arachni 0.4.0.4 → 0.4.1

data/Rakefile

@@ -1,37 +1,84 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
 =end
 
+require 'bundler'
 require File.expand_path( File.dirname( __FILE__ ) ) + '/lib/arachni/version'
 
+begin
+    require 'rspec'
+    require 'rspec/core/rake_task'
+
+    namespace :spec do
+        RSpec::Core::RakeTask.new( :core ) do |t|
+            t.pattern = FileList[ "spec/arachni/**/*_spec.rb" ]
+        end
+
+        RSpec::Core::RakeTask.new( :modules ) do |t|
+            t.pattern = FileList[ "spec/modules/**/*_spec.rb" ]
+        end
+
+        RSpec::Core::RakeTask.new( :reports ) do |t|
+            t.pattern = FileList[ "spec/reports/**/*_spec.rb" ]
+        end
+
+        RSpec::Core::RakeTask.new( :plugins ) do |t|
+            t.pattern = FileList[ "spec/plugins/**/*_spec.rb" ]
+        end
+
+        RSpec::Core::RakeTask.new( :path_extractors ) do |t|
+            t.pattern = FileList[ "spec/path_extractors/**/*_spec.rb" ]
+        end
+    end
+
+    RSpec::Core::RakeTask.new
+rescue LoadError
+    puts 'If you want to run the tests please install rspec first:'
+    puts '  gem install rspec'
+end
+
 desc "Generate docs"
 
 task :docs do
 
-    outdir = "../arachni-gh-pages"
-    sh "mkdir #{outdir}" if !File.directory?( outdir )
+    outdir = "../arachni-docs"
+    sh "rm -rf #{outdir}"
+    sh "mkdir -p #{outdir}"
 
-    sh "inkscape gfx/logo.svg --export-png=#{outdir}/logo.png"
-    sh "inkscape gfx/icon.svg --export-png=#{outdir}/icon.png"
-    sh "inkscape gfx/icon.svg --export-png=#{outdir}/favicon.ico"
-    sh "inkscape gfx/banner.svg --export-png=#{outdir}/banner.png"
+    sh "yardoc -o #{outdir}"
 
-    sh "yardoc --verbose --title \
-      \"Arachni - Web Application Security Scanner Framework\" \
-      external/* path_extractors/* plugins/* reports/* modules/* metamodules/* lib/* -o #{outdir} \
-      - EXPLOITATION.md HACKING.md CHANGELOG.md LICENSE.md AUTHORS.md \
-      CONTRIBUTORS.md ACKNOWLEDGMENTS.md"
+    sh "rm -rf .yardoc"
+end
 
+desc "Generate graphics"
+task :gfx do
 
-    sh "rm -rf .yard*"
-end
+    outdir = 'gfx/compiled'
+    srcdir = 'gfx/source'
+
+    sh 'mkdir -p ~/.fonts'
+    sh 'cp gfx/font/Beneath_the_Surface.ttf ~/.fonts'
+
+    Dir.glob( "#{srcdir}/*.svg" ).each do |src|
+        sh "inkscape #{src} --export-png=#{outdir}/#{File.basename( src, '.svg' )}.png"
+    end
+
+    cp "#{outdir}/icon.png", "#{outdir}/favicon.ico"
 
+    sh 'rm -f ~/.fonts/Beneath_the_Surface.ttf'
+end
 
 #
 # Simple profiler using perftools[1].
@@ -43,10 +90,17 @@ end
 #
 desc "Profile Arachni"
 task :profile do
-    sh "CPUPROFILE_FREQUENCY=500 CPUPROFILE=/tmp/profile.dat " +
-        "RUBYOPT=\"-r`gem which perftools | tail -1`\" " +
-        " ./bin/arachni http://demo.testfire.net --link-count=5 && " +
-        "pprof.rb --gif /tmp/profile.dat > profile.gif"
+
+    if !Gem::Specification.find_all_by_name( 'perftools.rb' ).empty?
+        sh "CPUPROFILE_FREQUENCY=500 CPUPROFILE=/tmp/profile.dat " +
+               "RUBYOPT=\"-r`gem which perftools | tail -1`\" " +
+               " ./bin/arachni http://demo.testfire.net && " +
+               "pprof.rb --gif /tmp/profile.dat > profile.gif"
+    else
+        puts 'If you want to run the profiler please install perftools.rb first:'
+        puts '  gem install perftools.rb'
+    end
+
 end
 
 #
@@ -55,12 +109,14 @@ end
 desc "Cleaning report and log files."
 task :clean do
 
+    sh "rm error.log || true"
     sh "rm *.afr || true"
     sh "rm *.yaml || true"
     sh "rm *.json || true"
     sh "rm *.marshal || true"
     sh "rm *.gem || true"
     sh "rm logs/*.log || true"
+    sh "rm spec/logs/*.log || true"
     sh "rm lib/arachni/ui/web/server/db/*.* || true"
     sh "rm lib/arachni/ui/web/server/db/welcomed || true"
     sh "rm lib/arachni/ui/web/server/public/reports/*.* || true"
@@ -68,28 +124,10 @@ task :clean do
 end
 
