arachni 0.4.4 → 0.4.5

Sign up to get free protection for your applications and to get access to all the features.
Files changed (148) hide show
  1. checksums.yaml +8 -8
  2. data/CHANGELOG.md +37 -0
  3. data/README.md +18 -3
  4. data/lib/arachni/element/capabilities/auditable.rb +5 -1
  5. data/lib/arachni/element/capabilities/auditable/taint.rb +37 -2
  6. data/lib/arachni/platform/fingerprinter.rb +4 -4
  7. data/lib/arachni/platform/manager.rb +15 -1
  8. data/lib/arachni/platforms.rb +2 -1
  9. data/lib/arachni/rpc/server/framework/distributor.rb +2 -2
  10. data/lib/arachni/spider.rb +1 -1
  11. data/lib/arachni/ui/cli/utilities.rb +1 -1
  12. data/lib/version +1 -1
  13. data/modules/audit/file_inclusion.rb +126 -0
  14. data/modules/audit/os_cmd_injection.rb +11 -9
  15. data/modules/audit/path_traversal.rb +21 -21
  16. data/modules/audit/source_code_disclosure.rb +16 -15
  17. data/modules/audit/sqli.rb +13 -6
  18. data/modules/audit/sqli/patterns/access +3 -0
  19. data/modules/audit/sqli/patterns/coldfusion +1 -0
  20. data/modules/audit/sqli/patterns/db2 +5 -0
  21. data/modules/audit/sqli/patterns/emc +2 -0
  22. data/modules/audit/sqli/patterns/firebird +2 -0
  23. data/modules/audit/sqli/patterns/frontbase +1 -0
  24. data/modules/audit/sqli/patterns/hsqldb +1 -0
  25. data/modules/audit/sqli/patterns/informix +3 -0
  26. data/modules/audit/sqli/patterns/ingres +3 -0
  27. data/modules/audit/sqli/patterns/interbase +2 -0
  28. data/modules/audit/sqli/patterns/maxdb +2 -0
  29. data/modules/audit/sqli/patterns/mssql +24 -0
  30. data/modules/audit/sqli/patterns/mysql +15 -0
  31. data/modules/audit/sqli/patterns/oracle +6 -0
  32. data/modules/audit/sqli/patterns/pgsql +8 -0
  33. data/modules/audit/sqli/patterns/sqlite +5 -0
  34. data/modules/audit/sqli/patterns/sybase +3 -0
  35. data/modules/recon/common_files/filenames.txt +1 -0
  36. data/modules/recon/localstart_asp.rb +67 -0
  37. data/path_extractors/comments.rb +30 -0
  38. data/path_extractors/meta_refresh.rb +8 -4
  39. data/plugins/uncommon_headers.rb +91 -0
  40. data/reports/html/default/issue.erb +1 -1
  41. data/reports/html/default/plugins.erb +3 -3
  42. data/reports/plugin_formatters/html/uncommon_headers.rb +47 -0
  43. data/reports/plugin_formatters/stdout/uncommon_headers.rb +37 -0
  44. data/reports/plugin_formatters/xml/discovery.rb +2 -0
  45. data/reports/plugin_formatters/xml/timing_attacks.rb +2 -0
  46. data/reports/plugin_formatters/xml/uncommon_headers.rb +38 -0
  47. data/reports/plugin_formatters/xml/uniformity.rb +2 -1
  48. data/reports/xml/buffer.rb +9 -5
  49. data/spec/arachni/element/capabilities/auditable/taint_spec.rb +295 -82
  50. data/spec/arachni/framework_spec.rb +48 -35
  51. data/spec/arachni/platform/manager_spec.rb +3 -2
  52. data/spec/modules/audit/file_inclusion_spec.rb +25 -0
  53. data/spec/modules/audit/path_traversal_spec.rb +3 -3
  54. data/spec/modules/audit/sqli_spec.rb +2 -1
  55. data/spec/modules/recon/localstart_asp_spec.rb +19 -0
  56. data/spec/path_extractors/comments_spec.rb +22 -0
