arachni 0.4.0.4 → 0.4.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (688) hide show
  1. data/ACKNOWLEDGMENTS.md +2 -2
  2. data/AUTHORS.md +1 -4
  3. data/CHANGELOG.md +102 -3
  4. data/CONTRIBUTORS.md +4 -1
  5. data/EXPLOITATION.md +6 -6
  6. data/Gemfile +3 -0
  7. data/HACKING.md +29 -10
  8. data/LICENSE.md +176 -339
  9. data/NOTICE +12 -0
  10. data/README.md +160 -119
  11. data/Rakefile +83 -45
  12. data/arachni.gemspec +124 -0
  13. data/bin/arachni +14 -8
  14. data/bin/arachni_console +52 -0
  15. data/bin/arachni_rpc +14 -8
  16. data/bin/arachni_rpcd +15 -9
  17. data/bin/arachni_rpcd_monitor +14 -8
  18. data/bin/arachni_script +41 -0
  19. data/bin/arachni_web +18 -19
  20. data/bin/arachni_web_autostart +17 -18
  21. data/external/metasploit/plugins/arachni.rb +7 -9
  22. data/external/metasploit/{LICENSE → plugins/arachni/LICENSE} +0 -0
  23. data/external/metasploit/{modules → plugins/arachni/modules}/exploits/unix/webapp/arachni_exec.rb +1 -1
  24. data/external/metasploit/{modules → plugins/arachni/modules}/exploits/unix/webapp/arachni_path_traversal.rb +2 -2
  25. data/external/metasploit/{modules → plugins/arachni/modules}/exploits/unix/webapp/arachni_php_eval.rb +1 -1
  26. data/external/metasploit/{modules → plugins/arachni/modules}/exploits/unix/webapp/arachni_php_include.rb +1 -1
  27. data/external/metasploit/{modules → plugins/arachni/modules}/exploits/unix/webapp/arachni_sqlmap.rb +2 -2
  28. data/external/scripts/LICENSE.tpl +174 -0
  29. data/external/scripts/README.md +95 -0
  30. data/external/scripts/README.tpl +30 -0
  31. data/external/scripts/build.sh +631 -0
  32. data/external/scripts/build_all.sh +29 -0
  33. data/external/scripts/build_and_package.sh +100 -0
  34. data/external/scripts/cross_build_and_package.sh +20 -0
  35. data/external/scripts/installer.sh.tpl +166 -0
  36. data/external/scripts/lib/readlink_f.sh +40 -0
  37. data/external/scripts/package.sh +134 -0
  38. data/external/scripts/push_nightlies.sh +125 -0
  39. data/extras/placeholder +0 -0
  40. data/gfx/README.md +18 -0
  41. data/gfx/compiled/banner.png +0 -0
  42. data/gfx/compiled/favicon.ico +0 -0
  43. data/gfx/compiled/icon.png +0 -0
  44. data/gfx/compiled/logo.png +0 -0
  45. data/gfx/compiled/spider.png +0 -0
  46. data/gfx/font/Beneath_the_Surface.ttf +0 -0
  47. data/gfx/font/bts_readme.txt +14 -0
  48. data/gfx/source/banner.svg +999 -0
  49. data/gfx/source/icon.svg +627 -0
  50. data/gfx/source/logo.svg +672 -0
  51. data/gfx/source/spider.png +0 -0
  52. data/gfx/source/spider.svg +277 -0
  53. data/lib/arachni.rb +30 -5
  54. data/lib/arachni/audit_store.rb +111 -143
  55. data/lib/arachni/banner.rb +37 -0
  56. data/lib/arachni/bloom_filter.rb +74 -0
  57. data/lib/arachni/cache.rb +21 -0
  58. data/lib/arachni/cache/base.rb +170 -0
  59. data/lib/arachni/cache/least_cost_replacement.rb +89 -0
  60. data/lib/arachni/cache/least_recently_used.rb +73 -0
  61. data/lib/arachni/cache/random_replacement.rb +52 -0
  62. data/lib/arachni/component/manager.rb +391 -0
  63. data/lib/arachni/component/options.rb +38 -0
  64. data/lib/arachni/component/options/address.rb +41 -0
  65. data/lib/arachni/component/options/base.rb +126 -0
  66. data/lib/arachni/component/options/bool.rb +55 -0
  67. data/lib/arachni/component/options/enum.rb +51 -0
  68. data/lib/arachni/component/options/float.rb +45 -0
  69. data/lib/arachni/component/options/int.rb +44 -0
  70. data/lib/arachni/component/options/path.rb +36 -0
  71. data/lib/arachni/component/options/port.rb +37 -0
  72. data/lib/arachni/component/options/string.rb +44 -0
  73. data/lib/arachni/component/options/url.rb +42 -0
  74. data/lib/arachni/crypto/rsa_aes_cbc.rb +14 -8
  75. data/lib/arachni/database.rb +4 -4
  76. data/lib/arachni/database/base.rb +14 -8
  77. data/lib/arachni/database/hash.rb +21 -12
  78. data/lib/arachni/database/queue.rb +15 -9
  79. data/lib/arachni/element/base.rb +147 -0
  80. data/lib/arachni/element/capabilities/auditable.rb +623 -0
  81. data/lib/arachni/element/capabilities/auditable/rdiff.rb +243 -0
  82. data/lib/arachni/element/capabilities/auditable/taint.rb +141 -0
  83. data/lib/arachni/element/capabilities/auditable/timeout.rb +330 -0
  84. data/lib/arachni/element/capabilities/body.rb +19 -0
  85. data/lib/arachni/element/capabilities/mutable.rb +286 -0
  86. data/lib/arachni/element/capabilities/path.rb +19 -0
  87. data/lib/arachni/element/capabilities/refreshable.rb +48 -0
  88. data/lib/arachni/element/capabilities/server.rb +19 -0
  89. data/lib/arachni/element/cookie.rb +1043 -0
  90. data/lib/arachni/element/form.rb +1364 -0
  91. data/lib/arachni/element/header.rb +87 -0
  92. data/lib/arachni/element/link.rb +227 -0
  93. data/lib/arachni/exceptions.rb +12 -34
  94. data/lib/arachni/framework.rb +345 -436
  95. data/lib/arachni/http.rb +445 -409
  96. data/lib/arachni/http/cookie_jar.rb +163 -0
  97. data/lib/arachni/issue.rb +102 -65
  98. data/lib/arachni/mixins/observable.rb +25 -28
  99. data/lib/arachni/mixins/progress_bar.rb +11 -5
  100. data/lib/arachni/mixins/terminal.rb +17 -11
  101. data/lib/arachni/module.rb +4 -4
  102. data/lib/arachni/module/auditor.rb +270 -793
  103. data/lib/arachni/module/base.rb +107 -101
  104. data/lib/arachni/module/element_db.rb +54 -59
  105. data/lib/arachni/module/key_filler.rb +35 -35
  106. data/lib/arachni/module/manager.rb +178 -68
  107. data/lib/arachni/module/output.rb +25 -30
  108. data/lib/arachni/module/trainer.rb +85 -156
  109. data/lib/arachni/module/utilities.rb +29 -138
  110. data/lib/arachni/options.rb +496 -162
  111. data/lib/arachni/page.rb +186 -0
  112. data/lib/arachni/parser.rb +392 -2
  113. data/lib/arachni/plugin.rb +4 -4
  114. data/lib/arachni/plugin/base.rb +113 -44
  115. data/lib/arachni/plugin/manager.rb +120 -54
  116. data/lib/arachni/report.rb +4 -4
  117. data/lib/arachni/report/base.rb +59 -44
  118. data/lib/arachni/report/manager.rb +33 -32
  119. data/lib/arachni/rpc/client.rb +2 -0
  120. data/lib/arachni/rpc/client/base.rb +31 -18
  121. data/lib/arachni/rpc/client/dispatcher.rb +24 -11
  122. data/lib/arachni/rpc/client/instance.rb +24 -11
  123. data/lib/arachni/rpc/server/base.rb +12 -9
  124. data/lib/arachni/rpc/server/dispatcher.rb +161 -164
  125. data/lib/arachni/rpc/server/dispatcher/handler.rb +164 -0
  126. data/lib/arachni/rpc/server/{node.rb → dispatcher/node.rb} +86 -104
  127. data/lib/arachni/rpc/server/distributor.rb +432 -0
  128. data/lib/arachni/rpc/server/framework.rb +266 -758
  129. data/lib/arachni/rpc/server/instance.rb +38 -53
  130. data/lib/arachni/rpc/server/module/manager.rb +17 -20
  131. data/lib/arachni/rpc/server/output.rb +73 -179
  132. data/lib/arachni/rpc/server/plugin/manager.rb +58 -24
  133. data/lib/arachni/ruby.rb +6 -4
  134. data/lib/arachni/ruby/array.rb +30 -9
  135. data/lib/arachni/ruby/enumerable.rb +29 -0
  136. data/lib/arachni/ruby/object.rb +47 -12
  137. data/lib/arachni/ruby/string.rb +69 -24
  138. data/lib/arachni/ruby/webrick.rb +31 -0
  139. data/lib/arachni/session.rb +279 -0
  140. data/lib/arachni/spider.rb +295 -149
  141. data/lib/arachni/typhoeus/hydra.rb +18 -4
  142. data/lib/arachni/typhoeus/request.rb +52 -65
  143. data/lib/arachni/typhoeus/response.rb +62 -22
  144. data/lib/arachni/typhoeus/utils.rb +25 -0
  145. data/lib/arachni/ui/cli/cli.rb +331 -298
  146. data/lib/arachni/ui/cli/output.rb +105 -77
  147. data/lib/arachni/ui/foo/output.rb +116 -0
  148. data/lib/arachni/ui/rpc/dispatcher_monitor.rb +5 -12
  149. data/lib/arachni/ui/rpc/rpc.rb +43 -48
  150. data/lib/arachni/ui/web/addon_manager.rb +18 -13
  151. data/lib/arachni/ui/web/addons/sample.rb +14 -8
  152. data/lib/arachni/ui/web/addons/scheduler.rb +14 -8
  153. data/lib/arachni/ui/web/addons/scheduler/views/index.erb +1 -1
  154. data/lib/arachni/ui/web/addons/scheduler/views/options.erb +0 -3
  155. data/lib/arachni/ui/web/dispatcher_manager.rb +14 -9
  156. data/lib/arachni/ui/web/instance_manager.rb +14 -8
  157. data/lib/arachni/ui/web/log.rb +14 -10
