arachni 0.4.0.4 → 0.4.1

data/modules/audit/ldapi.rb

@@ -1,97 +1,72 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
-=end
-
-module Arachni
+        http://www.apache.org/licenses/LICENSE-2.0
 
-module Modules
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
 
 #
 # LDAP injection audit module.
 #
-# @author: Tasos "Zapotek" Laskos
-#                                      <tasos.laskos@gmail.com>
-#                                      <zapotek@segfault.gr>
-# @version: 0.1.1
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+#
+# @version 0.1.2
 #
 # @see http://cwe.mitre.org/data/definitions/90.html
 # @see http://projects.webappsec.org/w/page/13246947/LDAP-Injection
 # @see http://www.owasp.org/index.php/LDAP_injection
 #
-class LDAPInjection < Arachni::Module::Base
-
-    include Arachni::Module::Utilities
-
-    def prepare
-
-        #
-        # we make this a class variable and populate it only once
-        # to reduce file IO
-        #
-        @@__errors ||= []
-
-        if @@__errors.empty?
-            read_file( 'errors.txt' ) { |error| @@__errors << error }
-        end
-
-
-        # prepare the strings that will hopefully cause the webapp
-        # to output LDAP error messages
-        @__injection_str = "#^($!@$)(()))******"
-
-        @__opts = {
-            :format    => [ Format::APPEND ],
-            :substring => @@__errors
-        }
+class Arachni::Modules::LDAPInjection < Arachni::Module::Base
 
+    def self.error_strings
+        @errors ||= read_file( 'errors.txt' )
     end
 
     def run
-        audit( @__injection_str, @__opts )
+        # This string will hopefully force the webapp to output LDAP error messages
+        audit( "#^($!@$)(()))******",
+            format:    [Format::APPEND],
+            substring: self.class.error_strings
+        )
     end
 
-
     def self.info
         {
-            :name           => 'LDAPInjection',
-            :description    => %q{It tries to force the web application to
+            name:        'LDAPInjection',
+            description: %q{It tries to force the web application to
                 return LDAP error messages in order to discover failures
                 in user input validation.},
-            :elements       => [
-                Issue::Element::FORM,
-                Issue::Element::LINK,
-                Issue::Element::COOKIE,
-                Issue::Element::HEADER
-            ],
-            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.1.1',
-            :references     => {
-                'WASC'      => 'http://projects.webappsec.org/w/page/13246947/LDAP-Injection',
-                'OWASP'     => 'http://www.owasp.org/index.php/LDAP_injection'
+            elements:    [ Element::FORM, Element::LINK, Element::COOKIE, Element::HEADER ],
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
+            version:     '0.1.2',
+            references:  {
+                'WASC'  => 'http://projects.webappsec.org/w/page/13246947/LDAP-Injection',
+                'OWASP' => 'http://www.owasp.org/index.php/LDAP_injection'
             },
-            :targets        => { 'Generic' => 'all' },
-            :issue   => {
-                :name        => %q{LDAP Injection},
-                :description => %q{LDAP queries can be injected into the web application
-                    which can be used to disclose sensitive data of affect the execution flow.},
-                :tags        => [ 'ldap', 'injection', 'regexp' ],
-                :cwe         => '90',
-                :severity    => Issue::Severity::HIGH,
-                :cvssv2       => '',
-                :remedy_guidance    => %q{User inputs must be validated and filtered
-                    before being used in an LDAP query.},
-                :remedy_code => ''
+            targets:     %w(Generic),
+            issue:       {
+                name:            %q{LDAP Injection},
+                description:     %q{LDAP queries can be injected into the web application
+    which can be used to disclose sensitive data of affect the execution flow.},
+                tags:            %w(ldap injection regexp),
+                cwe:             '90',
+                severity:        Severity::HIGH,
+                cvssv2:          '',
+                remedy_guidance: %q{User inputs must be validated and filtered
+    before being used in an LDAP query.},
+                remedy_code:     ''
             }
 
         }
     end
 
 end
-end
-end

data/modules/audit/os_cmd_injection.rb

@@ -1,99 +1,81 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
-=end
-
-module Arachni
+        http://www.apache.org/licenses/LICENSE-2.0
 
