arachni 0.4.0.4 → 0.4.1

data/spec/arachni/rpc/server/plugin/manager_spec.rb

@@ -0,0 +1,86 @@
+require_relative '../../../../spec_helper'
+
+require Arachni::Options.instance.dir['lib'] + 'rpc/client/instance'
+require Arachni::Options.instance.dir['lib'] + 'rpc/server/instance'
+
+describe Arachni::RPC::Server::Plugin::Manager do
+    before( :all ) do
+        @opts = Arachni::Options.instance
+        port1 = random_port
+        port2 = random_port
+
+        @token = 'secret!'
+
+        fork_em {
+            @opts.rpc_port = port1
+            Arachni::RPC::Server::Instance.new( @opts, @token )
+        }
+        fork_em {
+            @opts.rpc_port = port2
+            Arachni::RPC::Server::Instance.new( @opts, @token )
+        }
+        sleep 1
+
+        @plugins = Arachni::RPC::Client::Instance.new( @opts,
+            "#{@opts.rpc_address}:#{port1}", @token
+        ).plugins
+
+        @plugins_clean = Arachni::RPC::Client::Instance.new( @opts,
+            "#{@opts.rpc_address}:#{port2}", @token
+        ).plugins
+    end
+
+    describe '#available' do
+        it 'should return an array of available plugins' do
+            @plugins.available.should be_any
+        end
+    end
+
+    describe '#loaded' do
+        context 'when there are loaded plugins' do
+            it 'should return an empty array' do
+                @plugins.loaded.should be_empty
+            end
+        end
+        context 'when there are loaded plugins' do
+            it 'should return an array of loaded plugins' do
+                @plugins.load( { 'default' => {}} )
+                @plugins.loaded.should be_any
+            end
+        end
+    end
+
+    describe '#load' do
+        it 'should load plugins by name' do
+            @plugins_clean.load( { 'default' => {}} )
+            @plugins_clean.loaded.should == ['default']
+        end
+
+        context 'with invalid options' do
+            it 'should throw an exception' do
+                raised = false
+                begin
+                    @plugins_clean.load( { 'with_options' => {}} )
+                rescue Exception
+                    raised = true
+                end
+                raised.should be_true
+            end
+        end
+    end
+
+    describe '#merge_results' do
+        it 'should merge the results of the distributable plugins' do
+            framework = Arachni::RPC::Server::Framework.new( Arachni::Options.instance )
+            plugins = framework.plugins
+            plugins.load( { 'distributable' => {}} )
+            plugins.loaded.should == ['distributable']
+
+            results = [ 'distributable' => { results: { stuff: 2 } } ]
+            plugins.register_results( Arachni::Plugins::Distributable.new( framework, {} ), stuff: 1 )
+            plugins.merge_results( results )['distributable'][:results][:stuff].should == 3
+            plugins.clear
+        end
+    end
+
+end