  158. data/lib/arachni/ui/web/output_stream.rb +11 -5
  159. data/lib/arachni/ui/web/report_manager.rb +14 -10
  160. data/lib/arachni/ui/web/scheduler.rb +16 -11
  161. data/lib/arachni/ui/web/server.rb +62 -56
  162. data/lib/arachni/ui/web/server/public/style.css +1 -1
  163. data/lib/arachni/ui/web/server/views/addon.erb +1 -1
  164. data/lib/arachni/ui/web/server/views/dispatchers.erb +3 -3
  165. data/lib/arachni/ui/web/server/views/dispatchers_edit.erb +2 -2
  166. data/lib/arachni/ui/web/server/views/error.erb +1 -1
  167. data/lib/arachni/ui/web/server/views/home.erb +2 -2
  168. data/lib/arachni/ui/web/server/views/instance.erb +6 -6
  169. data/lib/arachni/ui/web/server/views/layout.erb +4 -4
  170. data/lib/arachni/ui/web/server/views/settings.erb +13 -8
  171. data/lib/arachni/ui/web/server/views/welcome.erb +1 -1
  172. data/lib/arachni/ui/web/utilities.rb +24 -35
  173. data/lib/arachni/uri.rb +619 -0
  174. data/lib/arachni/utilities.rb +316 -0
  175. data/lib/arachni/version.rb +12 -6
  176. data/lib/version +1 -0
  177. data/modules/audit/code_injection.rb +64 -81
  178. data/modules/audit/code_injection_timing.rb +57 -75
  179. data/modules/audit/csrf.rb +87 -185
  180. data/modules/audit/ldapi.rb +42 -67
  181. data/modules/audit/os_cmd_injection.rb +53 -71
  182. data/modules/audit/os_cmd_injection/payloads.txt +1 -1
  183. data/modules/audit/os_cmd_injection_timing.rb +54 -75
  184. data/modules/audit/os_cmd_injection_timing/payloads.txt +1 -3
  185. data/modules/audit/path_traversal.rb +84 -110
  186. data/modules/audit/response_splitting.rb +41 -53
  187. data/modules/audit/rfi.rb +68 -76
  188. data/modules/audit/session_fixation.rb +86 -0
  189. data/modules/audit/sqli.rb +51 -77
  190. data/modules/audit/sqli/regexp_ids.txt +5 -19
  191. data/modules/audit/sqli/regexp_ignore.txt +2 -0
  192. data/modules/audit/sqli_blind_rdiff.rb +51 -62
  193. data/modules/audit/sqli_blind_timing.rb +53 -73
  194. data/modules/audit/trainer.rb +21 -58
  195. data/modules/audit/unvalidated_redirect.rb +41 -51
  196. data/modules/audit/xpath.rb +38 -69
  197. data/modules/audit/xpath/errors.txt +2 -3
  198. data/modules/audit/xss.rb +65 -69
  199. data/modules/audit/xss_event.rb +50 -69
  200. data/modules/audit/xss_path.rb +63 -89
  201. data/modules/audit/xss_script_tag.rb +53 -66
  202. data/modules/audit/xss_tag.rb +46 -65
  203. data/modules/audit/xss_uri.rb +22 -24
  204. data/modules/recon/allowed_methods.rb +46 -62
  205. data/modules/recon/backdoors.rb +39 -66
  206. data/modules/recon/backup_files.rb +49 -79
  207. data/modules/recon/common_directories.rb +39 -63
  208. data/modules/recon/common_directories/directories.txt +0 -5
  209. data/modules/recon/common_files.rb +34 -63
  210. data/modules/recon/directory_listing.rb +66 -116
  211. data/modules/recon/grep/captcha.rb +34 -41
  212. data/modules/recon/grep/credit_card.rb +57 -68
  213. data/modules/recon/grep/cvs_svn_users.rb +40 -50
  214. data/modules/recon/grep/emails.rb +34 -41
  215. data/modules/recon/grep/html_objects.rb +30 -33
  216. data/modules/recon/grep/http_only_cookies.rb +57 -0
  217. data/modules/recon/grep/insecure_cookies.rb +55 -0
  218. data/modules/recon/grep/mixed_resource.rb +93 -0
  219. data/modules/recon/grep/private_ip.rb +34 -32
  220. data/modules/recon/grep/ssn.rb +33 -31
  221. data/modules/recon/grep/unencrypted_password_forms.rb +84 -0
  222. data/modules/recon/htaccess_limit.rb +38 -54
  223. data/modules/recon/http_put.rb +48 -62
  224. data/modules/recon/interesting_responses.rb +77 -79
  225. data/modules/recon/webdav.rb +53 -79
  226. data/modules/recon/xst.rb +44 -63
  227. data/modules/test2.rb +46 -0
  228. data/path_extractors/anchors.rb +17 -15
  229. data/path_extractors/forms.rb +17 -15
  230. data/path_extractors/frames.rb +17 -18
  231. data/path_extractors/generic.rb +52 -55
  232. data/path_extractors/links.rb +16 -14
  233. data/path_extractors/meta_refresh.rb +33 -18
  234. data/path_extractors/scripts.rb +17 -15
  235. data/plugins/autologin.rb +60 -85
  236. data/plugins/beep_notify.rb +25 -27
  237. data/plugins/cookie_collector.rb +28 -45
  238. data/plugins/defaults/autothrottle.rb +43 -51
  239. data/plugins/defaults/content_types.rb +63 -52
  240. data/plugins/defaults/healthmap.rb +45 -62
  241. data/plugins/defaults/{metamodules → meta}/remedies/discovery.rb +34 -69
  242. data/plugins/defaults/meta/remedies/manual_verification.rb +61 -0
  243. data/plugins/defaults/meta/remedies/timing_attacks.rb +108 -0
  244. data/plugins/defaults/meta/uniformity.rb +81 -0
  245. data/plugins/defaults/profiler.rb +68 -115
  246. data/plugins/defaults/resolver.rb +33 -28
  247. data/plugins/email_notify.rb +60 -62
  248. data/plugins/form_dicattack.rb +67 -121
  249. data/plugins/http_dicattack.rb +51 -65
  250. data/plugins/libnotify.rb +37 -41
  251. data/plugins/proxy.rb +407 -152
  252. data/plugins/proxy/panel/403_forbidden.html.erb +11 -0
  253. data/plugins/proxy/panel/404_not_found.html.erb +6 -0
  254. data/plugins/proxy/panel/css/bootstrap.min.css +9 -0
  255. data/plugins/proxy/panel/css/panel.css +30 -0
  256. data/plugins/proxy/panel/help.html.erb +66 -0
  257. data/plugins/proxy/panel/img/glyphicons-halflings-white.png +0 -0
  258. data/plugins/proxy/panel/img/glyphicons-halflings.png +0 -0
  259. data/plugins/proxy/panel/img/record.png +0 -0
  260. data/plugins/proxy/panel/inspect.html.erb +7 -0
  261. data/plugins/proxy/panel/js/bootstrap.min.js +6 -0
  262. data/plugins/proxy/panel/js/jquery.min.js +2 -0
  263. data/plugins/proxy/panel/js/panel.js +39 -0
  264. data/plugins/proxy/panel/layout.html.erb +25 -0
  265. data/plugins/proxy/panel/page_accordion.html.erb +67 -0
  266. data/plugins/proxy/panel/page_twin_accordion.html.erb +18 -0
  267. data/plugins/proxy/panel/panel.html.erb +63 -0
  268. data/plugins/proxy/panel/shutdown_message.html.erb +7 -0
  269. data/plugins/proxy/panel/verify_login_check.html.erb +31 -0
  270. data/plugins/proxy/panel/verify_login_final.html.erb +26 -0
  271. data/plugins/proxy/panel/verify_login_sequence.html.erb +45 -0
  272. data/plugins/proxy/server.rb +175 -47
  273. data/plugins/proxy/ssl-interceptor-cert.pem +34 -0
  274. data/plugins/proxy/ssl-interceptor-pkey.pem +51 -0
  275. data/plugins/rescan.rb +27 -28
  276. data/plugins/script.rb +53 -0
  277. data/plugins/vector_feed.rb +226 -0
  278. data/plugins/waf_detector.rb +70 -73
  279. data/reports/afr.rb +23 -24
  280. data/reports/ap.rb +25 -36
  281. data/reports/html.rb +109 -163
  282. data/reports/html/default.erb +13 -12
  283. data/reports/html/default/configuration.erb +21 -21
  284. data/reports/html/default/css/main.css +350 -350
  285. data/reports/html/default/issues.erb +1 -1
  286. data/reports/html/default/js/charts.js +2 -2
  287. data/reports/html/default/js/helpers.js +0 -42
  288. data/reports/html/default/js/init.js +0 -1
  289. data/reports/html/default/sitemap.erb +2 -2
  290. data/reports/html/default/summary.erb +4 -4
  291. data/reports/html/default/summary_issue.erb +1 -1
  292. data/reports/json.rb +26 -28
  293. data/reports/marshal.rb +23 -25
  294. data/reports/metareport.rb +65 -98
  295. data/reports/plugin_formatters/html/autologin.rb +34 -41
  296. data/reports/plugin_formatters/html/content_types.rb +46 -52
  297. data/reports/plugin_formatters/html/cookie_collector.rb +41 -47
  298. data/reports/plugin_formatters/html/discovery.rb +36 -41
  299. data/reports/plugin_formatters/html/form_dicattack.rb +28 -34
  300. data/reports/plugin_formatters/html/healthmap.rb +48 -55
  301. data/reports/plugin_formatters/html/http_dicattack.rb +28 -34
  302. data/reports/plugin_formatters/html/profiler.rb +26 -30
  303. data/reports/plugin_formatters/html/profiler/template.erb +7 -7
  304. data/reports/plugin_formatters/html/resolver.rb +44 -52
  305. data/reports/plugin_formatters/html/timing_attacks.rb +42 -44
  306. data/reports/plugin_formatters/html/uniformity.rb +37 -42
  307. data/reports/plugin_formatters/html/waf_detector.rb +26 -34
