arachni 0.4.0.4 → 0.4.1

data/spec/arachni/element/header_spec.rb

@@ -0,0 +1,49 @@
+require_relative '../../spec_helper'
+
+describe Arachni::Element::Header do
+    it_should_behave_like 'auditable', url: server_url_for( :header ),
+                          single_input: true
+
+    before( :all ) do
+        @url = server_url_for( :header )
+
+        @inputs = { 'My-header' => 'header_value' }
+        @header = Arachni::Element::Header.new( @url, @inputs )
+    end
+
+    it 'should be assigned to Arachni::Header for easy access' do
+        Arachni::Header.should == Arachni::Element::Header
+    end
+
+    describe 'Arachni::Element::HEADER' do
+        it 'should return "header"' do
+            Arachni::Element::HEADER.should == 'header'
+        end
+    end
+
+    it 'should retain its assigned inputs' do
+        @header.auditable.should == @inputs
+    end
+
+    describe '#simple' do
+        it 'should return the inputs as is' do
+            @header.simple.should == @inputs
+        end
+    end
+
+    describe '#mutations' do
+        describe :param_flip do
+            it 'should create a new header' do
+                @header.mutations( 'seed', param_flip: true ).last.auditable.keys.should ==
+                    %w(seed)
+            end
+        end
+    end
+
+    describe '#type' do
+        it 'should be "header"' do
+            @header.type.should == 'header'
+        end
+    end
+
+end

data/spec/arachni/element/link_spec.rb

@@ -0,0 +1,220 @@
+require_relative '../../spec_helper'
+
+describe Arachni::Element::Link do
+    it_should_behave_like 'refreshable'
+    it_should_behave_like 'auditable', url: server_url_for( :link )
+
+    before( :all ) do
+        @url = server_url_for( :link )
+        Arachni::Options.instance.url = @url
+        @url = Arachni::Options.instance.url
+
+        @inputs = { inputs: { 'param_name' => 'param_value' } }
+        @link = Arachni::Element::Link.new( @url, @inputs )
+    end
+
+    it 'should be assigned to Arachni::Link for easy access' do
+        Arachni::Link.should == Arachni::Element::Link
+    end
+
+    describe 'Arachni::Element::LINK' do
+        it 'should return "link"' do
+            Arachni::Element::LINK.should == 'link'
+        end
+    end
+
+    describe '#new' do
+        context 'when only a url is provided' do
+            it 'should be used for both the owner #url and #action and be parsed in order to extract #auditable inputs' do
+                url = 'http://test.com/?one=2&three=4'
+                e = Arachni::Element::Link.new( url )
+                e.url.should == url
+                e.action.should == url
+                e.auditable.should == { 'one' => '2', 'three' => '4' }
+                e.raw.should == {}
+            end
+        end
+        context 'when the raw option is a string' do
+            it 'should be treated as an #action URL and parsed in order to extract #auditable inputs' do
+                url    = 'http://test.com/test'
+                action = '?one=2&three=4'
+                e = Arachni::Element::Link.new( url, action )
+                e.url.should == url
+                e.action.should == url + action
+                e.auditable.should == { 'one' => '2', 'three' => '4' }
+                e.raw.should == { action: e.action, inputs: e.auditable }
+            end
+        end
+        context "when the raw hash option contains a url in 'href', :href, 'action' or :action" do
+            it 'should be treated as an #action URL and parsed in order to extract #auditable inputs' do
+                ['href', :href, 'action', :action].each do |k|
+                    action = '?one=2&three=4'
+                    raw    = { k => action }
+                    url    = 'http://test.com/test'
+
+                    e = Arachni::Element::Link.new( url, raw )
+                    e.url.should == url
+                    e.action.should == url + action
+                    e.auditable.should == { 'one' => '2', 'three' => '4' }
+                    e.raw.should == raw
+                end
+            end
+        end
+        context "when the raw hash option contains a auditable inputs in 'vars', :vars, 'inputs' or :inputs" do
+            it 'should be used as auditable inputs' do
+                ['vars', :vars, 'inputs', :inputs].each do |k|
+                    raw    = { k => { 'one' => '2', 'three' => '4' } }
+                    url    = 'http://test.com/test'
+
+                    e = Arachni::Element::Link.new( url, raw )
+                    e.url.should == url
+                    e.action.should == url
+                    e.auditable.should == { 'one' => '2', 'three' => '4' }
+                    e.raw.should == raw
+                end
+            end
+        end
+        context "when the raw hash option contains a auditable inputs in :action and :inputs" do
+            it 'should be treated as an #action URL and #auditable inputs respectively' do
+                url    = 'http://test.com/test/'
+                action = 'some/path'
+                raw = {
+                    :action => action,
+                    :inputs => { 'one' => '2', 'three' => '4' }
+                }
+
+                e = Arachni::Element::Link.new( url, raw )
+                e.url.should == url
+                e.action.should == url + action
+                e.auditable.should == { 'one' => '2', 'three' => '4' }
+                e.raw.should == raw
+            end
+        end
+        context "when the raw hash option contains a auditable inputs in :action and :inputs" do
+            it 'should be treated as an #action URL and #auditable inputs respectively' do
+                url = 'http://test.com/test/'
+                raw = { 'one' => '2', 'three' => '4' }
+
+                e = Arachni::Element::Link.new( url, raw )
+                e.url.should == url
