arachni 0.4.0.4 → 0.4.1

data/spec/servers/modules/audit/xss_path.rb

@@ -0,0 +1,44 @@
+require 'sinatra'
+
+require 'ap'
+
+get '/' do
+    <<-EOHTML
+        <a href="/query/">Query</a>
+        <a href="/form_action1/">Form action no quotes</a>
+        <a href="/form_action2/">Form action single quotes</a>
+        <a href="/form_action3/">Form action double quotes</a>
+    EOHTML
+end
+
+get '/<*' do
+    URI.unescape( env['REQUEST_PATH'] )
+end
+
+get '/query/' do
+    URI.unescape( env['QUERY_STRING'] )
+end
+
+get "/form_action1*" do
+    <<-EOHTML
+        <form action=#{URI.unescape( env['REQUEST_PATH'] )}>
+            <input name='input' value='default' />
+        </form>
+    EOHTML
+end
+
+get "/form_action2*" do
+    <<-EOHTML
+        <form action='#{URI.unescape( env['REQUEST_PATH'] )}'>
+            <input name='input' value='default' />
+        </form>
+    EOHTML
+end
+
+get "/form_action3*" do
+    <<-EOHTML
+        <form action="#{URI.unescape( env['REQUEST_PATH'] )}">
+            <input name='input' value='default' />
+        </form>
+    EOHTML
+end

data/spec/servers/modules/audit/xss_script_tag.rb

@@ -0,0 +1,73 @@
+require 'sinatra'
+require 'sinatra/contrib'
+
+def get_variations( str )
+    <<-EOHTML
+        <script>#{str}</script>
+    EOHTML
+end
+
+get '/' do
+    <<-EOHTML
+        <a href="/link?input=default">Link</a>
+        <a href="/form">Form</a>
+        <a href="/cookie">Cookie</a>
+        <a href="/header">Header</a>
+    EOHTML
+end
+
+get "/link" do
+    <<-EOHTML
+        <a href="/link/append?input=default">Link</a>
+    EOHTML
+end
+
+get "/link/append" do
+    default = 'default'
+    return if !params['input'].start_with?( default )
+
+    get_variations( params['input'].split( default ).last )
+end
+
+get "/form" do
+    <<-EOHTML
+        <form action="/form/append">
+            <input name='input' value='default' />
+        </form>
+    EOHTML
+end
+
+get "/form/append" do
+    default = 'default'
+    return if !params['input'] || !params['input'].start_with?( default )
+
+    get_variations( params['input'].split( default ).last )
+end
+
+
+get "/cookie" do
+    <<-EOHTML
+        <a href="/cookie/append">Cookie</a>
+    EOHTML
+end
+
+get "/cookie/append" do
+    default = 'cookie value'
+    cookies['cookie2'] ||= default
+    return if !cookies['cookie2'].start_with?( default )
+
+    get_variations( cookies['cookie2'].split( default ).last )
+end
+
+get "/header" do
+    <<-EOHTML
+        <a href="/header/append">Header</a>
+    EOHTML
+end
+
+get "/header/append" do
+    default = 'arachni_user'
+    return if !env['HTTP_USER_AGENT'] || !env['HTTP_USER_AGENT'].start_with?( default )
+
+    get_variations( env['HTTP_USER_AGENT'].split( default ).last )
+end