  308. data/reports/plugin_formatters/stdout/autologin.rb +28 -40
  309. data/reports/plugin_formatters/stdout/content_types.rb +36 -53
  310. data/reports/plugin_formatters/stdout/cookie_collector.rb +28 -41
  311. data/reports/plugin_formatters/stdout/discovery.rb +27 -37
  312. data/reports/plugin_formatters/stdout/form_dicattack.rb +22 -35
  313. data/reports/plugin_formatters/stdout/healthmap.rb +40 -57
  314. data/reports/plugin_formatters/stdout/http_dicattack.rb +22 -36
  315. data/reports/plugin_formatters/stdout/profiler.rb +55 -74
  316. data/reports/plugin_formatters/stdout/resolver.rb +18 -34
  317. data/reports/plugin_formatters/stdout/timing_attacks.rb +27 -39
  318. data/reports/plugin_formatters/stdout/uniformity.rb +32 -44
  319. data/reports/plugin_formatters/stdout/waf_detector.rb +20 -32
  320. data/reports/plugin_formatters/xml/autologin.rb +27 -49
  321. data/reports/plugin_formatters/xml/content_types.rb +41 -66
  322. data/reports/plugin_formatters/xml/cookie_collector.rb +29 -49
  323. data/reports/plugin_formatters/xml/discovery.rb +23 -41
  324. data/reports/plugin_formatters/xml/form_dicattack.rb +22 -40
  325. data/reports/plugin_formatters/xml/healthmap.rb +44 -63
  326. data/reports/plugin_formatters/xml/http_dicattack.rb +22 -41
  327. data/reports/plugin_formatters/xml/profiler.rb +65 -89
  328. data/reports/plugin_formatters/xml/resolver.rb +21 -41
  329. data/reports/plugin_formatters/xml/timing_attacks.rb +27 -45
  330. data/reports/plugin_formatters/xml/uniformity.rb +36 -55
  331. data/reports/plugin_formatters/xml/waf_detector.rb +23 -42
  332. data/reports/stdout.rb +120 -121
  333. data/reports/txt.rb +29 -45
  334. data/reports/xml.rb +109 -148
  335. data/reports/xml/buffer.rb +66 -79
  336. data/reports/yaml.rb +26 -28
  337. data/rpcd_handlers/placeholder +0 -0
  338. data/spec/arachni/audit_store_spec.rb +223 -0
  339. data/spec/arachni/bloom_filter_spec.rb +76 -0
  340. data/spec/arachni/cache/base_spec.rb +275 -0
  341. data/spec/arachni/cache/least_cost_replacement_spec.rb +58 -0
  342. data/spec/arachni/cache/least_recently_used_spec.rb +91 -0
  343. data/spec/arachni/cache/random_replacement_spec.rb +43 -0
  344. data/spec/arachni/component/manager_spec.rb +448 -0
  345. data/spec/arachni/component/options/address_spec.rb +32 -0
  346. data/spec/arachni/component/options/base_spec.rb +105 -0
  347. data/spec/arachni/component/options/bool_spec.rb +67 -0
  348. data/spec/arachni/component/options/enum_spec.rb +51 -0
  349. data/spec/arachni/component/options/float_spec.rb +42 -0
  350. data/spec/arachni/component/options/int_spec.rb +46 -0
  351. data/spec/arachni/component/options/path_spec.rb +32 -0
  352. data/spec/arachni/component/options/port_spec.rb +38 -0
  353. data/spec/arachni/component/options/string_spec.rb +38 -0
  354. data/spec/arachni/component/options/url_spec.rb +36 -0
  355. data/spec/arachni/crypto/rsa_aes_cbc_spec.rb +31 -0
  356. data/spec/arachni/database/hash_spec.rb +217 -0
  357. data/spec/arachni/database/queue_spec.rb +52 -0
  358. data/spec/arachni/element/base_spec.rb +127 -0
  359. data/spec/arachni/element/body_spec.rb +9 -0
  360. data/spec/arachni/element/capabilities/auditable/rdiff_spec.rb +47 -0
  361. data/spec/arachni/element/capabilities/auditable/taint_spec.rb +110 -0
  362. data/spec/arachni/element/capabilities/auditable/timeout_spec.rb +107 -0
  363. data/spec/arachni/element/capabilities/mutable_spec.rb +261 -0
  364. data/spec/arachni/element/cookie_spec.rb +362 -0
  365. data/spec/arachni/element/form_spec.rb +668 -0
  366. data/spec/arachni/element/header_spec.rb +49 -0
  367. data/spec/arachni/element/link_spec.rb +220 -0
  368. data/spec/arachni/element/path_spec.rb +9 -0
  369. data/spec/arachni/element/server_spec.rb +9 -0
  370. data/spec/arachni/framework_spec.rb +860 -0
  371. data/spec/arachni/http/cookie_jar_spec.rb +267 -0
  372. data/spec/arachni/http_spec.rb +991 -0
  373. data/spec/arachni/issue_spec.rb +307 -0
  374. data/spec/arachni/mixins/observable_spec.rb +59 -0
  375. data/spec/arachni/mixins/progress_bar_spec.rb +41 -0
  376. data/spec/arachni/module/auditor_spec.rb +506 -0
  377. data/spec/arachni/module/element_db_spec.rb +131 -0
  378. data/spec/arachni/module/key_filler.rb +15 -0
  379. data/spec/arachni/module/manager_spec.rb +154 -0
  380. data/spec/arachni/module/trainer_spec.rb +102 -0
  381. data/spec/arachni/module/utilities_spec.rb +30 -0
  382. data/spec/arachni/module/utilities_spec/read_file.txt +3 -0
  383. data/spec/arachni/options_spec.rb +555 -0
  384. data/spec/arachni/page_spec.rb +290 -0
  385. data/spec/arachni/parser_spec.rb +508 -0
  386. data/spec/arachni/plugin/manager_spec.rb +174 -0
  387. data/spec/arachni/report/base_spec.rb +53 -0
  388. data/spec/arachni/report/manager_spec.rb +82 -0
  389. data/spec/arachni/rpc/client/base_spec.rb +157 -0
  390. data/spec/arachni/rpc/client/dispatcher_spec.rb +40 -0
  391. data/spec/arachni/rpc/client/instance_spec.rb +92 -0
  392. data/spec/arachni/rpc/server/base_spec.rb +40 -0
  393. data/spec/arachni/rpc/server/dispatcher/handler.rb +120 -0
  394. data/spec/arachni/rpc/server/dispatcher/node_spec.rb +220 -0
  395. data/spec/arachni/rpc/server/dispatcher_spec.rb +136 -0
  396. data/spec/arachni/rpc/server/distributor_spec.rb +628 -0
  397. data/spec/arachni/rpc/server/framework_hpg_spec.rb +321 -0
  398. data/spec/arachni/rpc/server/framework_simple_spec.rb +453 -0
  399. data/spec/arachni/rpc/server/instance_spec.rb +81 -0
  400. data/spec/arachni/rpc/server/modules/manager_spec.rb +79 -0
  401. data/spec/arachni/rpc/server/options_spec.rb +124 -0
  402. data/spec/arachni/rpc/server/output_spec.rb +238 -0
  403. data/spec/arachni/rpc/server/plugin/manager_spec.rb +86 -0
  404. data/spec/arachni/ruby/array_spec.rb +103 -0
  405. data/spec/arachni/ruby/enumerable_spec.rb +37 -0
  406. data/spec/arachni/ruby/object_spec.rb +38 -0
  407. data/spec/arachni/ruby/string_spec.rb +77 -0
  408. data/spec/arachni/ruby/webrick_spec.rb +15 -0
  409. data/spec/arachni/session_spec.rb +308 -0
  410. data/spec/arachni/spider_spec.rb +383 -0
  411. data/spec/arachni/typhoeus/hydra_spec.rb +14 -0
  412. data/spec/arachni/typhoeus/requrest_spec.rb +58 -0
  413. data/spec/arachni/typhoeus/response_spec.rb +78 -0
  414. data/spec/arachni/uri_spec.rb +462 -0
  415. data/spec/arachni/utilities_spec.rb +297 -0
  416. data/spec/fixtures/auditstore.afr +2959 -0
  417. data/spec/fixtures/cookies.txt +9 -0
  418. data/spec/fixtures/modules/test.rb +58 -0
  419. data/spec/fixtures/modules/test2.rb +46 -0
  420. data/spec/fixtures/modules/test3.rb +46 -0
  421. data/spec/fixtures/passwords.txt +17 -0
  422. data/spec/fixtures/plugins/bad.rb +46 -0
  423. data/spec/fixtures/plugins/defaults/default.rb +45 -0
  424. data/spec/fixtures/plugins/distributable.rb +42 -0
  425. data/spec/fixtures/plugins/loop.rb +32 -0
  426. data/spec/fixtures/plugins/wait.rb +34 -0
  427. data/spec/fixtures/plugins/with_options.rb +31 -0
  428. data/spec/fixtures/reports/base_spec/plugin_formatters/with_formatters/foobar.rb +21 -0
  429. data/spec/fixtures/reports/base_spec/with_formatters.rb +23 -0
  430. data/spec/fixtures/reports/base_spec/with_outfile.rb +24 -0
  431. data/spec/fixtures/reports/base_spec/without_outfile.rb +20 -0
  432. data/spec/fixtures/reports/manager_spec/afr.rb +21 -0
  433. data/spec/fixtures/reports/manager_spec/foo.rb +26 -0
  434. data/spec/fixtures/rescan.afr.tpl +145 -0
  435. data/spec/fixtures/rpcd_handlers/echo.rb +68 -0
  436. data/spec/fixtures/run_mod/body.rb +58 -0
  437. data/spec/fixtures/run_mod/cookies.rb +58 -0
  438. data/spec/fixtures/run_mod/empty.rb +58 -0
  439. data/spec/fixtures/run_mod/flch.rb +63 -0
  440. data/spec/fixtures/run_mod/forms.rb +58 -0
  441. data/spec/fixtures/run_mod/headers.rb +58 -0
  442. data/spec/fixtures/run_mod/links.rb +58 -0
  443. data/spec/fixtures/run_mod/nil.rb +57 -0
  444. data/spec/fixtures/run_mod/path.rb +58 -0
  445. data/spec/fixtures/run_mod/server.rb +58 -0