+                e.action.should == url
+                e.auditable.should == { 'one' => '2', 'three' => '4' }
+                e.raw.should == raw
+            end
+        end
+    end
+
+    describe '#id' do
+        context 'when the action it contains path parameters' do
+            it 'should ignore them' do
+                e = Arachni::Element::Link.new( 'http://test.com/path;p=v?p1=v1&p2=v2', @inputs[:inputs] )
+                c = Arachni::Element::Link.new( 'http://test.com/path?p1=v1&p2=v2', @inputs[:inputs] )
+                e.id.should == c.id
+            end
+        end
+    end
+
+    describe '#simple' do
+        it 'should return a simplified version as a hash' do
+            @link.simple.should == { @link.action => @link.auditable }
+        end
+    end
+
+    describe '#to_s' do
+        it 'should return a URL' do
+            url = Arachni::Element::Link.new(
+                'http://test.com/test?one=two&three=four',
+                { 'one' => 2, '5' => 'six' }
+            ).to_s
+            url.should == 'http://test.com/test?one=2&three=four&5=six'
+        end
+    end
+
+    describe '#type' do
+        it 'should be "link"' do
+            @link.type.should == 'link'
+        end
+    end
+
+    describe '.from_document' do
+        context 'when the response does not contain any links' do
+            it 'should return an empty array' do
+                Arachni::Element::Link.from_document( '', '' ).should be_empty
+            end
+        end
+        context 'when the response contains links' do
+            it 'should return an array of links' do
+                html = '
+                <html>
+                    <body>
+                        <a href="' + @url + '/test2?param_one=value_one&param_two=value_two"></a>
+                    </body>
+                </html>'
+
+                link = Arachni::Element::Link.from_document( @url, html ).first
+                link.action.should == @url + 'test2?param_one=value_one&param_two=value_two'
+                link.url.should == @url
+                link.auditable.should == {
+                    'param_one'  => 'value_one',
+                    'param_two'  => 'value_two'
+                }
+            end
+            context 'and includes a base attribute' do
+                it 'should return an array of links with adjusted URIs' do
+                    base_url = "#{@url}this_is_the_base/"
+                    html = '
+                    <html>
+                        <head>
+                            <base href="' + base_url + '" />
+                        </head>
+                        <body>
+                            <a href="test?param_one=value_one&param_two=value_two"></a>
+                        </body>
+                    </html>'
+
+                    link = Arachni::Element::Link.from_document( @url, html ).first
+                    link.action.should == base_url + 'test?param_one=value_one&param_two=value_two'
+                    link.url.should == @url
+                    link.auditable.should == {
+                        'param_one'  => 'value_one',
+                        'param_two'  => 'value_two'
+                    }
+                end
+            end
+            context 'when the action match a skip rule' do
+                it 'should be ignored' do
+                    Arachni::Options.url     = @url
+                    Arachni::Options.exclude = 'skip-this'
+
+                    base_url = "http://test.com/this_is_the_base/"
+                    html = <<-HTML
+                    <html>
+                        <head>
+                            <base href="#{base_url}" />
+                        </head>
+                        <body>
+                            <a href="test?param_one=value_one&param_two=value_two"></a>
+                            <a href="#{@url}/test?param_one=value_one&param_two=value_two"></a>
+                            <a href="#{@url}/test?param_one=value_one&param_two=skip-this"></a>
+                        </body>
+                    </html>
+                    HTML
+
+                    Arachni::Element::Link.from_document( @url, html ).size.should == 1
+                    Arachni::Options.reset
+                end
+            end
+        end
+    end
+
+    describe '.from_response' do
+        it 'should return all available links from an HTTP response' do
+            res = Typhoeus::Response.new(
+                effective_url: @url + '/?param=val',
+                body: '<a href="test?param_one=value_one&param_two=value_two"></a>'
+            )
+            Arachni::Element::Link.from_response( res ).size.should == 2
+        end
+    end
+
+end

data/spec/arachni/element/path_spec.rb

@@ -0,0 +1,9 @@
+require_relative '../../spec_helper'
+
+describe Arachni::Element::PATH do
+    describe 'Arachni::Element::PATH' do
+        it 'should return "path"' do
+            Arachni::Element::PATH.should == 'path'
+        end
+    end
+end

data/spec/arachni/element/server_spec.rb

@@ -0,0 +1,9 @@
+require_relative '../../spec_helper'
+
+describe Arachni::Element::SERVER do
+    describe 'Arachni::Element::SERVER' do
+        it 'should return "server"' do
+            Arachni::Element::SERVER.should == 'server'
+        end
+    end
+end

data/spec/arachni/framework_spec.rb

@@ -0,0 +1,860 @@
+require_relative '../spec_helper'
+
+describe Arachni::Framework do
+
+    before( :all ) do
+        @url = server_url_for( :auditor )
+        @opts = Arachni::Options.instance
+    end
+
+    before( :each ) do
+        reset_options
+        @opts.dir['reports'] = spec_path + '/fixtures/reports/manager_spec/'
+        @opts.dir['modules'] = spec_path + '/fixtures/taint_module/'
+
+        @f = Arachni::Framework.new
+        @f.reset
+    end
+    after( :each ) { @f.reset }
+
+    describe '#opts' do
