arachni 0.4.0.4 → 0.4.1

data/plugins/proxy/server.rb

@@ -1,67 +1,195 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
 =end
 
 require 'webrick/httpproxy'
-require 'stringio'
-require 'zlib'
-require 'open-uri'
-
-module Arachni
-module Plugins
-
-class Proxy
-    #
-    # We add our own type of WEBrick::HTTPProxyServer class that supports
-    # notifications when the user tries to access a resource irrelevant
-    # to the scan and does not restrict header exchange.
-    #
-    # @author: Tasos "Zapotek" Laskos
-    #                                      <tasos.laskos@gmail.com>
-    #                                      <zapotek@segfault.gr>
-    # @version: 0.1.2
-    #
-    class Server < WEBrick::HTTPProxyServer
-
-        def choose_header(src, dst)
-            connections = split_field(src['connection'])
-            src.each{|key, value|
-                key = key.downcase
-                if HopByHop.member?(key)          || # RFC2616: 13.5.1
-                   connections.member?(key)       #|| # RFC2616: 14.10
-                   # ShouldNotTransfer.member?(key)    # pragmatics
-                  @logger.debug("choose_header: `#{key}: #{value}'")
-                  next
-                end
-            dst[key] = value
-          }
+require 'webrick/https'
+
+class Arachni::Plugins::Proxy
+#
+# We add our own type of WEBrick::HTTPProxyServer class that supports
+# notifications when the user tries to access a resource irrelevant
+# to the scan, does not restrict header exchange and supports SSL interception.
+#
+# SSL interception is achieved by redirecting traffic to a 2nd (SSL enabled)
+# instance of this server by hijacking the browser's CONNECT request.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+#
+class Server < WEBrick::HTTPProxyServer
+
+    #
+    # Transfers headers from the webapp HTTP response to the Proxy HTTP response.
+    #
+    # @param    [#[], #each]    src     headers of the webapp response
+    # @param    [#[]=]    dst     headers of the forwarded/proxy response
+    #
+    def choose_header( src, dst )
+        connections = split_field( src['connection'] )
+
+        src.each do |key, value|
+            key = key.downcase
+
+            if HopByHop.member?( key )          || # RFC2616: 13.5.1
+                connections.member?( key )       || # RFC2616: 14.10
+                 #ShouldNotTransfer.member?(key)    # pragmatics
+                key == 'content-encoding'
+                @logger.debug( "choose_header: `#{key}: #{value}'" )
+                next
+            end
+
+            field = key.to_s.split( /_|-/ ).map { |segment| segment.capitalize }.join( '-' )
+            dst[field] = value
         end
+    end
 
-        def service( req, res )
-            exclude_reasons = @config[:ProxyURITest].call( req.unparsed_uri )
+    #
+    # Performs a GET request.
+    #
+    # @see Webrick::HTTPProxyServer#proxy_service
+    #
+    def do_GET( req, res )
+        perform_proxy_request( req, res ) do |url, header|
+            Arachni::HTTP.get( url , http_opts( headers: header ) ).response
+        end
+    end
+
+    #
+    # Performs a POST request.
+    #
+    # @see Webrick::HTTPProxyServer#proxy_service
+    #
+    def do_POST( req, res )
+        perform_proxy_request( req, res ) do |url, header|
+            params = Arachni::Utilities.form_parse_request_body( req.body )
+            Arachni::HTTP.post( url, http_opts( params: params, headers: header ) ).response
+        end
+    end
+
+    #
+    # Hijacks CONNECT requests and redirects them to our SSL interceptor proxy
+    # which listens on {#interceptor_port}.
+    #
+    # @see #service
+    # @see Webrick::HTTPProxyServer#service
+    #
+    def do_CONNECT( req, res )
+        req.instance_variable_set( :@unparsed_uri, "localhost:#{interceptor_port}" )
+        start_ssl_interceptor
+        super( req, res )
+    end
 