  446. data/spec/fixtures/script_plugin.rb +1 -0
  447. data/spec/fixtures/taint_module/taint.rb +48 -0
  448. data/spec/fixtures/usernames.txt +13 -0
  449. data/spec/fixtures/wait_module/wait.rb +48 -0
  450. data/spec/helpers/auditor.rb +9 -0
  451. data/spec/helpers/misc.rb +41 -0
  452. data/spec/helpers/processes.rb +112 -0
  453. data/spec/helpers/requires.rb +8 -0
  454. data/spec/helpers/server.rb +54 -0
  455. data/spec/logs/Dispatcher - 2752-13830.log +49 -0
  456. data/spec/logs/Dispatcher - 2766-8238.log +35 -0
  457. data/spec/logs/Dispatcher - 2808-9029.log +31 -0
  458. data/spec/logs/Dispatcher - 2854-8571.log +26 -0
  459. data/spec/logs/Dispatcher - 2888-10411.log +20 -0
  460. data/spec/logs/Dispatcher - 2922-14464.log +13 -0
  461. data/spec/logs/Dispatcher - 2957-15255.log +19 -0
  462. data/spec/logs/Dispatcher - 3216-14203.log +35 -0
  463. data/spec/logs/Dispatcher - 3305-8622.log +43 -0
  464. data/spec/logs/Dispatcher - 3340-15426.log +35 -0
  465. data/spec/logs/Dispatcher - 3399-12586.log +40 -0
  466. data/spec/logs/Dispatcher - 3433-14149.log +26 -0
  467. data/spec/logs/Dispatcher - 3582-6198.log +27 -0
  468. data/spec/logs/Dispatcher - 3616-11169.log +13 -0
  469. data/spec/logs/Dispatcher - 3849-9016.log +7 -0
  470. data/spec/logs/output_spec.log +4 -0
  471. data/spec/logs/placeholder +0 -0
  472. data/spec/modules/audit/code_injection_spec.rb +25 -0
  473. data/spec/modules/audit/code_injection_timing_spec.rb +24 -0
  474. data/spec/modules/audit/csrf_spec.rb +38 -0
  475. data/spec/modules/audit/ldapi_spec.rb +19 -0
  476. data/spec/modules/audit/os_cmd_injection_spec.rb +24 -0
  477. data/spec/modules/audit/os_cmd_injection_timing_spec.rb +24 -0
  478. data/spec/modules/audit/path_traversal_spec.rb +23 -0
  479. data/spec/modules/audit/response_splitting_spec.rb +19 -0
  480. data/spec/modules/audit/rfi_spec.rb +19 -0
  481. data/spec/modules/audit/session_fixation_spec.rb +23 -0
  482. data/spec/modules/audit/sqli_blind_rdiff_spec.rb +19 -0
  483. data/spec/modules/audit/sqli_blind_timing_spec.rb +23 -0
  484. data/spec/modules/audit/sqli_spec.rb +24 -0
  485. data/spec/modules/audit/trainer_spec.rb +25 -0
  486. data/spec/modules/audit/unvalidated_redirect_spec.rb +24 -0
  487. data/spec/modules/audit/xpath_spec.rb +25 -0
  488. data/spec/modules/audit/xss_event_spec.rb +19 -0
  489. data/spec/modules/audit/xss_path_spec.rb +19 -0
  490. data/spec/modules/audit/xss_script_tag_spec.rb +19 -0
  491. data/spec/modules/audit/xss_spec.rb +24 -0
  492. data/spec/modules/audit/xss_tag_spec.rb +19 -0
  493. data/spec/modules/recon/allowed_methods_spec.rb +19 -0
  494. data/spec/modules/recon/backdoors_spec.rb +19 -0
  495. data/spec/modules/recon/backup_files_spec.rb +19 -0
  496. data/spec/modules/recon/common_directories_spec.rb +19 -0
  497. data/spec/modules/recon/common_files_spec.rb +19 -0
  498. data/spec/modules/recon/directory_listing_spec.rb +19 -0
  499. data/spec/modules/recon/grep/captcha_spec.rb +19 -0
  500. data/spec/modules/recon/grep/credit_card_spec.rb +19 -0
  501. data/spec/modules/recon/grep/cvs_svn_users_spec.rb +19 -0
  502. data/spec/modules/recon/grep/emails_spec.rb +19 -0
  503. data/spec/modules/recon/grep/html_objects_spec.rb +19 -0
  504. data/spec/modules/recon/grep/http_only_cookies_spec.rb +19 -0
  505. data/spec/modules/recon/grep/insecure_cookies_spec.rb +19 -0
  506. data/spec/modules/recon/grep/mixed_resource_spec.rb +20 -0
  507. data/spec/modules/recon/grep/private_ip_spec.rb +26 -0
  508. data/spec/modules/recon/grep/ssn_spec.rb +19 -0
  509. data/spec/modules/recon/grep/unencrypted_password_forms_spec.rb +19 -0
  510. data/spec/modules/recon/htaccess_limit_spec.rb +19 -0
  511. data/spec/modules/recon/http_put_spec.rb +19 -0
  512. data/spec/modules/recon/interesting_responses_spec.rb +27 -0
  513. data/spec/modules/recon/webdav_spec.rb +19 -0
  514. data/spec/modules/recon/xst_spec.rb +19 -0
  515. data/spec/path_extractors/anchors_spec.rb +19 -0
  516. data/spec/path_extractors/forms_spec.rb +19 -0
  517. data/spec/path_extractors/frames_spec.rb +20 -0
  518. data/spec/path_extractors/generic_spec.rb +28 -0
  519. data/spec/path_extractors/links_spec.rb +19 -0
  520. data/spec/path_extractors/meta_refresh_spec.rb +24 -0
  521. data/spec/path_extractors/scripts_spec.rb +19 -0
  522. data/spec/pems/cacert.pem +39 -0
  523. data/spec/pems/client/cert.pem +39 -0
  524. data/spec/pems/client/foo-cert.pem +39 -0
  525. data/spec/pems/client/foo-key.pem +51 -0
  526. data/spec/pems/client/key.pem +51 -0
  527. data/spec/pems/server/cert.pem +39 -0
  528. data/spec/pems/server/key.pem +51 -0
  529. data/spec/plugins/autologin_spec.rb +76 -0
  530. data/spec/plugins/autothrottle_spec.rb +45 -0
  531. data/spec/plugins/content_types_spec.rb +93 -0
  532. data/spec/plugins/cookie_collector_spec.rb +32 -0
  533. data/spec/plugins/form_dicattack_spec.rb +60 -0
  534. data/spec/plugins/healthmap_spec.rb +40 -0
  535. data/spec/plugins/http_dicattack_spec.rb +40 -0
  536. data/spec/plugins/meta/remedies/discovery_spec.rb +15 -0
  537. data/spec/plugins/meta/remedies/manual_verification_spec.rb +28 -0
  538. data/spec/plugins/meta/remedies/timing_attacks_spec.rb +30 -0
  539. data/spec/plugins/meta/uniformity_spec.rb +83 -0
  540. data/spec/plugins/profiler_spec.rb +82 -0
  541. data/spec/plugins/rescan_spec.rb +26 -0
  542. data/spec/plugins/resolver_spec.rb +16 -0
  543. data/spec/plugins/script_spec.rb +12 -0
  544. data/spec/plugins/vector_feed_spec.rb +155 -0
  545. data/spec/plugins/waf_detector_spec.rb +41 -0
  546. data/spec/reports/afr_spec.rb +13 -0
  547. data/spec/reports/ap_spec.rb +9 -0
  548. data/spec/reports/html_spec.rb +13 -0
  549. data/spec/reports/json_spec.rb +17 -0
  550. data/spec/reports/marshal_spec.rb +13 -0
  551. data/spec/reports/stdout_spec.rb +9 -0
  552. data/spec/reports/txt_spec.rb +8 -0
  553. data/spec/reports/xml_spec.rb +13 -0
  554. data/spec/reports/yaml_spec.rb +13 -0
  555. data/spec/servers/arachni/element/capabilities/auditable/rdiff.rb +36 -0
  556. data/spec/servers/arachni/element/capabilities/auditable/taint.rb +10 -0
  557. data/spec/servers/arachni/element/capabilities/auditable/timeout.rb +30 -0
  558. data/spec/servers/arachni/element/cookie.rb +37 -0
  559. data/spec/servers/arachni/element/form.rb +93 -0
  560. data/spec/servers/arachni/element/header.rb +22 -0
  561. data/spec/servers/arachni/element/link.rb +26 -0
  562. data/spec/servers/arachni/framework.rb +54 -0
  563. data/spec/servers/arachni/http.rb +140 -0
  564. data/spec/servers/arachni/http_auth.rb +9 -0
  565. data/spec/servers/arachni/module/auditor.rb +135 -0
  566. data/spec/servers/arachni/module/trainer.rb +40 -0
  567. data/spec/servers/arachni/parser.rb +70 -0
  568. data/spec/servers/arachni/rpc/server/framework_hpg.rb +21 -0
  569. data/spec/servers/arachni/rpc/server/framework_simple.rb +30 -0
  570. data/spec/servers/arachni/session.rb +110 -0
  571. data/spec/servers/arachni/spider.rb +148 -0
  572. data/spec/servers/modules/audit/code_injection.rb +140 -0
  573. data/spec/servers/modules/audit/code_injection_timing.rb +110 -0
  574. data/spec/servers/modules/audit/csrf.rb +80 -0
  575. data/spec/servers/modules/audit/ldapi.rb +73 -0
  576. data/spec/servers/modules/audit/os_cmd_injection.rb +140 -0
  577. data/spec/servers/modules/audit/os_cmd_injection_timing.rb +111 -0
  578. data/spec/servers/modules/audit/path_traversal.rb +176 -0
  579. data/spec/servers/modules/audit/response_splitting.rb +114 -0
  580. data/spec/servers/modules/audit/rfi.rb +113 -0
  581. data/spec/servers/modules/audit/session_fixation.rb +87 -0
  582. data/spec/servers/modules/audit/sqli.rb +118 -0
  583. data/spec/servers/modules/audit/sqli/coldfusion +1 -0
  584. data/spec/servers/modules/audit/sqli/db2 +4 -0
  585. data/spec/servers/modules/audit/sqli/emc +2 -0
  586. data/spec/servers/modules/audit/sqli/informix +3 -0
  587. data/spec/servers/modules/audit/sqli/interbase +2 -0
  588. data/spec/servers/modules/audit/sqli/jdbc +0 -0