+        it 'should provide access to the framework options' do
+            @f.opts.is_a?( Arachni::Options ).should be_true
+        end
+
+        describe '#exclude_binaries' do
+            it 'should exclude binary pages from the audit' do
+                f = Arachni::Framework.new
+
+                f.opts.url = @url + '/binary'
+                f.opts.audit :links, :forms, :cookies
+                f.modules.load :taint
+
+                ok = false
+                f.on_run_mods { ok = true }
+                f.run
+                ok.should be_true
+                f.reset
+
+                f.opts.url = @url + '/binary'
+                f.opts.exclude_binaries = true
+                f.modules.load :taint
+
+                ok = true
+                f.on_run_mods { ok = false }
+
+                f.run
+                f.reset
+                ok.should be_true
+            end
+        end
+        describe '#restrict_paths' do
+            it 'should serve as a replacement to crawling' do
+                f = Arachni::Framework.new
+                f.opts.url = @url
+                f.opts.restrict_paths = %w(/elem_combo /log_remote_file_if_exists/true)
+                f.opts.audit_links = true
+                f.opts.audit_forms = true
+                f.opts.audit_cookies = true
+                f.modules.load( 'taint' )
+
+                f.run
+
+                sitemap = f.auditstore.sitemap.sort.map { |u| u.split( '?' ).first }
+                sitemap.uniq.should == f.opts.restrict_paths.sort
+                f.modules.clear
+            end
+        end
+    end
+
+    describe '#reports' do
+        it 'should provide access to the report manager' do
+            @f.reports.is_a?( Arachni::Report::Manager ).should be_true
+            @f.reports.available.sort.should == %w(afr foo).sort
+        end
+    end
+
+    describe '#modules' do
+        it 'should provide access to the module manager' do
+            @f.modules.is_a?( Arachni::Module::Manager ).should be_true
+            @f.modules.available.should == %w(taint)
+        end
+    end
+
+    describe '#plugins' do
+        it 'should provide access to the plugin manager' do
+            @f.plugins.is_a?( Arachni::Plugin::Manager ).should be_true
+            @f.plugins.available.sort.should == %w(wait bad with_options distributable loop default).sort
+        end
+    end
+
+    describe '#http' do
+        it 'should provide access to the HTTP interface' do
+            @f.http.is_a?( Arachni::HTTP ).should be_true
+        end
+    end
+
+    describe '#spider' do
+        it 'should provide access to the Spider' do
+            @f.spider.is_a?( Arachni::Spider ).should be_true
+        end
+    end
+
+    describe '#run' do
+
+        context 'when the page has a body which is' do
+            context 'not empty' do
+                it 'should run modules that audit the page body' do
+                    @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                    f = Arachni::Framework.new
+
+                    f.opts.audit_links = true
+                    f.modules.load %w(body)
+
+                    link = Arachni::Element::Link.new( 'http://test' )
+                    p = Arachni::Page.new( url: 'http://test', body: 'stuff' )
+                    f.push_to_page_queue( p )
+
+                    f.run
+                    f.auditstore.issues.size.should == 1
+                    f.modules.clear
+                end
+            end
+            context 'empty' do
+                it 'should not run modules that audit the page body' do
+                    @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                    f = Arachni::Framework.new
+
+                    f.opts.audit_links = true
+                    f.modules.load %w(body)
+
+                    link = Arachni::Element::Link.new( 'http://test' )
+                    p = Arachni::Page.new( url: 'http://test', body: '' )
+                    f.push_to_page_queue( p )
+
+                    f.run
+                    f.auditstore.issues.size.should == 0
+                    f.modules.clear
+                end
+            end
+        end
+
+        context 'when audit_links is' do
+            context true do
+                context 'and the page contains links' do
+                    it 'should run modules that audit links' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_links = true
+                        f.modules.load %w(links forms cookies headers flch)
+
+                        link = Arachni::Element::Link.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', links: [link] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 2
+                        f.modules.clear
+                    end
+
+                    it 'should run modules that audit path and server' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_links = true
+                        f.modules.load %w(path server)
+
+                        link = Arachni::Element::Link.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', links: [link] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 2
+                        f.modules.clear
+                    end
+
+                    it 'should run modules that have not specified any elements' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_links = true
+                        f.modules.load %w(nil empty)
+
+                        link = Arachni::Element::Link.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', links: [link] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 1
+                        f.modules.clear
+                    end
+                end
+            end
+
+            context false do
+                context 'and the page contains links' do
+                    it 'should not run modules that audit links' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_links = false
