arachni 0.4.2 → 0.4.3

data/plugins/proxy.rb

@@ -25,122 +25,14 @@ require 'ostruct'
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 #
-# @version 0.2.1
+# @version 0.2.2
 #
 class Arachni::Plugins::Proxy < Arachni::Plugin::Base
 
     BASEDIR  = "#{File.dirname( __FILE__ )}/proxy/"
     BASE_URL = 'http://arachni.proxy/'
 
-    class TemplateScope
-        include Arachni::Utilities
-
-        PANEL_BASEDIR  = "#{Arachni::Plugins::Proxy::BASEDIR}panel/"
-        PANEL_TEMPLATE = "#{PANEL_BASEDIR}panel.html.erb"
-        PANEL_URL      = "#{Arachni::Plugins::Proxy::BASE_URL}panel/"
-
-        def initialize( params = {} )
-            update( params )
-        end
-
-        def self.new( *args )
-            @self ||= super( *args )
-        end
-
-        def self.get
-            new
-        end
-
-        def root_url
-            PANEL_URL
-        end
-
-        def js_url
-            "#{root_url}js/"
-        end
-
-        def css_url
-            "#{root_url}css/"
-        end
-
-        def img_url
-            "#{root_url}img/"
-        end
-
-        def inspect_url
-            "#{root_url}inspect"
-        end
-
-        def shutdown_url
-            url_for :shutdown
-        end
-
-        def url_for( *args )
-            Arachni::Plugins::Proxy.url_for( *args )
-        end
-
-        def update( params )
-            params.each { |name, value| set( name, value ) }
-            self
-        end
-
-        def set( name, value )
-            self.class.send( :attr_accessor, name )
-            instance_variable_set( "@#{name.to_s}", value )
-            self
-        end
-
-        def content_for?( ivar )
-            !!instance_variable_get( "@#{ivar.to_s}" )
-        end
-
-        def content_for( name, value = :nil )
-            if value == :nil
-                instance_variable_get( "@#{name.to_s}" )
-            else
-                set( name, html_encode( value.to_s ) )
-                nil
-            end
-        end
-
-        def erb( tpl, params = {} )
-            params = params.dup
-            params[:params] ||= {}
-
-            with_layout = true
-            with_layout = !!params.delete( :layout ) if params.include?( :layout )
-
-            update( params )
-
-            tpl = tpl.to_s + '.html.erb' if tpl.is_a?( Symbol )
-
-            path = File.exist?( tpl ) ? tpl : PANEL_BASEDIR + tpl
-
-            evaled = ERB.new( IO.read( path ) ).result( get_binding )
-            with_layout ? layout { evaled } : evaled
-        end
-
-        def render( tpl, opts )
-            erb tpl, opts.merge( layout: false )
-        end
-
-        def layout
-            ERB.new( IO.read( PANEL_BASEDIR + 'layout.html.erb' ) ).result( binding )
-        end
-
-        def panel
-            erb :panel
-        end
-
-        def get_binding
-            binding
-        end
-
-        def clear
-            instance_variables.each { |v| instance_variable_set( v, nil ) }
-        end
-    end
-
+    require_relative 'proxy/template_scope'
 
     MSG_SHUTDOWN = 'Shutting down the Arachni proxy plug-in...'
 
@@ -212,7 +104,31 @@ class Arachni::Plugins::Proxy < Arachni::Plugin::Base
         @pages.select { |p| (p.forms.any? || p.links.any? || p.cookies.any?) && p.text? }
     end
 
+    def vectors_yaml
+        vectors = []
+        prepare_pages_for_inspection.each do |page|
+            page.elements.each do |element|
+                next if element.auditable.empty?
+
+                vectors << {
+                    type:   element.type,
+                    method: element.method,
+                    action: element.action,
+                    inputs: element.auditable
+                }
+            end
+        end
+        vectors.to_yaml
+    end
+
     def request_handler( req, res )
+        url = req.request_uri.to_s
+
+        if !url.start_with?( url_for( :panel ) ) && skip_path?( url )
+            print_info "Ignoring, out of scope: #{url}"
+            return true
+        end
+
         # Clear the template scope to prepare it for this request.
         TemplateScope.get.clear
 
