arachni 0.4.0.4 → 0.4.1

data/spec/plugins/content_types_spec.rb

@@ -0,0 +1,93 @@
+require_relative '../spec_helper'
+
+describe name_from_filename do
+    include_examples 'plugin'
+
+    before ( :all ) do
+        options.url = url
+    end
+
+    def results
+        framework.plugins.results[name_from_filename][:results]
+    end
+
+    def default_results
+        yaml_load <<YAML
+---
+image/png:
+- :url: __URL__png
+  :method: GET
+  :params:
+application/vnd.ms-excel:
+- :url: __URL__excel
+  :method: GET
+  :params:
+YAML
+    end
+
+    def results_with_options
+        yaml_load <<YAML
+---
+text/html;charset=utf-8:
+- :url: __URL__
+  :method: GET
+  :params:
+text/css:
+- :url: __URL__css
+  :method: GET
+  :params:
+YAML
+    end
+
+    def results_with_empty_options
+        yaml_load <<YAML
+---
+text/html;charset=utf-8:
+- :url: __URL__
+  :method: GET
+  :params:
+text/css:
+- :url: __URL__css
+  :method: GET
+  :params:
+image/png:
+- :url: __URL__png
+  :method: GET
+  :params:
+application/vnd.ms-excel:
+- :url: __URL__excel
+  :method: GET
+  :params:
+YAML
+    end
+
+    context 'with default options' do
+        it "should not log 'text' content types" do
+            run
+            results.should eq default_results
+        end
+    end
+
+    context 'with custom \'exclude\' option' do
+        it "should not log the provided content types" do
+            Arachni::Options.plugins = { name_from_filename => { 'exclude' => 'image|excel' } }
+            run
+            results.should eq results_with_options
+        end
+    end
+
+    context 'with an empty \'exclude\' option' do
+        it "should log everything" do
+            Arachni::Options.plugins = { name_from_filename => { 'exclude' => '' } }
+            run
+            results.should eq results_with_empty_options
+        end
+    end
+
+    describe '.merge' do
+        it 'should merge an array of results' do
+            results = framework.plugins[name_from_filename].merge [ default_results, results_with_options ]
+            results.should eq results_with_empty_options
+        end
+    end
+end

data/spec/plugins/cookie_collector_spec.rb

@@ -0,0 +1,32 @@
+require_relative '../spec_helper'
+
+describe name_from_filename do
+    include_examples 'plugin'
+
+    before( :all ) do
+        options.url = url
+    end
+
+    it 'should log the expected results' do
+        run
+
+        results = results_for( name_from_filename )
+
+        results.size.should == 3
+
+        oks = 0
+        results.each do |result|
+            if (result[:res]['effective_url'] == url &&
+                result[:cookies] == { 'cookie1' => 'val1' }) ||
+                (result[:res]['effective_url'] == url + 'a_link' &&
+                result[:cookies] == { 'link_followed' => 'yay link!' }) ||
+                (result[:res]['effective_url'] == url + 'update_cookie' &&
+                result[:cookies] == { 'link_followed' => 'updated link!', 'stuff' => 'blah' })
+                oks += 1
+            end
+
+        end
+
+        oks.should == 3
+    end
+end

data/spec/plugins/form_dicattack_spec.rb

@@ -0,0 +1,60 @@
+require_relative '../spec_helper'
+
+describe name_from_filename do
+    include_examples 'plugin'
+
+    before( :all ) do
+        options.url = url
+    end
+
+    context "when given the right params" do
+        it 'should locate the form and login successfully' do
+            name = name_from_filename
+
+            options.plugins[name] = {
+                'username_field' => 'username',
+                'password_field' => 'password',
+                'username_list'  => spec_path + 'fixtures/usernames.txt',
+                'password_list'  => spec_path + 'fixtures/passwords.txt',
+                'login_verifier' => 'logged in user!'
+            }
+
+            run
+            results_for( name ).should == { username: 'sys', password: 'admin' }
+        end
+    end
+
+    context "when being unable to login" do
+        it 'should not log any results' do
+            name = name_from_filename
+
+            options.plugins[name] = {
+                'username_field' => 'username',
+                'password_field' => 'password',
+                'username_list'  => spec_path + 'fixtures/usernames.txt',
+                'password_list'  => spec_path + 'fixtures/passwords.txt',
+                'login_verifier' => '34342#R#@$#2'
+            }
+
+            run
+            results_for( name ).should be_nil
+        end
+    end
+
+    context "when given invalid params" do
+        it 'should complain about not being able to find the form' do
+            name = name_from_filename
+
+            options.plugins[name] = {
+                'username_field' => 'username2',
+                'password_field' => 'password',
+                'username_list'  => spec_path + 'fixtures/usernames.txt',
+                'password_list'  => spec_path + 'fixtures/passwords.txt',
+                'login_verifier' => 'logged in user!'
+            }
+
+            run
+            results_for( name ).should be_nil
+        end
+    end
+end