+                        f.modules.load %w(links forms cookies headers flch)
+
+                        link = Arachni::Element::Link.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', links: [link] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 0
+                        f.modules.clear
+                    end
+
+                    it 'should run modules that audit path and server' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_links = true
+                        f.modules.load %w(path server)
+
+                        link = Arachni::Element::Link.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', links: [link] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 2
+                        f.modules.clear
+                    end
+
+                    it 'should run modules that have not specified any elements' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_links = true
+                        f.modules.load %w(nil empty)
+
+                        link = Arachni::Element::Link.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', links: [link] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 1
+                        f.modules.clear
+                    end
+                end
+            end
+
+        end
+
+        context 'when audit_forms is' do
+            context true do
+                context 'and the page contains forms' do
+                    it 'should run modules that audit forms' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_forms = true
+                        f.modules.load %w(links forms cookies headers flch)
+
+                        form = Arachni::Element::Form.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', forms: [form] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 2
+                        f.modules.clear
+                    end
+
+                    it 'should run modules that audit path and server' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_forms = true
+                        f.modules.load %w(path server)
+
+                        form = Arachni::Element::Form.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', forms: [form] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 2
+                        f.modules.clear
+                    end
+
+                    it 'should run modules that have not specified any elements' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_forms = true
+                        f.modules.load %w(nil empty)
+
+                        form = Arachni::Element::Form.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', forms: [form] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 1
+                        f.modules.clear
+                    end
+                end
+            end
+
+            context false do
+                context 'and the page contains forms' do
+                    it 'should not run modules that audit forms' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_forms = false
+                        f.modules.load %w(links forms cookies headers flch)
+
+                        form = Arachni::Element::Form.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', forms: [form] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 0
+                        f.modules.clear
+                    end
+
+                    it 'should run modules that audit path and server' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_forms = false
+                        f.modules.load %w(path server)
+
+                        form = Arachni::Element::Form.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', forms: [form] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 2
+                        f.modules.clear
+                    end
+
+                    it 'should run modules that have not specified any elements' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_forms = false
+                        f.modules.load %w(nil empty)
+
+                        form = Arachni::Element::Form.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', forms: [form] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 1
+                        f.modules.clear
+                    end
+                end
+            end
+
+        end
+
+        context 'when audit_cookies is' do
+            context true do
+                context 'and the page contains cookies' do
+                    it 'should run modules that audit cookies' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_cookies = true
+                        f.modules.load %w(links forms cookies headers flch)
+
+                        cookie = Arachni::Element::Cookie.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', cookies: [cookie] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 2
+                        f.modules.clear
+                    end
+
+                    it 'should run modules that audit path and server' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_cookies = true
+                        f.modules.load %w(path server)
+
+                        cookie = Arachni::Element::Form.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', cookies: [cookie] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 2
+                        f.modules.clear
+                    end
+
+                    it 'should run modules that have not specified any elements' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_cookies = true
+                        f.modules.load %w(nil empty)
+
+                        cookie = Arachni::Element::Form.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', cookies: [cookie] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 1
+                        f.modules.clear
+                    end
+                end
+            end
+
+            context false do
+                context 'and the page contains cookies' do