 
-#
-# Building
-#
-desc "Build the arachni gem."
-task :build  => [ :clean ] do
-    sh "gem build arachni.gemspec"
-end
-
-
-#
-# Installing
-#
-desc "Build and install the arachni gem."
-task :install  => [ :build ] do
-    sh "gem install arachni-#{Arachni::VERSION}.gem"
-end
+Bundler::GemHelper.install_tasks
 
+desc "Push a new version to RubyGems"
+task :publish => [ :release ]
 
-#
-# Publishing
-#
-desc "Push a new version to Gemcutter"
-task :publish => [ :build ] do
-    sh "gem push arachni-#{Arachni::VERSION}.gem"
-end
+desc "Build Arachni and run all the tests."
+task :default => [ :build, :spec ]

data/arachni.gemspec

@@ -0,0 +1,124 @@
+=begin
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
+
+Gem::Specification.new do |s|
+      require File.expand_path( File.dirname( __FILE__ ) ) + '/lib/arachni/version'
+
+      s.required_ruby_version = '>= 1.9.2'
+
+      s.name              = "arachni"
+      s.version           = Arachni::VERSION
+      s.date              = Time.now.strftime( '%Y-%m-%d' )
+      s.summary           = "Arachni is a feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of web applications."
+      s.homepage          = "https://github.com/Arachni/arachni"
+      s.email             = "tasos.laskos@gmail.com"
+      s.authors           = [ "Tasos Laskos" ]
+      s.files            += Dir.glob("conf/**/**")
+      s.files            += Dir.glob("data/**/**")
+      s.files            += Dir.glob("external/**/**")
+      s.files            += Dir.glob("extras/**/**")
+      s.files            += Dir.glob("gfx/**/**")
+      s.files            += Dir.glob("lib/**/**")
+      s.files            += Dir.glob("logs/**/**")
+      s.files            += Dir.glob("modules/**/**")
+      s.files            += Dir.glob("path_extractors/**/**")
+      s.files            += Dir.glob("plugins/**/**")
+      s.files            += Dir.glob("profiles/**/**")
+      s.files            += Dir.glob("reports/**/**")
+      s.files            += Dir.glob("rpcd_handlers/**/**")
+      s.files            += Dir.glob("spec/**/**")
+      s.files            += %w(Gemfile Rakefile arachni.gemspec)
+
+      s.executables       = [ "arachni", "arachni_rpcd_monitor",
+                              "arachni_rpcd", "arachni_rpc", "arachni_web",
+                              "arachni_web_autostart", "arachni_console",
+                              "arachni_script" ]
+
+      s.extra_rdoc_files  = %w( README.md ACKNOWLEDGMENTS.md LICENSE.md AUTHORS.md CHANGELOG.md CONTRIBUTORS.md EXPLOITATION.md HACKING.md NOTICE )
+      s.rdoc_options      = ["--charset=UTF-8"]
+
+      s.add_dependency 'bundler',         ">= 1.0.0"
+      s.add_dependency "typhoeus",        "~> 0.3.3"
+      #s.add_dependency "addressable",     "~> 2.2.6"
+      s.add_dependency "pony"
+      s.add_dependency "awesome_print"
+      s.add_dependency "json"
+      s.add_dependency "rb-readline"
+      s.add_dependency "nokogiri",        ">= 1.5.0"
+      s.add_dependency "sys-proctable",   ">= 0.9.1"
+      s.add_dependency "terminal-table",  ">= 1.4.2"
+      s.add_dependency "sinatra",         "~> 1.3.2"
+      s.add_dependency "sinatra-contrib", "~> 1.3.1"
+      s.add_dependency "sinatra-flash",   ">= 0.3.0"
+      s.add_dependency "async_sinatra",   ">= 0.5.0"
+      s.add_dependency "thin",            ">= 1.2.11"
+      s.add_dependency "datamapper",      "~> 1.2.0"
+      s.add_dependency "data_objects",    "~> 0.10.8"
+      s.add_dependency "dm-sqlite-adapter", "~> 1.2.0"
+      s.add_dependency "net-ssh",         ">= 2.2.1"
+      s.add_dependency "net-scp",         ">= 1.0.4"
+      s.add_dependency "eventmachine",    ">= 1.0.0.beta.4"
+      s.add_dependency "em-synchrony",    ">= 1.0.0"
+      s.add_dependency "arachni-rpc-em",  "= 0.1.2"
+
+      s.add_development_dependency 'rake',  "~> 0.9.2.2"
+      s.add_development_dependency 'rspec', "~> 2.8"
+
+      s.post_install_message = <<MSG
+
+Thank you for installing Arachni, here are some resources which should
+help you make the best of it:
+
+Homepage           - http://arachni-scanner.com
+Blog               - http://arachni-scanner.com/blog
+Documentation      - http://arachni-scanner.com/wiki
+Support            - http://support.arachni-scanner.com
+GitHub page        - http://github.com/Arachni/arachni
+Code Documentation - http://rubydoc.info/github/Arachni/arachni
+Author             - Tasos "Zapotek" Laskos (http://twitter.com/Zap0tek)
+Twitter            - http://twitter.com/ArachniScanner
+Copyright          - 2010-2012 Tasos Laskos
+License            - Apache License v2
+
+Please do not hesitate to ask for assistance (via the support portal)
+or report a bug (via GitHub Issues) if you come across any problem.
+
+MSG
+
+      s.description = <<DESCRIPTION
+Arachni is a feature-full, modular, high-performance Ruby framework aimed towards
+helping penetration testers and administrators evaluate the security of web applications.
+
+Arachni is smart, it trains itself by learning from the HTTP responses it receives during the audit process
+and is able to perform meta-analysis using a number of factors in order to correctly assess the trustworthiness
+of results and intelligently identify false-positives.
+
+Unlike other scanners, it takes into account the dynamic nature of web applications, can detect changes caused while travelling
+through the paths of a web application's cyclomatic complexity and is able to adjust itself accordingly.
+This way attack/input vectors that would otherwise be undetectable by non-humans are seamlessly handled by Arachni.
+
+Moreover, Arachni yields great performance due to its asynchronous HTTP model (courtesy of Typhoeus) -- especially
+when combined with a High Performance Grid setup which allows you to combine the resources of multiple nodes for lightning fast scans.
+Thus, you'll only be limited by the responsiveness of the server under audit.
+
+Finally, it is versatile enough to cover a great deal of use cases, ranging from a simple
+command line scanner utility, to a global high performance grid of scanners, to a Ruby library allowing for scripted audits.
+
+Note: Despite the fact that Arachni is mostly targeted towards web application security,
+it can easily be used for general purpose scraping, data-mining, etc with the addition of custom modules.
+DESCRIPTION
+
+end

