arachni 0.4.0.4 → 0.4.1

data/reports/afr.rb

@@ -1,46 +1,45 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
-=end
+        http://www.apache.org/licenses/LICENSE-2.0
 
-module Arachni
-module Reports
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
 
 #
 # Arachni Framework Report (.afr)
 #
-# @author: Tasos "Zapotek" Laskos
-#                                      <tasos.laskos@gmail.com>
-#                                      <zapotek@segfault.gr>
-# @version: 0.1.1
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+#
+# @version 0.1.2
 #
-class AFR < Arachni::Report::Base
+class Arachni::Reports::AFR < Arachni::Report::Base
 
     def run
         print_line
-        print_status( 'Dumping audit results in \'' + @options['outfile']  + '\'.' )
+        print_status "Dumping audit results in '#{outfile}'."
 
-        @audit_store.save( @options['outfile'] )
+        auditstore.save( outfile )
 
-        print_status( 'Done!' )
+        print_status 'Done!'
     end
 
     def self.info
         {
-            :name           => 'Arachni Framework Report',
-            :description    => %q{Saves the file in the default Arachni Framework Report (.afr) format.},
-            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.1',
-            :options        => [ Arachni::Report::Options.outfile( '.afr' ) ]
+            name:        'Arachni Framework Report',
+            description: %q{Saves the file in the default Arachni Framework Report (.afr) format.},
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
+            version:     '0.1.1',
+            options:     [ Arachni::Report::Options.outfile( '.afr' ) ]
         }
     end
 
 end
-
-end
-end

data/reports/ap.rb

@@ -1,57 +1,46 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
 =end
 
 require 'ap'
 
-module Arachni
-module Reports
-
 #
-# Awesome prints an {AuditStore#to_h} hash.
+# Awesome prints an {AuditStore#to_hash} hash.
 #
-# @author: Tasos "Zapotek" Laskos
-#                                      <tasos.laskos@gmail.com>
-#                                      <zapotek@segfault.gr>
-# @version: 0.1
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 #
-class AP < Arachni::Report::Base
-
-    #
-    # @param [AuditStore]  audit_store
-    # @param [Hash]   options    options passed to the report
-    # @param [String]    outfile    where to save the report
-    #
-    def initialize( audit_store, options )
-        @audit_store   = audit_store
-    end
-
-    def run( )
+# @version 0.1.1
+#
+class Arachni::Reports::AP < Arachni::Report::Base
 
-        print_line( )
-        print_status( 'Awesome printing AuditStore as a Hash...' )
+    def run
+        print_line
+        print_status 'Awesome printing AuditStore as a Hash...'
 
-        ap @audit_store.to_h
+        ap auditstore.to_hash
 
-        print_status( 'Done!' )
+        print_status 'Done!'
     end
 
     def self.info
         {
-            :name           => 'AP',
-            :description    => %q{Awesome prints an AuditStore hash.},
-            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.1'
+            name:        'AP',
+            description: %q{Awesome prints an AuditStore hash.},
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
+            version:     '0.1.1'
         }
     end
 
 end
-
-end
-end

data/reports/html.rb

@@ -1,65 +1,60 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
 =end
 
 require 'erb'
 require 'base64'
 require 'cgi'
-require 'iconv'
-
-module Arachni
-
-require Options.instance.dir['lib'] + 'crypto/rsa_aes_cbc'
-
-module Reports
 
 #
 # Creates an HTML report of the audit.
 #
-# @author: Tasos "Zapotek" Laskos
-#                                      <tasos.laskos@gmail.com>
-#                                      <zapotek@segfault.gr>
-# @version: 0.3
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+#
+# @version 0.3.1
 #
-class HTML < Arachni::Report::Base
-    include Arachni::Module::Utilities
+class Arachni::Reports::HTML < Arachni::Report::Base
 
     module Utils
 
         def normalize( str )
             return '' if !str || str.empty?
-            str.encode( 'UTF-8', :invalid => :replace, :undef => :replace )
+            str.encode( 'utf-8', 'binary', invalid: :replace, undef: :replace )
         end
 
         def escapeHTML( str )
             # carefully escapes HTML and converts to UTF-8
             # while removing invalid character sequences
-            return CGI.escapeHTML( normalize( str ) )
+            CGI.escapeHTML( normalize( str ) )
         end
 
