arachni 0.3 → 0.4

data/lib/arachni.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -8,9 +8,4 @@
 
 =end
 
-module Arachni
-
-    # the universal system version
-    VERSION      = '0.3'
-
-end
+require_relative 'arachni/framework'

data/lib/{audit_store.rb → arachni/audit_store.rb}

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -23,7 +23,7 @@ require Options.instance.dir['lib'] + 'issue'
 # @author: Tasos "Zapotek" Laskos
 #                                      <tasos.laskos@gmail.com>
 #                                      <zapotek@segfault.gr>
-# @version: 0.1.1
+# @version: 0.1.2
 #
 class AuditStore
 
@@ -52,6 +52,9 @@ class AuditStore
     #
     attr_reader :issues
 
+    #
+    # @return    [Hash]  plugin results
+    #
     attr_reader :plugins
 
     #
@@ -69,8 +72,7 @@ class AuditStore
     #
     attr_reader :delta_time
 
-    attr_accessor :framework
-
+    MODULE_NAMESPACE = ::Arachni::Modules
 
     ORDER = [
         ::Arachni::Issue::Severity::HIGH,
@@ -79,9 +81,9 @@ class AuditStore
         ::Arachni::Issue::Severity::INFORMATIONAL
     ]
 
-    def initialize( audit = {}, framework )
-
-        @framework = framework
+    def initialize( audit = {} )
+        @plugins = {}
+        @sitemap = []
 
         # set instance variables from audit opts
         audit.each {
@@ -91,7 +93,11 @@ class AuditStore
 
         @options         = prepare_options( @options )
         @issues          = sort( prepare_variations( @issues ) )
-        @start_datetime  = @options['start_datetime'].asctime
+        if @options['start_datetime']
+            @start_datetime  = @options['start_datetime'].asctime
+        else
+            @start_datetime = Time.now.asctime
+        end
 
         if @options['finish_datetime']
             @finish_datetime = @options['finish_datetime'].asctime
@@ -99,8 +105,7 @@ class AuditStore
             @finish_datetime = Time.now.asctime
         end
 
-        @delta_time      = secs_to_hms( @options['delta_time'] )
-
+        @delta_time = secs_to_hms( @options['delta_time'] )
     end
 
     #
@@ -112,9 +117,11 @@ class AuditStore
     #
     def AuditStore.load( file )
          begin
-            Marshal.load( IO.read( file ) )
-         rescue
-             YAML.load( IO.read( file ) )
+             r = YAML.load( IO.read( file ) )
+             r.version
+             r
+         rescue Exception => e
+             Marshal.load( File.binread( file ) )
          end
     end
 
@@ -124,12 +131,16 @@ class AuditStore
     # @param    [String]    file
     #
     def save( file )
-        @framework = ''
-        f = File.open( file, 'w' )
         begin
-            Marshal.dump( self, f )
+            File.open( file, 'w' ) {
+                |f|
+                f.write( YAML.dump( self ) )
+            }
         rescue
-            YAML.dump( self, f )
+            File.open( file, 'wb' ) {
+                |f|
+                f.write( Marshal.dump( self ) )
+            }
         end
     end
 
@@ -139,16 +150,24 @@ class AuditStore
     # @return    [Hash]
     #
     def to_h
+        hash = obj_to_hash( self ).dup
 
-        hash = obj_to_hash( self )
-
-        issues = []
-        hash['issues'].each {
+        hash['issues'] = hash['issues'].map {
             |issue|
-            issues << obj_to_hash( issue )
+            issue.variations = issue.variations.map { |var| obj_to_hash( var ) }
+            obj_to_hash( issue )
+        }
+
+        hash['plugins'].each {
+            |plugin, results|
+            next if !results[:options]
+
+            hash['plugins'][plugin][:options] = hash['plugins'][plugin][:options].map {
+                |opt|
+                opt.to_h
+            }
         }
 
-        hash['issues'] = issues
         return hash
     end
 
@@ -174,15 +193,12 @@ class AuditStore
     # @return    [Hash]
     #
     def obj_to_hash( obj )
-        hash = Hash.new
+        hash = {}
         obj.instance_variables.each {
             |var|
-
             key       = var.to_s.gsub( /@/, '' )
             hash[key] = obj.instance_variable_get( var )
-
         }
-
         return hash
     end
 
@@ -261,53 +277,37 @@ class AuditStore
             var = issue.var || ''
 
             __id  = issue.mod_name +
-             '::' + issue.elem + '::' +
+                '::' + issue.elem + '::' +
                 var + '::' +
-                issue.url.split( /\?/ )[0]
+                issue.url.split( /\?/ )[0].gsub( '//', '/' )
 
             orig_url  = issue.url
             issue.url = issue.url.split( /\?/ )[0]
 