@@ -236,28 +152,10 @@ class Arachni::Plugins::Proxy < Arachni::Plugin::Base
 
         TemplateScope.get.set :sign_in_url, sign_in_url
 
-        url    = req.request_uri.to_s
         params = parse_request_body( req.body.to_s ).merge( parse_query( url ) ) || {}
 
         print_status "Requesting #{url}"
 
-        reasons = []
-        if !system_url?( url )
-            reasons << MSG_NOT_IN_DOMAIN if !path_in_domain?( url )
-            reasons << MSG_EXCLUDED      if exclude_path?( url )
-            reasons << MSG_NOT_INCLUDED  if !include_path?( url )
-        end
-
-        if reasons.any?
-            print_info MSG_DISALLOWED
-            reasons.each { |reason| print_info "  * #{reason}" }
-
-            # Forbidden.
-            res.status = 403
-            set_response_body( res, erb( '403_forbidden'.to_sym, { reasons: reasons } ) )
-            return false
-        end
-
         # This is a sign-in request.
         if params['session_token'] == options['session_token']
             # Set us up for the redirection that's coming.
@@ -307,6 +205,14 @@ class Arachni::Plugins::Proxy < Arachni::Plugin::Base
                         when '/'
                             erb :panel
 
+                        when '/vectors.yml'
+                            res.header['Content-Type'] = 'application/x-yaml'
+
+                            erb :vectors,
+                                layout:  false,
+                                format:  :yml,
+                                vectors: vectors_yaml
+
                         when '/inspect'
                             erb :inspect,
                                 pages: prepare_pages_for_inspection
@@ -356,6 +262,7 @@ class Arachni::Plugins::Proxy < Arachni::Plugin::Base
                             erb :verify_login_final, ok: logged_in
 
                         else
+                            res.header['Cache-Control'] = 'max-age=2592000'
                             begin
                                 IO.read TemplateScope::PANEL_BASEDIR + '/../' + res.request_uri.path
                             rescue Errno::ENOENT
@@ -442,7 +349,10 @@ class Arachni::Plugins::Proxy < Arachni::Plugin::Base
     # Called by the proxy for each response.
     #
     def response_handler( req, res )
-        return res if res.request_method.to_s.downcase == 'connect'
+        if res.request_method.to_s.downcase == 'connect' ||
+            skip_path?( res.request_uri.to_s )
+            return res
+        end
 
         headers = {}
         headers.merge!( res.header.dup )    if res.header
@@ -469,9 +379,9 @@ class Arachni::Plugins::Proxy < Arachni::Plugin::Base
     end
 
     def inject_panel( res )
-        return res if !res.header['content-type'].to_s.start_with?( 'text/html' )
+        return res if !res.header['content-type'].to_s.start_with?( 'text/html' ) ||
+                        !(body_tag = res.body.match( /<(\s*)body(.*)>/i ))
 
-        body_tag = res.body.match( /<(\s*)body(.*)>/i )
         res.body.gsub!( body_tag.to_s, "#{body_tag}#{panel_iframe}" )
         res.header['content-length'] = res.body.size.to_s
         res
@@ -574,7 +484,7 @@ class Arachni::Plugins::Proxy < Arachni::Plugin::Base
                     this proxy but rather a way to restrict usage enough to avoid
                     users unwittingly interfering with each others' sessions.},
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            version:     '0.2.1',
+            version:     '0.2.2',
             options:     [
                  Options::Port.new( 'port', [false, 'Port to bind to.', 8282] ),
                  Options::Address.new( 'bind_address',

data/plugins/proxy/panel/panel.html.erb

@@ -16,6 +16,12 @@
                         <i class="faded icon-stop icon-white"></i>
                     </a>
                 </li>
+                <li id='inspect'>
+                    <a title="Export the logged vectors in YAML format."
+                       class="newWindow" href="<%= vectors_url %>">
+                        <i class="faded icon-download icon-white"></i>
+                    </a>
+                </li>
                 <li id='inspect'>
                     <a title="Inspect logged pages and their elements -- <%= page_count %> pages thus far"
                        class="newWindow" href="<%= inspect_url %>">