-module Modules
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
 
 #
 # Simple OS command injection module.
 #
-# @author: Tasos "Zapotek" Laskos
-#                                      <tasos.laskos@gmail.com>
-#                                      <zapotek@segfault.gr>
-# @version: 0.1.5
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+#
+# @version 0.1.6
 #
 # @see http://cwe.mitre.org/data/definitions/78.html
 # @see http://www.owasp.org/index.php/OS_Command_Injection
 #
-class OSCmdInjection < Arachni::Module::Base
-
-    include Arachni::Module::Utilities
+class Arachni::Modules::OSCmdInjection < Arachni::Module::Base
 
-    def prepare
-
-        @__opts = {}
-        @__opts[:regexp]   = [
-            /root:x:0:0:.+:[0-9a-zA-Z\/]+/i,
-            /\[boot loader\](.*)\[operating systems\]/i
-        ]
-        @__opts[:format]   = [ Format::STRAIGHT ]
-
-        @@__injection_str ||= []
-
-        if @@__injection_str.empty?
-            read_file( 'payloads.txt' ) {
-                |str|
-
-                [ '', '&&', '|', ';' ].each {
-                    |sep|
-                    @@__injection_str << sep + " " + str
-                }
+    def self.opts
+        @opts ||= {
+            regexp: [
+                /root:x:0:0:.+:[0-9a-zA-Z\/]+/,
+                /\[boot loader\](.*)\[operating systems\]/
+            ],
+            format: [ Format::STRAIGHT, Format::APPEND ]
+        }
+    end
 
-                @@__injection_str << "`" + " " + str + "`"
-            }
+    def self.payloads
+        @payloads ||= []
+        if @payloads.empty?
+            read_file( 'payloads.txt' ) do |str|
+                [ '', '&&', '|', ';' ].each { |sep| @payloads << sep + " " + str }
+                @payloads << "`" + " " + str + "`"
+            end
         end
-
+        @payloads
     end
 
     def run
-        @@__injection_str.each {
-            |str|
-            audit( str, @__opts )
-        }
+        self.class.payloads.each { |str| audit( str, self.class.opts ) }
     end
 
-
     def self.info
         {
-            :name           => 'OS command injection',
-            :description    => %q{Tries to find operating system command injections.},
-            :elements       => [
-                Issue::Element::FORM,
-                Issue::Element::LINK,
-                Issue::Element::COOKIE,
-                Issue::Element::HEADER
-            ],
-            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
-            :version        => '0.1.5',
-            :references     => {
-                 'OWASP'         => 'http://www.owasp.org/index.php/OS_Command_Injection'
+            name:        'OS command injection',
+            description: %q{Tries to find operating system command injections.},
+            elements:    [ Element::FORM, Element::LINK, Element::COOKIE, Element::HEADER ],
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
+            version:     '0.1.6',
+            references:  {
+                'OWASP' => 'http://www.owasp.org/index.php/OS_Command_Injection'
             },
-            :targets        => { 'Generic' => 'all' },
-            :issue   => {
-                :name        => %q{Operating system command injection},
-                :description => %q{The web application allows an attacker to
-                    execute arbitrary OS commands.},
-                :tags        => [ 'os', 'command', 'code', 'injection', 'regexp' ],
-                :cwe         => '78',
-                :severity    => Issue::Severity::HIGH,
-                :cvssv2       => '9.0',
-                :remedy_guidance    => %q{User inputs must be validated and filtered
-                    before being evaluated as OS level commands.},
-                :remedy_code => '',
-                :metasploitable => 'unix/webapp/arachni_exec'
+            targets:     %w(Windows Unix),
+            issue:       {
+                name:            %q{Operating system command injection},
+                description:     %q{The web application allows an attacker to
+    execute arbitrary OS commands.},
+                tags:            %w(os command code injection regexp),
+                cwe:             '78',
+                severity:        Severity::HIGH,
+                cvssv2:          '9.0',
+                remedy_guidance: %q{User inputs must be validated and filtered
+    before being evaluated as OS level commands.},
+                remedy_code:     '',
+                metasploitable:  'unix/webapp/arachni_exec'
             }
-
         }
     end
 
 end
-end
-end

data/modules/audit/os_cmd_injection/payloads.txt

@@ -1,2 +1,2 @@
 /bin/cat /etc/passwd
-type %SYSTEMROOT%\\win.ini
+type %SystemDrive%\\boot.ini

data/modules/audit/os_cmd_injection_timing.rb

@@ -1,104 +1,83 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
-=end
-
-module Arachni
+        http://www.apache.org/licenses/LICENSE-2.0
 