+                    it 'should not run modules that audit cookies' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_cookies = false
+                        f.modules.load %w(links forms cookies headers flch)
+
+                        cookie = Arachni::Element::Form.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', cookies: [cookie] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 0
+                        f.modules.clear
+                    end
+
+                    it 'should run modules that audit path and server' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_cookies = false
+                        f.modules.load %w(path server)
+
+                        cookie = Arachni::Element::Form.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', cookies: [cookie] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 2
+                        f.modules.clear
+                    end
+
+                    it 'should run modules that have not specified any elements' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_cookies = false
+                        f.modules.load %w(nil empty)
+
+                        cookie = Arachni::Element::Form.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', cookies: [cookie] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 1
+                        f.modules.clear
+                    end
+                end
+            end
+
+        end
+
+        context 'when audit_headers is' do
+            context true do
+                context 'and the page contains headers' do
+                    it 'should run modules that audit headers' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_headers = true
+                        f.modules.load %w(links forms cookies headers flch)
+
+                        header = Arachni::Element::Cookie.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', headers: [header] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 2
+                        f.modules.clear
+                    end
+
+                    it 'should run modules that audit path and server' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_headers = true
+                        f.modules.load %w(path server)
+
+                        header = Arachni::Element::Form.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', headers: [header] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 2
+                        f.modules.clear
+                    end
+
+                    it 'should run modules that have not specified any elements' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_headers = true
+                        f.modules.load %w(nil empty)
+
+                        header = Arachni::Element::Form.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', headers: [header] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 1
+                        f.modules.clear
+                    end
+                end
+            end
+
+            context false do
+                context 'and the page contains headers' do
+                    it 'should not run modules that audit headers' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_headers = false
+                        f.modules.load %w(links forms cookies headers flch)
+
+                        header = Arachni::Element::Form.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', headers: [header] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 0
+                        f.modules.clear
+                    end
+
+                    it 'should run modules that audit path and server' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_headers = false
+                        f.modules.load %w(path server)
+
+                        header = Arachni::Element::Form.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', headers: [header] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 2
+                        f.modules.clear
+                    end
+
+                    it 'should run modules that have not specified any elements' do
+                        @opts.dir['modules']  = spec_path + '/fixtures/run_mod/'
+                        f = Arachni::Framework.new
+
+                        f.opts.audit_headers = false
+                        f.modules.load %w(nil empty)
+
+                        header = Arachni::Element::Form.new( 'http://test' )
+                        p = Arachni::Page.new( url: 'http://test', headers: [header] )
+                        f.push_to_page_queue( p )
+
+                        f.run
+                        f.auditstore.issues.size.should == 1
+                        f.modules.clear
+                    end
+                end
+            end
+
+        end
+
+        context 'when it has log-in capabilities and gets logged out' do
+            it 'should log-in again before continuing with the audit' do
+                f = Arachni::Framework.new
+                url = server_url_for( :framework ) + '/'
+                f.opts.url = "#{url}/congrats"
+
+                f.opts.audit :links, :forms
+                f.modules.load_all
+
+                f.session.login_sequence = proc do
+                    res = f.http.get( url, async: false, follow_location: true ).response
+                    return false if !res
+
+                    login_form = f.forms_from_response( res ).first
+                    next false if !login_form
+
+                    login_form['username'] = 'john'
+                    login_form['password'] = 'doe'
+                    res = login_form.submit( async: false, update_cookies: true, follow_location: false ).response
+                    return false if !res
+
+                    true
+                end
+
+                f.session.login_check = proc do
+                    !!f.http.get( url, async: false, follow_location: true ).