-            if( exclude_reasons.empty? )
-                super( req, res )
+    #
+    # Performs a HEAD request.
+    #
+    # @see Webrick::HTTPProxyServer#proxy_service
+    #
+    def do_HEAD( req, res )
+        perform_proxy_request( req, res ) do |url, header|
+            Arachni::HTTP.request( url , http_opts( method: :head, headers: header ) ).response
+        end
+    end
+
+    # @param    [Hash]  opts    merges HTTP opts with some defaults
+    def http_opts( opts = {} )
+        opts.merge( no_cookiejar: true, async: false, follow_location: false,
+                    timeout: @config[:Timeout], update_cookies: true )
+    end
+
+    #
+    # Starts the SSL interceptor proxy server.
+    #
+    # The interceptor will listen on {#interceptor_port}.
+    #
+    def start_ssl_interceptor
+        return @interceptor if @interceptor
+
+        dir = File.dirname( __FILE__ ) + '/'
+        cert = OpenSSL::X509::Certificate.new( File.read( dir + 'ssl-interceptor-cert.pem' ) )
+        pkey = OpenSSL::PKey::RSA.new( File.read( dir + 'ssl-interceptor-pkey.pem' ) )
+
+        @interceptor = self.class.new(
+            BindAddress:    'localhost',
+            Port:           interceptor_port,
+            SSLEnable:      true,
+            SSLCertName:    [ [ "CN", WEBrick::Utils::getservername ] ],
+            SSLEnable:      true,
+            SSLCertificate: cert,
+            SSLPrivateKey:  pkey,
+            ArachniProxy:   method( :proxy_service ),
+            ProxyURITest:   @config[:ProxyURITest],
+            Logger:         WEBrick::Log::new( '/dev/null', 7 ),
+        )
+
+        def @interceptor.service( req, res )
+            exclude_reasons = @config[:ProxyURITest].call( req.request_uri )
+
+            if exclude_reasons.empty?
+                @config[:ArachniProxy].call( req, res )
             else
                 notify( exclude_reasons, req, res )
             end
         end
 
-        def notify( reasons, req, res )
-            res.header['content-type'] = 'text/plain'
-            res.header.delete( 'content-encoding' )
+        Thread.new { @interceptor.start }
+        sleep 1
+        @interceptor
+    end
 
-            res.body << reasons.pop + "\n"
-            res.body << reasons.map{ |msg| "  *  #{msg}" }.join( "\n" )
+    # @return    [Integer]   picks and stores an available port number for the interceptor
+    def interceptor_port
+        @interceptor_port ||= available_port
+    end
+
+    # @return    [Integer]   returns an available port number
+    def available_port
+        loop do
+            port = 5555 + rand( 9999 )
+            begin
+                socket = Socket.new( :INET, :STREAM, 0 )
+                socket.bind( Addrinfo.tcp( '127.0.0.1', port ) )
+                socket.close
+                return port
+            rescue Errno::EADDRINUSE
+            end
         end
     end
-end
+
+    # Communicates with the endpoint webapp and forwards its responses to the
+    # proxy which then sends it to the browser.
+    def perform_proxy_request( req, res )
+        response = yield( req.request_uri.to_s, setup_proxy_header( req, res ) )
+
+        # Persistent connection requirements are mysterious for me.
+        # So I will close the connection in every response.
+        res['proxy-connection'] = "close"
+        res['connection'] = "close"
+
+        # Convert Typhoeus::Response to WEBrick::HTTPResponse
+        res.status = response.code.to_i
+        choose_header( response, res )
+
+        # scrub the existing cookies clean and pass the new ones
+        sc = response.headers_hash['Set-Cookie']
+        sc.each { |c| res.cookies << c } if sc.is_a?( Array )
+        res.header.delete( 'set-cookie' )
+
+        #set_cookie( response, res )
+        set_via( res )
+        res.body = response.body
+    end
 