-            if( !new_issues[__id] )
-                new_issues[__id] = issue
-            end
-
-            if( !new_issues[__id].variations )
-                new_issues[__id].variations = []
-            end
+            new_issues[__id] = issue         if !new_issues[__id]
+            new_issues[__id].variations = [] if !new_issues[__id].variations
 
             issue.headers ||= {}
-            issue.headers['request']  = issue.headers[:request] || {}
-            issue.headers['response'] = issue.headers[:response] || {}
 
-            new_issues[__id]._hash = Digest::MD5.hexdigest( __id )
+            issue.headers['request'] ||= {}
+            (issue.headers[:request] || {}).each {
+                |k, v|
+                issue.headers['request'][k] = v.dup if v
+            }
 
-            modname = ''
-            @framework.modules.each_pair {
-                |name, mod|
+            issue.headers['response'] ||= {}
+            issue.headers['response'] = (issue.headers[:response] || '').dup
 
-                if mod.info[:name] == new_issues[__id].mod_name
-                    modname = name
-                    break
-                end
-            }
+            issue.headers.delete( :request )
+            issue.headers.delete( :response )
 
-            new_issues[__id].internal_modname = modname
-
-            new_issues[__id].variations << {
-                'url'           => orig_url,
-                'injected'      => issue.injected,
-                'id'            => issue.id,
-                'regexp'        => issue.regexp,
-                'regexp_match'  => issue.regexp_match,
-                'headers'       => issue.headers,
-                'response'      => issue.response,
-                'opts'          => issue.opts ? issue.opts : {}
-            }
+            new_issues[__id]._hash = Digest::MD5.hexdigest( __id )
+            new_issues[__id].internal_modname =
+                get_internal_module_name( new_issues[__id].mod_name )
+            new_issues[__id].variations << issue.deep_clone
 
             variation_keys.each {
                 |key|
-
                 if( new_issues[__id].instance_variable_defined?( '@' + key ) )
                     new_issues[__id].remove_instance_var( '@' + key )
                 end
@@ -326,6 +326,14 @@ class AuditStore
         new_issues
     end
 
+    def get_internal_module_name( modname )
+        MODULE_NAMESPACE.constants.each {
+            |mod|
+            klass = MODULE_NAMESPACE.const_get( mod )
+            return mod.to_s if klass.info[:name] == modname
+        }
+    end
+
     #
     # Converts seconds to a (00:00:00) (hours:minutes:seconds) string
     #

data/lib/{component_manager.rb → arachni/component_manager.rb}

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -40,11 +40,11 @@ class ComponentManager < Hash
 
     #
     # @param    [String]    lib       the path to the component library/folder
-    # @param    [Module]    parent    the parent module of the components
+    # @param    [Module]    namespace    the namespace of the components
     #
-    def initialize( lib, parent )
+    def initialize( lib, namespace )
         @lib    = lib
-        @parent = parent
+        @namespace = namespace
     end
 
     #
@@ -79,7 +79,7 @@ class ComponentManager < Hash
             |opt|
 
             name  = opt.name
-            val   = user_opts[name]
+            val   = user_opts[name] || opt.default
 
             if( opt.empty_required_value?( val ) )
                 errors[name] = {
@@ -269,8 +269,8 @@ class ComponentManager < Hash
                 msg = "Empty required value"
             end
 
-            print_info( " *  #{msg}: #{optname} => #{val}" )
-            print_info( " *  Expected type: #{error[:opt].type}" )
+            print_error( " *  #{msg}: #{optname} => #{val}" )
+            print_error( " *  Expected type: #{error[:opt].type}" )
 
             print_line
         }
@@ -280,7 +280,7 @@ class ComponentManager < Hash
 
     def load_from_path( path )
         ::Kernel::load( path )
-        return @parent.const_get( @parent.constants[-1] )
+        return @namespace.const_get( @namespace.constants[-1] )
     end
 
 

data/lib/{component_options.rb → arachni/component_options.rb}

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -127,7 +127,7 @@ class OptBase
             |var|
             hash[var.to_s.gsub( /@/, '' )] = self.instance_variable_get( var )
         }
-        return hash
+        return hash.merge( 'type' => type )
     end
 
