arachni 0.4.0.4 → 0.4.1

data/spec/arachni/element/body_spec.rb

@@ -0,0 +1,9 @@
+require_relative '../../spec_helper'
+
+describe Arachni::Element::BODY do
+    describe 'Arachni::Element::BODY' do
+        it 'should return "body"' do
+            Arachni::Element::BODY.should == 'body'
+        end
+    end
+end

data/spec/arachni/element/capabilities/auditable/rdiff_spec.rb

@@ -0,0 +1,47 @@
+require_relative '../../../../spec_helper'
+
+describe Arachni::Element::Capabilities::Auditable::RDiff do
+
+    before :all do
+        @url     = server_url_for( :rdiff )
+        @auditor = Auditor.new
+    end
+
+    describe '#rdiff_analysis' do
+        before do
+            @opts = {
+                faults: ['bad'],
+                bools:  ['good']
+            }
+            @params = { 'rdiff' => 'blah' }
+            issues.clear
+        end
+
+        context 'when response behavior suggests a vuln' do
+            it 'should log issue' do
+                auditable = Arachni::Element::Link.new( @url + '/true', @params )
+                auditable.auditor = @auditor
+                auditable.rdiff_analysis( @opts )
+                @auditor.http.run
+                @auditor.http.run
+
+                results = Arachni::Module::Manager.results
+                results.should be_any
+                results.first.var.should == 'rdiff'
+            end
+        end
+
+        context 'when responses are\'t consistent with vuln behavior' do
+            it 'should not log issue' do
+                auditable = Arachni::Element::Link.new( @url + '/false', @params )
+                auditable.auditor = @auditor
+                auditable.rdiff_analysis( @opts )
+                @auditor.http.run
+                @auditor.http.run
+                issues.should be_empty
+            end
+        end
+
+    end
+
+end

data/spec/arachni/element/capabilities/auditable/taint_spec.rb

@@ -0,0 +1,110 @@
+require_relative '../../../../spec_helper'
+
+describe Arachni::Element::Capabilities::Auditable::Taint do
+
+    before :all do
+        @url = server_url_for( :taint )
+        @auditor = Auditor.new
+
+        @positive = Arachni::Element::Link.new( @url, 'input' => '' )
+        @positive.auditor = @auditor
+
+        @negative = Arachni::Element::Link.new( @url, 'inexistent_input' => '' )
+        @negative.auditor = @auditor
+    end
+
+    describe '.taint' do
+
+        before do
+            @seed = 'my_seed'
+            Arachni::Framework.reset
+         end
+
+        context 'when called with no opts' do
+            it 'should use the defaults' do
+                @positive.taint_analysis( @seed )
+                @auditor.http.run
+                issues.size.should == 1
+            end
+        end
+
+        context 'when called against non-vulnerable input' do
+            it 'should not log issue' do
+                @negative.taint_analysis( @seed )
+                @auditor.http.run
+                issues.should be_empty
+            end
+        end
+
+        context 'when called with option' do
+
+            context 'for matching with' do
+
+                describe :regexp do
+                    context 'with valid :match' do
+                        it 'should verify the matched data with the provided string' do
+                            @positive.taint_analysis( @seed,
+                                regexp: /my_.+d/,
+                                match: @seed,
+                                format: [ Arachni::Module::Auditor::Format::STRAIGHT ]
+                             )
+                            @auditor.http.run
+                            issues.size.should == 1
+                            issues.first.injected.should == @seed
+                        end
+                    end
+
+                    context 'with invalid :match' do
+                        it 'should not log issue' do
+                            @positive.taint_analysis( @seed,
+                                regexp: @seed,
+                                match: 'blah',
+                                format: [ Arachni::Module::Auditor::Format::STRAIGHT ]
+                             )
+                            @auditor.http.run
+                            issues.should be_empty
+                        end
+                    end
+
+                    context 'without :match' do
+                        it 'should try to match the provided pattern' do
+                            @positive.taint_analysis( @seed,
+                                regexp: @seed,
+                                format: [ Arachni::Module::Auditor::Format::STRAIGHT ]
+                             )
+                            @auditor.http.run
+                            issues.size.should == 1
+                            issues.first.injected.should == @seed
+                        end
+                    end
+                end
+
+                describe :substring do
+                    it 'should try to find the provided substring' do
+                        @positive.taint_analysis( @seed,
+                            substring: @seed,
+                            format: [ Arachni::Module::Auditor::Format::STRAIGHT ]
+                         )
+                        @auditor.http.run
+                        issues.size.should == 1
+                    end
+                end
+
+                describe :ignore do
+                    it 'should ignore matches whose response also matches them' do
+                        @positive.taint_analysis( @seed,
+                            substring: @seed,
+                            format: [ Arachni::Module::Auditor::Format::STRAIGHT ],
+                            ignore: @seed
+                        )
+                        @auditor.http.run
+                        issues.should be_empty
+                    end
+                end
+
+            end
+        end
+
+    end
+
+end