  57. data/spec/path_extractors/meta_refresh_spec.rb +3 -3
  58. data/spec/plugins/uncommon_headers_spec.rb +64 -0
  59. data/spec/support/logs/Dispatcher - 1755-58492.log +9 -0
  60. data/spec/support/logs/Dispatcher - 1783-39171.log +21 -0
  61. data/spec/support/logs/Dispatcher - 1920-39032.log +9 -0
  62. data/spec/support/logs/Dispatcher - 1931-5309.log +19 -0
  63. data/spec/support/logs/Dispatcher - 1943-59691.log +17 -0
  64. data/spec/support/logs/Dispatcher - 1953-29898.log +13 -0
  65. data/spec/support/logs/Dispatcher - 1962-41002.log +9 -0
  66. data/spec/support/logs/Dispatcher - 1973-27626.log +9 -0
  67. data/spec/support/logs/Dispatcher - 1983-18043.log +11 -0
  68. data/spec/support/logs/Dispatcher - 1996-23139.log +11 -0
  69. data/spec/support/logs/Dispatcher - 2010-10568.log +35 -0
  70. data/spec/support/logs/Dispatcher - 2072-29284.log +21 -0
  71. data/spec/support/logs/Dispatcher - 2081-3234.log +21 -0
  72. data/spec/support/logs/Dispatcher - 2090-18129.log +23 -0
  73. data/spec/support/logs/Dispatcher - 2132-43806.log +19 -0
  74. data/spec/support/logs/Dispatcher - 2141-1327.log +17 -0
  75. data/spec/support/logs/Dispatcher - 2150-52559.log +15 -0
  76. data/spec/support/logs/Dispatcher - 2163-60400.log +11 -0
  77. data/spec/support/logs/Dispatcher - 2176-6021.log +9 -0
  78. data/spec/support/logs/Dispatcher - 2185-22991.log +9 -0
  79. data/spec/support/logs/Dispatcher - 2194-15317.log +9 -0
  80. data/spec/support/logs/Dispatcher - 2203-51674.log +9 -0
  81. data/spec/support/logs/Dispatcher - 2212-25563.log +11 -0
  82. data/spec/support/logs/Dispatcher - 2225-7249.log +9 -0
  83. data/spec/support/logs/Dispatcher - 2234-36714.log +9 -0
  84. data/spec/support/logs/Dispatcher - 2291-34161.log +63 -0
  85. data/spec/support/logs/Dispatcher - 2300-29645.log +43 -0
  86. data/spec/support/logs/Dispatcher - 2309-26961.log +39 -0
  87. data/spec/support/logs/Dispatcher - 2320-25486.log +34 -0
  88. data/spec/support/logs/Dispatcher - 2394-20678.log +28 -0
  89. data/spec/support/logs/Dispatcher - 2409-35315.log +21 -0
  90. data/spec/support/logs/Dispatcher - 2428-13197.log +13 -0
  91. data/spec/support/logs/Dispatcher - 2444-26232.log +9 -0
  92. data/spec/support/logs/Dispatcher - 2573-19232.log +19 -0
  93. data/spec/support/logs/Dispatcher - 2583-26954.log +21 -0
  94. data/spec/support/logs/Dispatcher - 2592-57040.log +15 -0
  95. data/spec/support/logs/Dispatcher - 2606-55321.log +19 -0
  96. data/spec/support/logs/Dispatcher - 2615-56847.log +21 -0
  97. data/spec/support/logs/Dispatcher - 2624-51835.log +15 -0
  98. data/spec/support/logs/Dispatcher - 2745-54916.log +17 -0
  99. data/spec/support/logs/Dispatcher - 2754-32405.log +21 -0
  100. data/spec/support/logs/Dispatcher - 2763-13372.log +13 -0
  101. data/spec/support/logs/Dispatcher - 2776-6861.log +19 -0
  102. data/spec/support/logs/Dispatcher - 2785-19122.log +21 -0
  103. data/spec/support/logs/Dispatcher - 2794-54279.log +15 -0
  104. data/spec/support/logs/Dispatcher - 2847-13871.log +17 -0