data/spec/plugins/healthmap_spec.rb

@@ -0,0 +1,40 @@
+require_relative '../spec_helper'
+
+describe name_from_filename do
+    include_examples 'plugin'
+
+    before ( :all ) do
+        options.url = url
+        framework.opts.audit :links
+        framework.modules.load :xss
+    end
+
+    def results
+        <<YAML
+---
+:map:
+- :safe: __URL__
+- :safe: __URL__safe
+- :unsafe: __URL__vuln
+:total: 4
+:safe: 3
+:unsafe: 1
+:issue_percentage: 25
+YAML
+    end
+
+    it 'should log safe and vuln URLs accordingly' do
+        run
+
+        results     = actual_results
+        exp_results = expected_results
+
+        actual_map   = results.delete( :map )
+        expected_map = exp_results.delete( :map )
+
+        actual_map.select { |k, v| k == :safe }.should be_eql expected_map.select { |k, v| k == :safe }
+        actual_map.select { |k, v| k == :unsafe }.should be_eql expected_map.select { |k, v| k == :unsafe }
+
+        results.should be_eql exp_results
+    end
+end

data/spec/plugins/http_dicattack_spec.rb

@@ -0,0 +1,40 @@
+require_relative '../spec_helper'
+
+describe name_from_filename do
+    include_examples 'plugin'
+
+    before( :all ) do
+        options.plugins[name] = {
+            'username_list'  => spec_path + 'fixtures/usernames.txt',
+            'password_list'  => spec_path + 'fixtures/passwords.txt',
+        }
+    end
+
+    def results
+        results_for( name_from_filename )
+    end
+
+    context "when given the right params" do
+        it 'should locate the form and login successfully' do
+            options.url = server_url_for( name_from_filename )
+            run
+            results.should == { username: 'admin', password: 'pass' }
+        end
+    end
+
+    context "when being unable to login" do
+        it 'should not log any results' do
+            options.url = server_url_for( "#{name_from_filename}_secure" )
+            run
+            results.should be_nil
+        end
+    end
+
+    context "when the page isn't protected" do
+        it 'should not log anything' do
+            options.url = server_url_for( "#{name_from_filename}_unprotected" )
+            run
+            results.should be_nil
+        end
+    end
+end

data/spec/plugins/meta/remedies/discovery_spec.rb

@@ -0,0 +1,15 @@
+require_relative '../../../spec_helper'
+
+describe name_from_filename do
+    include_examples 'plugin'
+
+    #before( :all ) do
+    #    framework.modules.load_by_tags :discovery
+    #end
+
+    #def results
+    #    :nil
+    #end
+
+    #easy_test
+end

data/spec/plugins/meta/remedies/manual_verification_spec.rb

@@ -0,0 +1,28 @@
+require_relative '../../../spec_helper'
+
+describe name_from_filename do
+    include_examples 'plugin'
+
+    before( :all ) do
+        issues = [Arachni::Issue.new( url: 'http://test.com/0', verification: true ),
+                   Arachni::Issue.new( url: 'http://test.com/1', verification: false )]
+        framework.modules.register_results( issues )
+    end
+
+    def results
+        framework.auditstore.issues.map.with_index do |issue, idx|
+            next if issue.url != 'http://test.com/0'
+            {
+                'hash'   => issue.digest,
+                'index'  => idx + 1,
+                'url'    => issue.url,
+                'name'   => issue.name,
+                'var'    => issue.var,
+                'elem'   => issue.elem,
+                'method' => issue.method
+            }
+        end.compact
+    end
+
+    easy_test
+end

data/spec/plugins/meta/remedies/timing_attacks_spec.rb

@@ -0,0 +1,30 @@
+require_relative '../../../spec_helper'
+
+describe name_from_filename do
+    include_examples 'plugin'
+
+    before( :all ) do
+        options.url = url
+        options.audit :forms
+
+        # this module uses the least amount of seeds, should save us some time
+        framework.modules.load :os_cmd_injection_timing
+    end
+
+    def results
+        framework.auditstore.issues.map.with_index do |issue, idx|
+            next if issue.var != 'untrusted_input'
+            {
+                'hash'   => issue.digest,
+                'index'  => idx + 1,
+                'url'    => issue.url,
+                'name'   => issue.name,
+                'var'    => issue.var,
+                'elem'   => issue.elem,
+                'method' => issue.method
+            }
+        end.compact
+    end
+
+    easy_test
+end