data/spec/arachni/ruby/array_spec.rb

@@ -0,0 +1,103 @@
+require_relative '../../spec_helper'
+
+describe Array do
+    before( :all ) do
+        @arr = Array.new
+        50.times { |i| @arr << i }
+    end
+
+    describe '#includes_tag?' do
+        context 'when passed' do
+            context 'nil' do
+                it 'should return false' do
+                    @arr.includes_tags?( nil ).should == false
+                end
+            end
+
+            context '[]' do
+                it 'should return false' do
+                    @arr.includes_tags?( [] ).should == false
+                end
+            end
+
+            context String do
+                context 'when includes the given tag (as either a String or a Symbol)' do
+                    it 'should return true' do
+                        [ 1 ].includes_tags?( 1 ).should == true
+                        [ :tag ].includes_tags?( :tag ).should == true
+                        [ :tag ].includes_tags?( 'tag' ).should == true
+                        %w(tag).includes_tags?( 'tag' ).should == true
+                        %w(tag).includes_tags?( :tag ).should == true
+                        [ :tag, 'tag' ].includes_tags?( :tag ).should == true
+                        [ :tag, 'tag' ].includes_tags?( 'tag' ).should == true
+                    end
+                end
+                context 'when it does not includes the given tag (as either a String or a Symbol)' do
+                    it 'should return false' do
+                        [ 1 ].includes_tags?( 2 ).should == false
+                        [ :tag ].includes_tags?( :tag1 ).should == false
+                        [ :tag ].includes_tags?( 'tag2' ).should == false
+                        %w(tag).includes_tags?( 'tag3' ).should == false
+                        %w(tag).includes_tags?( :tag5 ).should == false
+                        [ :tag, 'tag' ].includes_tags?( :ta5g ).should == false
+                        [ :tag, 'tag' ].includes_tags?( 'ta4g' ).should == false
+                        [ :t3ag, 'tag1' ].includes_tags?( 'tag' ).should == false
+                    end
+                end
+            end
+
+            context Array do
+                context 'when includes any of the given tags (as either a String or a Symbol)' do
+                    it 'should return true' do
+                        [ 1, 2, 3 ].includes_tags?( [1] ).should == true
+                        [ :tag ].includes_tags?( [:tag] ).should == true
+                        [ :tag ].includes_tags?( ['tag', 12] ).should == true
+                        %w(tag).includes_tags?( ['tag', nil] ).should == true
+                        %w(tag).includes_tags?( [:tag] ).should == true
+                        [ :tag, 'tag' ].includes_tags?( [:tag] ).should == true
+                        [ :tag, 'tag' ].includes_tags?( ['tag', :blah] ).should == true
+                    end
+                end
+                context 'when it does not include any of the given tags (as either a String or a Symbol)' do
+                    it 'should return true' do
+                        [ 1, 2, 3 ].includes_tags?( [4, 5] ).should == false
+                        [ :tag ].includes_tags?( [:ta3g] ).should == false
+                        [ :tag ].includes_tags?( ['ta3g', 12] ).should == false
+                        %w(tag).includes_tags?( ['ta3g', nil] ).should == false
+                        %w(tag).includes_tags?( [:t4ag] ).should == false
+                        [ :tag, 'tag' ].includes_tags?( [:t3ag] ).should == false
+                        [ :tag, 'tag' ].includes_tags?( ['t2ag', :b3lah] ).should == false
+                    end
+                end
+            end
+        end
+    end
+
+    describe '#chunk' do
+        it 'should split the array into chunks' do
+            chunks = @arr.chunk( 5 )
+            chunks.size.should == 5
+            chunks.each { |c| c.size.should == 10 }
+
+            chunks = @arr.chunk( 3 )
+            chunks.size.should == 3
+
+            chunks[0].size.should == 17
+            chunks[1].size.should == 17
+            chunks[2].size.should == 16
+        end
+
+        context 'when called without params' do
+            it 'should split the array into 2 chunks' do
+                chunks = @arr.chunk
+                chunks.size.should == 2
+
+                24.times do |i|
+                    chunks.first[i].should == i
+                    chunks.last[i].should  == i + 25
+                end
+            end
+        end
+    end
+
+end

data/spec/arachni/ruby/enumerable_spec.rb

@@ -0,0 +1,37 @@
+require_relative '../../spec_helper'
+
+class MyArr < Array
+    attr_accessor :stuff
+end
+
+describe Enumerable do
+
+    before( :all ) do
+        @v = []
+        @v << 'string'
+        @v << 'str'
+        @v << 'str'
+        @v << :k
+        @v << 'my value'
+    end
+
+    describe '#realsize' do
+        it 'should return the sum of the real size of its elements' do
+            c = @v.dup
+            v = @v.dup
+
+            a = [ v.pop, [ v.pop, [ v.pop, { v.pop => v.pop } ] ] ]
+            a.realsize.should == c.reduce(0) { |s, i| s += i.size }
+        end
+
+        context 'when the instance has variables' do
+            it 'should add their size to the sum' do
+                ma = MyArr.new( @v )
+                ma.stuff = 'my stuff'
+
+                ma.realsize.should > @v.realsize
+            end
+        end
+    end
+
+end