  105. data/spec/support/logs/Dispatcher - 2856-56546.log +21 -0
  106. data/spec/support/logs/Dispatcher - 2865-22921.log +13 -0
  107. data/spec/support/logs/Dispatcher - 2878-27922.log +17 -0
  108. data/spec/support/logs/Dispatcher - 2888-5399.log +21 -0
  109. data/spec/support/logs/Dispatcher - 2897-6079.log +13 -0
  110. data/spec/support/logs/Dispatcher - 3129-24131.log +19 -0
  111. data/spec/support/logs/Dispatcher - 3139-17731.log +21 -0
  112. data/spec/support/logs/Dispatcher - 3148-33704.log +15 -0
  113. data/spec/support/logs/Dispatcher - 3172-16517.log +21 -0
  114. data/spec/support/logs/Dispatcher - 3181-26384.log +25 -0
  115. data/spec/support/logs/Dispatcher - 3190-37513.log +15 -0
  116. data/spec/support/logs/Dispatcher - 3232-40996.log +17 -0
  117. data/spec/support/logs/Dispatcher - 3241-14948.log +21 -0
  118. data/spec/support/logs/Dispatcher - 3250-40285.log +13 -0
  119. data/spec/support/logs/Dispatcher - 3263-26987.log +21 -0
  120. data/spec/support/logs/Dispatcher - 3272-2729.log +25 -0
  121. data/spec/support/logs/Dispatcher - 3297-52308.log +15 -0
  122. data/spec/support/logs/Dispatcher - 3335-17008.log +17 -0
  123. data/spec/support/logs/Dispatcher - 3344-33205.log +21 -0
  124. data/spec/support/logs/Dispatcher - 3353-22917.log +13 -0
  125. data/spec/support/logs/Dispatcher - 3367-34935.log +17 -0
  126. data/spec/support/logs/Dispatcher - 3376-35370.log +21 -0
  127. data/spec/support/logs/Dispatcher - 3385-26487.log +13 -0
  128. data/spec/support/logs/Instance - 2588-19460.error.log +314 -0
  129. data/spec/support/logs/Instance - 2861-5917.error.log +314 -0
  130. data/spec/support/logs/Instance - 2893-61274.error.log +413 -0
  131. data/spec/support/logs/Instance - 2913-11030.error.log +312 -0
  132. data/spec/support/logs/Instance - 2919-17549.error.log +314 -0
  133. data/spec/support/logs/Instance - 3054-17565.error.log +312 -0
  134. data/spec/support/servers/modules/audit/file_inclusion.rb +202 -0
  135. data/spec/support/servers/modules/audit/sqli/access +3 -0
  136. data/spec/support/servers/modules/audit/sqli/firebird +1 -0
  137. data/spec/support/servers/modules/audit/sqli/frontbase +1 -0
  138. data/spec/support/servers/modules/audit/sqli/hsqldb +1 -0
  139. data/spec/support/servers/modules/audit/sqli/ingres +3 -0
  140. data/spec/support/servers/modules/audit/sqli/maxdb +2 -0
  141. data/spec/support/servers/modules/audit/sqli/mssql +0 -5
  142. data/spec/support/servers/modules/audit/sqli/oracle +1 -1
  143. data/spec/support/servers/modules/audit/sqli/sybase +3 -0
  144. data/spec/support/servers/modules/recon/localstart_asp.rb +5 -0
  145. data/spec/support/servers/plugins/uncommon_headers.rb +16 -0
  146. metadata +202 -4
  147. data/modules/audit/sqli/regexp_ids.txt +0 -69
  148. data/plugins/redundant_vectors.rb +0 -34
@@ -0,0 +1,3 @@
1
+ JET Database Engine
2
+ Access Database Engine
3
+ [Microsoft][ODBC Microsoft Access Driver]
@@ -0,0 +1 @@
1
+ Dynamic SQL Error
@@ -0,0 +1 @@
1
+ Exception condition 1. Transaction rollback.
