arachni 0.4.0.4 → 0.4.1

data/reports/txt.rb

@@ -1,74 +1,58 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
-=end
-
-
-module Arachni
+        http://www.apache.org/licenses/LICENSE-2.0
 
-module Reports
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
 
 #
 # Creates a plain text report of the audit.
 #
 # It redirects stdout to an outfile and runs the default (stdout.rb) report.
 #
-# @author: Tasos "Zapotek" Laskos
-#                                      <tasos.laskos@gmail.com>
-#                                      <zapotek@segfault.gr>
-# @version: 0.2
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 #
-class Text < Arachni::Report::Base
-
-    #
-    # @param [AuditStore]  audit_store
-    # @param [Hash]        options    options passed to the report
-    #
-    def initialize( audit_store, options )
-        @audit_store = audit_store
-        @outfile     = options['outfile']
-
-        require Options.instance.dir['reports'] + 'stdout'
-
-        # get an instance of the stdout report
-        @__stdout_rep = Arachni::Reports::Stdout.new( audit_store, options )
-    end
+# @version 0.2.1
+#
+class Arachni::Reports::Text < Arachni::Report::Base
 
-    def run( )
+    def run
+        require Arachni::Options.dir['reports'] + 'stdout'
 
-        print_line( )
-        print_status( 'Creating text report...' )
+        print_line
+        print_status "Dumping audit results in #{outfile}."
 
         # redirect output streams to the outfile
-        stdout = $stdout.dup
-        stderr = $stderr.dup
-        $stderr = $stdout = File.new( @outfile, 'w' )
+        stdout  = $stdout.dup
+        stderr  = $stderr.dup
+        $stderr = $stdout = File.new( outfile, 'w' )
 
-        @__stdout_rep.run( )
+        Reports::Stdout.new( auditstore, options ).run
 
         $stdout.close
         $stdout = stdout.dup
         $stderr = stderr.dup
 
-        print_status( 'Saved in \'' + @outfile + '\'.' )
+        print_status 'Done!'
     end
 
     def self.info
         {
-            :name           => 'Text report',
-            :description    => %q{Exports a report as a plain text file.},
-            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.2',
-            :options        => [ Arachni::Report::Options.outfile( '.txt' ) ]
+            name:        'Text report',
+            description: %q{Exports a report as a plain text file.},
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
+            version:     '0.2.1',
+            options:     [ Options.outfile( '.txt' ) ]
         }
     end
 
 end
-
-end
-end

data/reports/xml.rb

@@ -1,186 +1,149 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
 =end
 
 require 'base64'
 
-module Arachni
-
-require Arachni::Options.instance.dir['reports'] + '/xml/buffer.rb'
-
-module Reports
-
 #
 # Creates an XML report of the audit.
 #
-# @author: Tasos "Zapotek" Laskos
-#                                      <tasos.laskos@gmail.com>
-#                                      <zapotek@segfault.gr>
-# @version: 0.2.1
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 #
-class XML < Arachni::Report::Base
-
-    include Arachni::Reports::Buffer
-
-    #
-    # @param [AuditStore]  audit_store
-    # @param [Hash]        options    options passed to the report
-    #
-    def initialize( audit_store, options )
-        @audit_store = audit_store
-        @outfile     = options['outfile']
-
-        # XML buffer
-        @__buffer = "<?xml version=\"1.0\" encoding=\"UTF-8\" ?>\n"
-    end
-
-    def run( )
+# @version 0.2.2
+#
+class Arachni::Reports::XML < Arachni::Report::Base
+    require Arachni::Options.dir['reports'] + '/xml/buffer.rb'
+    include Buffer
 
-        print_line( )
-        print_status( 'Creating XML report...' )
+    def run
+        print_line
+        print_status 'Creating XML report...'
 