data/spec/arachni/ruby/object_spec.rb

@@ -0,0 +1,38 @@
+require_relative '../../spec_helper'
+
+class Empty
+end
+
+class MyClass
+    attr_accessor :stuff
+end
+
+describe Object do
+
+    describe '#deep_clone' do
+        it 'should return a deep copy of the object' do
+            a = [ [1,2] ]
+            b = a.deep_clone
+            a[0] << 3
+
+            b.should == [ [1,2] ]
+        end
+    end
+
+    describe '#realsize' do
+        context 'when the class has instance variables' do
+            it 'should return an integer > 0' do
+                s = MyClass.new
+                s.stuff = 'my stuff'
+                s.realsize.should > 0
+            end
+        end
+        context 'when the class has instance variables' do
+            it 'should return nil' do
+                s = Empty.new
+                s.realsize.should == 0
+            end
+        end
+    end
+
+end

data/spec/arachni/ruby/string_spec.rb

@@ -0,0 +1,77 @@
+require_relative '../../spec_helper'
+
+describe String do
+
+    describe '#rdiff' do
+        it 'should return the common parts between self and another string' do
+            str = <<-END
+                This is the first test.
+                Not really sure what else to put here...
+            END
+
+            str2 = <<-END
+                This is the second test.
+                Not really sure what else to put here...
+                Boo-Yah!
+            END
+
+            str.rdiff( str2 ).should == "                This is the  test.\n" +
+                "                Not really sure what else to put here"
+        end
+    end
+
+    describe '#diff_ratio' do
+        context 'when the strings are identical' do
+            it 'should return 0.0' do
+                'test'.diff_ratio( 'test' ).should == 0
+                'test this'.diff_ratio( 'test this' ).should == 0
+            end
+        end
+        context 'when the strings completely different' do
+            it 'should return 1.0' do
+                'test'.diff_ratio( 'toast' ).should == 1
+                'test this'.diff_ratio( 'toast that' ).should == 1
+            end
+        end
+        context 'when the strings share less than half of their words' do
+            it 'should return < 0.5' do
+                'test this here now'.diff_ratio( 'test that here now' ).should > 0.0
+                'test this here now'.diff_ratio( 'test that here now' ).should < 0.5
+            end
+        end
+        context 'when the strings share more than half of their words' do
+            it 'should return > 0.5' do
+                'test this here now'.diff_ratio( 'test that here later' ).should > 0.0
+                'test this here now'.diff_ratio( 'test that here later' ).should > 0.5
+            end
+        end
+    end
+
+    describe '#words' do
+        context 'when strict is set to true' do
+            it 'should not include boundaries' do
+                'blah.bloo<ha hoo'.words( true ).sort.should == %w(blah bloo ha hoo).sort
+            end
+        end
+        context 'when strict is set to false' do
+            it 'should include boundaries' do
+                'blah.bloo<ha hoo'.words( false ).sort.should ==  [" ", ".", "<", "blah", "bloo", "ha", "hoo"] .sort
+            end
+        end
+        context 'when strict is not specified' do
+            it 'should default to false' do
+                'blah.bloo<ha hoo'.words.sort.should == 'blah.bloo<ha hoo'.words( false ).sort
+            end
+        end
+    end
+
+    describe '#substring?' do
+        it 'should return true if the substring exists in self' do
+            str = 'my string'
+            str.substring?( 'my' ).should be_true
+            str.substring?( 'myt' ).should be_false
+            str.substring?( 'my ' ).should be_true
+        end
+    end
+
+end

data/spec/arachni/ruby/webrick_spec.rb

@@ -0,0 +1,15 @@
+require_relative '../../spec_helper'
+
+describe WEBrick::Cookie do
+
+    describe '.parse_set_cookie' do
+        it 'should include the httponly attribute' do
+            str = "cookie2=val2; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; Domain=.foo.com; HttpOnly"
+            WEBrick::Cookie.parse_set_cookie( str ).httponly.should be_true
+
+            str = "cookie2=val2; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; Domain=.foo.com"
+            WEBrick::Cookie.parse_set_cookie( str ).httponly.should be_false
+        end
+    end
+
+end