data/bin/arachni

@@ -1,18 +1,24 @@
 #!/usr/bin/env ruby
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
 =end
 
-require_relative "../lib/arachni/options"
+require_relative '../lib/arachni'
 
-Arachni::Options.instance.parse!
+Arachni::Options.parse
 
-require Arachni::Options.instance.dir['lib'] + 'ui/cli/cli'
+require Arachni::Options.dir['lib'] + 'ui/cli/cli'
 
 Arachni::UI::CLI.new( Arachni::Options.instance ).run

data/bin/arachni_console

@@ -0,0 +1,52 @@
+#!/usr/bin/env ruby
+=begin
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
+
+require_relative '../lib/arachni/ui/cli/output'
+require_relative '../lib/arachni'
+require 'irb'
+require 'irb/completion'
+
+include Arachni
+include UI::Output
+
+puts BANNER
+puts
+puts "(Call the 'mute' method to mute framework output.)"
+
+IRB.setup nil
+IRB.conf[:MAIN_CONTEXT] = IRB::Irb.new.context
+
+HISTFILE = '~/.irb_history'
+MAXHISTSIZE = 300
+
+begin
+    histfile = File.expand_path( HISTFILE )
+    if File.exists?( histfile )
+        lines = IO.readlines( histfile ).map { |line| line.chomp }
+        Readline::HISTORY.push( *lines )
+    end
+    Kernel.at_exit do
+        lines = Readline::HISTORY.to_a.reverse.uniq.reverse
+        lines = lines[-MAXHISTSIZE, MAXHISTSIZE] if lines.size > MAXHISTSIZE
+        File.open( histfile, 'a' ) { |f| f.write( lines.join( "\n" ) ) }
+    end
+rescue => e
+    puts "Error when configuring permanent history: #{e}"
+end
+
+require 'irb/ext/multi-irb'
+IRB.irb nil, Arachni

data/bin/arachni_rpc

@@ -1,17 +1,23 @@
 #!/usr/bin/env ruby
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
 =end
 
-require_relative "../lib/arachni/options"
+require_relative '../lib/arachni'
 
-Arachni::Options.instance.parse!
-require Arachni::Options.instance.dir['lib'] + 'ui/rpc/rpc'
+Arachni::Options.parse
+require Arachni::Options.dir['lib'] + 'ui/rpc/rpc'
 
 Arachni::UI::RPC.new( Arachni::Options.instance ).run

data/bin/arachni_rpcd

@@ -1,18 +1,24 @@
 #!/usr/bin/env ruby
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
 =end
 
-require_relative "../lib/arachni/options"
+require_relative '../lib/arachni'
 
-Arachni::Options.instance.parse!
+Arachni::Options.parse
 
-require Arachni::Options.instance.dir['lib'] + 'rpc/server/dispatcher'
+require Arachni::Options.dir['lib'] + 'rpc/server/dispatcher'
 
-Arachni::RPC::Server::Dispatcher.new( Arachni::Options.instance )
+::EM.run { Arachni::RPC::Server::Dispatcher.new( Arachni::Options.instance ) }