-        start_tag( 'arachni_report' )
+        append "<?xml version=\"1.0\" encoding=\"UTF-8\" ?>\n"
+        start_tag 'arachni_report'
 
         simple_tag( 'title', 'Web Application Security Report - Arachni Framework' )
-        simple_tag( 'generated_on', Time.now.to_s )
+        simple_tag( 'generated_on', Time.now )
         simple_tag( 'report_false_positives', REPORT_FP )
 
-        start_tag( 'system' )
-        simple_tag( 'version', @audit_store.version )
-        simple_tag( 'revision', @audit_store.revision )
-        simple_tag( 'start_datetime', @audit_store.start_datetime )
-        simple_tag( 'finish_datetime', @audit_store.finish_datetime )
-        simple_tag( 'delta_time', @audit_store.delta_time )
-
-        simple_tag( 'url', @audit_store.options['url'] )
-        simple_tag( 'user_agent', @audit_store.options['user_agent'] )
-
-        start_tag( 'audited_elements' )
-        simple_tag( 'element', 'links' ) if @audit_store.options['audit_links']
-        simple_tag( 'element', 'forms' ) if @audit_store.options['audit_forms']
-        simple_tag( 'element', 'cookies' ) if @audit_store.options['audit_cookies']
-        simple_tag( 'element', 'headers' ) if @audit_store.options['audit_headers']
-        end_tag( 'audited_elements' )
-
-        start_tag( 'modules')
-        @audit_store.options['mods'].each { |mod| add_mod( mod ) }
-        end_tag( 'modules' )
-
-        start_tag( 'filters' )
-        if @audit_store.options['exclude']
-            start_tag( "exclude" )
-            @audit_store.options['exclude'].each {
-                |ex|
-                simple_tag( 'regexp', ex )
-            }
-            end_tag( "exclude" )
-        end
-
-
-        if @audit_store.options['include']
-            start_tag( "include" )
-            @audit_store.options['include'].each {
-                |inc|
-                simple_tag( 'regexp', inc )
-            }
-            end_tag( "include" )
+        start_tag 'system'
+        simple_tag( 'version', auditstore.version )
+        simple_tag( 'revision', auditstore.revision )
+        simple_tag( 'start_datetime', auditstore.start_datetime )
+        simple_tag( 'finish_datetime', auditstore.finish_datetime )
+        simple_tag( 'delta_time', auditstore.delta_time )
+
+        simple_tag( 'url', auditstore.options['url'] )
+        simple_tag( 'user_agent', auditstore.options['user_agent'] )
+
+        start_tag 'audited_elements'
+        simple_tag( 'element', 'links' ) if auditstore.options['audit_links']
+        simple_tag( 'element', 'forms' ) if auditstore.options['audit_forms']
+        simple_tag( 'element', 'cookies' ) if auditstore.options['audit_cookies']
+        simple_tag( 'element', 'headers' ) if auditstore.options['audit_headers']
+        end_tag 'audited_elements'
+
+        start_tag 'modules'
+        auditstore.options['mods'].each { |mod| add_mod( mod ) }
+        end_tag 'modules'
+
+        start_tag 'filters'
+
+        %w(exclude include).each do |type|
+            if auditstore.options[type]
+                start_tag type
+                auditstore.options[type].each { |ex| simple_tag( 'regexp', ex ) }
+                end_tag type
+            end
         end
 
-
-        if @audit_store.options['redundant']
-            start_tag( "redundant" )
-            @audit_store.options['redundant'].each {
-                |red|
-                simple_tag( 'filter', red['regexp'] + ':' + red['count'].to_s )
-            }
-            end_tag( "redundant" )
+        if auditstore.options['redundant']
+            start_tag 'redundant'
+            auditstore.options['redundant'].each do |regexp, counter|
+                simple_tag( 'filter', "#{regexp}:#{counter}" )
+            end
+            end_tag 'redundant'
         end
-        end_tag( 'filters' )
+        end_tag 'filters'
 
-
-        start_tag( 'cookies' )
-        if( @audit_store.options['cookies'] )
-            @audit_store.options['cookies'].each {
-                |name, value|
-                add_cookie( name, value )
-            }
+        start_tag 'cookies'
+        if auditstore.options['cookies']
+            auditstore.options['cookies'].each { |name, value| add_cookie( name, value ) }
         end
-        end_tag( 'cookies' )
-
+        end_tag 'cookies'
 
-        end_tag( 'system' )
+        end_tag 'system'
 
+        start_tag 'issues'
+        auditstore.issues.each do |issue|
+            start_tag 'issue'
 