data/spec/arachni/session_spec.rb

@@ -0,0 +1,308 @@
+require_relative '../spec_helper'
+
+describe Arachni::Session do
+
+    before( :all ) do
+        @url = server_url_for( :session )
+        @opts = Arachni::Options.instance
+    end
+
+    after( :each ) do
+        Arachni::Options.reset
+        Arachni::HTTP.reset
+    end
+
+    def new_session
+        Arachni::Session.new
+    end
+
+    describe '#opts' do
+        describe '#login_check_url and #login_check_pattern' do
+            it 'should be used to set a login check' do
+                s = new_session
+                s.opts.url = @url
+
+                s.has_login_sequence?.should be_false
+                s.login_sequence = proc do
+                    res = s.http.get( @url, async: false, follow_location: true ).response
+                    return false if !res
+
+                    login_form = s.forms_from_response( res ).first
+                    next false if !login_form
+
+                    login_form['username'] = 'john'
+                    login_form['password'] = 'doe'
+                    res = login_form.submit( async: false, update_cookies: true, follow_location: false ).response
+                    return false if !res
+
+                    true
+                end
+                s.has_login_sequence?.should be_true
+
+                s.has_login_check?.should be_false
+                s.opts.login_check_url     = @url
+                s.opts.login_check_pattern = 'logged-in user'
+                s.has_login_check?.should be_true
+
+                s.logged_in?.should be_false
+                s.login.should be_true
+                s.logged_in?.should be_true
+
+                bool = false
+                s.logged_in? { |b| bool = b }
+                s.http.run
+                bool.should be_true
+
+                not_bool = true
+                s.logged_in?( no_cookiejar: true ) { |b| not_bool = b }
+                s.http.run
+                not_bool.should be_false
+            end
+        end
+    end
+
+    describe '#cookies' do
+        it 'should return session cookies' do
+            s = new_session
+            s.http.get @url + '/cookies', async: false, update_cookies: true
+
+            s.cookies.select { |c| c.name == 'rack.session' }.size == 1
+            s.cookies.select { |c| c.name == 'session_cookie' }.size == 1
+
+            s.can_login?.should be_false
+            s.has_login_sequence?.should be_false
+
+            s.login_form = s.find_login_form( url: @url + '/nonce_login' ).
+                update( username: 'nonce_john', password: 'nonce_doe' )
+
+            # lets invalidate the form nonce now
+            # (to make sure that it will be refreshed before logging in)
+            s.http.get @url + '/nonce_login', async: false
+
+            s.has_login_sequence?.should be_true
+
+            s.set_login_check @url + '/with_nonce', 'logged-in user'
+
+            cookie = nil
+            s.cookie { |c| cookie = c }
+            s.http.run
+
+            cookie.name.should == 'rack.session'
+
+            s.can_login?.should be_true
+            s.logged_in?.should be_false
+        end
+        context 'when called without having configured a login check' do
+            it 'should raise an exception' do
+                raised = false
+                begin
+                    new_session.cookie
+                rescue
+                    raised = true
+                end
+                raised.should be_true
+            end
+        end
+    end
+
+    describe '#find_login_form' do
+        before { @id = "#{@url}/login::post::[\"password\", \"token\", \"username\"]" }
+        context 'when passed an array of :pages' do
+            it 'should go through its forms and locate the login one' do
+                p = Arachni::Page.from_url( @url + '/login' )
+                s = new_session
+
+                s.find_login_form( pages: [ p, p ] ).id.should == @id
+            end
+        end
+        context 'when passed an array of :forms' do
+            it 'should go through its forms and locate the login one' do
+                p = Arachni::Page.from_url( @url + '/login' )
+                s = new_session
+
+                s.find_login_form( forms: p.forms ).id.should == @id
+            end
+        end
+        context 'when passed a url' do
+            context 'and called without a block' do
+                it 'should operate in blocking mode, go through its forms and locate the login one' do
+                    s = new_session
+                    s.find_login_form( url: @url + '/login' ).id.should == @id
+                end
+            end
+            context 'and called with a block' do
+                it 'should operate in async mode, go through its forms, locate the login one and pass it to the block' do
+                    s = new_session
+
+                    form = nil
+                    s.find_login_form( url: @url + '/login' ) { |f| form = f }
+                    s.http.run
+
+                    form.id.should == @id
+                end
+            end
+        end
+        context 'when passed an array of :inputs' do
+            it 'should use them to narrow down the list' do
+                new_session.find_login_form( url: @url + '/multiple',