data/spec/servers/modules/audit/xss_tag.rb

@@ -0,0 +1,139 @@
+require 'sinatra'
+require 'sinatra/contrib'
+
+get '/' do
+    <<-EOHTML
+        <a href="/link?input=default">Link</a>
+        <a href="/form">Form</a>
+        <a href="/cookie">Cookie</a>
+        <a href="/header">Header</a>
+    EOHTML
+end
+
+get "/link" do
+    <<-EOHTML
+        <a href="/link/no?input=default">Link</a>
+        <a href="/link/single?input=default">Link</a>
+        <a href="/link/double?input=default">Link</a>
+    EOHTML
+end
+
+get "/link/no" do
+    default = 'default'
+    return if !params['input'].start_with?( default )
+
+    "<a href='/' class=#{params['input']}>Vuln</a>"
+end
+
+get "/link/single" do
+    default = 'default'
+    return if !params['input'].start_with?( default )
+
+    "<a href='/' class='#{params['input']}'>Vuln</a>"
+end
+
+get "/link/double" do
+    default = 'default'
+    return if !params['input'].start_with?( default )
+
+    "<a href='/' class=\"#{params['input']}\">Vuln</a>"
+end
+
+get "/form" do
+    <<-EOHTML
+        <form action="/form/no">
+            <input name='input' value='default' />
+        </form>
+
+        <form action="/form/single">
+            <input name='input' value='default' />
+        </form>
+
+        <form action="/form/double">
+            <input name='input' value='default' />
+        </form>
+    EOHTML
+end
+
+get "/form/no" do
+    default = 'default'
+    return if !params['input'] || !params['input'].start_with?( default )
+
+    "<a href='/' class=#{params['input']}>Vuln</a>"
+end
+
+get "/form/single" do
+    default = 'default'
+    return if !params['input'] || !params['input'].start_with?( default )
+
+    "<a href='/' class='#{params['input']}'>Vuln</a>"
+end
+
+get "/form/double" do
+    default = 'default'
+    return if !params['input'] || !params['input'].start_with?( default )
+
+    "<a href='/' class=\"#{params['input']}\">Vuln</a>"
+end
+
+
+get "/cookie" do
+    <<-EOHTML
+        <a href="/cookie/no">Cookie</a>
+        <a href="/cookie/single">Cookie</a>
+        <a href="/cookie/double">Cookie</a>
+    EOHTML
+end
+
+get "/cookie/no" do
+    default = 'cookie value'
+    cookies['cookie'] ||= default
+    return if !cookies['cookie'].start_with?( default )
+
+    "<a href='/' class=#{cookies['cookie']}>Vuln</a>"
+end
+
+get "/cookie/single" do
+    default = 'cookie value'
+    cookies['cookie1'] ||= default
+    return if !cookies['cookie1'].start_with?( default )
+
+    "<a href='/' class='#{cookies['cookie1']}'>Vuln</a>"
+end
+
+get "/cookie/double" do
+    default = 'cookie value'
+    cookies['cookie2'] ||= default
+    return if !cookies['cookie2'].start_with?( default )
+
+    "<a href='/' class=\"#{cookies['cookie2']}\">Vuln</a>"
+end
+
+get "/header" do
+    <<-EOHTML
+        <a href="/header/no">Header</a>
+        <a href="/header/single">Header</a>
+        <a href="/header/double">Header</a>
+    EOHTML
+end
+
+get "/header/no" do
+    default = 'arachni_user'
+    return if !env['HTTP_USER_AGENT'] || !env['HTTP_USER_AGENT'].start_with?( default )
+
+    "<a href='/' class=#{env['HTTP_USER_AGENT']}>Vuln</a>"
+end
+
+get "/header/single" do
+    default = 'arachni_user'
+    return if !env['HTTP_USER_AGENT'] || !env['HTTP_USER_AGENT'].start_with?( default )
+
+    "<a href='/' class='#{env['HTTP_USER_AGENT']}'>Vuln</a>"
+end
+
+get "/header/double" do
+    default = 'arachni_user'
+    return if !env['HTTP_USER_AGENT'] || !env['HTTP_USER_AGENT'].start_with?( default )
+
+    "<a href='/' class=\"#{env['HTTP_USER_AGENT']}\">Vuln</a>"
+end

data/spec/servers/modules/module_server.rb

@@ -0,0 +1,14 @@
+require_relative '../../../lib/arachni'
+
+def framework
+    @@framework ||= Arachni::Framework.new
+end
+
+def current_module
+    @@current_module ||=
+        framework.modules[ File.basename( caller.first.split( ':' ).first, '.rb' ) ]
+end
+
+def module_name
+    File.basename( caller.first.split( ':' ).first, '.rb' )
+end

data/spec/servers/modules/recon/allowed_methods.rb

@@ -0,0 +1,5 @@
+require 'sinatra'
+
+options '/' do
+    headers 'Allow' => 'OPTIONS, TRACE, GET, HEAD'
+end

data/spec/servers/modules/recon/backdoors.rb

@@ -0,0 +1,4 @@
+require 'sinatra'
+require_relative '../module_server'
+
+current_module.filenames.each { |filename| get( "/#{filename}" ) { filename } }

data/spec/servers/modules/recon/backup_files.rb

@@ -0,0 +1,28 @@
+require 'sinatra'
+require_relative '../module_server'
+
+get '/' do
+    <<-HTML
+        <a href="/some_filename.php">Hit me</a>
+    HTML
+end
+
+%w(some_filename.php).each do |filename|
+    get '/' + filename do
+        filename
+    end
+
+    current_module.extensions.each do |ext|
+        path = ext % filename
+        get '/' + path do
+            path
+        end
+    end
+
+    current_module.extensions.each do |ext|
+        path = ext % filename.split( '.' ).first
+        get '/' + path do
+            path
+        end
+    end
+end

