arachni 0.4.0.4 → 0.4.1

data/reports/plugin_formatters/xml/resolver.rb

@@ -1,53 +1,33 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
-=end
-
-module Arachni
-
-require Arachni::Options.instance.dir['reports'] + '/xml/buffer.rb'
-
-module Reports
-
-class XML
-module PluginFormatters
-
-    #
-    # @author: Tasos "Zapotek" Laskos
-    #                                      <tasos.laskos@gmail.com>
-    #                                      <zapotek@segfault.gr>
-    # @version: 0.1
-    #
-    class Resolver < Arachni::Plugin::Formatter
-
-        include Buffer
+        http://www.apache.org/licenses/LICENSE-2.0
 
-        def run
-            start_tag( 'resolver' )
-            simple_tag( 'description', @description )
-
-            start_tag( 'results' )
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
 
-            @results.each {
-                |hostname, ipaddress|
-                __buffer( "<hostname value='#{hostname}' ipaddress='#{ipaddress}' />" )
-            }
+class Arachni::Reports::XML
 
-            end_tag( 'results' )
-            end_tag( 'resolver' )
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+#
+class PluginFormatters::Resolver < Arachni::Plugin::Formatter
+    include Buffer
 
-            return buffer( )
+    def run
+        results.each do |hostname, ipaddress|
+            append "<hostname value='#{hostname}' ipaddress='#{ipaddress}' />"
         end
-
+        buffer
     end
 
 end
 end
-
-end
-end

data/reports/plugin_formatters/xml/timing_attacks.rb

@@ -1,55 +1,37 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
-=end
-
-module Arachni
-
-require Arachni::Options.instance.dir['reports'] + '/xml/buffer.rb'
-
-module Reports
-
-class XML
-module PluginFormatters
-
-    #
-    # XML formatter for the results of the TimingAttacks plugin.
-    #
-    # @author: Tasos "Zapotek" Laskos
-    #                                      <tasos.laskos@gmail.com>
-    #                                      <zapotek@segfault.gr>
-    # @version: 0.1
-    #
-    class TimingAttacks < Arachni::Plugin::Formatter
-
-        include Arachni::Reports::Buffer
+        http://www.apache.org/licenses/LICENSE-2.0
 
-        def run
-            start_tag( 'timeout_notice' )
-            simple_tag( 'description', @description )
-            start_tag( 'results' )
-
-            @results.each { |issue| add_issue( issue ) }
-
-            end_tag( 'results' )
-            end_tag( 'timeout_notice' )
-        end
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
 
-        def add_issue( issue )
-            __buffer( "<issue hash=\"#{issue['hash'].to_s}\" " +
-                " index=\"#{issue['index'].to_s}\" name=\"#{issue['name']}\"" +
-                " url=\"#{issue['url']}\" element=\"#{issue['elem']}\" " +
-                " variable=\"#{issue['var']}\" method=\"#{issue['method']}\" />" )
+class Arachni::Reports::XML
+
+#
+# XML formatter for the results of the TimingAttacks plugin.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+#
+class PluginFormatters::TimingAttacks < Arachni::Plugin::Formatter
+    include Buffer
+
+    def run
+        results.each do |issue|
+            append "<issue hash=\"#{issue['hash'].to_s}\" " +
+               " index=\"#{issue['index'].to_s}\" name=\"#{issue['name']}\"" +
+               " url=\"#{issue['url']}\" element=\"#{issue['elem']}\" " +
+               " variable=\"#{issue['var']}\" method=\"#{issue['method']}\" />"
         end
-
     end
 
 end
 end
-end
-end

data/reports/plugin_formatters/xml/uniformity.rb

@@ -1,72 +1,53 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
-=end
-
-module Arachni
-
-require Arachni::Options.instance.dir['reports'] + '/xml/buffer.rb'
-
-module Reports
-
-class XML
-module PluginFormatters
-
-    #
-    # XML formatter for the results of the Uniformity plugin.
-    #
-    # @author: Tasos "Zapotek" Laskos
-    #                                      <tasos.laskos@gmail.com>
-    #                                      <zapotek@segfault.gr>
-    # @version: 0.1
-    #
-    class Uniformity < Arachni::Plugin::Formatter
-
-        include Arachni::Reports::Buffer
-
-        def run
-            start_tag( 'uniformity' )
-            simple_tag( 'description', @description )
-            start_tag( 'results' )
-
-            uniformals = @results['uniformals']
-            pages      = @results['pages']
+        http://www.apache.org/licenses/LICENSE-2.0
 