+                                             inputs: :token ).id.should == @id
+            end
+        end
+        context 'when passed an :action' do
+            context Regexp do
+                it 'should use it to match against form actions' do
+                    new_session.find_login_form( url: @url + '/multiple',
+                                                 action: /login/ ).id.should == @id
+                end
+            end
+            context String do
+                it 'should use it to match against form actions' do
+                    new_session.find_login_form( url: @url + '/multiple',
+                                                 action: "#{@url}/login" ).
+                        id.should == @id
+                end
+            end
+        end
+
+    end
+
+    describe '#login_form=' do
+        it 'should set a login form' do
+            s = new_session
+
+            s.can_login?.should be_false
+            s.has_login_sequence?.should be_false
+
+            s.login_form = s.find_login_form( url: @url + '/nonce_login' ).
+                update( username: 'nonce_john', password: 'nonce_doe' )
+
+            # lets invalidate the form nonce now
+            # (to make sure that it will be refreshed before logging in)
+            s.http.get @url + '/nonce_login', async: false
+
+            s.has_login_sequence?.should be_true
+
+            s.set_login_check @url + '/with_nonce', 'logged-in user'
+
+            s.can_login?.should be_true
+            s.logged_in?.should be_false
+
+            s.login
+            s.logged_in?.should be_true
+        end
+    end
+
+    describe '#can_login?' do
+        context 'when there are no login sequences' do
+            it 'should return false' do
+                new_session.can_login?.should be_false
+            end
+        end
+        context 'when there are login sequences' do
+            it 'should return true' do
+                s = new_session
+                s.login_sequence = proc {}
+                s.login_check = proc {}
+                s.can_login?.should be_true
+            end
+        end
+    end
+
+    describe '#login' do
+        context 'when there is no login capability' do
+            it 'should return nil' do
+                s = new_session
+                s.can_login?.should be_false
+                s.has_login_sequence?.should be_false
+                s.login.should be_nil
+            end
+        end
+    end
+
+    describe '#logged_in?' do
+        context 'when there is no login check' do
+            it 'should return nil' do
+                s = new_session
+                s.can_login?.should be_false
+                s.has_login_check?.should be_false
+                s.logged_in?.should be_nil
+            end
+        end
+    end
+
+    describe '#ensure_logged_in' do
+        context 'when there is no login capability' do
+            it 'should return nil' do
+                s = new_session
+                s.can_login?.should be_false
+                s.ensure_logged_in.should be_nil
+            end
+        end
+    end
+
+    describe '#login_sequence' do
+        context 'when a block is given' do
+            it 'should set it as a login sequence' do
+                s = new_session
+                s.login_sequence { :yeah! }
+                s.login_sequence.call.should == :yeah!
+                s.login.should == :yeah!
+            end
+        end
+    end
+
+    describe '#login_check' do
+        context 'when a block is given' do
+            it 'should set it as a login sequence' do
+                s = new_session
+                s.login_check { :yeah! }
+                s.login_check.call.should == :yeah!
+                s.logged_in?.should == :yeah!
+            end
+        end
+    end
+
+    describe '#set_login_check' do
+        it 'should set a login check using a URL and regular expression' do
+            s = new_session
+            url = server_url_for( :session ) + '/'
+            s.opts.url = "#{url}/congrats"
+
+            s.has_login_sequence?.should be_false
+            s.login_sequence = proc do
+                res = s.http.get( url, async: false, follow_location: true ).response
+                return false if !res
+
+                login_form = s.forms_from_response( res ).first
+                next false if !login_form
+
+                login_form['username'] = 'john'
+                login_form['password'] = 'doe'
+                res = login_form.submit( async: false, update_cookies: true, follow_location: false ).response
+                return false if !res
+
+                true
+            end
+            s.has_login_sequence?.should be_true
+
+            s.has_login_check?.should be_false
+            s.set_login_check( url, 'logged-in user' )
+            s.has_login_check?.should be_true
+
+            s.logged_in?.should be_false
+            s.login.should be_true
+            s.logged_in?.should be_true
+
+            bool = false
+            s.logged_in? { |b| bool = b }
+            s.http.run
+            bool.should be_true
+
+            not_bool = true
+            s.logged_in?( no_cookiejar: true ) { |b| not_bool = b }
+            s.http.run
+            not_bool.should be_false
+        end
+    end
+
+end