arachni 0.4.0.4 → 0.4.1

data/spec/plugins/rescan_spec.rb

@@ -0,0 +1,26 @@
+require_relative '../spec_helper'
+
+describe name_from_filename do
+    include_examples 'plugin'
+
+    before ( :all ) do
+        options.do_not_crawl
+        options.url = url
+        options.audit :links
+        framework.modules.load :xss
+    end
+
+    it 'should log safe and vuln URLs accordingly' do
+        afr = spec_path + '/fixtures/rescan.afr.tpl'
+        updated = spec_path + '/fixtures/rescan.afr'
+
+        yaml_load( IO.read( afr ) ).save( updated )
+        options.plugins[name_from_filename] = { 'afr' => updated }
+
+        run
+        framework.modules.issues.should be_any
+        framework.modules.issues.first.var.should == 'input'
+
+        File.delete( updated )
+    end
+end

data/spec/plugins/resolver_spec.rb

@@ -0,0 +1,16 @@
+require_relative '../spec_helper'
+
+describe name_from_filename do
+    include_examples 'plugin'
+
+    before( :all ) do
+        issues = [Arachni::Issue.new( url: 'http://localhost' )]
+        framework.modules.register_results( issues )
+    end
+
+    it 'should resolve vulnerable hostnames to IP addresses' do
+        run
+        [{ 'localhost' => '::1' }, { 'localhost' => '127.0.0.1' }].should include( results_for( name_from_filename ))
+    end
+
+end

data/spec/plugins/script_spec.rb

@@ -0,0 +1,12 @@
+require_relative '../spec_helper'
+
+describe name_from_filename do
+    include_examples 'plugin'
+
+    it 'should execute a Ruby script under the scope of the running plugin' do
+        options.plugins[name_from_filename] = { 'path' => spec_path + 'fixtures/script_plugin.rb' }
+
+        run
+        results_for( name_from_filename ).should == 'I\'m a script!'
+    end
+end

data/spec/plugins/vector_feed_spec.rb

@@ -0,0 +1,155 @@
+require_relative '../spec_helper'
+
+describe name_from_filename do
+    include_examples 'plugin'
+
+    def url
+        'http://test.com/'
+    end
+
+    before( :all ) do
+        options.url = url
+        options.do_not_crawl
+    end
+
+    def vectors
+        [
+            {
+                'type' => 'page',
+                'url'  => url,
+                'code' => 200,
+                'headers' => { 'Content-Type '=> "text/html; charset=utf-8" },
+                'body' => "HTML code goes here"
+            },
+            {
+                'type'   => 'link',
+                'action' => "#{url}link",
+                'inputs' => { 'my_param' => 'my val' }
+            },
+            {
+                'type'   => 'form',
+                'method' => 'post',
+                'action' => "#{url}form",
+                'inputs' => {
+                    'post_this' => 'HUA!',
+                    'csrf'      => "my_csrf_token"
+                },
+                'skip' => %w(csrf)
+            },
+            {
+                'type'   => 'cookie',
+                'action' => "#{url}cookie",
+                'inputs' => { 'session_id' => '43434234343sddsdsds' }
+            },
+            {
+                'type'   => 'header',
+                'action' => "#{url}header",
+                'inputs' => { 'User-Agent' => "Blah/2" }
+            }
+        ]
+    end
+
+    def check( pages )
+        v = vectors
+
+        oks = 0
+        pages.each do |page|
+            if page.response_headers.any?
+                page.url.should  == v.first['url']
+                page.code.should == v.first['code']
+                page.body.should == v.first['body']
+
+                page.response_headers.should == v.first['headers']
+
+                oks += 1
+            end
+
+            if page.cookies.any?
+                page.cookies.size.should == 1
+                cookie = v.select { |vector| vector['type'] == 'cookie' }.first
+                page.cookies.first.action.should == cookie['action']
+                page.cookies.first.auditable.should == cookie['inputs']
+
+                page.url.should  == cookie['action']
+                page.code.should == 200
+                page.body.should == ''
+
+                oks += 1
+            end
+
+            if page.links.any?
+                link = v.select { |vector| vector['type'] == 'link' }.first
+                page.links.first.action.should == link['action']
+                page.links.first.auditable.should == link['inputs']
+
+                page.url.should  == url
+                page.code.should == 200
+                page.body.should == ''
+
+                oks += 1
+            end
+
+            if page.forms.any?
+                form = v.select { |vector| vector['type'] == 'form' }.first
+                page.forms.first.action.should == form['action']
+                page.forms.first.auditable.should == form['inputs']
+
+                page.forms.first.immutables.include?( form['skip'].first ).should be_true
+
+                page.url.should  == url
+                page.code.should == 200
+                page.body.should == ''
+
+                oks += 1
+            end
+
+            if page.headers.any?
+                header = v.select { |vector| vector['type'] == 'header' }.first
+                page.headers.first.action.should == header['action']
+                page.headers.first.auditable.should == header['inputs']
+
+                page.url.should  == header['action']
+                page.code.should == 200
+                page.body.should == ''
+
+                oks += 1
+            end
+        end
+
+        oks.should == 5
+    end
+
+    def run_test
+        pages = []
+        framework.add_on_run_mods { |page| pages << page }
+        run
+
+        check( pages )
+    end
+
+    context 'when setting the option' do
+        describe :vectors do
+            it 'should forward the given vectors to the framework to be audited' do
+                options.plugins[name_from_filename] = { 'vectors' => vectors.dup }
+                run_test
+            end
+        end
+
+        describe :yaml_string do
+            it 'should unserialize the given string and forward the given vectors to the framework to be audited' do
+                options.plugins[name_from_filename] = { 'yaml_string' => vectors.to_yaml}
+                run_test
+            end
+        end
+
+        describe :yaml_file do
+            it 'should unserialize the given string and forward the given vectors to the framework to be audited' do
+                File.open( 'yaml_file.yml', 'w' ){ |f| f.write( YAML.dump( vectors ) ) }
+                options.plugins[name_from_filename] = { 'yaml_file' => 'yaml_file.yml' }
+                run_test
+
+                File.delete( 'yaml_file.yml' )
+            end
+        end
+    end
+end