-            uniformals.each_pair {
-                |id, uniformal|
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
 
-                start_uniformals( id )
+class Arachni::Reports::XML
 
-                uniformal['hashes'].each_with_index {
-                    |hash, i|
-                    add_uniformal( i, uniformal )
-                }
+#
+# XML formatter for the results of the Uniformity plugin.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+#
+class PluginFormatters::Uniformity < Arachni::Plugin::Formatter
+    include Buffer
 
-                end_tag( 'uniformals' )
-            }
+    def run
+        uniformals = results['uniformals']
+        pages      = results['pages']
 
-            end_tag( 'results' )
-            end_tag( 'uniformity' )
-        end
+        uniformals.each do |id, uniformal|
+            start_uniformals id
 
-        def add_uniformal( idx, uniformal )
-            __buffer( "<issue index=\"#{uniformal['indices'][idx]}\"" +
-                " hash=\"#{uniformal['hashes'][idx]}\" />" )
-        end
+            uniformal['hashes'].each_with_index do |hash, i|
+                add_uniformal( i, uniformal )
+            end
 
-        def start_uniformals( id )
-            __buffer( "<uniformals id=\"#{id}\">" )
+            end_tag 'uniformals'
         end
+    end
 
+    def add_uniformal( idx, uniformal )
+        append "<issue index=\"#{uniformal['indices'][idx]}\"" +
+            " hash=\"#{uniformal['hashes'][idx]}\" />"
+    end
 
+    def start_uniformals( id )
+        append "<uniformals id=\"#{id}\">"
     end
 
-end
-end
+
 end
 end

data/reports/plugin_formatters/xml/waf_detector.rb

@@ -1,53 +1,34 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
-=end
-
-module Arachni
-
-require Arachni::Options.instance.dir['reports'] + '/xml/buffer.rb'
-
-module Reports
-
-class XML
-module PluginFormatters
-
-    #
-    # XML formatter for the results of the WAF Detector plugin
-    #
-    # @author: Tasos "Zapotek" Laskos
-    #                                      <tasos.laskos@gmail.com>
-    #                                      <zapotek@segfault.gr>
-    # @version: 0.1
-    #
-    class WAFDetector < Arachni::Plugin::Formatter
-
-        include Buffer
+        http://www.apache.org/licenses/LICENSE-2.0
 
-        def run
-            start_tag( 'waf_detector' )
-            simple_tag( 'description', @description )
-
-            start_tag( 'results' )
-
-            simple_tag( 'message', @results[:msg] )
-            simple_tag( 'code', @results[:code].to_s )
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
 
-            end_tag( 'results' )
-            end_tag( 'waf_detector' )
+class Arachni::Reports::XML
 
-            return buffer( )
-        end
+#
+# XML formatter for the results of the WAF Detector plugin
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+#
+class PluginFormatters::WAFDetector < Arachni::Plugin::Formatter
+    include Buffer
 
+    def run
+        simple_tag( 'message', results[:msg] )
+        simple_tag( 'code', results[:code] )
+        buffer
     end
 
 end
 end
-
-end
-end

data/reports/stdout.rb

@@ -1,15 +1,18 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
-=end
+        http://www.apache.org/licenses/LICENSE-2.0
 
-module Arachni
-module Reports
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
 
 #
 # Default report.
@@ -18,165 +21,161 @@ module Reports
 # All UIs must have a default report.
 #
 #
-# @author: Tasos "Zapotek" Laskos
-#                                      <tasos.laskos@gmail.com>
-#                                      <zapotek@segfault.gr>
-# @version: 0.2.1
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 #
-class Stdout < Arachni::Report::Base
-
-    #
-    # @param [AuditStore]  audit_store
-    # @param [Hash]   options    options passed to the report
-    #
-    def initialize( audit_store, options )
-        @audit_store = audit_store
-    end
-
-    def run( )
+# @version 0.2.2
+#
+class Arachni::Reports::Stdout < Arachni::Report::Base
 