data/spec/servers/modules/recon/common_directories.rb

@@ -0,0 +1,6 @@
+require 'sinatra'
+require_relative '../module_server'
+
+current_module.directories.each { |name| get( "/#{name}/" ) { name } }
+
+get( '/' ) {}

data/spec/servers/modules/recon/common_files.rb

@@ -0,0 +1,6 @@
+require 'sinatra'
+require_relative '../module_server'
+
+current_module.filenames.each { |name| get( "/#{name}" ) { name } }
+
+get( '/' ) {}

data/spec/servers/modules/recon/directory_listing.rb

@@ -0,0 +1,30 @@
+require 'sinatra'
+require_relative '../module_server'
+
+def root
+    File.expand_path( File.dirname( __FILE__ ) )
+end
+
+get '/' do
+    <<-EOHTML
+        <a href="/some/path.crap?input=bloo">Path</a>
+    EOHTML
+end
+
+get '/some/path.crap' do
+    <<-EOHTML
+        Blah blah blah...#{params['input']}
+    EOHTML
+end
+
+get '/some*' do
+    req = URI.decode( env['PATH_INFO'].gsub( '/some', root ) ).gsub( '\\', '/' )
+    req << '/' if !req.end_with?( '/' )
+
+    #ap req
+    if File.directory?( req )
+        Dir.glob( req + '*' ).join( '<br/>' )
+    elsif !File.exists?( req )
+        'Does not exist'
+    end
+end

data/spec/servers/modules/recon/grep/captcha.rb

@@ -0,0 +1,27 @@
+require 'sinatra'
+
+get '/' do
+    <<-EOHTML
+        <a href="/captcha">Captcha</a>
+        <a href="/empty">Empty</a>
+        <a href="/irrelevant">Irrelevant</a>
+    EOHTML
+end
+
+get '/captcha' do
+    <<-EOHTML
+        <form>
+            <input name='CapTcha-32-Some_stuff' />
+        </form>
+    EOHTML
+end
+
+get '/empty' do
+    ''
+end
+
+get '/irrelevant' do
+    <<-EOHTML
+        Random crap here...
+    EOHTML
+end

data/spec/servers/modules/recon/grep/credit_card.rb

@@ -0,0 +1,28 @@
+require 'sinatra'
+require 'sinatra/contrib'
+
+NUMBERS = {
+    amex:         378282246310005,
+    amex_copr:    378734493671000,
+    oz_bank_card: 5610591081018250,
+    dinners:      30569309025904,
+    discover:     6011111111111117,
+    jcb:          3530111333300000,
+    master:       5555555555554444,
+    visa:         4111111111111111,
+    pbs:          76009244561,
+    paymentech:   6331101999990016
+}
+
+NUMBERS.each do |type, number|
+    get "/#{type}" do
+        number.to_s
+    end
+end
+
+get '/' do
+    NUMBERS.keys.map do |type|
+        "<a href=\"#{type}\">#{type}</a> "
+    end.join
+end
+

data/spec/servers/modules/recon/grep/cvs_svn_users.rb

@@ -0,0 +1,23 @@
+require 'sinatra'
+require 'sinatra/contrib'
+
+KEYWORDS = {
+    locker:  '$Locker: markd_locker $ ',
+    author:  '$Author: markd_author $ ',
+    id:      '$Id: https-test.pl 1081 2008-09-30 19:03:23Z john_id1 Exp $ ',
+    id2:     '$Id: https-test.pl 1081 2008-09-30 19:03:23Z john_id2 $ ',
+    header2: '$Header: /cvsweb/cvs-guide/keyword.html,v 1.3 1999/12/23 21:59:22 markd_header2 $ ',
+    header:  '$Header: /cvsweb/cvs-guide/keyword.html,v 1.3 1999/12/23 21:59:22 markd_header Exp $ '
+}
+
+KEYWORDS.each do |type, string|
+    get "/#{type}" do
+        string
+    end
+end
+
+get '/' do
+    KEYWORDS.keys.map do |type|
+        "<a href=\"#{type}\">#{type}</a> "
+    end.join
+end

data/spec/servers/modules/recon/grep/emails.rb

@@ -0,0 +1,21 @@
+require 'sinatra'
+require 'sinatra/contrib'
+
+ADDRESSES = [
+    'tasos@blah.com',
+    'john@foo.blah.com',
+    'john32.21d@foo.blah.com',
+    'a.little.more.unusual@dept.example.com'
+]
+
+ADDRESSES.each.with_index  do |address, i|
+    get "/#{i}" do
+        address
+    end
+end
+
+get '/' do
+    ADDRESSES.map.with_index do |type, i|
+        "<a href=\"#{i}\">#{i}</a> "
+    end.join
+end