-        start_tag( 'issues' )
-        @audit_store.issues.each {
-            |issue|
-
-            start_tag( 'issue' )
-
-            issue.each_pair {
-                |k, v|
+            issue.each_pair do |k, v|
                 next if !v.is_a?( String )
                 simple_tag( k, v )
-            }
-
-            add_tags( [issue.tags].flatten.compact )
-
-            start_tag( 'references' )
-            issue.references.each{
-                |name, url|
-                add_reference( name, url )
-            }
-            end_tag( 'references' )
-
+            end
 
-            add_variations( issue )
+            add_tags [issue.tags].flatten.compact
 
-            end_tag( 'issue' )
-        }
+            start_tag 'references'
+            issue.references.each { |name, url| add_reference( name, url ) }
+            end_tag 'references'
 
-        end_tag( 'issues' )
+            add_variations issue
 
-        start_tag( 'plugins' )
+            end_tag 'issue'
+        end
+        end_tag 'issues'
 
+        start_tag 'plugins'
         # get XML formatted plugin data and append them to the XML buffer
-        format_plugin_results( @audit_store.plugins ).values.compact.each { |xml| append( xml ) }
+        # along with some generic info
+        format_plugin_results.each do |plugin, results|
+            start_tag plugin
+            simple_tag( 'name', auditstore.plugins[plugin][:name] )
+            simple_tag( 'description', auditstore.plugins[plugin][:description] )
 
-        end_tag( 'plugins' )
+            start_tag 'results'
+            append( results )
+            end_tag 'results'
 
-        end_tag( 'arachni_report' )
+            end_tag plugin
+        end
+        end_tag 'plugins'
 
-        xml_write( )
-        print_status( 'Saved in \'' + @outfile + '\'.' )
-    end
+        end_tag 'arachni_report'
 
-    def xml_write( )
-        file = File.new( @outfile, 'w' )
-        file.write( @__buffer )
-        file.close
+        File.open( outfile, 'w' ) { |f| f.write( buffer ) }
+        print_status "Saved in '#{outfile}'."
     end
 
-
     def self.info
         {
-            :name           => 'XML report',
-            :description    => %q{Exports a report as an XML file.},
-            :author         => 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            :version        => '0.2.1',
-            :options        => [ Arachni::Report::Options.outfile( '.xml' ) ]
+            name:        'XML report',
+            description: %q{Exports a report as an XML file.},
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
+            version:     '0.2.2',
+            options:     [ Options.outfile( '.xml' ) ]
         }
     end
 
     def add_variations( issue )
-        start_tag( 'variations' )
-        issue.variations.each_with_index {
-            |var|
-            start_tag( 'variation' )
+        start_tag 'variations'
+
+        issue.variations.each_with_index do |var|
+            start_tag 'variation'
 
             simple_tag( 'url', var['url'] )
             simple_tag( 'id', URI.encode( var['id'] ) ) if var['id']
@@ -188,7 +151,7 @@ class XML < Arachni::Report::Base
             simple_tag( 'regexp', var['regexp'].to_s ) if var['regexp']
             simple_tag( 'regexp_match', var['regexp_match'] ) if var['regexp_match']
 
-            start_tag( 'headers' )
+            start_tag 'headers'
 
             if var['headers']['request'].is_a?( Hash )
                 add_headers( 'request', var['headers']['request'] )
@@ -198,29 +161,27 @@ class XML < Arachni::Report::Base
             if var['headers']['response'].is_a?( Hash )
                 response = var['headers']['response']
             else
-                var['headers']['response'].split( "\n" ).each {
-                    |line|
+                var['headers']['response'].split( "\n" ).each do |line|
                     field, value = line.split( ':', 2 )
                     next if !value
                     response[field] = value
-                }
+                end
             end
 
             if response.is_a?( Hash )
                 add_headers( 'response', response )
             end
 
-            end_tag( 'headers' )
+            end_tag 'headers'
 
             if var['response'] && !var['response'].empty?
                 simple_tag( 'html', Base64.encode64( var['response'] ) )
             end
 
-            end_tag( 'variation' )
-        }
-        end_tag( 'variations' )
+            end_tag 'variation'
+        end
+
+        end_tag 'variations'
     end
 
 end
-end
-end

data/reports/xml/buffer.rb

@@ -1,102 +1,89 @@
 =begin
-                  Arachni
-  Copyright (c) 2010-2012 Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2012 Tasos Laskos <tasos.laskos@gmail.com>
 
