arachni 0.4.0.4 → 0.4.1

data/modules/recon/grep/cvs_svn_users.rb

@@ -1,73 +1,63 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
-=end
+        http://www.apache.org/licenses/LICENSE-2.0
 
-module Arachni
-module Modules
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
 
 #
 # CVS/SVN users recon module.
 #
 # Scans every page for CVS/SVN users.
 #
-# @author: morpheuslaw <msidagni@nopsec.com>
-# @version: 0.1
+# @author   Tasos Laskos <tasos.laskos@gmail.com>
+# @version  0.3
 #
-class CvsSvnUsers < Arachni::Module::Base
-
-    def initialize( page )
-        @page = page
+class Arachni::Modules::CvsSvnUsers < Arachni::Module::Base
+
+    def self.regexps
+        @regexps ||= [
+            /\$Author: (\w+) \$/,
+            /\$Locker: (\w+) \$/,
+            /\$Header: .* (\w+) Exp \$/,
+            /\$Id: .* (\w+) Exp \$/,
+            /\$Header: .* (\w+) (?<!Exp )\$/,
+            /\$Id: .* (\w+) (?<!Exp )\$/
+        ]
     end
 
     def run
-        regexps = [
-            /\$Author: (.*) \$/,
-            /\$Locker: (.*) \$/,
-            /\$Header: .* (.*) (Exp )?\$/,
-            /\$Id: .* (.*) (Exp )?\$/
-        ]
-
-        matches = regexps.map {
-            |regexp|
-            @page.html.scan( regexp )
-        }.flatten.reject{ |match| !match || match =~ /Exp/ }.map{ |match| match.strip }.uniq
-
-        matches.each {
-            |match|
-            log(
-                :regexp  => regexps.to_s,
-                :match   => match,
-                :element => Issue::Element::BODY
-            )
-        }
-
+        match_and_log( self.class.regexps )
     end
 
     def self.info
         {
-            :name           => 'CVS/SVN users',
-            :description    => %q{Scans every page for CVS/SVN users.},
-            :author         => 'morpheuslaw <msidagni@nopsec.com>',
-            :version        => '0.1',
-            :targets        => { 'Generic' => 'all' },
-            :issue   => {
-                :name        => %q{CVS/SVN user disclosure.},
-                :description => %q{A CVS or SVN user is disclosed in the body of the HTML page.},
-                :cwe         => '200',
-                :severity    => Issue::Severity::LOW,
-                :cvssv2      => '0',
-                :remedy_guidance    => %q{Remove all CVS and SVN users from the body of the HTML page.},
-                :remedy_code => '',
+            name:        'CVS/SVN users',
+            description: %q{Scans every page for CVS/SVN users.},
+            elements:    [ Element::BODY ],
+            author:      'Tasos Laskos <tasos.laskos@gmail.com>',
+            version:     '0.3',
+            targets:     %w(Generic),
+            references: {
+                'CWE' => 'http://cwe.mitre.org/data/definitions/200.html'
+            },
+            issue:       {
+                name:            %q{CVS/SVN user disclosure.},
+                description:     %q{A CVS or SVN user is disclosed in the body of the HTML page.},
+                cwe:             '200',
+                severity:        Severity::LOW,
+                remedy_guidance: %q{Remove all CVS and SVN users from the body of the HTML page.},
             }
         }
     end
 
 end
-end
-end

data/modules/recon/grep/emails.rb

@@ -1,59 +1,52 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
-=end
+        http://www.apache.org/licenses/LICENSE-2.0
 
-module Arachni
-module Modules
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
 
 #
+# Looks for and logs e-mail addresses.
 #
-# @author: Tasos "Zapotek" Laskos
-#                                      <tasos.laskos@gmail.com>
-#                                      <zapotek@segfault.gr>
-# @version: 0.1
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 #
-class EMails < Arachni::Module::Base
-
-    def initialize( page )
-        @page = page
-    end
-
-    def run( )
-        @@_logged ||= Set.new
+# @version 0.1.1
+#
+class Arachni::Modules::EMails < Arachni::Module::Base
 