  589. data/spec/servers/modules/audit/sqli/mssql +26 -0
  590. data/spec/servers/modules/audit/sqli/mysql +13 -0
  591. data/spec/servers/modules/audit/sqli/oracle +6 -0
  592. data/spec/servers/modules/audit/sqli/postgresql +7 -0
  593. data/spec/servers/modules/audit/sqli/sqlite +4 -0
  594. data/spec/servers/modules/audit/sqli/sybase +0 -0
  595. data/spec/servers/modules/audit/sqli_blind_rdiff.rb +74 -0
  596. data/spec/servers/modules/audit/sqli_blind_timing.rb +121 -0
  597. data/spec/servers/modules/audit/trainer_module.rb +160 -0
  598. data/spec/servers/modules/audit/unvalidated_redirect.rb +115 -0
  599. data/spec/servers/modules/audit/xpath.rb +111 -0
  600. data/spec/servers/modules/audit/xpath/dotnet +5 -0
  601. data/spec/servers/modules/audit/xpath/general +13 -0
  602. data/spec/servers/modules/audit/xpath/java +3 -0
  603. data/spec/servers/modules/audit/xpath/libxml2 +2 -0
  604. data/spec/servers/modules/audit/xpath/php +2 -0
  605. data/spec/servers/modules/audit/xss.rb +152 -0
  606. data/spec/servers/modules/audit/xss_event.rb +80 -0
  607. data/spec/servers/modules/audit/xss_path.rb +44 -0
  608. data/spec/servers/modules/audit/xss_script_tag.rb +73 -0
  609. data/spec/servers/modules/audit/xss_tag.rb +139 -0
  610. data/spec/servers/modules/module_server.rb +14 -0
  611. data/spec/servers/modules/recon/allowed_methods.rb +5 -0
  612. data/spec/servers/modules/recon/backdoors.rb +4 -0
  613. data/spec/servers/modules/recon/backup_files.rb +28 -0
  614. data/spec/servers/modules/recon/common_directories.rb +6 -0
  615. data/spec/servers/modules/recon/common_files.rb +6 -0
  616. data/spec/servers/modules/recon/directory_listing.rb +30 -0
  617. data/spec/servers/modules/recon/grep/captcha.rb +27 -0
  618. data/spec/servers/modules/recon/grep/credit_card.rb +28 -0
  619. data/spec/servers/modules/recon/grep/cvs_svn_users.rb +23 -0
  620. data/spec/servers/modules/recon/grep/emails.rb +21 -0
  621. data/spec/servers/modules/recon/grep/html_objects.rb +7 -0
  622. data/spec/servers/modules/recon/grep/http_only_cookies.rb +21 -0
  623. data/spec/servers/modules/recon/grep/insecure_cookies.rb +21 -0
  624. data/spec/servers/modules/recon/grep/mixed_resource.rb +83 -0
  625. data/spec/servers/modules/recon/grep/private_ip.rb +18 -0
  626. data/spec/servers/modules/recon/grep/ssn.rb +5 -0
  627. data/spec/servers/modules/recon/grep/unencrypted_password_forms.rb +33 -0
  628. data/spec/servers/modules/recon/htaccess_limit.rb +8 -0
  629. data/spec/servers/modules/recon/http_put.rb +7 -0
  630. data/spec/servers/modules/recon/interesting_responses.rb +5 -0
  631. data/spec/servers/modules/recon/webdav.rb +25 -0
  632. data/spec/servers/modules/recon/xst.rb +6 -0
  633. data/spec/servers/plugins/autologin.rb +38 -0
  634. data/spec/servers/plugins/autothrottle.rb +8 -0
  635. data/spec/servers/plugins/content_types.rb +17 -0
  636. data/spec/servers/plugins/cookie_collector.rb +20 -0
  637. data/spec/servers/plugins/form_dicattack.rb +28 -0
  638. data/spec/servers/plugins/healthmap.rb +16 -0
  639. data/spec/servers/plugins/http_dicattack.rb +9 -0
  640. data/spec/servers/plugins/http_dicattack_secure.rb +9 -0
  641. data/spec/servers/plugins/http_dicattack_unprotected.rb +5 -0
  642. data/spec/servers/plugins/meta/remedies/discovery.rb +7 -0
  643. data/spec/servers/plugins/meta/remedies/timing_attacks.rb +29 -0
  644. data/spec/servers/plugins/profiler.rb +82 -0
  645. data/spec/servers/plugins/rescan.rb +31 -0
  646. data/spec/servers/plugins/waf_detector.rb +33 -0
  647. data/spec/shared/component.rb +43 -0
  648. data/spec/shared/element/capabilities/auditable.rb +729 -0
  649. data/spec/shared/element/capabilities/refreshable.rb +56 -0
  650. data/spec/shared/module.rb +162 -0
  651. data/spec/shared/path_extractor.rb +47 -0
  652. data/spec/shared/plugin.rb +50 -0
  653. data/spec/shared/reports.rb +47 -0
  654. data/spec/spec_helper.rb +53 -0
  655. metadata +870 -323
  656. data/extras/modules/recon/raft_dirs.rb +0 -108
  657. data/extras/modules/recon/raft_dirs/raft-large-directories.txt +0 -62290
  658. data/extras/modules/recon/raft_files.rb +0 -110
  659. data/extras/modules/recon/raft_files/raft-large-files.txt +0 -37037
  660. data/extras/modules/recon/svn_digger_dirs.rb +0 -108
  661. data/extras/modules/recon/svn_digger_dirs/Licence.txt +0 -674
  662. data/extras/modules/recon/svn_digger_dirs/ReadMe-Arachni.txt +0 -4
  663. data/extras/modules/recon/svn_digger_dirs/ReadMe.txt +0 -6
  664. data/extras/modules/recon/svn_digger_dirs/all-dirs.txt +0 -5960
  665. data/extras/modules/recon/svn_digger_files.rb +0 -114
  666. data/extras/modules/recon/svn_digger_files/Licence.txt +0 -674
  667. data/extras/modules/recon/svn_digger_files/ReadMe-Arachni.txt +0 -4
  668. data/extras/modules/recon/svn_digger_files/ReadMe.txt +0 -6
  669. data/extras/modules/recon/svn_digger_files/all-extensionless.txt +0 -25419
  670. data/extras/modules/recon/svn_digger_files/all.txt +0 -43135
  671. data/lib/arachni/component_manager.rb +0 -293
  672. data/lib/arachni/component_options.rb +0 -425
  673. data/lib/arachni/parser/auditable.rb +0 -606
  674. data/lib/arachni/parser/elements.rb +0 -315
  675. data/lib/arachni/parser/page.rb +0 -168
  676. data/lib/arachni/parser/parser.rb +0 -866
  677. data/lib/arachni/rpc/server/options.rb +0 -95
  678. data/lib/arachni/ui/web/addons/autodeploy.rb +0 -207
  679. data/lib/arachni/ui/web/addons/autodeploy/lib/manager.rb +0 -398
  680. data/lib/arachni/ui/web/addons/autodeploy/views/index.erb +0 -291
  681. data/modules/recon/mixed_resource.rb +0 -100
  682. data/modules/recon/unencrypted_password_forms.rb +0 -107
  683. data/path_extractors/sitemap.rb +0 -31
  684. data/plugins/defaults/metamodules/remedies/manual_verification.rb +0 -65
  685. data/plugins/defaults/metamodules/remedies/timing_attacks.rb +0 -134
  686. data/plugins/defaults/metamodules/uniformity.rb +0 -99
  687. data/reports/metareport/arachni_metareport.rb +0 -174
  688. data/reports/plugin_formatters/stdout/metamodules.rb +0 -82
@@ -1,108 +0,0 @@
1
- =begin
2
- Arachni
3
- Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
4
-
5
- This is free software; you can copy and distribute and modify
6
- this program under the term of the GPL v2.0 License
7
- (See LICENSE file for details)
8
-
9
- =end
10
-
11
- module Arachni
12
-
13
- module Modules
14
-
15
- #
16
- # Looks for common files on the server, based on wordlists generated from open
17
- # source repositories.
18
- #
19
- # More information about the SVNDigger wordlists:
20
- # http://www.mavitunasecurity.com/blog/svn-digger-better-lists-for-forced-browsing/
21
- #
22
- # The SVNDigger word lists were released under the GPL v3.0 License.
23
- #
24
- # @author: Herman Stevens
25
- # <herman.stevens@gmail.com>
26
- # http://blog.astyran.sg
27
- #
28
- # @version: 0.2
29
- #
30
- # @see http://cwe.mitre.org/data/definitions/538.html
31
- #
32
- class SvnDiggerDirs < Arachni::Module::Base
33
-
34
- include Arachni::Module::Utilities
35
-
36
- def initialize( page )
37
- super( page )
38
- end
39
-
40
- def prepare
41
- # to keep track of the requests and not repeat them
42
- @@__audited ||= Set.new
43
-
44
- @@__directories ||=[]
45
- return if !@@__directories.empty?
46
-
47
- read_file( 'all-dirs.txt' ) {
48
- |file|
49
- @@__directories << file unless file.include?( '?' )
50
- }
51
- end
52
-
53
- def run( )
54
- path = get_path( @page.url )
55
- return if @@__audited.include?( path )
56
-
57
- print_status( "Scanning SVNDigger Dirs..." )
58
-
59
- @@__directories.each {
60
- |dirname|
61
-
62
- url = path + dirname + '/'
63
-
64
- print_status( "Checking for #{url}" )
65
-
66
- log_remote_directory_if_exists( url ) {
67
- |res|
68
- print_ok( "Found #{dirname} at " + res.effective_url )
69
- }
70
- }
71
-
72
- @@__audited << path
73
- end
74
-
75
- def self.info
76
- {
77
- :name => 'SVNDigger Dirs',
78
- :description => %q{Finds directories, based on wordlists created from open source repositories.