@@ -0,0 +1 @@
1
+ org.hsqldb.jdbc
@@ -0,0 +1,3 @@
1
+ Warning stuff ingres_
2
+ Ingres SQLSTATE
3
+ Ingres stuff Driver
@@ -0,0 +1,2 @@
1
+ SQL error stuff POS(1234) stuff
2
+ Warning stuff maxdb stuff
@@ -16,11 +16,6 @@ Unclosed quotation mark before the character string
16
16
  Syntax Error (missing operator) in query expression
17
17
  Data type mismatch in criteria expression
18
18
  ADODB.Field (0x800A0BCD)
19
- [Microsoft][ODBC Microsoft Access Driver]
20
19
  the used select statements have different number of columns
21
20
  OLE DB stuff SQL Server
22
21
  Warningstuff mssql_
23
- Access stuff Driver
24
- Driver stuff Access
25
- JET Database Engine
26
- Access Database Engine
@@ -1,4 +1,4 @@
1
- (PLS|ORA)-[0-9][0-9][0-9][0-9]
1
+ ORA 9124
2
2
  java.sql.SQLException
3
3
  Oracle error
4
4
  Oracle stuff Driver
@@ -0,0 +1,3 @@
1
+ Sybase message:
2
+ Warning stuff sybase stuff
3
+ Sybase stuff Server message stuff
@@ -0,0 +1,5 @@
1
+ require 'sinatra'
2
+
3
+ get '/localstart.asp' do
4
+ status 401
5
+ end
@@ -0,0 +1,16 @@
1
+ require 'sinatra'
2
+
3
+ get '/' do
4
+ <<EOHTML
5
+ <a href="/1">1</a>
6
+ <a href="/2">2</a>
7
+ EOHTML
8
+ end
9
+
10
+ get '/1' do
11
+ headers['Weird'] = 'Value'
12
+ end
13
+
14
+ get '/2' do
15
+ headers['Weird2'] = 'Value2'
16
+ end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: arachni
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.4.4
4
+ version: 0.4.5
5
5
  platform: ruby
6
6
  authors:
7
7
  - Tasos Laskos
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2013-08-12 00:00:00.000000000 Z
11
+ date: 2013-09-13 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: arachni-rpc-em
@@ -485,8 +485,25 @@ files:
485
485
  - modules/audit/code_injection.rb
486
486
  - modules/audit/path_traversal.rb
487
487
  - modules/audit/sqli_blind_rdiff.rb
488
- - modules/audit/sqli/regexp_ids.txt
488
+ - modules/audit/file_inclusion.rb
489
489
  - modules/audit/sqli/regexp_ignore.txt
490
+ - modules/audit/sqli/patterns/oracle
491
+ - modules/audit/sqli/patterns/emc
492
+ - modules/audit/sqli/patterns/pgsql
493
+ - modules/audit/sqli/patterns/maxdb
494
+ - modules/audit/sqli/patterns/firebird
495
+ - modules/audit/sqli/patterns/sqlite
496
+ - modules/audit/sqli/patterns/ingres
497
+ - modules/audit/sqli/patterns/sybase
498
+ - modules/audit/sqli/patterns/mssql
499
+ - modules/audit/sqli/patterns/informix
500
+ - modules/audit/sqli/patterns/frontbase
501
+ - modules/audit/sqli/patterns/db2
502
+ - modules/audit/sqli/patterns/interbase
503
+ - modules/audit/sqli/patterns/mysql
504
+ - modules/audit/sqli/patterns/coldfusion
505
+ - modules/audit/sqli/patterns/hsqldb
506
+ - modules/audit/sqli/patterns/access
490
507
  - modules/audit/ldapi.rb
491
508
  - modules/audit/rfi.rb
492
509
  - modules/audit/session_fixation.rb
@@ -516,6 +533,7 @@ files:
516
533
  - modules/recon/common_files/filenames.txt
517
534
  - modules/recon/xst.rb
518
535
  - modules/recon/x_forwarded_for_access_restriction_bypass.rb
536
+ - modules/recon/localstart_asp.rb
519
537
  - modules/recon/backup_files/extensions.txt
520
538
  - modules/recon/htaccess_limit.rb
521
539
  - modules/recon/http_put.rb
@@ -565,6 +583,7 @@ files:
565
583
  - path_extractors/anchors.rb
566
584
  - path_extractors/frames.rb
567
585
  - path_extractors/scripts.rb
586
+ - path_extractors/comments.rb
568
587
  - path_extractors/generic.rb
569
588
  - path_extractors/links.rb
570
589
  - plugins/defaults/resolver.rb
@@ -577,9 +596,9 @@ files:
577
596
  - plugins/libnotify.rb
578
597
  - plugins/cookie_collector.rb
579
598
  - plugins/proxy.rb
580
- - plugins/redundant_vectors.rb
581
599
  - plugins/profiler.rb
582
600
  - plugins/beep_notify.rb
601
+ - plugins/uncommon_headers.rb
583
602
  - plugins/rescan.rb
584
603
  - plugins/http_dicattack.rb
585
604
  - plugins/proxy/server.rb
@@ -627,6 +646,7 @@ files:
627
646
  - reports/plugin_formatters/stdout/timing_attacks.rb
628
647
  - reports/plugin_formatters/stdout/discovery.rb
629
648
  - reports/plugin_formatters/stdout/profiler.rb
649
+ - reports/plugin_formatters/stdout/uncommon_headers.rb
630
650
  - reports/plugin_formatters/stdout/uniformity.rb
631
651
  - reports/plugin_formatters/stdout/http_dicattack.rb
632
652
  - reports/plugin_formatters/stdout/content_types.rb
@@ -640,6 +660,7 @@ files:
640
660
  - reports/plugin_formatters/html/discovery.rb
641
661
  - reports/plugin_formatters/html/profiler.rb
642
662
  - reports/plugin_formatters/html/profiler/template.erb
663
+ - reports/plugin_formatters/html/uncommon_headers.rb
643
664
  - reports/plugin_formatters/html/uniformity.rb
644
665
  - reports/plugin_formatters/html/http_dicattack.rb
645
666
  - reports/plugin_formatters/html/content_types.rb
@@ -652,6 +673,7 @@ files:
652
673
  - reports/plugin_formatters/xml/timing_attacks.rb
653
674
  - reports/plugin_formatters/xml/discovery.rb
654
675
  - reports/plugin_formatters/xml/profiler.rb
676
+ - reports/plugin_formatters/xml/uncommon_headers.rb
655
677
  - reports/plugin_formatters/xml/uniformity.rb
656
678
  - reports/plugin_formatters/xml/http_dicattack.rb
657
679
  - reports/plugin_formatters/xml/content_types.rb
@@ -714,7 +736,82 @@ files:
714
736
  - spec/support/helpers/resets.rb
715
737
  - spec/support/helpers/paths.rb
716
738
  - spec/support/helpers/auditor.rb
739
+ - spec/support/logs/Dispatcher - 2776-6861.log
740
+ - spec/support/logs/Dispatcher - 2615-56847.log
741
+ - spec/support/logs/Instance - 3054-17565.error.log
742
+ - spec/support/logs/Dispatcher - 1973-27626.log
743
+ - spec/support/logs/Dispatcher - 3148-33704.log
744
+ - spec/support/logs/Dispatcher - 3172-16517.log
745
+ - spec/support/logs/Dispatcher - 2234-36714.log
746
+ - spec/support/logs/Dispatcher - 2225-7249.log
747
+ - spec/support/logs/Dispatcher - 1920-39032.log
748
+ - spec/support/logs/Dispatcher - 2132-43806.log
717
749
  - spec/support/logs/placeholder
750
+ - spec/support/logs/Dispatcher - 2176-6021.log
751
+ - spec/support/logs/Dispatcher - 2745-54916.log
752
+ - spec/support/logs/Dispatcher - 3181-26384.log
753
+ - spec/support/logs/Dispatcher - 2428-13197.log
754
+ - spec/support/logs/Dispatcher - 2291-34161.log
755
+ - spec/support/logs/Dispatcher - 1755-58492.log
756
+ - spec/support/logs/Dispatcher - 2141-1327.log
757
+ - spec/support/logs/Dispatcher - 3367-34935.log
758
+ - spec/support/logs/Dispatcher - 2320-25486.log
759
+ - spec/support/logs/Dispatcher - 3344-33205.log
760
+ - spec/support/logs/Dispatcher - 2212-25563.log
761
+ - spec/support/logs/Dispatcher - 2185-22991.log
762
+ - spec/support/logs/Dispatcher - 2010-10568.log
763
+ - spec/support/logs/Dispatcher - 2090-18129.log
764
+ - spec/support/logs/Dispatcher - 1931-5309.log
765
+ - spec/support/logs/Dispatcher - 2444-26232.log
766
+ - spec/support/logs/Dispatcher - 2409-35315.log
767
+ - spec/support/logs/Dispatcher - 3232-40996.log
768
+ - spec/support/logs/Dispatcher - 1943-59691.log
769
+ - spec/support/logs/Dispatcher - 3190-37513.log