data/spec/plugins/waf_detector_spec.rb

@@ -0,0 +1,41 @@
+require_relative '../spec_helper'
+
+describe name_from_filename do
+    include_examples 'plugin'
+
+    def url
+        server_url_for( name_from_filename ) + '/'
+    end
+
+    context 'when malicious requests are' do
+        context 'being rejected' do
+            it 'should log that a WAF exists' do
+                options.url = "#{url}positive"
+                run
+                results_for( name_from_filename ).should == {
+                    code: 1, msg: framework.plugins[name_from_filename]::MSG_FOUND
+                }
+            end
+        end
+
+        context 'being accepted' do
+            it 'should log that a WAF does not exist' do
+                options.url = "#{url}negative"
+                run
+                results_for( name_from_filename ).should == {
+                    code: 0, msg: framework.plugins[name_from_filename]::MSG_NOT_FOUND
+                }
+            end
+        end
+    end
+
+    context 'when the webapp behaves erratically' do
+        it 'should log that the tests were inconclusive' do
+            options.url = "#{url}inconclusive"
+            run
+            results_for( name_from_filename ).should == {
+                code: -1, msg: framework.plugins[name_from_filename]::MSG_INCONCLUSIVE
+            }
+        end
+    end
+end

data/spec/reports/afr_spec.rb

@@ -0,0 +1,13 @@
+require_relative '../spec_helper'
+
+describe name_from_filename do
+    include_examples 'report'
+
+    test_with_full_report do
+        full_report.should == YAML.load( IO.read( outfile ) )
+    end
+
+    test_with_empty_report do
+        empty_report.should == YAML.load( IO.read( outfile ) )
+    end
+end

data/spec/reports/ap_spec.rb

@@ -0,0 +1,9 @@
+require_relative '../spec_helper'
+
+describe name_from_filename do
+    include_examples 'report'
+
+    # not much to test here, if there's not an exception then we're cool
+    test_with_full_report
+    test_with_empty_report
+end

data/spec/reports/html_spec.rb

@@ -0,0 +1,13 @@
+require_relative '../spec_helper'
+
+describe name_from_filename do
+    include_examples 'report'
+
+    test_with_full_report do
+        Nokogiri::HTML( IO.read( outfile ) ).css( '.issue' ).should be_any
+    end
+
+    test_with_empty_report do
+        Nokogiri::HTML( IO.read( outfile ) ).css( '.issue' ).should be_empty
+    end
+end