79
-
80
- The wordlist utilized by this module will be vast and will add a considerable
81
- amount of time to the overall scan time.},
82
- :author => 'Herman Stevens <herman.stevens@gmail.com> ',
83
- :version => '0.2',
84
- :references => {
85
- 'Mavituna Security' =>
86
- 'http://www.mavitunasecurity.com/blog/svn-digger-better-lists-for-forced-browsing/',
87
- 'OWASP Testing Guide' =>
88
- 'https://www.owasp.org/index.php/Testing_for_Old,_Backup_and_Unreferenced_Files_(OWASP-CM-006)'
89
- },
90
- :targets => { 'Generic' => 'all' },
91
- :issue => {
92
- :name => %q{A SVNDigger directory was detected.},
93
- :description => %q{},
94
- :tags => [ 'svndigger', 'path', 'directory', 'discovery' ],
95
- :cwe => '538',
96
- :severity => Issue::Severity::INFORMATIONAL,
97
- :cvssv2 => '',
98
- :remedy_guidance => 'Review these resources manually. Check if unauthorized interfaces are exposed,
99
- or confidential information.',
100
- :remedy_code => '',
101
- }
102
-
103
- }
104
- end
105
-
106
- end
107
- end
108
- end
@@ -1,674 +0,0 @@
1
- GNU GENERAL PUBLIC LICENSE
2
- Version 3, 29 June 2007
3
-
4
- Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
5
- Everyone is permitted to copy and distribute verbatim copies
6
- of this license document, but changing it is not allowed.
7
-
8
- Preamble
9
-
10
- The GNU General Public License is a free, copyleft license for
11
- software and other kinds of works.
12
-
13
- The licenses for most software and other practical works are designed
14
- to take away your freedom to share and change the works. By contrast,
15
- the GNU General Public License is intended to guarantee your freedom to
16
- share and change all versions of a program--to make sure it remains free
17
- software for all its users. We, the Free Software Foundation, use the
18
- GNU General Public License for most of our software; it applies also to
19
- any other work released this way by its authors. You can apply it to
20
- your programs, too.
21
-
22
- When we speak of free software, we are referring to freedom, not
23
- price. Our General Public Licenses are designed to make sure that you
24
- have the freedom to distribute copies of free software (and charge for
25
- them if you wish), that you receive source code or can get it if you
26
- want it, that you can change the software or use pieces of it in new
27
- free programs, and that you know you can do these things.
28
-
29
- To protect your rights, we need to prevent others from denying you
30
- these rights or asking you to surrender the rights. Therefore, you have
31
- certain responsibilities if you distribute copies of the software, or if
32
- you modify it: responsibilities to respect the freedom of others.
33
-
34
- For example, if you distribute copies of such a program, whether
35
- gratis or for a fee, you must pass on to the recipients the same
36
- freedoms that you received. You must make sure that they, too, receive
37
- or can get the source code. And you must show them these terms so they
38
- know their rights.
39
-
40
- Developers that use the GNU GPL protect your rights with two steps:
41
- (1) assert copyright on the software, and (2) offer you this License
42
- giving you legal permission to copy, distribute and/or modify it.
43
-
44
- For the developers' and authors' protection, the GPL clearly explains
45
- that there is no warranty for this free software. For both users' and
46
- authors' sake, the GPL requires that modified versions be marked as
47
- changed, so that their problems will not be attributed erroneously to
48
- authors of previous versions.
49
-
50
- Some devices are designed to deny users access to install or run
51
- modified versions of the software inside them, although the manufacturer
52
- can do so. This is fundamentally incompatible with the aim of
53
- protecting users' freedom to change the software. The systematic
54
- pattern of such abuse occurs in the area of products for individuals to
55
- use, which is precisely where it is most unacceptable. Therefore, we
56
- have designed this version of the GPL to prohibit the practice for those
57
- products. If such problems arise substantially in other domains, we
58
- stand ready to extend this provision to those domains in future versions
59
- of the GPL, as needed to protect the freedom of users.
60
-
61
- Finally, every program is threatened constantly by software patents.
62
- States should not allow patents to restrict development and use of
63
- software on general-purpose computers, but in those that do, we wish to
64
- avoid the special danger that patents applied to a free program could
65
- make it effectively proprietary. To prevent this, the GPL assures that
66
- patents cannot be used to render the program non-free.
67
-
68
- The precise terms and conditions for copying, distribution and
69
- modification follow.
70
-
71
- TERMS AND CONDITIONS
72
-
73
- 0. Definitions.
74
-
75
- "This License" refers to version 3 of the GNU General Public License.
76
-
77
- "Copyright" also means copyright-like laws that apply to other kinds of
78
- works, such as semiconductor masks.
79
-
80
- "The Program" refers to any copyrightable work licensed under this
81
- License. Each licensee is addressed as "you". "Licensees" and
82
- "recipients" may be individuals or organizations.
83
-
84
- To "modify" a work means to copy from or adapt all or part of the work
85
- in a fashion requiring copyright permission, other than the making of an
86
- exact copy. The resulting work is called a "modified version" of the
87
- earlier work or a work "based on" the earlier work.
88
-
89
- A "covered work" means either the unmodified Program or a work based
90
- on the Program.
91
-
92
- To "propagate" a work means to do anything with it that, without
93
- permission, would make you directly or secondarily liable for
94
- infringement under applicable copyright law, except executing it on a
95
- computer or modifying a private copy. Propagation includes copying,
96
- distribution (with or without modification), making available to the
97
- public, and in some countries other activities as well.
98
-
99
- To "convey" a work means any kind of propagation that enables other
100
- parties to make or receive copies. Mere interaction with a user through
101
- a computer network, with no transfer of a copy, is not conveying.
102
-
103
- An interactive user interface displays "Appropriate Legal Notices"
104
- to the extent that it includes a convenient and prominently visible
105
- feature that (1) displays an appropriate copyright notice, and (2)
106
- tells the user that there is no warranty for the work (except to the
107
- extent that warranties are provided), that licensees may convey the
108
- work under this License, and how to view a copy of this License. If
109
- the interface presents a list of user commands or options, such as a
110
- menu, a prominent item in the list meets this criterion.
111
-
112
- 1. Source Code.
113
-
114
- The "source code" for a work means the preferred form of the work
115
- for making modifications to it. "Object code" means any non-source
116
- form of a work.
117
-
118
- A "Standard Interface" means an interface that either is an official
119
- standard defined by a recognized standards body, or, in the case of
120
- interfaces specified for a particular programming language, one that
121
- is widely used among developers working in that language.
122
-
123
- The "System Libraries" of an executable work include anything, other
124
- than the work as a whole, that (a) is included in the normal form of
125
- packaging a Major Component, but which is not part of that Major
126
- Component, and (b) serves only to enable use of the work with that
127
- Major Component, or to implement a Standard Interface for which an
128
- implementation is available to the public in source code form. A
129
- "Major Component", in this context, means a major essential component
130
- (kernel, window system, and so on) of the specific operating system
131
- (if any) on which the executable work runs, or a compiler used to
132
- produce the work, or an object code interpreter used to run it.
133
-
134
- The "Corresponding Source" for a work in object code form means all
135
- the source code needed to generate, install, and (for an executable
136
- work) run the object code and to modify the work, including scripts to
137
- control those activities. However, it does not include the work's
138
- System Libraries, or general-purpose tools or generally available free
139
- programs which are used unmodified in performing those activities but
140
- which are not part of the work. For example, Corresponding Source
141
- includes interface definition files associated with source files for
142
- the work, and the source code for shared libraries and dynamically
143
- linked subprograms that the work is specifically designed to require,
144
- such as by intimate data communication or control flow between those
145
- subprograms and other parts of the work.
146
-
147
- The Corresponding Source need not include anything that users
148
- can regenerate automatically from other parts of the Corresponding
149
- Source.
150
-
151
- The Corresponding Source for a work in source code form is that
152
- same work.
153
-
154
- 2. Basic Permissions.
155
-
156
- All rights granted under this License are granted for the term of
157
- copyright on the Program, and are irrevocable provided the stated
158
- conditions are met. This License explicitly affirms your unlimited
159
- permission to run the unmodified Program. The output from running a
160
- covered work is covered by this License only if the output, given its
161
- content, constitutes a covered work. This License acknowledges your
162
- rights of fair use or other equivalent, as provided by copyright law.
163
-
164
- You may make, run and propagate covered works that you do not
165
- convey, without conditions so long as your license otherwise remains
166
- in force. You may convey covered works to others for the sole purpose
167
- of having them make modifications exclusively for you, or provide you
168
- with facilities for running those works, provided that you comply with
169
- the terms of this License in conveying all material for which you do
170
- not control copyright. Those thus making or running the covered works
171
- for you must do so exclusively on your behalf, under your direction
172
- and control, on terms that prohibit them from making any copies of
173
- your copyrighted material outside their relationship with you.
174
-
175
- Conveying under any other circumstances is permitted solely under
176
- the conditions stated below. Sublicensing is not allowed; section 10
177
- makes it unnecessary.
178
-
179
- 3. Protecting Users' Legal Rights From Anti-Circumvention Law.
180
-
181
- No covered work shall be deemed part of an effective technological
182
- measure under any applicable law fulfilling obligations under article
183
- 11 of the WIPO copyright treaty adopted on 20 December 1996, or
184
- similar laws prohibiting or restricting circumvention of such
185
- measures.
186
-
187
- When you convey a covered work, you waive any legal power to forbid
188
- circumvention of technological measures to the extent such circumvention
189
- is effected by exercising rights under this License with respect to
190
- the covered work, and you disclaim any intention to limit operation or
191
- modification of the work as a means of enforcing, against the work's
192
- users, your or third parties' legal rights to forbid circumvention of
193
- technological measures.
194
-
195
- 4. Conveying Verbatim Copies.
196
-
197
- You may convey verbatim copies of the Program's source code as you
198
- receive it, in any medium, provided that you conspicuously and
199
- appropriately publish on each copy an appropriate copyright notice;
200
- keep intact all notices stating that this License and any
201
- non-permissive terms added in accord with section 7 apply to the code;
202
- keep intact all notices of the absence of any warranty; and give all
203
- recipients a copy of this License along with the Program.