+                        response.body.match( 'logged-in user' )
+                end
+
+                f.run
+                f.auditstore.issues.size.should == 1
+                f.reset
+            end
+        end
+
+        it 'should perform the audit' do
+            @f.opts.url = @url + '/elem_combo'
+            @f.opts.audit_links = true
+            @f.opts.audit_forms = true
+            @f.opts.audit_cookies = true
+            @f.modules.load( 'taint' )
+            @f.plugins.load( 'wait' )
+            @f.reports.load( 'foo' )
+
+            @f.status.should == 'ready'
+
+            @f.pause
+            @f.status.should == 'paused'
+
+            @f.resume
+            @f.status.should == 'ready'
+
+            called = false
+            t = Thread.new{
+                @f.run {
+                    called = true
+                    @f.status.should == 'cleanup'
+                }
+            }
+
+            raised = false
+            begin
+                Timeout.timeout( 10 ) {
+                    sleep( 0.01 ) while @f.status == 'preparing'
+                    sleep( 0.01 ) while @f.status == 'crawling'
+                    sleep( 0.01 ) while @f.status == 'auditing'
+                }
+            rescue TimeoutError
+                raised = true
+            end
+
+            raised.should be_false
+
+            t.join
+            called.should be_true
+
+            @f.status.should == 'done'
+            @f.auditstore.issues.size.should == 5
+
+            @f.auditstore.plugins['wait'][:results].should == { stuff: true }
+
+            File.exists?( 'afr' ).should be_true
+            File.exists?( 'foo' ).should be_true
+            File.delete( 'foo' )
+            File.delete( 'afr' )
+        end
+    end
+
+    describe '#push_to_page_queue' do
+        it 'should push a page to the page audit queue' do
+            res = @f.http.get( @url + '/train/true', async: false ).response
+            page = Arachni::Page.from_response( res, @f.opts )
+
+            @f.opts.audit_links = true
+            @f.opts.audit_forms = true
+            @f.opts.audit_cookies = true
+
+            @f.modules.load( 'taint' )
+
+            @f.page_queue_total_size.should == 0
+            @f.push_to_page_queue( page )
+            @f.run
+            @f.auditstore.issues.size.should == 3
+            @f.page_queue_total_size.should > 0
+            @f.modules.clear
+        end
+    end
+
+    describe '#push_to_url_queue' do
+        it 'should push a URL to the URL audit queue' do
+            @f.opts.audit_links = true
+            @f.opts.audit_forms = true
+            @f.opts.audit_cookies = true
+
+            @f.modules.load( 'taint' )
+
+            @f.url_queue_total_size.should == 0
+            @f.push_to_url_queue(  @url + '/link' )
+            @f.run
+            @f.auditstore.issues.size.should == 1
+            @f.url_queue_total_size.should > 0
+        end
+    end
+
+    describe '#stats' do
+        it 'should return a hash with stats' do
+            @f.stats.keys.sort.should == [ :requests, :responses, :time_out_count,
+                :time, :avg, :sitemap_size, :auditmap_size, :progress, :curr_res_time,
+                :curr_res_cnt, :curr_avg, :average_res_time, :max_concurrency, :current_page, :eta ].sort
+        end
+    end
+
+    describe '#lsmod' do
+        it 'should return info on all modules' do
+            @f.modules.load( 'taint' )
+            info = @f.modules.values.first.info
+            loaded = @f.modules.loaded
+            mods = @f.lsmod
+            @f.modules.loaded.should == loaded
+
+            mods.size.should == 1
+            mod = mods.first
+            mod[:name].should == info[:name]
+            mod[:mod_name].should == 'taint'
+            mod[:description].should == info[:description]
+            mod[:author].should == [info[:author]].flatten