-  This is free software; you can copy and distribute and modify
-  this program under the term of the GPL v2.0 License
-  (See LICENSE file for details)
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
 
-=end
-
-require 'base64'
-
-module Arachni
-module Reports
-
-    module Buffer
-
-        require 'cgi'
+        http://www.apache.org/licenses/LICENSE-2.0
 
-        def append( str )
-            __add( str, true )
-        end
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
 
-        def simple_tag( tag, text, no_escape = false )
-            start_tag( tag )
-            __add( text, no_escape )
-            end_tag( tag )
-        end
+require 'cgi'
 
-        def start_tag( tag )
-            __buffer( "\n<#{tag}>" )
-        end
+module Arachni::Reports::XML::Buffer
 
-        def end_tag( tag )
-            __buffer( "</#{tag}>\n" )
-        end
+    def simple_tag( tag, text, no_escape = false )
+        start_tag tag
+        append( no_escape ? text : escape( text ) )
+        end_tag tag
+    end
 
-        def add_cookie( name, value )
-            __buffer( "<cookie name=\"#{name}\" value=\"#{value}\" />" )
-        end
+    def start_tag( tag )
+        append "\n<#{tag}>"
+    end
 
-        def add_credentials( username, password )
-            __buffer( "<credentials username=\"#{username}\" password=\"#{password}\" />" )
-        end
+    def end_tag( tag )
+        append "</#{tag}>\n"
+    end
 
-        def add_reference( name, url )
-            __buffer( "<reference name=\"#{name}\" url=\"#{url}\" />" )
-        end
+    def add_cookie( name, value )
+        append "<cookie name=\"#{name}\" value=\"#{value}\" />"
+    end
 
-        def add_param( name, value )
-            __buffer( "<param name=\"#{name}\" value=\"#{value}\" />" )
-        end
+    def add_credentials( username, password )
+        append "<credentials username=\"#{username}\" password=\"#{password}\" />"
+    end
 
-        def add_mod( name )
-            __buffer( "<module name=\"#{name}\" />" )
-        end
+    def add_reference( name, url )
+        append "<reference name=\"#{name}\" url=\"#{url}\" />"
+    end
 
-        def add_headers( type, headers )
-
-            start_tag( type )
-            headers.each_pair {
-                |name, value|
-                if name.downcase == 'set-cookie' && value.is_a?( Array )
-                    __buffer( "<field name=\"#{name}\" value=\"#{CGI.escapeHTML( value.join( "\n" ) )}\" />" )
-                else
-                    __buffer( "<field name=\"#{name}\" value=\"#{CGI.escapeHTML( value.strip )}\" />" )
-                end
-            }
-            end_tag( type )
-        end
+    def add_param( name, value )
+        append "<param name=\"#{name}\" value=\"#{value}\" />"
+    end
 
-        def add_tags( tags )
+    def add_mod( name )
+        append "<module name=\"#{name}\" />"
+    end
 
-            start_tag( 'tags' )
-            tags.each {
-                |name|
-                __buffer( "<tag name=\"#{name}\" />" )
-            }
-            end_tag( 'tags' )
+    def add_headers( type, headers )
+        start_tag type
+        headers.each_pair do |name, value|
+            if value.is_a?( Array ) #&& name.downcase == 'set-cookie'
+                append "<field name=\"#{name}\" value=\"#{escape( value.join( "\n" ) )}\" />"
+            else
+                append "<field name=\"#{name}\" value=\"#{escape( value )}\" />"
+            end
         end
+        end_tag type
+    end
 
+    def add_tags( tags )
+        start_tag 'tags'
+        tags.each { |name| append "<tag name=\"#{name}\" />" }
+        end_tag 'tags'
+    end
 
-        def buffer
-            return @__buffer
-        end
+    def buffer
+        @xml
+    end
 
-        def __buffer( str = '' )
-            @__buffer ||= ''
-            @__buffer += str
-        end
+    def escape( str )
+        CGI.escapeHTML( str.to_s )
+    end
 
-        def __add( text, no_escape = false )
-            if !no_escape
-                __buffer( CGI.escapeHTML( text ) )
-            else
-                __buffer( text )
-            end
-        end
+    def append( str = '' )
+        str = str.to_s
 
+        @xml ||= ''
+        #@xml += (no_escape ? str : escape( str ))
+        @xml << str
     end
-end
+
 end