         def for_anomalous_metamodules( audit_store, &block )
-            audit_store.plugins.each_pair {
-                |metaname, data|
+            audit_store.plugins.each do |metaname, data|
                 next if !data[:tags] || !data[:tags].include?( 'anomaly' )
                 block.call( metaname, data )
-            }
+            end
         end
 
         def erb( tpl, params = {} )
             scope = TemplateScope.new( params )
-            scope.add( :audit_store, @audit_store )
+            scope.add( :auditstore, auditstore )
 
             tpl = tpl.to_s + '.erb' if tpl.is_a?( Symbol )
 
             @@base_path ||= @base_path
 
-
             path = File.exist?( tpl ) ? tpl : @@base_path + tpl
             ERB.new( IO.read( path ) ).result( scope.get_binding )
         end
@@ -70,18 +65,14 @@ class HTML < Arachni::Report::Base
     class TemplateScope
         include Utils
 
-        REPORT_FP_URL = "https://arachni.segfault.gr/false_positive"
-        ISSUES_URL    = 'https://github.com/Zapotek/arachni/issues'
+        ISSUES_URL = 'https://github.com/Arachni/arachni/issues'
 
         def initialize( params )
             add_hash( params )
         end
 
         def add_hash( params )
-            params.each_pair {
-                |name, value|
-                add( name, value )
-            }
+            params.each { |name, value| add( name, value ) }
             self
         end
 
@@ -93,10 +84,7 @@ class HTML < Arachni::Report::Base
 
         def format_issue( hash )
             idx, issue = find_issue_by_hash( hash )
-            erb :issue, {
-                :idx   => idx,
-                :issue => issue
-            }
+            erb :issue, idx: idx, issue: issue
         end
 
         def prep_description( str )
@@ -104,23 +92,22 @@ class HTML < Arachni::Report::Base
         end
 
         def find_issue_by_hash( hash )
-            @audit_store.issues.each_with_index {
-                |issue, i|
-                return [i+1, issue] if issue._hash == hash
-            }
-            return nil
+            auditstore.issues.each.with_index do |issue, i|
+                return [i+1, issue] if issue.digest == hash
+            end
+            nil
         end
 
         def get_meta_info( name )
-            @audit_store.plugins['metamodules'][:results][name]
+            auditstore.plugins['metamodules'][:results][name]
         end
 
         def get_plugin_info( name )
-            @audit_store.plugins[name]
+            auditstore.plugins[name]
         end
 
         def js_multiline( str )
-          "\"" + normalize( str ).gsub( "\n", '\n' ) + "\"";
+            "\"" + normalize( str ).gsub( "\n", '\n' ) + "\""
         end
 
         def get_binding
@@ -128,56 +115,44 @@ class HTML < Arachni::Report::Base
         end
     end
 
-    def prepare
-        # @crypto = RSA_AES_CBC.new( Options.instance.dir['data'] + 'crypto/public.pem' )
-    end
-
     #
     # Runs the HTML report.
     #
     def run
         print_line
-        print_status( 'Creating HTML report...' )
-
-        plugins   = format_plugin_results( @audit_store.plugins )
-        @base_path = File.dirname( @options['tpl'] ) + '/' +
-            File.basename( @options['tpl'], '.erb' ) + '/'
+        print_status 'Creating HTML report...'
 
-        conf = {}
-        # conf['options']  = @audit_store.options
-        # conf['version']  = @audit_store.version
-        # conf['revision'] = @audit_store.revision
-        # conf = @crypto.encrypt( conf.to_yaml )
+        plugins    = format_plugin_results( auditstore.plugins )
+        @base_path = File.dirname( options['tpl'] ) + '/' +
+            File.basename( options['tpl'], '.erb' ) + '/'
 
-        title_url = @audit_store.options['url']
+        title_url = auditstore.options['url']
         begin
-            title_url = uri_parse( @audit_store.options['url'] ).host
+            title_url = uri_parse( auditstore.options['url'] ).host
         rescue
         end
 
