arachni 0.3 → 0.4

data/lib/ui/web/server/public/reports/placeholder

@@ -1 +0,0 @@
-git doesn't like empty directories

data/lib/ui/web/server/views/dispatchers.erb

@@ -1,100 +0,0 @@
-
-        <div id="page-intro">
-            <h2>Dispatchers</h2>
-            <p>The dispatchers spawn an XMLRPC server per scan and provide statistics for all running server instances.<br/>
-                This interface allows you to "Attach" to (see the output of), pause, resume and shutdown instances.
-            </p>
-
-            <form action="/dispatchers/edit" method="get">
-                <input type="submit" value="Edit dispatchers" />
-            </form>
-
-
-
-        </div>
-        <%= erb :flash, {:layout => false} %>
-
-        <% stats.each_pair do |d_url, dispatcher_stats| %>
-        <h2>
-            @<%=escape( d_url )%> - <%=dispatcher_stats['running_jobs'].size%> running scans,
-             <%=i=0;dispatcher_stats['running_jobs'].each{ |job| i+= proc_mem( job['proc']['rss'] ).to_i }; i.to_s%>MB RAM usage.
-        </h2>
-
-        <%if !dispatcher_stats['running_jobs'].empty? %>
-        <form action="/dispatchers/<%=remove_proto( d_url.dup )%>/shutdown_all" method="post">
-            <%= csrf_tag %>
-            <input type="submit" value="Shutdown all" />
-        </form>
-        <%end%>
-
-
-        <% if !dispatcher_stats['running_jobs'].empty? %>
-        <table>
-            <tr>
-                <th>PID</th>
-                <th>Port</th>
-                <th>Owner</th>
-                <th>State</th>
-                <th>Start time (Server-side)</th>
-                <th>Current time (Server-side)</th>
-                <th>Runtime</th>
-                <th>Memory consumption</th>
-                <th>Action</th>
-            </tr>
-        <% dispatcher_stats['running_jobs'].each do |job| %>
-            <tr>
-
-
-                <td><%=job['pid']%></td>
-                <td><%=job['port']%></td>
-                <td><%=job['owner']%></td>
-
-                <%if !job['paused'] %>
-                    <td>Running</td>
-                <% else %>
-                    <td>Paused</td>
-                <% end %>
-
-                <td><%=job['starttime'].to_time%></td>
-                <td><%=job['currtime'].to_time%></td>
-                <td><%=secs_to_hms( job['runtime'] )%></td>
-                <td><%=proc_mem( job['proc']['rss'] )%> MB</td>
-
-                <td>
-                    <% if !( job['owner'] =~/WebUI helper/ ) %>
-
-                    <form action="/instance/<%=port_to_url( job['port'], d_url, true )%>" method="get" target="_blank">
-                        <input type="submit" value="Attach" />
-                    </form>
-
-                    <%if !job['paused'] %>
-                    <form action="/dispatchers/<%=port_to_url( job['port'], d_url, true )%>/pause" method="post">
-                        <%= csrf_tag %>
-                        <input type="submit" value="Pause" />
-                    </form>
-                    <%end%>
-
-                    <%if job['paused'] %>
-                    <form action="/dispatchers/<%=port_to_url( job['port'], d_url, true )%>/resume" method="post">
-                        <%= csrf_tag %>
-                        <input type="submit" value="Resume" />
-                    </form>
-                    <% end %>
-
-                    <% end %>
-
-                    <form action="/dispatchers/<%=port_to_url( job['port'], d_url, true )%>/shutdown" method="post">
-                        <%= csrf_tag %>
-                        <input type="submit" value="Shutdown" />
-                    </form>
-                </td>
-            </tr>
-        <% end %>
-        </table>
-        <% else %>
-        <span class="notice"> There are no running scans at the moment.</span>
-        <% end %>
-
-        <br/><br/>
-
-        <% end %>

