arachni 0.4.0.4 → 0.4.1

data/spec/servers/modules/recon/grep/html_objects.rb

@@ -0,0 +1,7 @@
+require 'sinatra'
+
+get '/' do
+    <<-EOHTML
+        <object width="400" height="400" data="helloworld.swf"></object>
+    EOHTML
+end

data/spec/servers/modules/recon/grep/http_only_cookies.rb

@@ -0,0 +1,21 @@
+require 'sinatra'
+require 'sinatra/contrib'
+
+get '/' do
+    response.set_cookie( "cookie", {
+        value:    "value",
+        httponly: false
+    })
+    response.set_cookie( "cookie2", {
+        value:    "value2",
+        httponly: false
+    })
+    response.set_cookie( "cookie3", {
+        value:    "value3",
+        httponly: true
+    })
+    response.set_cookie( "cookie4", {
+        value:    "value4",
+        httponly: true
+    })
+end

data/spec/servers/modules/recon/grep/insecure_cookies.rb

@@ -0,0 +1,21 @@
+require 'sinatra'
+require 'sinatra/contrib'
+
+get '/' do
+    response.set_cookie( "cookie", {
+        value:  "value",
+        secure: false
+    })
+    response.set_cookie( "cookie2", {
+        value:  "value2",
+        secure: false
+    })
+    response.set_cookie( "cookie3", {
+        value:  "value3",
+        secure: true
+    })
+    response.set_cookie( "cookie4", {
+        value:  "value4",
+        secure: true
+    })
+end

data/spec/servers/modules/recon/grep/mixed_resource.rb

@@ -0,0 +1,83 @@
+require 'sinatra/base'
+require 'webrick'
+require 'webrick/https'
+require 'openssl'
+
+name = "/C=US/ST=SomeState/L=SomeCity/O=Organization/OU=Unit/CN=localhost"
+ca  = OpenSSL::X509::Name.parse( name )
+key = OpenSSL::PKey::RSA.new( 1024 )
+crt = OpenSSL::X509::Certificate.new
+
+crt.version = 2
+crt.serial  = 1
+crt.subject = ca
+crt.issuer  = ca
+crt.public_key = key.public_key
+crt.not_before = Time.now
+crt.not_after  = Time.now + 1 * 365 * 24 * 60 * 60 # 1 year
+
+options = {
+    Port:            ARGV.first.gsub( /\D/, '' ).to_i,
+    SSLEnable:       true,
+    SSLVerifyClient: OpenSSL::SSL::VERIFY_NONE,
+    SSLCertificate:  crt,
+    SSLPrivateKey:   key,
+    SSLCertName:     [["CN", WEBrick::Utils::getservername]],
+}
+
+class MixedResourceHTTPSServer < Sinatra::Base
+
+    get '/' do
+        <<-EOHTML
+            <a href="/vuln_script">Vuln script</a>
+            <a href="/ok_script">OK script</a>
+            <a href="/relative_script">Relative script</a>
+
+            <a href="/vuln_link">Vuln link</a>
+            <a href="/ok_link">OK link</a>
+            <a href="/relative_link">Relative link</a>
+        EOHTML
+    end
+
+    get '/vuln_script' do
+        <<-EOHTML
+            <script src="http://localhost/stuff.js"></script>
+        EOHTML
+    end
+
+    get '/ok_script' do
+        <<-EOHTML
+            <script src="https://localhost/secure_stuff.js"></script>
+        EOHTML
+    end
+
+    get '/relative_script' do
+        <<-EOHTML
+            <script src="stuff/secure_stuff.js"></script>
+        EOHTML
+    end
+
+    get '/vuln_link' do
+        <<-EOHTML
+            <link rel="stylesheet" type="text/css" href="http://localhost/theme.css" />
+        EOHTML
+    end
+
+    get '/ok_script' do
+        <<-EOHTML
+            <link rel="stylesheet" type="text/css" href="https://localhost/secure_theme.css" />
+        EOHTML
+    end
+
+    get '/relative_link' do
+        <<-EOHTML
+            <link rel="stylesheet" type="text/css" href="stuff/secure_theme.css" />
+        EOHTML
+    end
+
+end
+
+server = ::Rack::Handler::WEBrick
+trap( :INT ) { server.shutdown }
+
+server.run( MixedResourceHTTPSServer, options )