-        params = __prepare_data.merge(
-            :title_url   => escapeHTML( title_url ),
-            :conf        => conf,
-            :audit_store => @audit_store,
-            :plugins     => plugins,
-            :base_path   => @base_path
+        params = prepare_data.merge(
+            title_url:   escapeHTML( title_url ),
+            audit_store: auditstore,
+            plugins:     plugins,
+            base_path:   @base_path
         )
 
-        __save( @options['outfile'], erb( @options['tpl'], params ) )
+        File.open( outfile, 'w' ) { |f| f.write( erb( options['tpl'], params ) ) }
 
-        print_status( 'Saved in \'' + @options['outfile'] + '\'.' )
+        print_status "Saved in '#{outfile}'."
     end
 
     def self.info
         {
-            :name           => 'HTML Report',
-            :description    => %q{Exports a report as an HTML document.},
-            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.2',
-            :options        => [
-                Arachni::OptPath.new( 'tpl', [ false, 'Template to use.',
-                    File.dirname( __FILE__ ) + '/html/default.erb' ] ),
-                Arachni::Report::Options.outfile( '.html' )
+            name:        'HTML Report',
+            description: %q{Exports a report as an HTML document.},
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
+            version:     '0.3.1',
+            options:     [
+                Options::Path.new( 'tpl', [false, 'Template to use.', File.dirname( __FILE__ ) + '/html/default.erb'] ),
+                Options.outfile( '.html' )
             ]
         }
     end
@@ -193,38 +168,31 @@ class HTML < Arachni::Report::Base
     end
 
 
-    def __save( outfile, out )
-        file = File.new( outfile, 'w' )
-        file.write( out )
-        file.close
-    end
-
-    def __prepare_data( )
-
+    def prepare_data
         graph_data = {
-            :severities => {
-                Issue::Severity::HIGH => 0,
-                Issue::Severity::MEDIUM => 0,
-                Issue::Severity::LOW => 0,
-                Issue::Severity::INFORMATIONAL => 0,
+            severities:       {
+                Severity::HIGH          => 0,
+                Severity::MEDIUM        => 0,
+                Severity::LOW           => 0,
+                Severity::INFORMATIONAL => 0
             },
-            :issues     => {},
-            :trusted_issues    => {},
-            :untrusted_issues  => {},
-            :elements   => {
-                Issue::Element::FORM => 0,
-                Issue::Element::LINK => 0,
-                Issue::Element::COOKIE => 0,
-                Issue::Element::HEADER => 0,
-                Issue::Element::BODY => 0,
-                Issue::Element::PATH => 0,
-                Issue::Element::SERVER => 0,
+            issues:           {},
+            trusted_issues:   {},
+            untrusted_issues: {},
+            elements:         {
+                Element::FORM   => 0,
+                Element::LINK   => 0,
+                Element::COOKIE => 0,
+                Element::HEADER => 0,
+                Element::BODY   => 0,
+                Element::PATH   => 0,
+                Element::SERVER => 0
             },
-            :verification => {
+            verification:     {
                 'Yes' => 0,
                 'No'  => 0
             },
-            :trust => {
+            trust:            {
                 'Trusted'   => 0,
                 'Untrusted' => 0
             }
@@ -240,18 +208,11 @@ class HTML < Arachni::Report::Base
         anomalous_hashes = []
 
         anomalous_meta_results = {}
-        for_anomalous_metamodules( @audit_store ) {
-            |metaname, data|
+        for_anomalous_metamodules( auditstore ) do |metaname, data|
             anomalous_meta_results[metaname] = data
-        }
-
-        @audit_store.issues.each_with_index {
-            |issue, i|
+        end
 
-            # begin
-                # crypto_issues << @crypto.encrypt( YAML::dump( issue ) )
-            # rescue
-            # end
+        auditstore.issues.each.with_index do |issue, i|
 
             graph_data[:severities][issue.severity] += 1
             total_severities += 1
@@ -267,102 +228,87 @@ class HTML < Arachni::Report::Base
             graph_data[:verification][verification] += 1
             total_verifications += 1
 
-            issue.variations.each_with_index {
-                |variation, j|
+            issue.variations.each_with_index do |variation, j|
 
-                if( variation['response'] && !variation['response'].empty? )
+                if variation['response'] && !variation['response'].empty?
+                    variation['response'] = normalize( variation['response'] )
 
