arachni 0.4.0.4 → 0.4.1

data/reports/html/default/issues.erb

@@ -16,7 +16,7 @@
                     </blockquote>
 
                     <% if !filtered_hashes.empty? %>
-                        <% audit_store.issues.each_with_index do |issue, i|%>
+                        <% auditstore.issues.each_with_index do |issue, i|%>
                             <% next if !filtered_hashes.include?( issue._hash ) %>
 
                             <%= erb :issue, { :idx => i+1, :issue => issue, :crypto_issues => crypto_issues } %>

data/reports/html/default/js/charts.js

@@ -1,8 +1,8 @@
 
 function pie( holder, title, data, colors ) {
 
-    container = $( '#' + holder )
-    container.empty()
+    container = $( '#' + holder );
+    container.empty();
 
     $.jqplot( holder,
         [ data ],

data/reports/html/default/js/helpers.js

@@ -16,48 +16,6 @@ function renderResponse( id, html ){
     $( '#' + id ).html( $( '<iframe style="width: 100%; height: 400px" ' + 'src="' + html + '" />' ) );
 }
 
-// function report_fp(i) {
-//
-    // if (!email_address) {
-        // email_address = prompt("Please enter your e-mail address:", "")
-    // }
-//
-    // if (!email_address) return false;
-//
-    // // get some values from elements on the page:
-    // var $form = $("#false_positive_" + i),
-        // issue = $form.find('input[name="issue"]').val(),
-        // module = $form.find('input[name="module"]').val(),
-        // url = $form.find('input[name="url"]').val();
-//
-    // // Send the data using post and put the results in a div
-    // $.post("<%=REPORT_FP_URL%>", {
-        // email_address: email_address,
-        // url: url,
-        // module: module,
-        // issue: issue,
-        // configuration: configuration
-    // }, function () {
-        // $("#fp_report_msg").html("Done!")
-    // });
-//
-    // $(function () {
-        // var fp_txt = '<p>Please wait while the data is being transferred...</p>';
-        // $("#fp_report_msg").html(fp_txt);
-//
-        // $("#fp_report_msg").dialog({
-            // modal: true,
-            // buttons: {
-                // Ok: function () {
-                    // $(this).dialog("close");
-                    // $("#fp_report_msg").html(fp_txt);
-                // }
-            // }
-        // });
-    // });
-//
-// }
-
 function toggleElem(id) {
     elem = $( '#' + id);
 

data/reports/html/default/js/init.js

@@ -15,7 +15,6 @@ $.expr[':'].icontains = function(obj, index, meta, stack){
 
 <%= erb 'js/helpers.js' %>
 
-// var configuration = <%= js_multiline(conf) %>
 var email_address;
 
 jQuery(function ($) {

data/reports/html/default/sitemap.erb

@@ -6,8 +6,8 @@
                 </ul>
 
                 <div id='sitemap_list'>
-                    <h3><%=audit_store.sitemap.size%> pages</h3>
-                    <% audit_store.sitemap.each do |url| %>
+                    <h3><%=auditstore.sitemap.size%> pages</h3>
+                    <% auditstore.sitemap.each do |url| %>
                       <a href="<%=escapeHTML(url)%>"><%=escapeHTML(url)%></a><br/>
                     <%end%>
                 </div>

data/reports/html/default/summary.erb

@@ -3,7 +3,7 @@
             <div id="summary-tabs">
                 <ul>
                     <li><a href="#graphs">Graphs</a></li>
-                    <li><a href="#issue-list">Issues [<%=audit_store.issues.size%>]</a></li>
+                    <li><a href="#issue-list">Issues [<%=auditstore.issues.size%>]</a></li>
                 </ul>
 
                 <div id="graphs">
@@ -34,10 +34,10 @@
                     <%= erb :search, { :id => 'summary_issues_tab' } %>
 
                     <%
-                       half_sz = ( audit_store.issues.size / 2 ).round
+                       half_sz = ( auditstore.issues.size / 2 ).round
 
-                       left = audit_store.issues[0...half_sz]
-                       right = audit_store.issues[half_sz..-1]
+                       left = auditstore.issues[0...half_sz]
+                       right = auditstore.issues[half_sz..-1]
 
                        idx = 0
                     %>

data/reports/html/default/summary_issue.erb

@@ -13,7 +13,7 @@
         using <%= issue.method %>
         <%end%>
 
-        at <b><a href="<%= issue.url %>"><%= issue.url %></a></b>.
+        at <strong><a href="<%= issue.url %>"><%= issue.url %></a></strong>.
 