 end
 end

data/plugins/proxy/ssl-interceptor-cert.pem

@@ -0,0 +1,34 @@
+-----BEGIN CERTIFICATE-----
+MIIF1DCCA7ygAwIBAgIBATANBgkqhkiG9w0BAQUFADAxMQswCQYDVQQGEwJHUjEQ
+MA4GA1UEChMHQXJhY2huaTEQMA4GA1UEAxMHQXJhY2huaTAeFw0xMjA3MjgyMzIw
+MDVaFw0xMzA3MjgyMzIwMDVaMEExCzAJBgNVBAYTAkdSMRAwDgYDVQQKEwdBcmFj
+aG5pMSAwHgYDVQQDExdBcmFjaG5pIFNTTCBJbnRlcmNlcHRvcjCCAiIwDQYJKoZI
+hvcNAQEBBQADggIPADCCAgoCggIBAJpVHc7umSzXIj1imxuWzgLh0qS6urFqJvsh
+znH74wnFd9NkGZ4bKWW3gbDjt9yaqNl0v6x4yCIoWd0ThswOmainSjrT1c+r/VnW
+Bk4z4wygCRwMUQrBq2HRA4MU7tgc07kuxbYMxsGBC24geVOiVdz4KpSYLTz1B/ep
+OLi8yfYo2+ukebVT2CsW5HqG4MaAXPIxpL6qApqQEUr4yrQO2mMwfaWnX9XoJQCR
+oiHKZWtU/rJf36gBjvtffTkLZaim4x7OU1P/ZCDFBSnPPQMlXndSevlYrSvwqdLY
+/WHZg0HP0TBy67SUaEub5cmbFKarwVLrhoztMVMUzVHez1jlEWlm/DUhQ40x7roR
+cOhG+2BvO0kavSFSzfqWVLLNeKA993BTVRRIeK+gDhFC7JeIvN9CeMFNjTLa7X2r
+oFvy4HkRqA4NavoUK5bSjegvSngfq3eaTXnc+/jF7nRaQwql5Humeo6T3Fd+8Xda
+oDNu1YRb45yJLYnNSs5+eDG7QIUQXu2PJaeGDYcds9q7Dunw+yvMagy6eXPtNagl
+9WIkhj9ZN7b61TnEHG8+SYpeGw8SKGJjunXiZoueNOGh5wIUth0bOID2/UIUhOoH
+0ZptlJIuF4w27UqCYD9Y0RnPZ7rNintGHzCPdQpjSVYvMaPnp0MEZEpEwxQGP3Gl
+GF2sCtVvAgMBAAGjgeYwgeMwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBkAw
+KwYJYIZIAYb4QgENBB4WHFRpbnlDQSBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYD
+VR0OBBYEFFy1CgyDIn3PjQk/bbaW6TvTS/fFMGEGA1UdIwRaMFiAFD1zqztJOqjt
+tOthKH7x5saCDy0IoTWkMzAxMQswCQYDVQQGEwJHUjEQMA4GA1UEChMHQXJhY2hu
+aTEQMA4GA1UEAxMHQXJhY2huaYIJALNwlBEnwXuDMAkGA1UdEgQCMAAwCQYDVR0R
+BAIwADANBgkqhkiG9w0BAQUFAAOCAgEAHUc6Ewdd9ZS4XulHj1n3zE/5KlNaWcBt
+PootN8TbhaoHA9pCMAMy6lmyNN7PzvmXddJTEb6gkHwVOgVvKMF938KN4s3YHCXB
+lwVNfd4L4jBMQmUgjx6qsG95oD3L2dCjTH21+pRo/Ssl49b3Er33sOlO2R76E1zp
+Sm0ix4QD6YKPCTj5Qd8aprwOcRGL2+L08UFAtnbkQqDKraxYuxXiizZFp9J76yE3
+n5f2PrnNjoRJfersDg0rSRICOMaDVxK2TLasdKZjfhDv63gmAETLevcEWDrDaZKE
+x7rFZ695jAgEyuJFlTj/hX95p8+qmuvflOHNFgAnVMupEico9MhyoS37MKIBCEpm
+4Mt3BG6VXCS7wJ71HhM58afkZJ9P1pCFcW+pUrzx7thGH02SkPVwWxFW8bVrNEfF
+oidfbCELR+hl+R4b2XIyW1rp66v3gQ90o5btNX4NQRMjrUxdrpo2DKEizdGiNFNO
+lIZcFhOoAEd3kOOZ1r1NIoH7kxDOaejeAJEo98MqnL1PZiotJ1MAS60nEqK8Kt6q
+Cw+uzxfvmK1p5rytWhx4S42IkRztXjBEMCveXSVgmUu5QEPzoFRoNFUTOoY8L8m9
+14dwgSQC+AfUnosf/pfnTkUYrLzLOE2gwHLljEBYdpcGG/doF7CVldDfqUJe1OC+
+JTp2DYPsxXU=
+-----END CERTIFICATE-----