data/lib/ui/web/server/views/dispatchers_edit.erb

@@ -1,42 +0,0 @@
-
-
-        <div id="page-intro">
-            <h2>Edit Dispatchers</h2>
-            <p>
-                This screen allows you to add and remove Dispatchers.
-            </p>
-        </div>
-
-        <%= erb :flash, {:layout => false} %>
-
-        <% if !dispatchers.all.empty? %>
-        <table>
-            <tr>
-                <th>Location</th>
-                <th>Alive?</th>
-                <th>Action</th>
-            </tr>
-            <% dispatchers.all.each do |dispatcher| %>
-            <tr>
-                <td><%=dispatcher['url']%></td>
-                <td><%=dispatchers.alive?( dispatcher['url'] ).to_s.capitalize%></td>
-                <td>
-                    <form action="/dispatchers/<%=dispatcher['id']%>/delete" method="post">
-                        <%= csrf_tag %>
-                        <input type="submit" value="Delete" />
-                    </form>
-                </td>
-            </tr>
-            <%end%>
-        </table>
-        <%else%>
-        <span class="notice"> There are no available Dispatchers at the moment. Add one if you want to start a scan.</span>
-        <br/><br/>
-        <%end%>
-
-        <form action="/dispatchers/add" method="post">
-            <%= csrf_tag %>
-            <label>URL:</label>
-            <input name="url" value="https://localhost:7331" />
-            <input type="submit" value="Add" />
-        </form>

data/lib/ui/web/server/views/error.erb

@@ -1 +0,0 @@
-<h1 style="font-size:110%;font-family:Arial, sans-serif;"><%= error %></h1>

data/lib/ui/web/server/views/home.erb

@@ -1,25 +0,0 @@
-
-        <form action="/scan" method="post">
-
-            <%= csrf_tag %>
-
-            <input type="submit" value="Launch Scan" />
-
-            <div id="page-intro">
-                Select a Dispatcher:
-                <select name="dispatcher">
-                <% dispatcher_stats.each_pair do |d_url, stats| %>
-                    <% next if !dispatchers.alive?( d_url ) %>
-                    <option value="<%=d_url%>">
-                        @<%=escape( d_url )%> - <%=stats['running_jobs'].size%> running scans,
-                         <%=i=0;stats['running_jobs'].each{ |job| i+= proc_mem( job['proc']['rss'] ).to_i }; i.to_s%>MB RAM usage.
-                    </option>
-                <%end%>
-                </select>
-
-                <h2>URL: <input name="url" value="<%=session['opts']['settings']['url']%>" size="50" /></h2>
-            </div>
-
-        </form>
-
-        <%= erb :flash, {:layout => false} %>

data/metamodules/autothrottle.rb

@@ -1,74 +0,0 @@
-=begin
-                  Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
-
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
-
-=end
-
-module Arachni
-module MetaModules
-
-#
-# Auto adjusts HTTP throughput for maximum network utilization.
-#
-# @author: Tasos "Zapotek" Laskos
-#                                      <tasos.laskos@gmail.com>
-#                                      <zapotek@segfault.gr>
-# @version: 0.1.1
-#
-class AutoThrottle < Base
-
-    HIGH_THRESHOLD    = 0.9
-    MIDDLE_THRESHOLD  = 0.34
-    LOW_THREASHOLD    = 0.05
-
-    # easy on the throttle
-    STEP_UP      = 1
-    # hard on the breaks
-    STEP_DOWN    = -3
-
-    MIN_CONCURRENCY = 2
-
-    def initialize( framework )
-        @framework = framework
-        @http      = framework.http
-    end
-
-    def prepare
-
-        # run for each response as it arrives
-        @http.add_on_complete {
-
-            # adjust only after finished bursts
-            next if @http.curr_res_cnt == 0 || @http.curr_res_cnt % @http.max_concurrency != 0
-
-            print_debug( "Max concurrency: " + @http.max_concurrency.to_s )
-            if( @http.max_concurrency > MIN_CONCURRENCY && @http.average_res_time > HIGH_THRESHOLD ) ||
-                @http.max_concurrency > @framework.opts.http_req_limit
-
-                # make sure that @http.max_concurrency >= MIN_CONCURRENCY
-                if @http.max_concurrency + STEP_DOWN < MIN_CONCURRENCY
-                    step = MIN_CONCURRENCY - @http.max_concurrency
-                else
-                    step = STEP_DOWN
-                end
-
-                print_debug( "Stepping down!: #{step}" )
-                @http.max_concurrency!( @http.max_concurrency + step )
-
-            elsif @http.average_res_time < HIGH_THRESHOLD && @http.average_res_time > LOW_THREASHOLD
-
-                print_debug( "Stepping up!: +#{STEP_UP}" )
-                @http.max_concurrency!( @http.max_concurrency + STEP_UP )
-            end
-        }
-
-    end
-
-end
-
-end
-end

