
 
     end
+
+end
 end
 
 end

data/reports/plugin_formatters/html/profiler/template.erb

@@ -1,103 +1,8 @@
-<h3>Profiler</h3>
-<blockquote><pre><%=::Arachni::Reports::HTML.prep_description(@description)%></pre></blockquote>
-
-<script type="text/javascript">
-
-    var tooltip_data = <%=@results['times'].to_json%>;
-    var chart;
-    $(document).ready(function() {
-       chart = new Highcharts.Chart({
-          chart: {
-             renderTo: 'chart-response-times',
-             zoomType: 'x',
-             spacingRight: 20,
-             backgroundColor: '#ccc'
-          },
-           title: {
-             text: 'Response times exceeding the average (<%=times.size%> out of <%=@results['times'].size%> responses)'
-          },
-           subtitle: {
-             text: document.ontouchstart === undefined ?
-                'Click and drag in the plot area to zoom in' :
-                'Drag your finger over the plot to zoom in'
-          },
-          xAxis: {
-             title: {
-                text: null
-             }
-          },
-          yAxis: {
-             title: {
-                text: 'Seconds'
-             },
-             min: <%=times.min%>,
-             startOnTick: false,
-             showFirstLabel: false
-          },
-          tooltip: {
-             formatter: function() {
-                return 'URL: <b>' + unescape( tooltip_data[this.x]['url'] ) + '</b><br/>' +
-                    'Response time: <b>' + this.y +'</b> seconds<br/>';
-             }
-          },
-          legend: {
-             enabled: false
-          },
-          plotOptions: {
-             area: {
-                fillColor: {
-                   linearGradient: [0, 0, 0, 300],
-                   stops: [
-                      [0, 'rgba(0,0,0,0)'],
-                      [1, 'rgba(2,0,0,0)']
-                   ]
-                },
-                lineWidth: 1,
-                marker: {
-                   enabled: false,
-                   states: {
-                      hover: {
-                         enabled: true,
-                         radius: 5
-                      }
-                   }
-                },
-                shadow: false,
-                states: {
-                   hover: {
-                      lineWidth: 1
-                   }
-                }
-             }
-          },
-
-          series: [{
-             type: 'area',
-             pointInterval: 1,
-             data: <%=times.to_s%>
-          }]
-       });
-
-
-    });
-</script>
-
-
-<h4>Response time analysis</h4>
-
-<strong>Average response time</strong>: <%=avg_time%> seconds <br/>
-<strong>Max</strong>: <%=times.max%> seconds <br/>
-<strong>Min</strong>: <%=@results['times'].map{ |item| item['time'] }.min%> seconds <br/>
-<strong>Sample size</strong>: <%=@results['times'].size%> responses <br/>
-
-<div id="chart-response-times" style="width: 1000px"></div>
-
-<p>&nbsp;</p>
-
-<h4>Inputs that affect output (Taint analysis)</h4>
+
+<h3>Taint analysis (Inputs that affect output)</h3>
 <% @results['inputs'].each_with_index do |item, idx| %>
 
-    <h5>
+    <h4>
         <%=item['element']['type'].capitalize%>
 
         <%if item['element']['name']%>
@@ -119,7 +24,7 @@
         <%if item['element']['method']%>
         using <%=item['request']['method']%>
         <%end%>
-    </h5>
+    </h4>
 
     <p>
         It was submitted using the following parameters:
@@ -163,12 +68,14 @@
               <input onclick="javascript:inspect( '#inspection-dialog_<%=idx%>')" type="button" value="Inspect" />
             </form>
 
+            <% if item['request']['params'] %>
             <form style="display:inline" action="<%=item['request']['url']%>" target="_blank" method="<%=item['request']['method']%>">
               <% item['request']['params'].each_pair do |name, value|%>
               <input type="hidden" name="<%=CGI.escapeHTML(name)%>" value="<%=CGI.escapeHTML( value )%>" />
               <%end%>
               <input type="submit" value="Replay" />
             </form>
+            <%end%>
 