data/spec/arachni/element/capabilities/auditable/timeout_spec.rb

@@ -0,0 +1,107 @@
+require_relative '../../../../spec_helper'
+
+describe Arachni::Element::Capabilities::Auditable::Timeout do
+
+    before :all do
+        @url     = server_url_for( :timeout )
+        @auditor = Auditor.new
+
+        inputs = { 'sleep' => '' }
+
+        @positive = Arachni::Element::Link.new( @url + '/true', inputs )
+        @positive.auditor = @auditor
+
+        @positive_high_res = Arachni::Element::Link.new(
+            @url + '/high_response_time',
+            inputs
+        )
+        @positive_high_res.auditor = @auditor
+
+        @negative = Arachni::Element::Link.new( @url + '/false', inputs )
+        @negative.auditor = @auditor
+
+        @run = proc{ Arachni::Element::Capabilities::Auditable.timeout_audit_run }
+    end
+
+    before { Arachni::Framework.reset }
+
+    describe '#responsive?' do
+        context 'when the server is responsive' do
+            it 'should return true' do
+                Arachni::Element::Link.new( @url + '/true' ).responsive?.should be_true
+            end
+        end
+        context 'when the server is not responsive' do
+            it 'should return false' do
+                Arachni::Element::Link.new( @url + '/sleep' ).responsive?( 1 ).should be_false
+            end
+        end
+    end
+
+    describe '#timeout_analysis' do
+        before do
+            @timeout_opts = {
+                format: [ Arachni::Module::Auditor::Format::STRAIGHT ],
+                elements: [ Arachni::Element::LINK ]
+            }
+            issues.clear
+        end
+
+        describe :timeout_divider do
+            context 'when set' do
+                it 'should modify the final timeout value' do
+                    @positive.timeout_analysis( '__TIME__',
+                        @timeout_opts.merge(
+                            timeout_divider: 1000,
+                            timeout: 2000
+                        )
+                    )
+                    @run.call
+
+                    issues.should be_any
+                    issues.first.injected.should == 4.to_s
+                end
+            end
+
+            context 'when not set' do
+                it 'should not modify the final timeout value' do
+                    c = @positive.dup
+                    c[:multi] = true
+                    c.timeout_analysis( '__TIME__', @timeout_opts.merge( timeout: 2000 ))
+                    @run.call
+
+                    issues.should be_any
+                    issues.first.injected.should == 4000.to_s
+                end
+            end
+        end
+
+        context 'when a page has a high response time' do
+
+            before do
+                @delay_opts = {
+                    timeout_divider: 1000,
+                    timeout: 2000
+                }.merge( @timeout_opts )
+            end
+
+            context 'but isn\'t vulnerable' do
+                it 'should not log issue' do
+                    @negative.timeout_analysis( '__TIME__', @delay_opts )
+                    @run.call
+                    issues.should be_empty
+                end
+            end
+
+            context 'and is vulnerable' do
+                it 'should log issue' do
+                    @positive_high_res.timeout_analysis( '__TIME__', @delay_opts )
+                    @run.call
+                    issues.should be_any
+                end
+            end
+        end
+
+    end
+
+end