204
-
205
- You may charge any price or no price for each copy that you convey,
206
- and you may offer support or warranty protection for a fee.
207
-
208
- 5. Conveying Modified Source Versions.
209
-
210
- You may convey a work based on the Program, or the modifications to
211
- produce it from the Program, in the form of source code under the
212
- terms of section 4, provided that you also meet all of these conditions:
213
-
214
- a) The work must carry prominent notices stating that you modified
215
- it, and giving a relevant date.
216
-
217
- b) The work must carry prominent notices stating that it is
218
- released under this License and any conditions added under section
219
- 7. This requirement modifies the requirement in section 4 to
220
- "keep intact all notices".
221
-
222
- c) You must license the entire work, as a whole, under this
223
- License to anyone who comes into possession of a copy. This
224
- License will therefore apply, along with any applicable section 7
225
- additional terms, to the whole of the work, and all its parts,
226
- regardless of how they are packaged. This License gives no
227
- permission to license the work in any other way, but it does not
228
- invalidate such permission if you have separately received it.
229
-
230
- d) If the work has interactive user interfaces, each must display
231
- Appropriate Legal Notices; however, if the Program has interactive
232
- interfaces that do not display Appropriate Legal Notices, your
233
- work need not make them do so.
234
-
235
- A compilation of a covered work with other separate and independent
236
- works, which are not by their nature extensions of the covered work,
237
- and which are not combined with it such as to form a larger program,
238
- in or on a volume of a storage or distribution medium, is called an
239
- "aggregate" if the compilation and its resulting copyright are not
240
- used to limit the access or legal rights of the compilation's users
241
- beyond what the individual works permit. Inclusion of a covered work
242
- in an aggregate does not cause this License to apply to the other
243
- parts of the aggregate.
244
-
245
- 6. Conveying Non-Source Forms.
246
-
247
- You may convey a covered work in object code form under the terms
248
- of sections 4 and 5, provided that you also convey the
249
- machine-readable Corresponding Source under the terms of this License,
250
- in one of these ways:
251
-
252
- a) Convey the object code in, or embodied in, a physical product
253
- (including a physical distribution medium), accompanied by the
254
- Corresponding Source fixed on a durable physical medium
255
- customarily used for software interchange.
256
-
257
- b) Convey the object code in, or embodied in, a physical product
258
- (including a physical distribution medium), accompanied by a
259
- written offer, valid for at least three years and valid for as
260
- long as you offer spare parts or customer support for that product
261
- model, to give anyone who possesses the object code either (1) a
262
- copy of the Corresponding Source for all the software in the
263
- product that is covered by this License, on a durable physical
264
- medium customarily used for software interchange, for a price no
265
- more than your reasonable cost of physically performing this
266
- conveying of source, or (2) access to copy the
267
- Corresponding Source from a network server at no charge.
268
-
269
- c) Convey individual copies of the object code with a copy of the
270
- written offer to provide the Corresponding Source. This
271
- alternative is allowed only occasionally and noncommercially, and
272
- only if you received the object code with such an offer, in accord
273
- with subsection 6b.
274
-
275
- d) Convey the object code by offering access from a designated
276
- place (gratis or for a charge), and offer equivalent access to the
277
- Corresponding Source in the same way through the same place at no
278
- further charge. You need not require recipients to copy the
279
- Corresponding Source along with the object code. If the place to
280
- copy the object code is a network server, the Corresponding Source
281
- may be on a different server (operated by you or a third party)
282
- that supports equivalent copying facilities, provided you maintain
283
- clear directions next to the object code saying where to find the
284
- Corresponding Source. Regardless of what server hosts the
285
- Corresponding Source, you remain obligated to ensure that it is
286
- available for as long as needed to satisfy these requirements.
287
-
288
- e) Convey the object code using peer-to-peer transmission, provided
289
- you inform other peers where the object code and Corresponding
290
- Source of the work are being offered to the general public at no
291
- charge under subsection 6d.
292
-
293
- A separable portion of the object code, whose source code is excluded
294
- from the Corresponding Source as a System Library, need not be
295
- included in conveying the object code work.
296
-
297
- A "User Product" is either (1) a "consumer product", which means any
298
- tangible personal property which is normally used for personal, family,
299
- or household purposes, or (2) anything designed or sold for incorporation
300
- into a dwelling. In determining whether a product is a consumer product,
301
- doubtful cases shall be resolved in favor of coverage. For a particular
302
- product received by a particular user, "normally used" refers to a
303
- typical or common use of that class of product, regardless of the status
304
- of the particular user or of the way in which the particular user
305
- actually uses, or expects or is expected to use, the product. A product
306
- is a consumer product regardless of whether the product has substantial
307
- commercial, industrial or non-consumer uses, unless such uses represent
308
- the only significant mode of use of the product.
309
-
310
- "Installation Information" for a User Product means any methods,
311
- procedures, authorization keys, or other information required to install
312
- and execute modified versions of a covered work in that User Product from
313
- a modified version of its Corresponding Source. The information must
314
- suffice to ensure that the continued functioning of the modified object
315
- code is in no case prevented or interfered with solely because
316
- modification has been made.
317
-
318
- If you convey an object code work under this section in, or with, or
319
- specifically for use in, a User Product, and the conveying occurs as
320
- part of a transaction in which the right of possession and use of the
321
- User Product is transferred to the recipient in perpetuity or for a
322
- fixed term (regardless of how the transaction is characterized), the
323
- Corresponding Source conveyed under this section must be accompanied
324
- by the Installation Information. But this requirement does not apply
325
- if neither you nor any third party retains the ability to install
326
- modified object code on the User Product (for example, the work has
327
- been installed in ROM).
328
-
329
- The requirement to provide Installation Information does not include a
330
- requirement to continue to provide support service, warranty, or updates
331
- for a work that has been modified or installed by the recipient, or for
332
- the User Product in which it has been modified or installed. Access to a
333
- network may be denied when the modification itself materially and
334
- adversely affects the operation of the network or violates the rules and
335
- protocols for communication across the network.
336
-
337
- Corresponding Source conveyed, and Installation Information provided,
338
- in accord with this section must be in a format that is publicly
339
- documented (and with an implementation available to the public in
340
- source code form), and must require no special password or key for
341
- unpacking, reading or copying.
342
-
343
- 7. Additional Terms.
344
-
345
- "Additional permissions" are terms that supplement the terms of this
346
- License by making exceptions from one or more of its conditions.
347
- Additional permissions that are applicable to the entire Program shall
348
- be treated as though they were included in this License, to the extent
349
- that they are valid under applicable law. If additional permissions
350
- apply only to part of the Program, that part may be used separately
351
- under those permissions, but the entire Program remains governed by
352
- this License without regard to the additional permissions.
353
-
354
- When you convey a copy of a covered work, you may at your option
355
- remove any additional permissions from that copy, or from any part of
356
- it. (Additional permissions may be written to require their own
357
- removal in certain cases when you modify the work.) You may place
358
- additional permissions on material, added by you to a covered work,
359
- for which you have or can give appropriate copyright permission.
360
-
361
- Notwithstanding any other provision of this License, for material you
362
- add to a covered work, you may (if authorized by the copyright holders of
363
- that material) supplement the terms of this License with terms:
364
-
365
- a) Disclaiming warranty or limiting liability differently from the
366
- terms of sections 15 and 16 of this License; or
367
-
368
- b) Requiring preservation of specified reasonable legal notices or
369
- author attributions in that material or in the Appropriate Legal
370
- Notices displayed by works containing it; or
371
-
372
- c) Prohibiting misrepresentation of the origin of that material, or
373
- requiring that modified versions of such material be marked in
374
- reasonable ways as different from the original version; or
375
-
376
- d) Limiting the use for publicity purposes of names of licensors or
377
- authors of the material; or
378
-
379
- e) Declining to grant rights under trademark law for use of some
380
- trade names, trademarks, or service marks; or
381
-
382
- f) Requiring indemnification of licensors and authors of that
383
- material by anyone who conveys the material (or modified versions of
384
- it) with contractual assumptions of liability to the recipient, for
385
- any liability that these contractual assumptions directly impose on
386
- those licensors and authors.
387
-
388
- All other non-permissive additional terms are considered "further
389
- restrictions" within the meaning of section 10. If the Program as you
390
- received it, or any part of it, contains a notice stating that it is
391
- governed by this License along with a term that is a further
392
- restriction, you may remove that term. If a license document contains
393
- a further restriction but permits relicensing or conveying under this
394
- License, you may add to a covered work material governed by the terms
395
- of that license document, provided that the further restriction does
396
- not survive such relicensing or conveying.
397
-
398
- If you add terms to a covered work in accord with this section, you
399
- must place, in the relevant source files, a statement of the
400
- additional terms that apply to those files, or a notice indicating
401
- where to find the applicable terms.
402
-
403
- Additional terms, permissive or non-permissive, may be stated in the
404
- form of a separately written license, or stated as exceptions;
405
- the above requirements apply either way.
406
-
407
- 8. Termination.
408
-
409
- You may not propagate or modify a covered work except as expressly
410
- provided under this License. Any attempt otherwise to propagate or
411
- modify it is void, and will automatically terminate your rights under
412
- this License (including any patent licenses granted under the third
413
- paragraph of section 11).
414
-
415
- However, if you cease all violation of this License, then your
416
- license from a particular copyright holder is reinstated (a)
417
- provisionally, unless and until the copyright holder explicitly and
418
- finally terminates your license, and (b) permanently, if the copyright
419
- holder fails to notify you of the violation by some reasonable means
420
- prior to 60 days after the cessation.
421
-
422
- Moreover, your license from a particular copyright holder is
423
- reinstated permanently if the copyright holder notifies you of the
424
- violation by some reasonable means, this is the first time you have
425
- received notice of violation of this License (for any work) from that
426
- copyright holder, and you cure the violation prior to 30 days after
427
- your receipt of the notice.
428
-
429
- Termination of your rights under this section does not terminate the
430
- licenses of parties who have received copies or rights from you under
431
- this License. If your rights have been terminated and not permanently
432
- reinstated, you do not qualify to receive new licenses for the same
433
- material under section 10.
434
-
435
- 9. Acceptance Not Required for Having Copies.