data/plugins/proxy/ssl-interceptor-pkey.pem

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKQIBAAKCAgEAmlUdzu6ZLNciPWKbG5bOAuHSpLq6sWom+yHOcfvjCcV302QZ
+nhspZbeBsOO33Jqo2XS/rHjIIihZ3ROGzA6ZqKdKOtPVz6v9WdYGTjPjDKAJHAxR
+CsGrYdEDgxTu2BzTuS7FtgzGwYELbiB5U6JV3PgqlJgtPPUH96k4uLzJ9ijb66R5
+tVPYKxbkeobgxoBc8jGkvqoCmpARSvjKtA7aYzB9padf1eglAJGiIcpla1T+sl/f
+qAGO+199OQtlqKbjHs5TU/9kIMUFKc89AyVed1J6+VitK/Cp0tj9YdmDQc/RMHLr
+tJRoS5vlyZsUpqvBUuuGjO0xUxTNUd7PWOURaWb8NSFDjTHuuhFw6Eb7YG87SRq9
+IVLN+pZUss14oD33cFNVFEh4r6AOEULsl4i830J4wU2NMtrtfaugW/LgeRGoDg1q
++hQrltKN6C9KeB+rd5pNedz7+MXudFpDCqXke6Z6jpPcV37xd1qgM27VhFvjnIkt
+ic1Kzn54MbtAhRBe7Y8lp4YNhx2z2rsO6fD7K8xqDLp5c+01qCX1YiSGP1k3tvrV
+OcQcbz5Jil4bDxIoYmO6deJmi5404aHnAhS2HRs4gPb9QhSE6gfRmm2Uki4XjDbt
+SoJgP1jRGc9nus2Ke0YfMI91CmNJVi8xo+enQwRkSkTDFAY/caUYXawK1W8CAwEA
+AQKCAgAl2j6HZIn5L4LcX3T/nUtF9bE+afYkUY7iBXanCkqzONWc6W5HEw5iPlH2
+2sNbvisvuqzQVodvqUnxKTrkjagub2mLaC2G0/49rHq7b4p+rDnPwU2XP80THrqn
+ydiS9O8Q+mHPtu6Aw2/UQO7BDo3UtqFq9LATxV2A5uZcmSFH2NmnwB2B1eCtIN5F
+FxPGW/FwDbEEeppM4oz7QG4nH4V80oXevWCKDHgW3aFQfF3Hp38YrN8kS82P5enG
+tf7nEJegFKbncTpTtz7+9C9YuC+lQHuc8Jz4q/xbFJGBEGJbH+eE5IrfLY8vDDud
+6QV1o6a0+cN0iTCR2gZJ0EY23WgZeoGZprYH6bzZlaC6+rZYXPXfEBOasJ84OAuz
+qnmaKUJHeXL0iQ4A+vZXwxRgxVsTYTQgomyuE8d/elZM9CNTjbnFpjshPUBgLi3p
+MUWvlvrOobPKAX400LrvWr920BVkTsVn+E6gGg+uNP5PAyz4C5Znwq3YnDouAQJr
+jJEFQU/v1UW4p6KSewWno+XPGKPYb6fn5k7K0+XAwn6pBnOK7kNWFZqholC+yIye
+SPucPUZ2o4Cf1/mn3SkfSu/hPr+5NIEDImRX865759ikpNYWCuY2WBxW3qhtDUwQ
+GHSbz/rUUt1EAJ9mt0OAnrC/QXQI7WEzxoqf+OzmKIq/Z7ub0QKCAQEAx53KC2wf
+IDUMOcHQJG4pKAfcmYXvMhfpY7Ky3HroMjgwZLYNfu8Sms4iiXaVSE6xTzFcSznb
+Sov5+6+u89upS3r5DKBXawVJ0+aZabZm7/af0GkiUVjzGf97m+987oygnwVBlNEl
