arachni 0.4.0.4 → 0.4.1

data/lib/arachni/module/base.rb

@@ -1,180 +1,186 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
-=end
+        http://www.apache.org/licenses/LICENSE-2.0
 
-require 'set'
-require Arachni::Options.instance.dir['lib'] + 'module/output'
-require Arachni::Options.instance.dir['lib'] + 'module/utilities'
-require Arachni::Options.instance.dir['lib'] + 'module/trainer'
-require Arachni::Options.instance.dir['lib'] + 'module/auditor'
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
 
 module Arachni
-module Module
 
+lib = Arachni::Options.dir['lib']
+require lib + 'module/output'
+require lib + 'module/utilities'
+require lib + 'module/trainer'
+require lib + 'module/auditor'
+
+module Module
 
 #
-# Arachni's base module class<br/>
-# To be extended by Arachni::Modules.
+# Base module class to be extended by all modules.
 #
 # Defines basic structure and provides utilities to modules.
 #
-# @author: Tasos "Zapotek" Laskos
-#                                      <tasos.laskos@gmail.com>
-#                                      <zapotek@segfault.gr>
-# @version: 0.2
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 # @abstract
 #
 class Base
+    # I hate keep typing this all the time...
+    include Arachni
 
-    # get output module
-    include Output
+    include Utilities
+    extend  Utilities
 
     include Auditor
 
     #
-    # Arachni::HTTP instance for the modules
-    #
-    # @return [Arachni::Module::HTTP]
-    #
-    attr_reader :http
-
-    #
-    # Arachni::Page instance
-    #
-    # @return [Page]
-    #
-    attr_reader :page
-
-    #
-    # Initializes the module attributes, HTTP client and {Trainer}
-    #
-    # @see Trainer
-    # @see HTTP
+    # Initializes the module attributes, {Arachni::HTTP} client and {Trainer}.
     #
     # @param  [Page]  page
+    # @param  [Arachni::Framework]  framework
     #
-    def initialize( page )
-
-        @page  = page
-        @http  = Arachni::HTTP.instance
-        @http.trainer.set_page( @page )
-
-        # update the cookies
-        if( !@page.cookiejar.empty? )
-            @http.update_cookies( @page.cookiejar )
-        end
-
-        #
-        # This is slightly tricky...
-        #
-        # Each loaded module is instantiated for each page,
-        # however modules share the elements of each page and access them
-        # via the ElementsDB.
-        #
-        # Since the ElementDB is dynamically updated by the Trainer
-        # during the audit, is should only be initialized *once*
-        # for each page and not overwritten every single time a module is instantiated.
-        #
-        @@__last_url ||= ''
-        if( @@__last_url != @page.url )
-            @http.trainer.page = @page.dup
-            @http.trainer.init_forms( @page.forms )
-            @http.trainer.init_links( @page.links )
-            @http.trainer.init_cookies( @page.cookies )
-            @@__last_url = @page.url
-        end
+    def initialize( page, framework = nil )
+        @page       = http.page = page
+        @framework  = framework
     end
 
     #
-    # ABSTRACT - OPTIONAL
+    # OPTIONAL
     #
     # It provides you with a way to setup your module's data and methods.
     #
+    # @abstract
+    #
     def prepare
     end
 
     #
-    # ABSTRACT - REQUIRED
+    # REQUIRED
     #
     # This is used to deliver the module's payload whatever it may be.
     #
+    # @abstract
+    #
     def run
     end
 
     #
-    # ABSTRACT - OPTIONAL
+    # OPTIONAL
     #
     # This is called after run() has finished executing,
     #
+    # @abstract
+    #
     def clean_up
     end
 
     #
-    # Returns the framework.
+    # Provides access to the plugin manager
     #
-    def framework
-        @framework
+    # You can use it to gain access to the instances of running plugins like so:
+    #
+    #    p plugins.get( 'profiler' )
+    #    # => #<Thread:0x000000025b2ff0 sleep>
+    #
+    #    p plugins.get( 'profiler' )[:instance]
+    #    # => #<Arachni::Plugins::Profiler>
+    #
+    # @return   [Arachni::PluginManager]
+    #
+    def plugins
+        framework.plugins if framework
+    end
+
+    def session
+        framework.session if framework
     end
 
     #
-    # ABSTRACT - REQUIRED
+    # REQUIRED
     #
     # Provides information about the module.
     # Don't take this lightly and don't ommit any of the info.
     #
+    # @abstract
+    #
     def self.info
         {
-            :name           => 'Base module abstract class',
-            :description    => %q{Provides an abstract class the modules should implement.},
+            name:        'Base module abstract class',
+            description: %q{Provides an abstract class the modules should implement.},
             #
             # Arachni needs to know what elements the module plans to audit
             # before invoking it.
             # If a page doesn't have any of those elements
             # there's no point in instantiating the module.
             #
-            # If you want the module to run no-matter what leave the array
+            # If you want the module to run no-matter what, leave the array
             # empty.
             #
-            # 'Elements'       => [
-            #     Issue::Element::FORM,
-            #     Issue::Element::LINK,
-            #     Issue::Element::COOKIE,
-            #     Issue::Element::HEADER
+            # elements: [
+            #     Element::FORM,
+            #     Element::LINK,
+            #     Element::COOKIE,
+            #     Element::HEADER
             # ],
-            :elements       => [],
-            :author         => 'zapotek',
-            :version        => '0.1',
-            :references     => {
+            elements:    [],
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
+            version:     '0.1',
+            references:  {
+                'Title' => 'http://ref.url'
             },
-            :targets        => { 'Generic' => 'all' },
-            :issue   => {
-                :description => %q{},
-                :cwe         => '',
+            targets:     %W(Generic),
+            issue:       {
+                name:           %q{Serious issue},
+                description:    %q{This issue is a serious issue and you
+                    should consider it seriously},
+                # CWE ID number
+                cwe:            '',
                 #
                 # Severity can be:
                 #
-                # Issue::Severity::HIGH
-                # Issue::Severity::MEDIUM
-                # Issue::Severity::LOW
-                # Issue::Severity::INFORMATIONAL
+                # Severity::HIGH
+                # Severity::MEDIUM
+                # Severity::LOW
+                # Severity::INFORMATIONAL
                 #
-                :severity    => '',
-                :cvssv2       => '',
-                :remedy_guidance    => '',
-                :remedy_code => '',
+                severity:        Severity::HIGH,
+                cvssv2:          '', # CVSSV2 score
+                remedy_guidance: %q{Paint it blue and throw it in the sea.},
+                remedy_code:     %q{sudo rm -rf /}
             }
         }
     end
 