data/plugins/proxy/panel/vectors.yml.erb

@@ -0,0 +1,9 @@
+#
+# Generated by the Proxy plugin of the Arachni Web Application Security Scanner Framework.
+#
+# The contents of this file are formatted for use with the 'vector_feed' plugin.
+# You can use this file to save and then feed these vectors back to Arachni
+# without needing to operate the proxy again.
+#
+
+<%= vectors %>

data/plugins/proxy/server.rb

@@ -18,6 +18,7 @@ require 'webrick/httpproxy'
 require 'webrick/https'
 
 class Arachni::Plugins::Proxy
+
 #
 # We add our own type of WEBrick::HTTPProxyServer class that supports
 # notifications when the user tries to access a resource irrelevant
@@ -43,8 +44,8 @@ class Server < WEBrick::HTTPProxyServer
             key = key.downcase
 
             if HopByHop.member?( key )          || # RFC2616: 13.5.1
-                connections.member?( key )       || # RFC2616: 14.10
-                 #ShouldNotTransfer.member?(key)    # pragmatics
+                connections.member?( key )      || # RFC2616: 14.10
+                 #ShouldNotTransfer.member?(key)   # pragmatics
                 key == 'content-encoding'
                 @logger.debug( "choose_header: `#{key}: #{value}'" )
                 next
@@ -62,7 +63,7 @@ class Server < WEBrick::HTTPProxyServer
     #
     def do_GET( req, res )
         perform_proxy_request( req, res ) do |url, header|
-            Arachni::HTTP.get( url , http_opts( headers: header ) ).response
+            Arachni::HTTP.get( url, http_opts( headers: header ) ).response
         end
     end
 
@@ -74,10 +75,38 @@ class Server < WEBrick::HTTPProxyServer
     def do_POST( req, res )
         perform_proxy_request( req, res ) do |url, header|
             params = Arachni::Utilities.form_parse_request_body( req.body )
+
+            # This is not necessary since we've parsed and put the POST body
+            # in the request parameters. Otherwise the server will not return
+            # a response.
+            header.delete 'Content-Length'
+
             Arachni::HTTP.post( url, http_opts( params: params, headers: header ) ).response
         end
     end
 
+    #
+    # Performs a PUT request.
+    #
+    # @see Webrick::HTTPProxyServer#proxy_service
+    #
+    def do_PUT( req, res )
+        perform_proxy_request( req, res ) do |url, header|
+            Arachni::HTTP.request( url, http_opts( method: :put, headers: header ) ).response
+        end
+    end
+
+    #
+    # Performs a DELETE request.
+    #
+    # @see Webrick::HTTPProxyServer#proxy_service
+    #
+    def do_DELETE( req, res )
+        perform_proxy_request( req, res ) do |url, header|
+            Arachni::HTTP.request( url, http_opts( method: :delete, headers: header ) ).response
+        end
+    end
+
     #
     # Hijacks CONNECT requests and redirects them to our SSL interceptor proxy
     # which listens on {#interceptor_port}.
@@ -98,7 +127,7 @@ class Server < WEBrick::HTTPProxyServer
     #
     def do_HEAD( req, res )
         perform_proxy_request( req, res ) do |url, header|
-            Arachni::HTTP.request( url , http_opts( method: :head, headers: header ) ).response
+            Arachni::HTTP.request( url, http_opts( method: :head, headers: header ) ).response
         end
     end
 
@@ -124,7 +153,7 @@ class Server < WEBrick::HTTPProxyServer
             BindAddress:    'localhost',
             Port:           interceptor_port,
             SSLEnable:      true,
-            SSLCertName:    [ [ "CN", WEBrick::Utils::getservername ] ],
+            SSLCertName:    [ [ 'CN', WEBrick::Utils::getservername ] ],
             SSLEnable:      true,
             SSLCertificate: cert,
             SSLPrivateKey:  pkey,
@@ -166,12 +195,12 @@ class Server < WEBrick::HTTPProxyServer
     def perform_proxy_request( req, res )
         response = yield( req.request_uri.to_s, setup_proxy_header( req, res ) )
 
-        # Persistent connection requirements are mysterious for me.
-        # So I will close the connection in every response.
-        res['proxy-connection'] = "close"
-        res['connection'] = "close"
+        # Disable persistent connections to simplify things.
+        res['proxy-connection'] = 'close'
+        res['connection']       = 'close'
+
+        # Convert Typhoeus::Response to WEBrick::HTTPResponse.
 