+zlGUXZVx1DmWf1jKAkbr04e/fFI/qDTtVnMGYXS0B9jae9JUhPxxVYOLz5gKhUA1
+YFNSaO2jv4GhvcBfogOF6eIjTA1jjQFvvVspsv0KC0y5Jy88ft527QIZmMcD0PHK
+RYj73s1dMv+7RUuZ+Swy9o/Zo85EUjmHkj2pas59Eyv9hHTzOIFmCKp2HyLYmye9
+MI0lrWWFB+IYQwKCAQEAxezcaYYJUqkoiAwYLPpr8RFHA9U0auXE4/U8RH0WcYqN
+wKajuaqUkGzFAbNcBEuDFowy7YljV5gnUS6TqpKoEaVV+4YAVVnxaNEsELyaFB2c
+0jsMs/2jW/y7DMQ5N92RINlvDSUdnJ/h5Qx56Wm1umu+mgzyesjaJVa0AnkKlOvq
+qbuPKtPncFkOjD4PxeFLha+VPInoumyY0PKJmNVTAutf/vOKz6WG8tmFvn/yEgb4
+wznpdSluuJ90VmzH86wdbxrzbVbjwcIf0DPZ43wLSpSRBY4k2D1m27G/JumFf2w4
+vujAg9gMKLlw6XrLMr1P2en9b6kPPLG0xZR1qtUBZQKCAQEAnfxPNZ0cQWRaybeQ
+YdTiM/GM8eDkAFSWfjangwKvlVeNTZgctFLI+cad5Qf6fKDzikb50fv3iFeiwUU5
+hX1bzwaD6C9bILOty80drGIVtGQP9mXPKGzq8q+WiEMSMMcSNOl3Dy486r78Wtj1
+n074ws9mCklRSjiNH/sEsL86/InLCgTQm8lQmmFMTXhyxoh3dhTSdsXruNIZTjyO
+tfoGJeUEi3iYWxSEdSO/n5D8e/ST2zqT4X+WpuGm0o6Ft21LDvSsG4nSWhhhp+QH
+mF54PA7qzR/jMeuGCDQvNJidqOuuk37b1PmjC1t4SEd5lvA6zsfIgXwBK1T69fJ8
+SFH0ewKCAQEAv5YNrR+PurH/h+GdLTyia9E7mpwwhyEuuzJRSkKDDRj/KfKkHT7f
+XAXNlV3WvlmR5KuFSKVqwgmIVW7uhXg8tAgE+Nm3TOcpZTrEmtbVlo8rk9yQ6VGl
+ZY94SF1QvaD9sHyIoILC7S9ebGbtQ2GOBYvyDhBmTzBI6UfKK3KbKZhLqEzjwqMo
+LnomON6CShtRDXDu1pDv9DTWn7uGMaidGABbBeEdBu7FeCHS8pnK6mRRPDi8oSqg
+AJpo9JeL3XVHcJr382jeQln0jYcDbM5P57tzvZrgU2jsPdEKpVH6ZWOOck2+vGDP
+NER85aR1OQJDXz6+ke1l0Gx7/Z09YUWaeQKCAQAJJaYm+PM0aFvxZKtwKBrG205v
+BQICVDcZ8M08FwsZUmfQ0LnCBqBzUfeJ5afPr3/DkrjxLYXFxn9d3bEoQJrXJle4
+pZ43O9mhfoJ4KvBkHTK/S26LxekJX8pX7Cb2kj6yDE4UB/q26wm1EGNZINWrGLa5
+XSw99IBdYyvl1BBhfLxLLDPeXfDLzFsGtOtO4ub23IDWDHwQCKYo6ayY8gamzn4y
+FE0lVaAHaNzDYyw432/QfDrLcjkFqADX7ZwNngwRlJMFMdJ6rvL+6w/bKSMD4YGH
+olUyUpIWwKCTbLcPJQ4kCyNK6TsA3cYkwqA+0x2wJDrXquM5pLY8Zom70/2G
+-----END RSA PRIVATE KEY-----