-        regexp = /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}/i
-        match_and_log( regexp ){
-            |email|
-            return false if @@_logged.include?( email )
-            @@_logged << email
-        }
+    def run
+        match_and_log( /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}/i ) do |email|
+            return false if audited?( email )
+            audited( email )
+        end
     end
 
     def self.info
         {
-            :name           => 'E-mail address',
-            :description    => %q{Greps pages for disclosed e-mail addresses.},
-            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.1',
-            :targets        => { 'Generic' => 'all' },
-            :issue   => {
-                :name        => %q{Disclosed e-mail address.},
-                :description => %q{An e-mail address is being disclosed.},
-                :cwe         => '200',
-                :severity    => Issue::Severity::INFORMATIONAL,
-                :cvssv2      => '0',
-                :remedy_guidance    => %q{},
-                :remedy_code => '',
+            name:        'E-mail address',
+            description: %q{Greps pages for disclosed e-mail addresses.},
+            elements:    [ Element::BODY ],
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
+            version:     '0.1.1',
+            targets:     %w(Generic),
+            issue:       {
+                name:            %q{Disclosed e-mail address.},
+                description:     %q{An e-mail address is being disclosed.},
+                cwe:             '200',
+                severity:        Severity::INFORMATIONAL,
+                remedy_guidance: %q{E-mail addresses should be presented in such
+                    a way that it is hard to process them automatically.}
             }
         }
     end
 
 end
-end
-end

data/modules/recon/grep/html_objects.rb

@@ -1,53 +1,50 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
-=end
+        http://www.apache.org/licenses/LICENSE-2.0
 
-module Arachni
-module Modules
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
 
 #
+# Looks for HTML "object" tags.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 #
-# @author: Tasos "Zapotek" Laskos
-#                                      <tasos.laskos@gmail.com>
-#                                      <zapotek@segfault.gr>
-# @version: 0.1
+# @version 0.1.2
 #
-class HTMLObjects < Arachni::Module::Base
+class Arachni::Modules::HTMLObjects < Arachni::Module::Base
 
-    def initialize( page )
-        @page = page
+    def self.regexp
+        @regexp ||= /<object(.*)>(.*)<\/object>/im
     end
 
-    def run( )
-        regexp = /\<object(.*)\>(.*)\<\/object\>/im
-        match_and_log( regexp )
+    def run
+        match_and_log( self.class.regexp ) { |m| m && !m.empty? }
     end
 
     def self.info
         {
-            :name           => 'HTML objects',
-            :description    => %q{Greps pages for HTML objects.},
-            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.1',
-            :targets        => { 'Generic' => 'all' },
-            :issue   => {
-                :name        => %q{Found an HTML object.},
-                :description => %q{},
-                :cwe         => '200',
-                :severity    => Issue::Severity::INFORMATIONAL,
-                :cvssv2      => '0',
-                :remedy_guidance    => %q{},
-                :remedy_code => '',
+            name:        'HTML objects',
+            description: %q{Greps pages for HTML objects.},
+            elements:    [ Element::BODY ],
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
+            version:     '0.1.1',
+            targets:     %w(Generic),
+            issue:       {
+                name:     %q{Found an HTML object.},
+                cwe:      '200',
+                severity: Severity::INFORMATIONAL
             }
         }
     end
 
 end
-end
-end

data/modules/recon/grep/http_only_cookies.rb

@@ -0,0 +1,57 @@
+=begin
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
+
+#
+# Logs cookies that are accessible via JavaScript.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+#
+# @version 0.1.1
+#
+class Arachni::Modules::HttpOnlyCookies < Arachni::Module::Base
+
+    def run
+        page.cookies.each do |cookie|
+            next if cookie.http_only? || audited?( cookie.name )
+
+            log( var: cookie.name, element: cookie.type, )
+            audited( cookie.name )
+        end
+    end
+
+    def self.info
+        {
+            name:        'HttpOnly cookies',
+            description: %q{Logs cookies that are accessible via JavaScript.},
+            elements:    [ Element::COOKIE ],
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
+            version:     '0.1.1',
+            targets:     %w(Generic),
+            references:  {
+                'HttpOnly - OWASP' => 'https://www.owasp.org/index.php/HttpOnly'
+            },
+            issue:       {
+                name:            %q{HttpOnly cookie},
+                description:     %q{The logged cookie does not have the HttpOnly
+    flag set which makes it succeptible to maniplation via client-side code.},
+                cwe:             '200',
+                severity:        Severity::INFORMATIONAL,
+                remedy_guidance: %q{Set the 'HttpOnly' flag in the cookie.},
+            }
+        }
+    end
+
+end