-        print_line( "\n" )
-        print_line( "=" * 80 )
-        print_line( "\n" )
-        print_ok( 'Web Application Security Report - Arachni Framework' )
+    def run
         print_line
-        print_info( 'Report generated on: ' + Time.now.to_s )
-        print_info( 'Report false positives: ' + REPORT_FP )
         print_line
-        print_ok( 'System settings:' )
-        print_info( '---------------' )
-        print_info( 'Version:  ' + @audit_store.version )
-        print_info( 'Revision: '+ @audit_store.revision )
-        print_info( 'Audit started on:  ' + @audit_store.start_datetime )
-        print_info( 'Audit finished on: ' + @audit_store.finish_datetime )
-        print_info( 'Runtime: ' + @audit_store.delta_time )
+        print_line "=" * 80
         print_line
-        print_info( 'URL: ' + @audit_store.options['url'] )
-        print_info( 'User agent: ' + @audit_store.options['user_agent'] )
         print_line
-        print_status( 'Audited elements: ' )
-        print_info( '* Links' ) if @audit_store.options['audit_links']
-        print_info( '* Forms' ) if @audit_store.options['audit_forms']
-        print_info( '* Cookies' ) if @audit_store.options['audit_cookies']
-        print_info( '* Headers' ) if @audit_store.options['audit_headers']
+
+        print_ok 'Web Application Security Report - Arachni Framework'
         print_line
-        print_status( 'Modules: ' + @audit_store.options['mods'].join( ', ' ) )
+        print_info "Report generated on: #{Time.now}"
+        print_info "Report false positives at: #{REPORT_FP}"
         print_line
-        print_status( 'Filters: ' )
-
-        if @audit_store.options['exclude']
-            print_info( "  Exclude:" )
-            @audit_store.options['exclude'].each {
-                |ex|
-                print_info( '    ' + ex )
-            }
-        end
 
-        if @audit_store.options['include']
-            print_info( "  Include:" )
-            @audit_store.options['include'].each {
-                |inc|
-                print_info( "    " + inc )
-            }
-        end
+        print_ok 'System settings:'
+        print_info '---------------'
+
+        print_info "Version:  #{auditstore.version}"
+        print_info "Revision: #{auditstore.revision}"
+        print_info "Audit started on:  #{auditstore.start_datetime}"
+        print_info "Audit finished on: #{auditstore.finish_datetime}"
+        print_info "Runtime: #{auditstore.delta_time}"
+        print_line
+        print_info "URL: #{auditstore.options['url']}"
+        print_info "User agent: #{auditstore.options['user_agent']}"
+        print_line
+        print_status 'Audited elements: '
+        print_info '* Links'    if auditstore.options['audit_links']
+        print_info '* Forms'    if auditstore.options['audit_forms']
+        print_info '* Cookies'  if auditstore.options['audit_cookies']
+        print_info '* Headers'  if auditstore.options['audit_headers']
+        print_line
+        print_status 'Modules: ' + auditstore.options['mods'].join( ', ' )
+
+        if auditstore.options['exclude'].any? ||
+            auditstore.options['include'].any? ||
+            auditstore.options['redundant'].any?
+
+            print_line
+            print_status 'Filters: '
+
+            if auditstore.options['exclude'] && auditstore.options['exclude'].any?
+                print_info "  Exclude:"
+                auditstore.options['exclude'].each { |ex| print_info "    #{ex}" }
+            end
+
+            if auditstore.options['include'] && auditstore.options['include'].any?
+                print_info "  Include:"
+                auditstore.options['include'].each { |inc| print_info "    #{inc}" }
+            end
 
-        if @audit_store.options['redundant']
-            print_info( "  Redundant:" )
-            @audit_store.options['redundant'].each {
-                |red|
-                print_info( "    " + red['regexp'] + ':' + red['count'].to_s )
-            }
+            if auditstore.options['redundant'] && auditstore.options['redundant'].any?
+                print_info "  Redundant:"
+                auditstore.options['redundant'].each do |regexp, counter|
+                    print_info "    #{regexp}:#{counter}"
+                end
+            end
         end
 
-        print_line
-        print_status( 'Cookies: ' )
-        if( @audit_store.options['cookies'] )
-            @audit_store.options['cookies'].each {
-                |cookie|
-                print_info( "  #{cookie[0]} = #{cookie[1]}" )
-            }
+        if auditstore.options['cookies'] && auditstore.options['cookies'].any?
+            print_line
+            print_status 'Cookies: '
+            auditstore.options['cookies'].each do |cookie|
+                print_info "  #{cookie[0]} = #{cookie[1]}"
+            end
         end
 
         print_line
-        print_info( '===========================' )
+        print_info '==========================='
         print_line
-        print_ok( @audit_store.issues.size.to_s + " issues were detected." )
+        print_ok "#{auditstore.issues.size} issues were detected."
         print_line
 