-module Modules
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
 
 #
 # OS command injection module using timing attacks.
 #
-# @author: Tasos "Zapotek" Laskos
-#                                      <tasos.laskos@gmail.com>
-#                                      <zapotek@segfault.gr>
-# @version: 0.2.2
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+#
+# @version 0.2.3
 #
 # @see http://cwe.mitre.org/data/definitions/78.html
 # @see http://www.owasp.org/index.php/OS_Command_Injection
 #
-class OSCmdInjectionTiming < Arachni::Module::Base
-
-    include Arachni::Module::Utilities
-
-    def prepare
-
-        @@__injection_str ||= []
-
-        if @@__injection_str.empty?
-            read_file( 'payloads.txt' ) {
-                |str|
+class Arachni::Modules::OSCmdInjectionTiming < Arachni::Module::Base
 
-                [ '', '&&', '|', ';' ].each {
-                    |sep|
-                    @@__injection_str << sep + " " + str
-                }
+    prefer :os_cmd_injection
 
-                @@__injection_str << "`" + str + "`"
-            }
+    def self.payloads
+        @payloads ||= []
+        if @payloads.empty?
+            read_file( 'payloads.txt' ) do |str|
+                [ '', '&&', '|', ';' ].each { |sep| @payloads << sep + " " + str }
+                @payloads << "`" + str + "`"
+            end
         end
-
-        @__opts = {
-            :format  => [ Format::STRAIGHT ],
-            :timeout => 10000,
-            :timeout_divider => 1000
-        }
-
+        @payloads
     end
 
     def run
-        audit_timeout( @@__injection_str, @__opts )
-    end
-
-    def redundant
-        [ 'os_cmd_injection' ]
+        audit_timeout( self.class.payloads,
+                       format:          [Format::STRAIGHT],
+                       timeout:         10000,
+                       timeout_divider: 1000 )
     end
 
     def self.info
         {
-            :name           => 'OS command injection (timing)',
-            :description    => %q{Tries to find operating system command injections using timing attacks.},
-            :elements       => [
-                Issue::Element::FORM,
-                Issue::Element::LINK,
-                Issue::Element::COOKIE,
-                Issue::Element::HEADER
-            ],
-            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
-            :version        => '0.2.2',
-            :references     => {
-                 'OWASP'         => 'http://www.owasp.org/index.php/OS_Command_Injection'
+            name:        'OS command injection (timing)',
+            description: %q{Tries to find operating system command injections using timing attacks.},
+            elements:    [ Element::FORM, Element::LINK, Element::COOKIE, Element::HEADER ],
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
+            version:     '0.2.3',
+            references:  {
+                'OWASP' => 'http://www.owasp.org/index.php/OS_Command_Injection'
             },
-            :targets        => { 'Generic' => 'all' },
-            :issue   => {
-                :name        => %q{Operating system command injection (timing attack)},
-                :description => %q{The web application allows an attacker to
-                    execute arbitrary OS commands even though it does not return
-                    the command output in the HTML body.
-                    (This issue was discovered using a timing attack; timing attacks
-                    can result in false positives in cases where the server takes
-                    an abnormally long time to respond.
-                    Either case, these issues will require further investigation
-                    even if they are false positives.)},
-                :tags        => [ 'os', 'command', 'code', 'injection', 'timing', 'blind' ],
-                :cwe         => '78',
-                :severity    => Issue::Severity::HIGH,
-                :cvssv2       => '9.0',
-                :remedy_guidance    => %q{User inputs must be validated and filtered
-                    before being evaluated as OS level commands.},
-                :remedy_code => '',
-                :metasploitable => 'unix/webapp/arachni_exec'
+            targets:     %w(Linux BSD Solaris Windows),
+            issue:       {
+                name:            %q{Operating system command injection (timing attack)},
+                description:     %q{The web application allows an attacker to
+    execute arbitrary OS commands even though it does not return
+    the command output in the HTML body.
+    (This issue was discovered using a timing attack; timing attacks
+    can result in false positives in cases where the server takes
+    an abnormally long time to respond.
+    Either case, these issues will require further investigation
+    even if they are false positives.)},
+                tags:            %w(os command code injection timing blind),
+                cwe:             '78',
+                severity:        Severity::HIGH,
+                cvssv2:          '9.0',
+                remedy_guidance: %q{User inputs must be validated and filtered
+    before being evaluated as OS level commands.},
+                remedy_code:     '',
+                metasploitable:  'unix/webapp/arachni_exec'
             }
 
         }
     end
 
 end
-end
-end