436
-
437
- You are not required to accept this License in order to receive or
438
- run a copy of the Program. Ancillary propagation of a covered work
439
- occurring solely as a consequence of using peer-to-peer transmission
440
- to receive a copy likewise does not require acceptance. However,
441
- nothing other than this License grants you permission to propagate or
442
- modify any covered work. These actions infringe copyright if you do
443
- not accept this License. Therefore, by modifying or propagating a
444
- covered work, you indicate your acceptance of this License to do so.
445
-
446
- 10. Automatic Licensing of Downstream Recipients.
447
-
448
- Each time you convey a covered work, the recipient automatically
449
- receives a license from the original licensors, to run, modify and
450
- propagate that work, subject to this License. You are not responsible
451
- for enforcing compliance by third parties with this License.
452
-
453
- An "entity transaction" is a transaction transferring control of an
454
- organization, or substantially all assets of one, or subdividing an
455
- organization, or merging organizations. If propagation of a covered
456
- work results from an entity transaction, each party to that
457
- transaction who receives a copy of the work also receives whatever
458
- licenses to the work the party's predecessor in interest had or could
459
- give under the previous paragraph, plus a right to possession of the
460
- Corresponding Source of the work from the predecessor in interest, if
461
- the predecessor has it or can get it with reasonable efforts.
462
-
463
- You may not impose any further restrictions on the exercise of the
464
- rights granted or affirmed under this License. For example, you may
465
- not impose a license fee, royalty, or other charge for exercise of
466
- rights granted under this License, and you may not initiate litigation
467
- (including a cross-claim or counterclaim in a lawsuit) alleging that
468
- any patent claim is infringed by making, using, selling, offering for
469
- sale, or importing the Program or any portion of it.
470
-
471
- 11. Patents.
472
-
473
- A "contributor" is a copyright holder who authorizes use under this
474
- License of the Program or a work on which the Program is based. The
475
- work thus licensed is called the contributor's "contributor version".
476
-
477
- A contributor's "essential patent claims" are all patent claims
478
- owned or controlled by the contributor, whether already acquired or
479
- hereafter acquired, that would be infringed by some manner, permitted
480
- by this License, of making, using, or selling its contributor version,
481
- but do not include claims that would be infringed only as a
482
- consequence of further modification of the contributor version. For
483
- purposes of this definition, "control" includes the right to grant
484
- patent sublicenses in a manner consistent with the requirements of
485
- this License.
486
-
487
- Each contributor grants you a non-exclusive, worldwide, royalty-free
488
- patent license under the contributor's essential patent claims, to
489
- make, use, sell, offer for sale, import and otherwise run, modify and
490
- propagate the contents of its contributor version.
491
-
492
- In the following three paragraphs, a "patent license" is any express
493
- agreement or commitment, however denominated, not to enforce a patent
494
- (such as an express permission to practice a patent or covenant not to
495
- sue for patent infringement). To "grant" such a patent license to a
496
- party means to make such an agreement or commitment not to enforce a
497
- patent against the party.
498
-
499
- If you convey a covered work, knowingly relying on a patent license,
500
- and the Corresponding Source of the work is not available for anyone
501
- to copy, free of charge and under the terms of this License, through a
502
- publicly available network server or other readily accessible means,
503
- then you must either (1) cause the Corresponding Source to be so
504
- available, or (2) arrange to deprive yourself of the benefit of the
505
- patent license for this particular work, or (3) arrange, in a manner
506
- consistent with the requirements of this License, to extend the patent
507
- license to downstream recipients. "Knowingly relying" means you have
508
- actual knowledge that, but for the patent license, your conveying the
509
- covered work in a country, or your recipient's use of the covered work
510
- in a country, would infringe one or more identifiable patents in that
511
- country that you have reason to believe are valid.
512
-
513
- If, pursuant to or in connection with a single transaction or
514
- arrangement, you convey, or propagate by procuring conveyance of, a
515
- covered work, and grant a patent license to some of the parties
516
- receiving the covered work authorizing them to use, propagate, modify
517
- or convey a specific copy of the covered work, then the patent license
518
- you grant is automatically extended to all recipients of the covered
519
- work and works based on it.
520
-
521
- A patent license is "discriminatory" if it does not include within
522
- the scope of its coverage, prohibits the exercise of, or is
523
- conditioned on the non-exercise of one or more of the rights that are
524
- specifically granted under this License. You may not convey a covered
525
- work if you are a party to an arrangement with a third party that is
526
- in the business of distributing software, under which you make payment
527
- to the third party based on the extent of your activity of conveying
528
- the work, and under which the third party grants, to any of the
529
- parties who would receive the covered work from you, a discriminatory
530
- patent license (a) in connection with copies of the covered work
531
- conveyed by you (or copies made from those copies), or (b) primarily
532
- for and in connection with specific products or compilations that
533
- contain the covered work, unless you entered into that arrangement,
534
- or that patent license was granted, prior to 28 March 2007.
535
-
536
- Nothing in this License shall be construed as excluding or limiting
537
- any implied license or other defenses to infringement that may
538
- otherwise be available to you under applicable patent law.
539
-
540
- 12. No Surrender of Others' Freedom.
541
-
542
- If conditions are imposed on you (whether by court order, agreement or
543
- otherwise) that contradict the conditions of this License, they do not
544
- excuse you from the conditions of this License. If you cannot convey a
545
- covered work so as to satisfy simultaneously your obligations under this
546
- License and any other pertinent obligations, then as a consequence you may
547
- not convey it at all. For example, if you agree to terms that obligate you
548
- to collect a royalty for further conveying from those to whom you convey
549
- the Program, the only way you could satisfy both those terms and this
550
- License would be to refrain entirely from conveying the Program.
551
-
552
- 13. Use with the GNU Affero General Public License.
553
-
554
- Notwithstanding any other provision of this License, you have
555
- permission to link or combine any covered work with a work licensed
556
- under version 3 of the GNU Affero General Public License into a single
557
- combined work, and to convey the resulting work. The terms of this
558
- License will continue to apply to the part which is the covered work,
559
- but the special requirements of the GNU Affero General Public License,
560
- section 13, concerning interaction through a network will apply to the
561
- combination as such.
562
-
563
- 14. Revised Versions of this License.
564
-
565
- The Free Software Foundation may publish revised and/or new versions of
566
- the GNU General Public License from time to time. Such new versions will
567
- be similar in spirit to the present version, but may differ in detail to
568
- address new problems or concerns.
569
-
570
- Each version is given a distinguishing version number. If the
571
- Program specifies that a certain numbered version of the GNU General
572
- Public License "or any later version" applies to it, you have the
573
- option of following the terms and conditions either of that numbered
574
- version or of any later version published by the Free Software
575
- Foundation. If the Program does not specify a version number of the
576
- GNU General Public License, you may choose any version ever published
577
- by the Free Software Foundation.
578
-
579
- If the Program specifies that a proxy can decide which future
580
- versions of the GNU General Public License can be used, that proxy's
581
- public statement of acceptance of a version permanently authorizes you
582
- to choose that version for the Program.
583
-
584
- Later license versions may give you additional or different
585
- permissions. However, no additional obligations are imposed on any
586
- author or copyright holder as a result of your choosing to follow a
587
- later version.
588
-
589
- 15. Disclaimer of Warranty.
590
-
591
- THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
592
- APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
593
- HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
594
- OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
595
- THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
596
- PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
597
- IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
598
- ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
599
-
600
- 16. Limitation of Liability.
601
-
602
- IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
603
- WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
604
- THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
605
- GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
606
- USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
607
- DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
608
- PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
609
- EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
610
- SUCH DAMAGES.
611
-
612
- 17. Interpretation of Sections 15 and 16.
613
-
614
- If the disclaimer of warranty and limitation of liability provided
615
- above cannot be given local legal effect according to their terms,
616
- reviewing courts shall apply local law that most closely approximates
617
- an absolute waiver of all civil liability in connection with the
618
- Program, unless a warranty or assumption of liability accompanies a
619
- copy of the Program in return for a fee.
620
-
621
- END OF TERMS AND CONDITIONS
622
-
623
- How to Apply These Terms to Your New Programs
624
-
625
- If you develop a new program, and you want it to be of the greatest
626
- possible use to the public, the best way to achieve this is to make it
627
- free software which everyone can redistribute and change under these terms.
628
-
629
- To do so, attach the following notices to the program. It is safest
630
- to attach them to the start of each source file to most effectively
631
- state the exclusion of warranty; and each file should have at least
632
- the "copyright" line and a pointer to where the full notice is found.
633
-
634
- <one line to give the program's name and a brief idea of what it does.>
635
- Copyright (C) <year> <name of author>
636
-
637
- This program is free software: you can redistribute it and/or modify
638
- it under the terms of the GNU General Public License as published by
639
- the Free Software Foundation, either version 3 of the License, or
640
- (at your option) any later version.
641
-
642
- This program is distributed in the hope that it will be useful,
643
- but WITHOUT ANY WARRANTY; without even the implied warranty of
644
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
645
- GNU General Public License for more details.
646
-
647
- You should have received a copy of the GNU General Public License
648
- along with this program. If not, see <http://www.gnu.org/licenses/>.
649
-
650
- Also add information on how to contact you by electronic and paper mail.
651
-
652
- If the program does terminal interaction, make it output a short
653
- notice like this when it starts in an interactive mode:
654
-
655
- <program> Copyright (C) <year> <name of author>
656
- This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
657
- This is free software, and you are welcome to redistribute it
658
- under certain conditions; type `show c' for details.
659
-
660
- The hypothetical commands `show w' and `show c' should show the appropriate
661
- parts of the General Public License. Of course, your program's commands
662
- might be different; for a GUI interface, you would use an "about box".
663
-
664
- You should also get your employer (if you work as a programmer) or school,
665
- if any, to sign a "copyright disclaimer" for the program, if necessary.
666
- For more information on this, and how to apply and follow the GNU GPL, see
667
- <http://www.gnu.org/licenses/>.
668
-
669
- The GNU General Public License does not permit incorporating your program
670
- into proprietary programs. If your program is a subroutine library, you
671
- may consider it more useful to permit linking proprietary applications with
672
- the library. If this is what you want to do, use the GNU Lesser General
673
- Public License instead of this License. But first, please read
674
- <http://www.gnu.org/philosophy/why-not-lgpl.html>.