data/plugins/metamodules.rb

@@ -1,118 +0,0 @@
-=begin
-                  Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
-
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
-
-=end
-
-module Arachni
-
-#
-# Namespace under which all meta modules will reside
-#
-module MetaModules
-    class Base
-        include Arachni::Module::Output
-
-        def initialize( framework )
-        end
-
-        def prepare
-        end
-
-        def run
-        end
-
-        def clean_up
-        end
-
-        def self.info
-            {
-                :name           => '[Meta] ' + self.name.to_s.gsub( 'Arachni::MetaModules::', '' ),
-                :description    => %q{Performs high-level meta-analysis on the results of the scan
-                    using abstract meta components.},
-                :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-                :version        => '0.1',
-            }
-        end
-
-    end
-end
-
-
-module Plugins
-
-#
-# Performs high-level meta-analysis on the results of the scan
-# using abstract meta-modules.
-#
-# @author: Tasos "Zapotek" Laskos
-#                                      <tasos.laskos@gmail.com>
-#                                      <zapotek@segfault.gr>
-# @version: 0.1
-#
-class MetaModules < Arachni::Plugin::Base
-
-    def initialize( framework, options )
-        @framework = framework
-
-        @metamanager = Arachni::ComponentManager.new( @framework.opts.dir['root'] + 'metamodules/', Arachni::MetaModules )
-
-        # load all meta-components
-        @metamanager.load( ['*'] )
-        @inited = {}
-        @metamanager.each {
-            |name, klass|
-            @inited[name] = klass.new( @framework )
-        }
-    end
-
-    def prepare
-        # prepare all meta modules here to give them a chance to set up their hooks
-        # and callbacks to other framework interfaces.
-        @inited.values.each { |meta| meta.prepare }
-
-        # we need to wait until the framework has finished running
-        # in order to work with the full report
-        while( @framework.running? )
-            ::IO.select( nil, nil, nil, 1 )
-        end
-
-    end
-
-    def run
-        results = { }
-        # run all meta-modules
-        @inited.each_pair {
-            |name, meta|
-            if (metaresult = meta.run) && !metaresult.empty?
-                results[name] = { :results => metaresult }.merge( meta.class.info )
-            end
-        }
-
-        register_results( results )
-    end
-
-    def clean_up
-        # let the meta-modules clean up after themselves
-        @inited.values.each { |meta| meta.clean_up }
-    end
-
-    def self.info
-        {
-            :name           => 'Metamodules',
-            :description    => %q{Performs high-level meta-analysis on the results of the scan using abstract meta-modules.
-                Before reviewing the scan results you are strongly encouraged to take full advantage of the data gathered via meta-analysis.
-                They will help you shed light into the inner workings of the web application and even caution you about possible false positives and/or inconclusive test results.},
-            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.1'
-        }
-    end
-
-
-end
-end
-end