data/modules/recon/grep/insecure_cookies.rb

@@ -0,0 +1,55 @@
+=begin
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
+
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+#
+# @version 0.1.1
+#
+class Arachni::Modules::InsecureCookies < Arachni::Module::Base
+
+    def run
+        page.cookies.each do |cookie|
+            next if cookie.secure? || audited?( cookie.name )
+
+            log( var: cookie.name, element: cookie.type, )
+            audited( cookie.name )
+        end
+    end
+
+    def self.info
+        {
+            name:        'Insecure cookies',
+            description: %q{Logs cookies that are served over an unencrypted channel.},
+            elements:    [ Element::COOKIE ],
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
+            version:     '0.1.1',
+            targets:     %w(Generic),
+            references:  {
+                'SecureFlag - OWASP' => 'https://www.owasp.org/index.php/SecureFlag'
+            },
+            issue:       {
+                name:            %q{Insecure cookie},
+                description:     %q{The logged cookie is allowed to be served over
+    an unencrypted channel which makes it susceptible to sniffing.},
+                cwe:             '200',
+                severity:        Severity::INFORMATIONAL,
+                remedy_guidance: %q{Set the 'Secure' flag in the cookie.},
+            }
+        }
+    end
+
+end

data/modules/recon/grep/mixed_resource.rb

@@ -0,0 +1,93 @@
+=begin
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
+
+#
+# Mixed Resource detection module
+#
+# Looks for resources served over HTTP when the HTML code is server over HTTPS.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+#
+# @version 0.1.3
+#
+# @see http://googleonlinesecurity.blogspot.com/2011/06/trying-to-end-mixed-scripting.html
+#
+class Arachni::Modules::MixedResource < Arachni::Module::Base
+
+    def run
+        return if !https?( page.url )
+
+        print_status( 'Checking...' )
+
+        page.document.css( 'script' ).each do |script|
+            url = script.attributes['src'].to_s
+            log_resource( url ) if insecure_script?( script )
+        end
+
+        page.document.css( 'link' ).each do |script|
+            url = script.attributes['href'].to_s
+            log_resource( url ) if insecure_link?( script )
+        end
+    end
+
+    def insecure_link?( script )
+        url = script.attributes['href'].to_s
+        url && !url.empty? && script.attributes['rel'].to_s.downcase == 'stylesheet' &&
+            !https?( url )
+    end
+
+    def insecure_script?( script )
+        url = script.attributes['src'].to_s
+        url && !url.empty? && !https?( url )
+    end
+
+    def https?( url )
+        uri_parse( to_absolute( url, page.url ) ).scheme == 'https'
+    end
+
+    def log_resource( url )
+        return if audited?( url )
+        audited( url )
+
+        match_and_log( url )
+    end
+
+    def self.info
+        {
+            name:        'Mixed Resource',
+            description: %q{Looks for resources served over HTTP when the HTML code is server over HTTPS.},
+            elements:    [ Element::BODY ],
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
+            version:     '0.1.2',
+            references:  {
+                'Google Online Security Blog' =>
+                    'http://googleonlinesecurity.blogspot.com/2011/06/trying-to-end-mixed-scripting.html'
+            },
+            targets:     %w(Generic),
+            issue:       {
+                name:            %q{Mixed Resource},
+                description:     %q{Serving resources over an unencrypted channel
+    while the HTML code is served over HTTPS can lead to
+    Man-In-The-Middle attacks and provide a false sense of security.},
+                tags:            %w(unencrypted resource javascript stylesheet),
+                severity:        Severity::MEDIUM,
+                remedy_guidance: %q{Configure the server to serve all resources over the encrypted channel.}
+            }
+
+        }
+    end
+
+end