data/spec/plugins/meta/uniformity_spec.rb

@@ -0,0 +1,83 @@
+require_relative '../../spec_helper'
+
+describe name_from_filename do
+    include_examples 'plugin'
+
+    before( :all ) do
+        @modname = 'Uber kewl module'
+        @element = 'form'
+        @method  = 'GET'
+
+        @issue_name = 'my issue'
+        @input_name = 'vulnerable_input'
+
+        @issues = []
+        10.times do |i|
+            @issues << Arachni::Issue.new( url: 'http://test.com/' + i.to_s,
+                                           name: @issue_name,
+                                           internal_modname: @modname,
+                                           var: @input_name,
+                                           elem: @element,
+                                           method: @method )
+        end
+
+        issues = Arachni::Issue.new( url: 'http://test.com/hua',
+                                     name: 'other issue',
+                                     internal_modname: 'modname',
+                                     var: 'input_name',
+                                     elem: 'cookie',
+                                     method: 'POST' )
+
+        framework.modules.register_results( @issues | [issues] )
+    end
+
+    def results
+        YAML.load <<YAML
+---
+uniformals:
+  Uber kewl module:form:vulnerable_input:
+    issue:
+      name: my issue
+      var: vulnerable_input
+      elem: form
+      method: GET
+    indices:
+    - 1
+    - 2
+    - 3
+    - 4
+    - 5
+    - 6
+    - 7
+    - 8
+    - 9
+    - 10
+    hashes:
+    - c61ff253b87a6f6b662ee1bb4bdcd8e19ea7ecf28216bd1b05dde1084888f258
+    - 7a1065b3720f048249a775dc0fe565fd386efdc530028a5cfe6bfb586399ede6
+    - 3eddda3522e1a1cbee3ae786d69cd7444610dda337e1f9ae62c9b877304aec1c
+    - 9901676b0ee6a3d02dfad85b9ce957947d6f19b37c9d0af8bb425316b38cc22a
+    - 0fc968eea1aa581c7b57e43073b5471e1a2b111a907f9a44e45bd6afc2cc5e2a
+    - 75e03c80ae71a8d4b390ea2a7ca866447b98681f1e59e66b31c2d23925135e4c
+    - d561cc6ff830880a28ec00017056c3c199b10324e7609eae891724e25357c1bb
+    - 0e2fe63f234d3ff36ecfdb192e29b10020957c72b114053704a0177c8d0d37ad
+    - adac8a4dae0a6fdff9a12be5ea6a2950d3417ea453571159bbe56c4325bc0ee6
+    - 7447cf004d2c11726ef55714195573cd5d3af88529898d458afdb30c0cb31460
+pages:
+  Uber kewl module:form:vulnerable_input:
+  - http://test.com/0
+  - http://test.com/1
+  - http://test.com/2
+  - http://test.com/3
+  - http://test.com/4
+  - http://test.com/5
+  - http://test.com/6
+  - http://test.com/7
+  - http://test.com/8
+  - http://test.com/9
+
+YAML
+    end
+
+    easy_test
+end

data/spec/plugins/profiler_spec.rb

@@ -0,0 +1,82 @@
+require_relative '../spec_helper'
+
+describe name_from_filename do
+    include_examples 'plugin'
+
+    before ( :all ) do
+        Arachni::Options.url = url
+        framework.opts.audit :links, :forms, :cookies, :headers
+    end
+
+    it 'should log taints' do
+        run
+        results = actual_results
+        results.size.should == 6
+
+        eoks = 0
+        results.each do |result|
+            elem = result['element']
+
+            case elem['type']
+
+                when 'form'
+                    elem['name'].should == 'myform'
+                    elem['auditable']['input'].include?( result['taint'] ).should be_true
+
+                    eoks += 1
+
+                when 'link'
+                    elem['auditable']['input'].include?( result['taint'] ).should be_true
+                    eoks += 1
+
+                when 'cookie'
+                    elem['auditable'].keys.should == %w(cookie2)
+                    elem['auditable'].to_s.include?( result['taint'] ).should be_true
+                    eoks += 1
+
+                when 'header'
+                    next if elem['auditable'].keys == %w(Set-Cookie)
+                    elem['auditable'].keys.should == %w(User-Agent)
+                    elem['auditable'].to_s.include?( result['taint'] ).should be_true
+                    eoks += 1
+            end
+
+            oks = 0
+            result['landed'].each do |elem|
+
+                case elem['type']
+                    when 'body'
+                        oks += 1
+
+                    when 'form'
+                        elem['name'].should == 'form_name'
+                        elem['auditable'].keys.should == %w(blah)
+                        elem['auditable'].to_s.include?( result['taint'] ).should be_true
+
+                        oks += 1
+
+                    when 'link'
+                        elem['auditable'].keys.include?( 'name' ).should be_true
+                        elem['auditable'].to_s.include?( result['taint'] ).should be_true
+                        oks += 1
+
+                    when 'cookie'
+                        elem['auditable'].keys.should == %w(stuff)
+                        elem['auditable'].to_s.include?( result['taint'] ).should be_true
+                        oks += 1
+
+                    when 'header'
+                        next if elem['auditable'].keys == %w(Set-Cookie)
+                        elem['auditable'].keys.should == %w(My-Header)
+                        elem['auditable'].to_s.include?( result['taint'] ).should be_true
+                        oks += 1
+                end
+            end
+
+            oks.should == 5
+        end
+
+        eoks.should == 6
+
+    end
+end