         <p>&nbsp;</p>
     </div>

data/reports/json.rb

@@ -1,51 +1,49 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
 =end
 
 require 'json'
 
-module Arachni
-module Reports
-
 #
 # Converts the AuditStore to a Hash which it then dumps in JSON format into a file.
 #
-# @author: Tasos "Zapotek" Laskos
-#                                      <tasos.laskos@gmail.com>
-#                                      <zapotek@segfault.gr>
-# @version: 0.1
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 #
-class JSON < Arachni::Report::Base
+# @version 0.1.1
+#
+class Arachni::Reports::JSON < Arachni::Report::Base
 
     def run
-        print_line( )
-        print_status( 'Dumping audit results in \'' + @options['outfile']  + '\'.' )
+        print_line
+        print_status "Dumping audit results in #{outfile}."
 
-        File.open( @options['outfile'], 'w' ) {
-            |f|
-            f.write( ::JSON::pretty_generate( @audit_store.to_h ) )
-        }
+        File.open( outfile, 'w' ) do |f|
+            f.write ::JSON::pretty_generate( auditstore.to_hash )
+        end
 
-        print_status( 'Done!' )
+        print_status 'Done!'
     end
 
     def self.info
         {
-            :name           => 'JSON Report',
-            :description    => %q{Exports the audit results as a JSON file.},
-            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.1',
-            :options        => [ Arachni::Report::Options.outfile( '.json' ) ]
+            name:        'JSON Report',
+            description: %q{Exports the audit results as a JSON file.},
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
+            version:     '0.1.1',
+            options:     [ Options.outfile( '.json' ) ]
         }
     end
 
 end
-
-end
-end

data/reports/marshal.rb

@@ -1,36 +1,37 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
-=end
+        http://www.apache.org/licenses/LICENSE-2.0
 
-module Arachni
-module Reports
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
 
 #
 # Converts the AuditStore to a Hash which it then dumps in Marshal format into a file.
 #
-# @author: Tasos "Zapotek" Laskos
-#                                      <tasos.laskos@gmail.com>
-#                                      <zapotek@segfault.gr>
-# @version: 0.1
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 #
-class Marshal < Arachni::Report::Base
+# @version 0.1.1
+#
+class Arachni::Reports::Marshal < Arachni::Report::Base
 
     def run
-        print_line( )
-        print_status( 'Dumping audit results in \'' + @options['outfile']  + '\'.' )
+        print_line
+        print_status "Dumping audit results in #{outfile}."
 
-        File.open( @options['outfile'], 'w' ) {
-            |f|
-            f.write( ::Marshal::dump( @audit_store.to_h ) )
-        }
+        File.open( outfile, 'w' ) do |f|
+            f.write ::Marshal::dump( auditstore.to_hash )
+        end
 
-        print_status( 'Done!' )
+        print_status 'Done!'
     end
 
     def self.info
@@ -38,12 +39,9 @@ class Marshal < Arachni::Report::Base
             :name           => 'Marshal Report',
             :description    => %q{Exports the audit results as a Marshal file.},
             :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.1',
-            :options        => [ Arachni::Report::Options.outfile( '.marshal' ) ]
+            :version        => '0.1.1',
+            :options        => [ Options.outfile( '.marshal' ) ]
         }
     end
 
 end
-
-end
-end

data/reports/metareport.rb

@@ -1,138 +1,105 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
-=end
-
-module Arachni
-
-require Options.instance.dir['reports'] + 'metareport/arachni_metareport.rb'
+        http://www.apache.org/licenses/LICENSE-2.0
 
-module Reports
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
 
 #
 # Metareport
 #
 # Creates a file to be used with the Arachni MSF plug-in.
 #
-# @author: Tasos "Zapotek" Laskos
-#                                      <tasos.laskos@gmail.com>
-#                                      <zapotek@segfault.gr>
-# @version: 0.1
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 #
-class Metareport < Arachni::Report::Base
-
-    #
-    # @param [AuditStore]  audit_store
-    # @param [Hash]        options    options passed to the report
-    #
-    def initialize( audit_store, options )
-        @audit_store = audit_store
-        @options     = options
-    end
-
-    def run( )
+# @version 0.1.3
+#
+class Arachni::Reports::Metareport < Arachni::Report::Base
 
-        print_line( )
-        print_status( 'Creating file for the Metasploit framework...' )
+    def run
+        print_line
+        print_status 'Creating file for the Metasploit framework...'
 
         msf = []
-
-        @audit_store.issues.each {
-            |issue|
+        auditstore.issues.each do |issue|
             next if !issue.metasploitable
 