data/spec/arachni/element/capabilities/mutable_spec.rb

@@ -0,0 +1,261 @@
+require_relative '../../../spec_helper'
+
+describe Arachni::Element::Capabilities::Mutable do
+    before( :all ) do
+        @inputs = { 'another_param_name' => 'another_param_value' }
+        @seed = 'my_seed'
+        @mutable = Arachni::Element::Link.new( 'http://test.com', inputs: @inputs  )
+    end
+
+    describe '#original?' do
+        context 'when the element has not been mutated' do
+            it 'should return true' do
+                e = Arachni::Element::Link.new( 'http://test.com', inputs: @inputs )
+                e.original?.should be_true
+            end
+        end
+        context 'when the element has been mutated' do
+            it 'should return false' do
+                e = Arachni::Element::Link.new( 'http://test.com', inputs: @inputs )
+                e.mutations( @seed ).first.original?.should be_false
+            end
+        end
+    end
+
+    describe '#mutated?' do
+        context 'when the element has not been mutated' do
+            it 'should return true' do
+                e = Arachni::Element::Link.new( 'http://test.com', inputs: @inputs )
+                e.mutated?.should be_false
+            end
+        end
+        context 'when the element has been mutated' do
+            it 'should return false' do
+                e = Arachni::Element::Link.new( 'http://test.com', inputs: @inputs )
+                e.mutations( @seed ).first.mutated?.should be_true
+            end
+        end
+    end
+
+    describe '#altered_value' do
+        it 'should return the value of the altered input' do
+            e = Arachni::Element::Link.new( 'http://test.com', inputs: @inputs )
+            elem = e.mutations_for( @seed ).first
+            elem.altered_value.should == @seed
+        end
+    end
+
+    describe '#altered_value=' do
+        it 'should set the value of the altered input' do
+            e = Arachni::Element::Link.new( 'http://test.com', inputs: @inputs )
+            elem = e.mutations_for( @seed ).first
+            elem.altered_value = 'stuff'
+            elem.altered_value.should == 'stuff'
+            elem.auditable.values.first.should == 'stuff'
+        end
+    end
+
+    describe '#mutations' do
+        it 'should be aliased to #mutations_for' do
+            e = Arachni::Element::Link.new( 'http://test.com', inputs: @inputs )
+            e.mutations_for( @seed ).should == e.mutations( @seed )
+        end
+        it 'should be aliased to #permutations' do
+            e = Arachni::Element::Link.new( 'http://test.com', inputs: @inputs )
+            e.permutations( @seed ).should == e.mutations( @seed )
+        end
+        it 'should be aliased to #permutations_for' do
+            e = Arachni::Element::Link.new( 'http://test.com', inputs: @inputs )
+            e.permutations_for( @seed ).should == e.mutations( @seed )
+        end
+
+        it 'should only affect #auditable and #altered' do
+            e = Arachni::Element::Link.new( 'http://test.com', inputs: @inputs )
+            e.mutations( @seed ).each do |m|
+                e.url.should == m.url
+                e.action.should == m.action
+                e.altered.should_not == m.altered
+                e.auditable.should_not == m.auditable
+            end
+        end
+
+        context 'with no options' do
+            it 'should return all combinatios' do
+                inputs = { inputs: {
+                        'param_name' => 'param_value',
+                        'email' => nil
+                    }
+                }
+                Arachni::Element::Link.new( 'http://test.com', inputs )
+                    .mutations( @seed ).size.should == 8
+            end
+        end
+
+        describe '#immutables' do
+            it 'should skip parameters which is contains' do
+                l = Arachni::Element::Link.new( 'http://test.com',
+                    inputs: {
+                        'input_one' => 'value 1',
+                        'input_two' => 'value 2'
+                    }
+                )
+                l.immutables << 'input_one'
+                l.mutations( @seed ).reject { |e| e.altered != 'input_one' }
+                    .should be_empty
+
+                l.immutables.clear
+                l.mutations( @seed ).reject { |e| e.altered != 'input_one' }
+                    .should be_any
+            end
+        end
+
+        context 'with option' do
+            describe :respect_method do
+                describe true do
+                    it 'should not fuzz methods' do
+                        e = Arachni::Element::Form.new( 'http://test.com',
+                            inputs: {
+                                        'input_one' => 'value 1',
+                                        'input_two' => 'value 2'
+                                    }
+                        )
+
+                        respect_method = e.mutations( @seed, respect_method: true )
+                        respect_method.size.should == 9
+
+                        respect_method.map{ |m| m.method }.uniq.should == [e.method]
+                    end
+                end
+                describe false do
+                    it 'should methods' do
+                        e = Arachni::Element::Form.new( 'http://test.com',
+                            inputs: {
+                                        'input_one' => 'value 1',
+                                        'input_two' => 'value 2'
+                                    }
+                        )
+
+                        no_respect_method = e.mutations( @seed, respect_method: false )
+                        no_respect_method.size.should == 17
+