-        # Convert Typhoeus::Response to WEBrick::HTTPResponse
         res.status = response.code.to_i
         choose_header( response, res )
 
@@ -182,6 +211,8 @@ class Server < WEBrick::HTTPProxyServer
 
         #set_cookie( response, res )
         set_via( res )
+
+        res.header['content-length'] = response.body.size.to_s
         res.body = response.body
     end
 

data/plugins/proxy/template_scope.rb

@@ -0,0 +1,138 @@
+=begin
+    Copyright 2010-2013 Tasos Laskos <tasos.laskos@gmail.com>
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+=end
+
+class Arachni::Plugins::Proxy
+
+#
+# Helper class including method for rendering templates for the proxy.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
+#
+class TemplateScope
+    include Arachni::Utilities
+
+    PANEL_BASEDIR  = "#{Arachni::Plugins::Proxy::BASEDIR}panel/"
+    PANEL_TEMPLATE = "#{PANEL_BASEDIR}panel.html.erb"
+    PANEL_URL      = "#{Arachni::Plugins::Proxy::BASE_URL}panel/"
+
+    def initialize( params = {} )
+        update( params )
+    end
+
+    def self.new( *args )
+        @self ||= super( *args )
+    end
+
+    def self.get
+        new
+    end
+
+    def root_url
+        PANEL_URL
+    end
+
+    def js_url
+        "#{root_url}js/"
+    end
+
+    def css_url
+        "#{root_url}css/"
+    end
+
+    def img_url
+        "#{root_url}img/"
+    end
+
+    def inspect_url
+        "#{root_url}inspect"
+    end
+
+    def shutdown_url
+        url_for :shutdown
+    end
+
+    def vectors_url
+        "#{root_url}vectors.yml"
+    end
+
+    def url_for( *args )
+        Arachni::Plugins::Proxy.url_for( *args )
+    end
+
+    def update( params )
+        params.each { |name, value| set( name, value ) }
+        self
+    end
+
+    def set( name, value )
+        self.class.send( :attr_accessor, name )
+        instance_variable_set( "@#{name.to_s}", value )
+        self
+    end
+
+    def content_for?( ivar )
+        !!instance_variable_get( "@#{ivar.to_s}" )
+    end
+
+    def content_for( name, value = :nil )
+        if value == :nil
+            instance_variable_get( "@#{name.to_s}" )
+        else
+            set( name, html_encode( value.to_s ) )
+            nil
+        end
+    end
+
+    def erb( tpl, params = {} )
+        params = params.dup
+        params[:params] ||= {}
+
+        with_layout = true
+        with_layout = !!params.delete( :layout ) if params.include?( :layout )
+        format       = params.delete( :format ) || 'html'
+
+        update( params )
+
+        tpl = "#{tpl}.#{format}.erb" if tpl.is_a?( Symbol )
+
+        path = File.exist?( tpl ) ? tpl : PANEL_BASEDIR + tpl
+
+        evaled = ERB.new( IO.read( path ) ).result( get_binding )
+        with_layout ? layout { evaled } : evaled
+    end
+
+    def render( tpl, opts )
+        erb tpl, opts.merge( layout: false )
+    end
+
+    def layout
+        ERB.new( IO.read( PANEL_BASEDIR + 'layout.html.erb' ) ).result( binding )
+    end
+
+    def panel
+        erb :panel
+    end
+
+    def get_binding
+        binding
+    end
+
+    def clear
+        instance_variables.each { |v| instance_variable_set( v, nil ) }
+    end
+end
+end
+