 
@@ -185,7 +185,7 @@ end
 ###
 class OptBool < OptBase
 
-    TrueRegex = /^(y|yes|t|1|true)$/i
+    TrueRegex = /^(y|yes|t|1|true|on)$/i
 
     def type
         return 'bool'
@@ -196,7 +196,7 @@ class OptBool < OptBase
 
         if ((value != nil and
             (value.to_s.empty? == false) and
-            (value.to_s.match(/^(y|yes|n|no|t|f|0|1|true|false)$/i) == nil)))
+            (value.to_s.match(/^(y|yes|n|no|t|f|0|1|true|false|on)$/i) == nil)))
             return false
         end
 
@@ -391,5 +391,35 @@ class OptInt < OptBase
     end
 end
 
+###
+#
+# Floating point option.
+#
+###
+class OptFloat < OptBase
+    def type
+        return 'float'
+    end
+
+    def normalize(value)
+        begin
+            Float( value )
+        rescue
+            nil
+        end
+    end
+
+    def valid?(value)
+        return false if empty_required_value?(value)
+
+        if value and not normalize(value).to_s.match(/^\d+\.\d+$/)
+            return false
+        end
+
+        return super
+    end
+end
+
+
 end
 

data/lib/{crypto → arachni/crypto}/rsa_aes_cbc.rb

@@ -1,6 +1,6 @@
 =begin
                   Arachni
-  Copyright (c) 2010-2011 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 
   This is free software; you can copy and distribute and modify
   this program under the term of the GPL v2.0 License
@@ -9,7 +9,6 @@
 =end
 
 require 'openssl'
-require "yaml"
 require "base64"
 
 #

data/lib/arachni/database.rb

@@ -0,0 +1,4 @@
+opts = Arachni::Options.instance
+require opts.dir['lib'] + 'database/base'
+require opts.dir['lib'] + 'database/queue'
+require opts.dir['lib'] + 'database/hash'

data/lib/arachni/database/base.rb

@@ -0,0 +1,125 @@
+=begin
+                  Arachni
+  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+
+  This is free software; you can copy and distribute and modify
+  this program under the term of the GPL v2.0 License
+  (See LICENSE file for details)
+
+=end
+
+require 'tmpdir'
+
+module Arachni
+module Database
+
+    #
+    # Base class for Database data structures
+    #
+    # Provides helper methods for data structures to be implemented related to
+    # objecting dumping, loading, unique filename generation, etc.
+    #
+    # @author: Tasos "Zapotek" Laskos
+    #                                      <tasos.laskos@gmail.com>
+    #                                      <zapotek@segfault.gr>
+    # @version: 0.1
+    # @abstract
+    #
+    class Base
+
+        #
+        # @param    [Object]    serializer   any object that responds to 'dump' and 'load'.<br/>
+        #                                       Will default to YAML.
+        #
+        def initialize( serializer = nil )
+            @serializer = serializer
+            if !@serializer
+                @serializer = Marshal
+            end
+        end
+
+        private
+
+        #
+        # Dumps the object to a unique file and returns its path.
+        #
+        # The path can be used as a reference to the original value
+        # by way of passing it to load().
+        #
+        # @param    [Object]    obj
+        #
+        # @return   [String]    filepath
+        #
+        def dump( obj, &block )
+            f = File.open( get_unique_filename, 'w' )
+
+            serialized = serialize( obj )
+            f.write( serialized )
+
+            block.call( serialized ) if block_given?
+
+            f.path
+        ensure
+            f.close
+        end
+
+        #
+        # Loads the object stored in filepath.
+        #
+        # @param    [String]    filepath
+        #
+        # @return   [Object]
+        #
+        def load( filepath )
+            unserialize( IO.read( filepath ) )
+        end
+
+        #
+        # Deletes a file.
+        #
+        # @param    [String]    filepath
+        #
+        def delete_file( filepath )
+            File.delete( filepath ) if File.exist?( filepath )
+        end
+
+        #
+        # Loads the object in file and then removes it from the file-system.
+        #
+        # @param    [String]    filepath
+        #
+        # @return   [Object]
+        #
+        def load_and_delete_file( filepath )
+            obj = load( filepath )
+            delete_file( filepath )
+            return obj
+        end
+
+        def serialize( obj )
+            serializer.dump( obj )
+        end
+
+        def unserialize( obj )
+            serializer.load( obj )
+        end
+
+        def serializer
+            @serializer
+        end
+
+        def get_unique_filename
+            while( File.exist?( path = generate_filename ) );end
+            return path
+        end
+
+        def generate_filename
+            s = ""
+            10.times { s << ( 65 + rand( 26 ) ) }
+            ( Dir.tmpdir + "/#{self.class.name}_" + s ).gsub( '::', '_' )
+        end
+
+    end
+
+end
+end