+                        no_respect_method.map{ |m| m.method }.uniq.size.should == 2
+                    end
+                    it 'should generate mutations with boh POST and GET methods' do
+                        inputs = { inputs: { 'param_name' => 'param_value' } }
+                        e = Arachni::Element::Form.new( 'http://test.com', inputs )
+                        m = e.mutations( 'stuff', respect_method: false )
+                        m.size.should == 9
+
+                        m.select { |f| f.method.to_s.downcase == 'post' }.size.should == 4
+                        m.select { |f| f.method.to_s.downcase == 'get' }.size.should ==
+                            m.select { |f| f.method.to_s.downcase == 'post' }.size + 1
+                    end
+                end
+                describe 'nil' do
+                    it 'should not fuzz methods' do
+                        e = Arachni::Element::Form.new( 'http://test.com',
+                            inputs: {
+                                        'input_one' => 'value 1',
+                                        'input_two' => 'value 2'
+                                    }
+                        )
+
+                        respect_method = e.mutations( @seed )
+                        respect_method.size.should == 9
+
+                        respect_method.map{ |m| m.method }.uniq.should == [e.method]
+                    end
+                end
+            end
+            describe 'Options.fuzz_methods' do
+                it 'should serve as the default value of :respect_method' do
+                    e = Arachni::Element::Form.new( 'http://test.com',
+                        inputs: {
+                                    'input_one' => 'value 1',
+                                    'input_two' => 'value 2'
+                                }
+                    )
+
+                    Arachni::Options.fuzz_methods = true
+                    no_respect_method = e.mutations( @seed )
+                    no_respect_method.size.should == 17
+
+                    no_respect_method.map{ |m| m.method }.uniq.size.should == 2
+
+                    Arachni::Options.fuzz_methods = false
+                    respect_method = e.mutations( @seed )
+                    respect_method.size.should == 9
+
+                    respect_method.map{ |m| m.method }.uniq.should == [e.method]
+
+                end
+            end
+
+            describe :skip do
+                it 'should skip mutation of parameters with these names' do
+                    Arachni::Element::Form.new( 'http://test.com',
+                        inputs: {
+                            'input_one' => 'value 1',
+                            'input_two' => 'value 2'
+                        }
+                    ).mutations( @seed, skip: [ 'input_one' ] )
+                end
+            end
+            describe :param_flip do
+                it 'should use the seed as a param name' do
+                    m = @mutable.mutations( @seed,
+                        format: [Arachni::Element::Capabilities::Mutable::Format::STRAIGHT],
+                        param_flip: true ).last
+                    m.auditable[@seed].should be_true
+                end
+            end
+            describe :format do
+                describe 'Format::STRAIGHT' do
+                    it 'should inject the seed as is' do
+                        m = @mutable.mutations( @seed,
+                            format: [Arachni::Element::Capabilities::Mutable::Format::STRAIGHT] ).first
+                        m.auditable[m.altered].should == @seed
+                    end
+                end
+                describe 'Format::APPEND' do
+                    it 'should append the seed to the current value' do
+                        m = @mutable.mutations( @seed,
+                            format: [Arachni::Element::Capabilities::Mutable::Format::APPEND] ).first
+                        m.auditable[m.altered].should == @inputs[m.altered] + @seed
+                    end
+                end
+                describe 'Format::NULL' do
+                    it 'should terminate the string with a null character' do
+                        m = @mutable.mutations( @seed,
+                            format: [Arachni::Element::Capabilities::Mutable::Format::NULL] ).first
+                        m.auditable[m.altered].should == @seed + "\0"
+                    end
+                end
+                describe 'Format::SEMICOLON' do
+                    it 'should prepend the seed with a semicolon' do
+                        m = @mutable.mutations( @seed,
+                            format: [Arachni::Element::Capabilities::Mutable::Format::SEMICOLON] ).first
+                        m.auditable[m.altered].should == ';' + @seed
+                    end
+                end
+                describe 'Format::APPEND | Format::NULL' do
+                    it 'should append the seed and terminate the string with a null character' do
+                        format = [Arachni::Element::Capabilities::Mutable::Format::APPEND |
+                                     Arachni::Element::Capabilities::Mutable::Format::NULL]
+                        m = @mutable.mutations( @seed, format: format ).first
+                        m.auditable[m.altered].should == @inputs[m.altered] + @seed + "\0"
+                    end
+                end
+            end
+        end
+    end
+
+    describe '#altered' do
+        it 'should return the name of the mutated input' do
+            m = @mutable.mutations( @seed,
+                format: [Arachni::Element::Capabilities::Mutable::Format::STRAIGHT] ).first
+            m.auditable[m.altered].should_not == @inputs[m.altered]
+        end
+    end
+
+end