+            mod[:version].should == info[:version]
+            mod[:references].should == info[:references]
+            mod[:targets].should == info[:targets]
+            mod[:issue].should == info[:issue]
+        end
+
+        context 'when the #lsmod option is set' do
+            it 'should use it to filter out modules that do not match it' do
+                @f.opts.lsmod = 'boo'
+                @f.lsmod.size == 0
+
+                @f.opts.lsmod = 'taint'
+                @f.lsmod.size == 1
+            end
+        end
+    end
+
+    describe '#lsplug' do
+        it 'should return info on all plugins' do
+            loaded = @f.plugins.loaded
+            @f.lsplug.map { |r| r.delete( :path ); r }
+                .sort_by { |e| e[:plug_name] }.should == YAML.load( '
+---
+- :name: Wait
+  :description: ""
+  :tags: ["wait_string", :wait_sym]
+  :author:
+  - Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  :version: "0.1"
+  :plug_name: wait
+- :name: ""
+  :description: ""
+  :author:
+  - Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  :version: "0.1"
+  :plug_name: bad
+- :name: Component
+  :description: Component with options
+  :author:
+  - Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  :version: "0.1"
+  :options:
+  - !ruby/object:Arachni::Component::Options::String
+    default:
+    desc: Required option
+    enums: []
+
+    name: req_opt
+    required: true
+  - !ruby/object:Arachni::Component::Options::String
+    default:
+    desc: Optional option
+    enums: []
+
+    name: opt_opt
+    required: false
+  - !ruby/object:Arachni::Component::Options::String
+    default: value
+    desc: Option with default value
+    enums: []
+
+    name: default_opt
+    required: false
+  :plug_name: with_options
+- :name: Distributable
+  :description: ""
+  :author:
+  - Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  :version: "0.1"
+  :plug_name: distributable
+  :issue: {:tags: ["distributable_string", :distributable_sym]}
+- :name: ""
+  :description: ""
+  :author:
+  - Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  :version: "0.1"
+  :plug_name: loop
+- :name: Default
+  :description: Some description
+  :author:
+  - Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+  :version: "0.1"
+  :options:
+  - !ruby/object:Arachni::Component::Options::Int
+    default: 4
+    desc: An integer.
+    enums: []
+
+    name: int_opt
+    required: false
+  :plug_name: default
+' ).sort_by { |e| e[:plug_name] }
+            @f.plugins.loaded.should == loaded
+        end
+
+        context 'when the #lsplug option is set' do
+            it 'should use it to filter out plugins that do not match it' do
+                @f.opts.lsplug = 'bad|foo'
+                @f.lsplug.size == 2
+
+                @f.opts.lsplug = 'boo'
+                @f.lsplug.size == 0
+            end
+        end
+    end
+
+    describe '#lsrep' do
+        it 'should return info on all reports' do
+            loaded = @f.reports.loaded
+            @f.lsrep.map { |r| r[:options] = []; r.delete( :path ); r }
+                .sort_by { |e| e[:rep_name] }.should == YAML.load( '
+---
+- :name: Report abstract class.
+  :options: []
+
+  :description: This class should be extended by all reports.
+  :author:
+  - zapotek
+  :version: 0.1.1
+  :rep_name: afr
+- :name: Report abstract class.
+  :options: []
+
+  :description: This class should be extended by all reports.
+  :author:
+  - zapotek
+  :version: 0.1.1
+  :rep_name: foo
+').sort_by { |e| e[:rep_name] }
+            @f.reports.loaded.should == loaded
+        end
+
+        context 'when the #lsrep option is set' do
+            it 'should use it to filter out reports that do not match it' do
+                @f.opts.lsrep = 'foo'
+                @f.lsrep.size == 1
+
+                @f.opts.lsrep = 'boo'
+                @f.lsrep.size == 0
+
+            end
+        end
+    end
+
+end