-                    variation['response'] = variation['response'].force_encoding( 'utf-8' )
-
-                    @audit_store.issues[i].variations[j]['escaped_response'] =
+                    auditstore.issues[i].variations[j]['escaped_response'] =
                         Base64.encode64( variation['response'] ).gsub( /\n/, '' )
                 end
 
                 response = {}
                 if !variation['headers']['response'].is_a?( Hash )
-                    variation['headers']['response'].split( "\n" ).each {
-                        |line|
+                    variation['headers']['response'].split( "\n" ).each do |line|
                         field, value = line.split( ':', 2 )
                         next if !value
                         response[field] = value
-                    }
+                    end
                 end
-                variation['headers']['response'] = response.dup
 
-            }
+                variation['headers']['response'] = response.dup
+            end
 
             if !anomalous?( anomalous_meta_results, issue )
-                filtered_hashes << issue._hash
+                filtered_hashes << issue.digest
                 graph_data[:trust]['Trusted'] += 1
-                graph_data[:trusted_issues][issue.name] ||= 0
-                graph_data[:trusted_issues][issue.name]   += 1
-
+                graph_data[:trusted_issues][issue.name]   ||= 0
+                graph_data[:trusted_issues][issue.name]    += 1
                 graph_data[:untrusted_issues][issue.name] ||= 0
             else
-                anomalous_hashes << issue._hash
+                anomalous_hashes << issue.digest
                 graph_data[:trust]['Untrusted'] += 1
                 graph_data[:untrusted_issues][issue.name] ||= 0
-                graph_data[:untrusted_issues][issue.name] += 1
-                graph_data[:trusted_issues][issue.name] ||= 0
+                graph_data[:untrusted_issues][issue.name]  += 1
+                graph_data[:trusted_issues][issue.name]   ||= 0
             end
 
-        }
+        end
 
-        graph_data[:severities].each {
-            |severity, cnt|
+        graph_data[:severities].each do |severity, cnt|
             graph_data[:severities][severity] ||= 0
             begin
-                graph_data[:severities][severity] = ((cnt/Float(total_severities)) * 100).to_i
+                graph_data[:severities][severity] = ((cnt / Float( total_severities ) ) * 100).to_i
             rescue
             end
-        }
+        end
 
-        graph_data[:elements].each {
-            |elem, cnt|
+        graph_data[:elements].each do |elem, cnt|
             graph_data[:elements][elem] ||= 0
-
             begin
-                graph_data[:elements][elem] = ((cnt/Float(total_elements)) * 100).to_i
+                graph_data[:elements][elem] = ((cnt / Float( total_elements ) ) * 100).to_i
             rescue
             end
-        }
+        end
 
-        graph_data[:verification].each {
-            |verification, cnt|
+        graph_data[:verification].each do |verification, cnt|
             graph_data[:verification][verification] ||= 0
-
             begin
-                graph_data[:verification][verification] = ((cnt/Float(total_verifications)) * 100).to_i
+                graph_data[:verification][verification] = ((cnt / Float( total_verifications ) ) * 100).to_i
             rescue
             end
-        }
+        end
 
         {
-            :graph_data          => graph_data,
-            :total_severities    => total_severities,
-            :total_elements      => total_elements,
-            :total_verifications => total_verifications,
-            :crypto_issues       => crypto_issues,
-            :filtered_hashes     => filtered_hashes,
-            :anomalous_hashes    => anomalous_hashes,
-            :anomalous_meta_results => anomalous_meta_results
+            graph_data:             graph_data,
+            total_severities:       total_severities,
+            total_elements:         total_elements,
+            total_verifications:    total_verifications,
+            crypto_issues:          crypto_issues,
+            filtered_hashes:        filtered_hashes,
+            anomalous_hashes:       anomalous_hashes,
+            anomalous_meta_results: anomalous_meta_results
         }
 
     end
 
     def anomalous?( anomalous_meta_results, issue )
-        anomalous_meta_results.each_pair {
-            |metaname, data|
-            data[:results].each {
-                |m_issue|
+        anomalous_meta_results.each_pair do |metaname, data|
+            data[:results].each do |m_issue|
                 return true if m_issue['hash'] == issue._hash
-            }
-        }
-
-        return false
+            end
+        end
+        false
     end
 
 end
-
-end
-end