-        @audit_store.issues.each_with_index {
-            |issue, i|
+        auditstore.issues.each_with_index do |issue, i|
+
+            print_ok "[#{i+1}] #{issue.name}"
+            print_info '~~~~~~~~~~~~~~~~~~~~'
 
-            print_ok( "[#{i+1}] " + issue.name )
-            print_info( '~~~~~~~~~~~~~~~~~~~~' )
+            print_info "ID Hash:  #{issue.digest}"
+            print_info "Severity: #{issue.severity}"
+            print_info "URL:      #{issue.url}"
+            print_info "Element:  #{issue.elem}"
+            print_info "Method:   #{issue.method}" if issue.method
+            print_info 'Tags:     ' + issue.tags.join( ', ' ) if issue.tags.is_a?( Array )
+            print_info "Variable: #{issue.var}" if issue.var
 
-            print_info( 'ID Hash:  ' + issue._hash )
-            print_info( 'Severity: ' + issue.severity ) if issue.severity
-            print_info( 'URL:      ' + issue.url )
-            print_info( 'Element:  ' + issue.elem )
-            print_info( 'Method:   ' + issue.method ) if issue.method
-            print_info( 'Tags:     ' + issue.tags.join( ', ' ) ) if issue.tags.is_a?( Array )
-            print_info( 'Variable: ' + issue.var ) if issue.var
-            print_info( 'Description: ' )
-            print_info( issue.description )
+            print_info 'Description: '
+            print_info issue.description
 
             if issue.cwe && !issue.cwe.empty?
                 print_line
-                print_info( "CWE: http://cwe.mitre.org/data/definitions/#{issue.cwe}.html" )
+                print_info "CWE: http://cwe.mitre.org/data/definitions/#{issue.cwe}.html"
             end
 
             print_line
-            print_info( 'Requires manual verification?: ' + issue.verification.to_s )
+            print_info 'Requires manual verification?: ' + issue.verification.to_s
             print_line
 
-            if( issue.references )
-                print_info( 'References:' )
-                issue.references.each{
-                    |ref|
-                    print_info( '  ' + ref[0] + ' - ' + ref[1] )
-                }
+            if issue.references
+                print_info 'References:'
+                issue.references.each{ |ref| print_info "  #{ref[0]} - #{ref[1]}" }
             end
 
-            print_info_variations( issue )
-
+            print_info_variations issue
             print_line
-        }
+        end
+
+        return if auditstore.plugins.empty?
 
         print_line
-        print_ok( 'Plugin data:' )
-        print_info( '---------------' )
+        print_ok 'Plugin data:'
+        print_info '---------------'
         print_line
 
-        # let the plugin formatters to their thing and print their results
-        format_plugin_results( @audit_store.plugins )
+        # let the plugin formatters do their thing and print their results
+        # and let our block handle the boring crap
+        format_plugin_results do |results|
+            print_line
+            print_status results[:name]
+            print_info '~~~~~~~~~~~~~~'
+
+            print_info "Description: #{results[:description]}"
+            print_line
+        end
     end
 
     def self.info
         {
-            :name           => 'Stdout',
-            :description    => %q{Prints the results to standard output.},
-            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.2.1',
+            name:        'Stdout',
+            description: %q{Prints the results to standard output.},
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
+            version:     '0.2.2'
         }
     end
 
     def print_info_variations( issue )
         print_line
-        print_status( 'Variations' )
-        print_info( '----------' )
-        issue.variations.each_with_index {
-            |var, i|
-            print_info( "Variation #{i+1}:" )
-            print_info( 'URL: ' + var['url'] )
-            print_info( 'ID:  ' + var['id'].to_s ) if var['id']
-            print_info( 'Injected value:     ' + var['injected'].to_s ) if var['injected']
-            print_info( 'Regular expression: ' + var['regexp'].to_s ) if var['regexp']
-            print_info( 'Matched string:     ' + var['regexp_match'].to_s ) if var['regexp_match']
+        print_status 'Variations'
+        print_info '----------'
+
+        issue.variations.each_with_index do |var, i|
+            print_info "Variation #{i+1}:"
+            print_info "URL: #{var['url']}"
+            print_info "ID:  #{var['id']}"                          if var['id']
+            print_info "Injected value:     #{var['injected']}"     if var['injected']
+            print_info "Regular expression: #{var['regexp']}"       if var['regexp']
+            print_info "Matched string:     #{var['regexp_match']}" if var['regexp_match']
 
             print_line
-        }
+        end
     end
 
 end
-
-end
-end