data/profiles/comprehensive.afp

@@ -1,74 +0,0 @@
---- !ruby/object:Arachni::Options 
-audit_cookies: true
-audit_forms: true
-audit_links: true
-authed_by: 
-dir: 
-exclude: []
-
-exclude_cookies: []
-
-http_req_limit: 20
-include: []
-
-load_profile: 
-lsmod: []
-
-lsplug: []
-
-lsrep: []
-
-mods: 
-- interesting_responses
-- common_files
-- xst
-- http_put
-- webdav
-- directory_listing
-- allowed_methods
-- htaccess_limit
-- ssn
-- private_ip
-- emails
-- credit_card
-- cvs_svn_users
-- captcha
-- html_objects
-- unencrypted_password_forms
-- backdoors
-- backup_files
-- common_directories
-- trainer
-- os_cmd_injection
-- sqli
-- xss_script_tag
-- sqli_blind_rdiff
-- path_traversal
-- xss_event
-- xss_uri
-- sqli_blind_timing
-- code_injection
-- rfi
-- xss_tag
-- response_splitting
-- csrf
-- os_cmd_injection_timing
-- ldapi
-- code_injection_timing
-- xss_path
-- xpath
-- unvalidated_redirect
-- xss
-plugins: 
-  healthmap: {}
-
-  content_types: {}
-
-redirect_limit: 20
-redundant: []
-
-reports: 
-  stdout: {}
-
-save_profile: 
-user_agent: Arachni/0.2.2

data/reports/plugin_formatters/html/metamodules.rb

@@ -1,93 +0,0 @@
-=begin
-                  Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
-
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
-
-=end
-
-module Arachni
-
-module Reports
-
-class HTML
-    module PluginFormatters
-
-        #
-        # XML formatter for the results of the MetaModules plugin
-        #
-        # @author: Tasos "Zapotek" Laskos
-        #                                      <tasos.laskos@gmail.com>
-        #                                      <zapotek@segfault.gr>
-        # @version: 0.1
-        #
-        class MetaModules
-
-            def initialize( plugin_data )
-                @results     = plugin_data[:results]
-                @description = plugin_data[:description]
-            end
-
-            def run
-
-                metaresults = format_meta_results( @results ).values
-                return ERB.new( tpl ).result( binding )
-            end
-
-            def tpl
-                %q{
-                    <h3>Metamodules</h3>
-                    <blockquote><pre><%=::Arachni::Reports::HTML.prep_description(@description)%></pre></blockquote>
-
-                    <%metaresults.each do |html|%>
-                        <%=html%>
-                    <%end%>
-                }
-            end
-
-            #
-            # Runs plugin formatters for the running report and returns a hash
-            # with the prepared/formatted results.
-            #
-            # @param    [AuditStore#plugins]      plugins   plugin data/results
-            #
-            def format_meta_results( plugins )
-
-                ancestor = self.class.ancestors[0]
-
-                # add the PluginFormatters module to the report
-                eval( "module  MetaFormatters end" )
-
-                # prepare the directory of the formatters for the running report
-                lib = File.dirname( __FILE__ ) + '/metaformatters/'
-
-                @@formatters ||= {}
-                # initialize a new component manager to handle the plugin formatters
-                @@formatters[ancestor] ||= ::Arachni::Report::FormatterManager.new( lib, ancestor.const_get( 'MetaFormatters' ) )
-
-                # load all the formatters
-                @@formatters[ancestor].load( ['*'] ) if @@formatters[ancestor].empty?
-
-                # run the formatters and gather the formatted data they return
-                formatted = {}
-                @@formatters[ancestor].each_pair {
-                    |name, formatter|
-                    plugin_results = plugins[name]
-                    next if !plugin_results || plugin_results[:results].empty?
-
-                    formatted[name] = formatter.new( plugin_results.deep_clone ).run
-                }
-
-                return formatted
-            end
-
-
-        end
-
-    end
-end
-
-end
-end