data/spec/servers/modules/recon/grep/private_ip.rb

@@ -0,0 +1,18 @@
+require 'sinatra'
+
+get '/' do
+    <<-EOHTML
+        <a href="/body">Body</a>
+        <a href="/header">Header</a>
+    EOHTML
+end
+
+get '/body' do
+    <<-EOHTML
+        192.168.1.12
+    EOHTML
+end
+
+get '/header' do
+    headers 'Disclosure' => '192.168.1.121'
+end

data/spec/servers/modules/recon/grep/ssn.rb

@@ -0,0 +1,5 @@
+require 'sinatra'
+
+get '/' do
+    'stuff 333-65-4320 v'
+end

data/spec/servers/modules/recon/grep/unencrypted_password_forms.rb

@@ -0,0 +1,33 @@
+require 'sinatra'
+
+get '/' do
+    <<-EOHTML
+        <a href="/insecure">Insecure</a>
+        <a href="/secure">Secure</a>
+    EOHTML
+end
+
+get '/insecure' do
+    <<-EOHTML
+        <form>
+            <input name='insecure' type='password' />
+        </form>
+
+        <form>
+            <input id='insecure_2' type='password' />
+        </form>
+
+        Will be ignored.
+        <form>
+            <input type='password' />
+        </form>
+    EOHTML
+end
+
+get '/secure' do
+    <<-EOHTML
+        <form action="https://localhost/crap">
+            <input name='secure' type='password' />
+        </form>
+    EOHTML
+end

data/spec/servers/modules/recon/htaccess_limit.rb

@@ -0,0 +1,8 @@
+require 'sinatra'
+
+get '/' do
+    status 401
+end
+
+post '/' do
+end

data/spec/servers/modules/recon/http_put.rb

@@ -0,0 +1,7 @@
+require 'sinatra'
+
+put '/Arachni-*' do
+    body = request.body
+    self.class.get( env['REQUEST_PATH'] ) { body }
+    status 201
+end

data/spec/servers/modules/recon/interesting_responses.rb

@@ -0,0 +1,5 @@
+require 'sinatra'
+require_relative '../module_server'
+
+current_module.acceptable.each { |code| get( "/#{code}" ) { status code; code.to_s + rand( 9999 ).to_s } }
+current_module.acceptable.each { |code| get( "/blah/#{code}" ) { status code; code.to_s + rand( 9999 ).to_s } }

data/spec/servers/modules/recon/webdav.rb

@@ -0,0 +1,25 @@
+require 'sinatra'
+require_relative '../module_server'
+
+get '/' do
+    <<-HTML
+        <a href="/safe">Safe</a>
+        <a href="/empty">Empty</a>
+    HTML
+end
+
+options '/' do
+    headers 'Allow' => 'STUFF, PROPFIND'
+end
+
+get '/safe' do
+
+end
+options '/safe' do
+    headers 'Allow' => ''
+end
+
+get '/empty' do
+end
+options '/empty' do
+end

data/spec/servers/modules/recon/xst.rb

@@ -0,0 +1,6 @@
+require 'sinatra'
+require 'sinatra/multi_route'
+
+route 'TRACE', '/' do
+    "TRACE / HTTP/1.1"
+end

data/spec/servers/plugins/autologin.rb

@@ -0,0 +1,38 @@
+require 'sinatra'
+require 'sinatra/contrib'
+
+get '/' do
+    cookies[:success] ||= false
+
+    if cookies[:success] == 'true'
+        <<-HTML
+            <a href='/congrats'>Hi there logged-in user!</a>
+        HTML
+    else
+        redirect '/login'
+    end
+end
+
+get '/login' do
+    <<-HTML
+        <form method='post' name='login_form' action="/login">
+            <input name='username' value='' />
+            <input name='password' type='password' value='' />
+            <input name='token' type='hidden' value='secret!' />
+        </form>
+    HTML
+end
+
+post '/login' do
+    if params['username'] == 'john' && params['password'] == 'doe' &&
+        params['token'] == 'secret!'
+        cookies[:success] = true
+        redirect '/'
+    else
+        'Boohoo...'
+    end
+end
+
+get '/congrats' do
+    'Congrats!'
+end

data/spec/servers/plugins/autothrottle.rb

@@ -0,0 +1,8 @@
+require 'sinatra'
+
+get '/' do
+end
+
+get '/slow' do
+    sleep 1
+end