data/spec/reports/json_spec.rb

@@ -0,0 +1,17 @@
+require_relative '../spec_helper'
+
+describe name_from_filename do
+    include_examples 'report'
+
+    test_with_full_report do
+        json = IO.read( outfile )
+        JSON.pretty_generate( full_report.to_hash ).should == json
+        JSON.load( json ).is_a?( Hash ).should be_true
+    end
+
+    test_with_empty_report do
+        json = IO.read( outfile )
+        JSON.pretty_generate( empty_report.to_hash ).should == json
+        JSON.load( json ).is_a?( Hash ).should be_true
+    end
+end

data/spec/reports/marshal_spec.rb

@@ -0,0 +1,13 @@
+require_relative '../spec_helper'
+
+describe name_from_filename do
+    include_examples 'report'
+
+    test_with_full_report do
+        full_report.should == Marshal.load( IO.read( outfile ) )
+    end
+
+    test_with_empty_report do
+        empty_report.should == Marshal.load( IO.read( outfile ) )
+    end
+end

data/spec/reports/stdout_spec.rb

@@ -0,0 +1,9 @@
+require_relative '../spec_helper'
+
+describe name_from_filename do
+    include_examples 'report'
+
+    # not much to test here, if there's not an exception then we're cool
+    test_with_full_report
+    test_with_empty_report
+end

data/spec/reports/txt_spec.rb

@@ -0,0 +1,8 @@
+require_relative '../spec_helper'
+
+describe name_from_filename do
+    include_examples 'report'
+
+    test_with_full_report
+    test_with_empty_report
+end

data/spec/reports/xml_spec.rb

@@ -0,0 +1,13 @@
+require_relative '../spec_helper'
+
+describe name_from_filename do
+    include_examples 'report'
+
+    test_with_full_report do
+        Nokogiri::XML( IO.read( outfile ) ).css( 'issue' ).size.should == full_report.issues.size
+    end
+
+    test_with_empty_report do
+        Nokogiri::XML( IO.read( outfile ) ).css( 'issue' ).size.should == empty_report.issues.size
+    end
+end

data/spec/reports/yaml_spec.rb

@@ -0,0 +1,13 @@
+require_relative '../spec_helper'
+
+describe name_from_filename do
+    include_examples 'report'
+
+    test_with_full_report do
+        full_report.should == YAML.load( IO.read( outfile ) )
+    end
+
+    test_with_empty_report do
+        empty_report.should == YAML.load( IO.read( outfile ) )
+    end
+end

data/spec/servers/arachni/element/capabilities/auditable/rdiff.rb

@@ -0,0 +1,36 @@
+require 'sinatra'
+require 'sinatra/contrib'
+set :logging, false
+
+get '/true' do
+    out = case params[:rdiff]
+        when 'blahbad'
+            'Could not find any results, bugger off!'
+        when 'blahgood', 'blah'
+            '1 item found: Blah blah blah...'
+        else
+            'No idea what you want mate...'
+    end
+
+    <<-EOHTML
+    <a href='?rdiff=blah'>Inject here</a>
+    #{out}
+EOHTML
+
+end
+
+get '/false' do
+    out = case params[:rdiff]
+        when 'blahgood', 'blahbad'
+            'Could not find any results, bugger off!'
+        when 'blah'
+            '1 item found: Blah blah blah...'
+        else
+            'No idea what you want mate...'
+    end
+
+<<-EOHTML
+    <a href='?rdiff=blah'>Inject here</a>
+    #{out}
+EOHTML
+end

data/spec/servers/arachni/element/capabilities/auditable/taint.rb

@@ -0,0 +1,10 @@
+require 'sinatra'
+require 'sinatra/contrib'
+set :logging, false
+
+get '/' do
+    <<-EOHTML
+    <a href='?input=blah'>Inject here</a>
+    #{params[:input]}
+EOHTML
+end

data/spec/servers/arachni/element/capabilities/auditable/timeout.rb

@@ -0,0 +1,30 @@
+require 'sinatra'
+set :logging, false
+
+get '/false' do
+    sleep 2
+<<-EOHTML
+    <a href='?sleep=0'>Inject here</a>
+    #{params[:input]}
+EOHTML
+end
+
+get '/true' do
+    wait = params[:sleep].to_f
+    wait /= 1000.0 if params[:mili] == 'true'
+
+    sleep( wait )
+
+<<-EOHTML
+    <a href='?sleep=0&mili=#{params[:mili]}'>Inject here</a>
+EOHTML
+end
+
+get '/high_response_time' do
+    sleep( params[:sleep].to_i + 2 )
+    <<-EOHTML
+        <a href='?sleep=0'>Inject here</a>
+EOHTML
+end
+
+get( '/sleep' ) { sleep 10 }