data/plugins/rescan.rb

@@ -1,15 +1,18 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
-=end
+        http://www.apache.org/licenses/LICENSE-2.0
 
-module Arachni
-module Plugins
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
 
 #
 # Allows users to skip the crawling phase by extracting paths discovered
@@ -18,43 +21,39 @@ module Plugins
 # It basically sets the 'restrict_paths' framework option to the sitemap of
 # a previous report.
 #
-# @author: Tasos "Zapotek" Laskos
-#                                      <tasos.laskos@gmail.com>
-#                                      <zapotek@segfault.gr>
-# @version: 0.1
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+#
+# @version 0.1.2
 #
-class ReScan < Arachni::Plugin::Base
+class Arachni::Plugins::ReScan < Arachni::Plugin::Base
 
     def prepare
-        @framework.pause!
-        print_status( "System paused." )
+        framework.pause
+        print_status "System paused."
     end
 
     def run
-        @framework.opts.restrict_paths = Arachni::AuditStore.load( @options['afr'] ).sitemap
-        print_status( "Found #{@framework.opts.restrict_paths.size} paths." )
+        framework.opts.restrict_paths = Arachni::AuditStore.load( options['afr'] ).sitemap
+        print_status "Found #{framework.opts.restrict_paths.size} paths."
     end
 
     def clean_up
-        @framework.resume!
-        print_status( "System resumed." )
+        framework.resume
+        print_status "System resumed."
     end
 
     def self.info
         {
-            :name           => 'ReScan',
-            :description    => %q{It uses the AFR report of a previous scan to
+            name:        'ReScan',
+            description: %q{It uses the AFR report of a previous scan to
                 extract the sitemap in order to avoid a redundant crawl.
             },
-            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.1',
-            :options        => [
-                Arachni::OptPath.new( 'afr', [ true, 'Path to the AFR report.' ] )
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
+            version:     '0.1.2',
+            options:     [
+                Options::Path.new( 'afr', [true, 'Path to the AFR report.'] )
             ]
         }
     end
 
 end
-
-end
-end

data/plugins/script.rb

@@ -0,0 +1,53 @@
+=begin
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
+
+#
+# Loads and runs an external Ruby script under the scope of a plugin,
+# used for debugging and general hackery.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+#
+# @version 0.1.1
+#
+class Arachni::Plugins::Script < Arachni::Plugin::Base
+
+    def run
+        if Arachni::Options.rpc_address
+            print_error 'Cannot be executed while running as an RPC server.'
+            return
+        end
+
+        print_status "Loading #{options['path']}"
+        eval( IO.read( options['path'] ) )
+        print_status 'Done!'
+    end
+
+    def self.info
+        {
+            :name           => 'Script',
+            :description    => %q{Loads and runs an external Ruby script under the scope of a plugin,
+                used for debugging and general hackery.
+
+                Will not work over RPC.},
+            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
+            :version        => '0.1.1',
+            :options        => [
+                Options::Path.new( 'path', [ true, 'Path to the script.' ] )
+            ]
+        }
+    end
+
+end