-            issue.variations.each {
-                |variation|
-
-                if( ( method = issue.method.dup ) != 'post' )
-                    url = variation['url'].gsub( /\?.*/, '' )
+            issue.variations.each do |variation|
+                url = if (method = issue.method.dup) != 'post'
+                    variation.url.split( '?', 2 ).first
                 else
-                    url = variation['url']
-                end
-
-                if( issue.elem == 'cookie' || issue.elem == 'header' )
-                    method = issue.elem
+                    variation.url
                 end
 
-                # pp issue
-                # pp variation['opts']
+                method = issue.elem if issue.elem == 'cookie' || issue.elem == 'header'
 
-                params = variation['opts'][:combo]
+                params = variation.opts[:combo]
                 next if !params[issue.var]
-                params[issue.var] = params[issue.var].gsub( variation['opts'][:injected_orig], 'XXinjectionXX' )
+                params[issue.var] = params[issue.var].gsub( variation.opts[:injected_orig], 'XXinjectionXX' )
 
-                if method == 'cookie'
+                if method == 'cookie' && variation.headers['request']['cookie']
                     params[issue.var] = URI.encode( params[issue.var], ';' )
-                    cookies = sub_cookie( variation['headers']['request']['cookie'], params )
-                    variation['headers']['request']['cookie'] = cookies.dup
+                    cookies = sub_cookie( variation.headers['request']['cookie'], params )
+                    variation.headers['request']['cookie'] = cookies.dup
                 end
 
-                # ap sub_cookie( variation['headers']['request']['cookie'], params )
-
-                msf << ArachniMetareport.new( {
-                    :host   => URI( url ).host,
-                    :port   => URI( url ).port,
-                    :vhost  => '',
-                    :ssl    => URI( url ).scheme == 'https',
-                    :path   => URI( url ).path,
-                    :query  => URI( url ).query,
-                    :method => method.upcase,
-                    :params => params,
-                    :headers=> variation['headers']['request'].dup,
-                    :pname  => issue.var,
-                    :proof  => variation['regexp_match'],
-                    :risk   => '',
-                    :name   => issue.name,
-                    :description    =>  issue.description,
-                    :category   =>  'n/a',
-                    :exploit    => issue.metasploitable
-                } )
-            }
-
-        }
-
-        # pp msf
-
-        outfile = File.new( @options['outfile'], 'w')
-        ::YAML.dump( msf, outfile )
-        outfile.close
-
-        print_status( 'Saved in \'' + @options['outfile'] + '\'.' )
+                # ap sub_cookie( variation.headers['request']['cookie'], params )
+
+                uri = URI( url )
+                msf << {
+                    host:        uri.host,
+                    port:        uri.port,
+                    vhost:       '',
+                    ssl:         uri.scheme == 'https',
+                    path:        uri.path,
+                    query:       uri.query,
+                    method:      method.upcase,
+                    params:      params,
+                    headers:     variation['headers']['request'].dup,
+                    pname:       issue.var,
+                    proof:       variation['regexp_match'],
+                    risk:        '',
+                    name:        issue.name,
+                    description: issue.description,
+                    category:    'n/a',
+                    exploit:     issue.metasploitable
+                }
+            end
+        end
+
+        File.open( outfile, 'w' ) { |f| ::YAML.dump( msf, f ) }
+
+        print_status "Saved in '#{outfile}'."
     end
 
     def sub_cookie( str, params )
         hash = {}
-        str.split( ';' ).each {
-            |cookie|
-            k,v = cookie.split( '=', 2 )
+        str.to_s.split( ';' ).each do |cookie|
+            k, v = cookie.split( '=', 2 )
             hash[k] = v
-        }
+        end
 
-        return hash.merge( params ).map{ |k,v| "#{k}=#{v}" }.join( ';' )
+        hash.merge( params ).map{ |k,v| "#{k}=#{v}" }.join( ';' )
     end
 
-    #
-    # REQUIRED
-    #
-    # Do not ommit any of the info.
-    #
     def self.info
         {
-            :name           => 'Metareport',
-            :description    => %q{Creates a file to be used with the Arachni MSF plug-in.},
-            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.1',
-            :options        => [ Arachni::Report::Options.outfile( '.msf' ) ]
+            name:        'Metareport',
+            description: %q{Creates a file to be used with the Arachni MSF plug-in.},
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
+            version:     '0.1.3',
+            options:     [ Options.outfile( '.msf' ) ]
 
         }
     end
 
 end
-
-end
-end