-    def set_framework( framework )
-        @framework = framework
+    #
+    # Schedules self to be run *after* the specified modules and prevents
+    # auditing elements that have been previously logged by any of these modules.
+    #
+    # @return   [Array]     module names
+    #
+    def self.prefer( *args )
+        @preferred = args.flatten.compact
+    end
+
+    #
+    # @return   [Array]     names of modules which should be preferred over this one
+    #
+    # @see #prefer
+    #
+    def self.preferred
+        @preferred ||= []
     end
+    def preferred
+        self.class.preferred
+    end
+
 
 end
 end

data/lib/arachni/module/element_db.rb

@@ -1,12 +1,19 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
 =end
+
 module Arachni
 module Module
 
@@ -18,49 +25,57 @@ module Module
 #
 # For each page that is audited the database is reset.
 #
-# @author: Tasos "Zapotek" Laskos
-#                                      <tasos.laskos@gmail.com>
-#                                      <zapotek@segfault.gr>
-# @version: 0.2.1
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 #
 module ElementDB
-
-    include Arachni::Module::Utilities
+    include Utilities
 
     #
     # page forms
     #
-    @@forms    ||= Set.new
+    @@forms    ||= BloomFilter.new
 
     #
     # page links
     #
-    @@links    ||= Set.new
+    @@links    ||= BloomFilter.new
 
     #
     # page cookies
     #
     @@cookies  ||= Set.new
 
+    def self.reset
+        @@forms.clear
+        @@links.clear
+        @@cookies.clear
+    end
+
+    def init_db_from_page( page )
+        init_links( page.links )
+        init_forms( page.forms )
+        init_cookies( page.cookies )
+    end
+
     #
     # Initializes @@forms with the cookies found during the crawl/analysis
     #
     def init_forms( forms )
-      @@forms |= forms.map { |form| form.id }
+        forms.each { |form| @@forms << form.id }
     end
 
     #
     # Initializes @@links with the links found during the crawl/analysis
     #
     def init_links( links )
-      @@links |= links.map { |link| link.id }
+        links.each { |link| @@links << link.id }
     end
 
     #
     # Initializes @@cookies with the cookies found during the crawl/analysis
     #
     def init_cookies( cookies )
-      @@cookies = cookies
+        @@cookies = cookies
     end
 
     #
@@ -70,26 +85,19 @@ module ElementDB
     # @param    [Array<Element::Form>] forms
     #
     def update_forms( forms )
-
         return [], 0 if forms.size == 0
 
         form_cnt = 0
         new_forms ||= []
 
-        forms.each {
-            |form|
-
-            next if form.action.include?( seed )
-            next if form.auditable.size == 0
+        forms.each do |form|
+            next if @@forms.include?( form.id )
+            @@forms   << form.id
+            new_forms << form
+            form_cnt += 1
+        end
 
-            if !@@forms.include?( form.id )
-                @@forms << form.id
-                new_forms << form
-                form_cnt += 1
-            end
-        }
-
-        return new_forms, form_cnt
+        [new_forms, form_cnt]
     end
 
     #
@@ -103,20 +111,14 @@ module ElementDB
 
       link_cnt = 0
       new_links ||= []
-      links.each {
-          |link|
-
-          next if !link
-          next if link.action.include?( seed )
-
-          if !@@links.include?( link.id )
-              @@links    << link.id
-              new_links << link
-              link_cnt += 1
-          end
-      }
-
-      return new_links, link_cnt
+      links.each do |link|
+          next if @@links.include?( link.id )
+          @@links   << link.id
+          new_links << link
+          link_cnt += 1
+      end
+
+      [new_links, link_cnt]
     end
 
     #
@@ -131,33 +133,26 @@ module ElementDB
         cookie_cnt = 0
         @new_cookies ||= []
 
-        cookies.each_with_index {
-            |cookie|
-
-            @@cookies.each_with_index {
-                |page_cookie, i|
-
-                if( page_cookie.raw['name'] == cookie.raw['name'] )
+        cookies.reverse.each do |cookie|
+            @@cookies.each_with_index do |page_cookie, i|
+                if page_cookie.raw['name'] == cookie.raw['name']
                     @@cookies[i] = cookie
                 elsif !cookie_in_jar?( cookie )
                     @new_cookies << cookie
                     cookie_cnt += 1
                 end
-            }
-        }
+            end
+        end
 
         @@cookies.flatten!
         @@cookies |= @new_cookies
 
-        return [ @@cookies, cookie_cnt ]
+        [@@cookies, cookie_cnt]
     end
 
     def cookie_in_jar?( cookie )
-        @@cookies.each {
-            |c|
-            return true if c.raw['name'] == cookie.raw['name']
-        }
-        return false
+        @@cookies.each { |c| return true if c.raw['name'] == cookie.raw['name'] }
+        false
     end
 
 end