data/spec/servers/plugins/content_types.rb

@@ -0,0 +1,17 @@
+require 'sinatra'
+
+TYPES = {
+    css:   'text/css',
+    png:   'image/png',
+    excel: 'application/vnd.ms-excel',
+}
+
+get '/' do
+    TYPES.keys.map { |k| "<a href='#{k}'></a>" }.join
+end
+
+TYPES.each do |k, v|
+    get "/#{k}" do
+        headers 'Content-Type' => v
+    end
+end

data/spec/servers/plugins/cookie_collector.rb

@@ -0,0 +1,20 @@
+require 'sinatra'
+require 'sinatra/contrib'
+
+get '/' do
+    cookies[:cookie1] = 'val1'
+
+    <<-HTML
+        <a href='/a_link'>A link</a>
+        <a href='/update_cookie'>Update cookie</a>
+    HTML
+end
+
+get '/a_link' do
+    cookies[:link_followed] = 'yay link!'
+end
+
+get '/update_cookie' do
+    cookies[:link_followed] = 'updated link!'
+    cookies[:stuff] = 'blah'
+end

data/spec/servers/plugins/form_dicattack.rb

@@ -0,0 +1,28 @@
+require 'sinatra'
+require 'sinatra/contrib'
+
+get '/' do
+    <<-HTML
+    <form method='post' name='login_form' action="/login">
+        <input name='username' value='' />
+        <input name='password' type='password' value='' />
+        <input name='token' type='hidden' value='secret!' />
+    </form>
+    HTML
+end
+
+post '/login' do
+    if params['username'] == 'sys' && params['password'] == 'admin' &&
+        params['token'] == 'secret!'
+        <<-HTML
+            Hello logged in user!
+            <a href='/congrats'>stuff</a>
+        HTML
+    else
+        'Boohoo...'
+    end
+end
+
+get '/congrats' do
+    'Congrats!'
+end

data/spec/servers/plugins/healthmap.rb

@@ -0,0 +1,16 @@
+require 'sinatra'
+
+get '/' do
+    <<HTML
+    <a href='/vuln?input=stuff'></a>
+    <a href='/safe'></a>
+HTML
+end
+
+get '/safe' do
+    'stuff here'
+end
+
+get '/vuln' do
+    params['input'].to_s
+end

data/spec/servers/plugins/http_dicattack.rb

@@ -0,0 +1,9 @@
+require 'sinatra'
+
+use Rack::Auth::Basic do |username, password|
+    [username, password] == %w(admin pass)
+end
+
+get '/' do
+    'authenticated!'
+end

data/spec/servers/plugins/http_dicattack_secure.rb

@@ -0,0 +1,9 @@
+require 'sinatra'
+
+use Rack::Auth::Basic do |username, password|
+    [username, password] == %w(admin3434234342 pass)
+end
+
+get '/' do
+    'authenticated!'
+end

data/spec/servers/plugins/http_dicattack_unprotected.rb

@@ -0,0 +1,5 @@
+require 'sinatra'
+
+get '/' do
+    'blah'
+end

data/spec/servers/plugins/meta/remedies/discovery.rb

@@ -0,0 +1,7 @@
+require 'sinatra'
+
+get '/*' do
+    # we add the request path and random number to avoid
+    # being seen as a custom 404 handler
+    env['REQUEST_PATH'] + 'same crap' + rand( 9 ).to_s
+end

data/spec/servers/plugins/meta/remedies/timing_attacks.rb

@@ -0,0 +1,29 @@
+require 'sinatra'
+
+# stupid to way to pretend vulnerability for :os_cmd_injection_timing
+def eval( str )
+    if delay = str.to_s.gsub( /\D/, ' ' ).split( ' ' ).uniq.last
+        sleep delay.to_i
+    end
+end
+
+get '/' do
+    <<-HTML
+        <form action='/trusted'>
+            <input name="trusted_input"/>
+        </form>
+
+        <form action='/untrusted'>
+            <input name="untrusted_input"/>
+        </form>
+    HTML
+end
+
+get '/trusted' do
+    eval( params['trusted_input'] )
+end
+
+get '/untrusted' do
+    sleep( 4 )
+    eval( params['untrusted_input'] )
+end