     </p>
 

data/reports/plugin_formatters/html/resolver.rb

@@ -0,0 +1,63 @@
+=begin
+                  Arachni
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+
+  This is free software; you can copy and distribute and modify
+  this program under the term of the GPL v2.0 License
+  (See LICENSE file for details)
+
+=end
+
+module Arachni
+
+module Reports
+
+class HTML
+module PluginFormatters
+
+    #
+    # @author: Tasos "Zapotek" Laskos
+    #                                      <tasos.laskos@gmail.com>
+    #                                      <zapotek@segfault.gr>
+    # @version: 0.1
+    #
+    class Resolver < Arachni::Plugin::Formatter
+
+        def run
+            return ERB.new( tpl ).result( binding )
+        end
+
+        def tpl
+            %q{
+                <h3>Results</h3>
+                <table>
+                    <tr>
+                        <th>
+                            Hostname
+                        </th>
+                        <th>
+                            IP Address
+                        </th>
+                    </tr>
+                <% @results.each do |hostname, ipaddress| %>
+                    <tr>
+                        <td>
+                        <%= hostname %>
+                        </td>
+                        <td>
+                        <%= ipaddress %>
+                        </td>
+                    </tr>
+                <%end%>
+                </table>
+            }
+
+        end
+
+    end
+
+end
+end
+
+end
+end

data/reports/plugin_formatters/html/{metaformatters/timeout_notice.rb → timing_attacks.rb}

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -15,24 +15,15 @@ module Reports
 class HTML
 module PluginFormatters
 
-class MetaModules
-
-module MetaFormatters
-
     #
-    # HTML formatter for the results of the TimeoutNotice metamodule
+    # HTML formatter for the results of the TimingAttacks plugin.
     #
     # @author: Tasos "Zapotek" Laskos
     #                                      <tasos.laskos@gmail.com>
     #                                      <zapotek@segfault.gr>
     # @version: 0.1
     #
-    class TimeoutNotice < Arachni::Plugin::Formatter
-
-        def initialize( metadata )
-            @results     = metadata[:results]
-            @description = metadata[:description]
-        end
+    class TimingAttacks < Arachni::Plugin::Formatter
 
         def run
             return ERB.new( tpl ).result( binding )
@@ -40,14 +31,14 @@ module MetaFormatters
 
         def tpl
             %q{
-                    <h4>Timeout notice</h4>
-                    <blockquote><pre><%=::Arachni::Reports::HTML.prep_description(@description)%></pre></blockquote>
-
                     <ul>
                     <%@results.each do |issue| %>
                         <li>
                             <a href="#issue_<%=issue['index']%>">
-                                <%=issue['name']%> at <%=issue['url']%> in <%=issue['elem']%> variable '<%=issue['var']%>' using <%=issue['method']%>
+                                [#<%=issue['index']%>]
+                                <%=issue['name']%> at <%=issue['url']%> in
+                                <%=issue['elem']%> variable '<%=issue['var']%>'
+                                using <%=issue['method']%>
                             </a>
                         </li>
                     <%end%>
@@ -57,9 +48,6 @@ module MetaFormatters
     end
 
 end
-
-end
-end
 end
 end
 end

data/reports/plugin_formatters/html/{metaformatters/uniformity.rb → uniformity.rb}

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -14,11 +14,8 @@ module Reports
 class HTML
 module PluginFormatters
 
-class MetaModules
-module MetaFormatters
-
     #
-    # HTML formatter for the results of the Uniformity metamodule
+    # HTML formatter for the results of the Uniformity plugin.
     #
     # @author: Tasos "Zapotek" Laskos
     #                                      <tasos.laskos@gmail.com>
@@ -27,30 +24,23 @@ module MetaFormatters
     #
     class Uniformity < Arachni::Plugin::Formatter
 
-        def initialize( metadata )
-            @results     = metadata[:results]
-            @description = metadata[:description]
-        end
-
         def run
             return ERB.new( tpl ).result( binding )
         end
 
         def tpl
             %q{
-                    <h4>Uniformity (Lack of centralised sanitization)</h4>
-                    <blockquote><pre><%=::Arachni::Reports::HTML.prep_description(@description)%></pre></blockquote>
-
                     <ul>
                     <%@results['uniformals'].each_pair do |id, uniformal| %>
                         <% issue = uniformal['issue'] %>
                         <li>
-                            <%=issue['name']%> in <%=issue['elem']%> variable '<%=issue['var']%>' using <%=issue['method']%> at the following pages:
+                            <%=issue['name']%> in <%=issue['elem']%> variable
+                            '<%=issue['var']%>' using <%=issue['method']%> at the following pages:
                             <ul>
 
                             <%@results['pages'][id].each_with_index do |url, i|%>
                                 <li>
-                                    <a href="#issue_<%=uniformal['indices'][i]%>"><%=url%></a>
+                                    [<%=uniformal['indices'][i]%>] <a href="#issue_<%=uniformal['indices'][i]%>"><%=url%></a>
                                 </li>
                             <%end%>
 
@@ -67,5 +57,3 @@ end
 end
 end
 end
-end
-end