770
+ - spec/support/logs/Dispatcher - 2072-29284.log
771
+ - spec/support/logs/Dispatcher - 3139-17731.log
772
+ - spec/support/logs/Dispatcher - 1962-41002.log
773
+ - spec/support/logs/Dispatcher - 2309-26961.log
774
+ - spec/support/logs/Dispatcher - 2785-19122.log
775
+ - spec/support/logs/Instance - 2861-5917.error.log
776
+ - spec/support/logs/Dispatcher - 3250-40285.log
777
+ - spec/support/logs/Dispatcher - 2194-15317.log
778
+ - spec/support/logs/Dispatcher - 2888-5399.log
779
+ - spec/support/logs/Dispatcher - 2394-20678.log
780
+ - spec/support/logs/Dispatcher - 2878-27922.log
781
+ - spec/support/logs/Dispatcher - 3272-2729.log
782
+ - spec/support/logs/Instance - 2919-17549.error.log
783
+ - spec/support/logs/Dispatcher - 3376-35370.log
784
+ - spec/support/logs/Instance - 2893-61274.error.log
785
+ - spec/support/logs/Dispatcher - 2081-3234.log
786
+ - spec/support/logs/Dispatcher - 2150-52559.log
787
+ - spec/support/logs/Dispatcher - 2624-51835.log
788
+ - spec/support/logs/Instance - 2588-19460.error.log
789
+ - spec/support/logs/Dispatcher - 1983-18043.log
790
+ - spec/support/logs/Dispatcher - 2573-19232.log
791
+ - spec/support/logs/Dispatcher - 3335-17008.log
792
+ - spec/support/logs/Dispatcher - 1783-39171.log
793
+ - spec/support/logs/Dispatcher - 2300-29645.log
794
+ - spec/support/logs/Dispatcher - 2754-32405.log
795
+ - spec/support/logs/Dispatcher - 1953-29898.log
796
+ - spec/support/logs/Dispatcher - 2763-13372.log
797
+ - spec/support/logs/Dispatcher - 2897-6079.log
798
+ - spec/support/logs/Dispatcher - 1996-23139.log
799
+ - spec/support/logs/Dispatcher - 3385-26487.log
800
+ - spec/support/logs/Dispatcher - 2847-13871.log
801
+ - spec/support/logs/Dispatcher - 2163-60400.log
802
+ - spec/support/logs/Dispatcher - 2856-56546.log
803
+ - spec/support/logs/Dispatcher - 3297-52308.log
804
+ - spec/support/logs/Instance - 2913-11030.error.log
805
+ - spec/support/logs/Dispatcher - 3263-26987.log
806
+ - spec/support/logs/Dispatcher - 3241-14948.log
807
+ - spec/support/logs/Dispatcher - 2606-55321.log
808
+ - spec/support/logs/Dispatcher - 2203-51674.log
809
+ - spec/support/logs/Dispatcher - 2583-26954.log
810
+ - spec/support/logs/Dispatcher - 3353-22917.log
811
+ - spec/support/logs/Dispatcher - 3129-24131.log
812
+ - spec/support/logs/Dispatcher - 2592-57040.log
813
+ - spec/support/logs/Dispatcher - 2865-22921.log
814
+ - spec/support/logs/Dispatcher - 2794-54279.log
718
815
  - spec/support/pems/cacert.pem
719
816
  - spec/support/pems/server/key.pem
720
817
  - spec/support/pems/server/cert.pem
@@ -763,6 +860,7 @@ files:
763
860
  - spec/support/servers/plugins/cookie_collector.rb
764
861
  - spec/support/servers/plugins/http_dicattack_secure.rb
765
862
  - spec/support/servers/plugins/profiler.rb
863
+ - spec/support/servers/plugins/uncommon_headers.rb
766
864
  - spec/support/servers/plugins/rescan.rb
767
865
  - spec/support/servers/plugins/http_dicattack.rb
768
866
  - spec/support/servers/plugins/meta/remedies/timing_attacks.rb
@@ -793,18 +891,25 @@ files:
793
891
  - spec/support/servers/modules/audit/code_injection.rb
794
892
  - spec/support/servers/modules/audit/path_traversal.rb
795
893
  - spec/support/servers/modules/audit/sqli_blind_rdiff.rb
894
+ - spec/support/servers/modules/audit/file_inclusion.rb
796
895
  - spec/support/servers/modules/audit/sqli/oracle
797
896
  - spec/support/servers/modules/audit/sqli/emc
897
+ - spec/support/servers/modules/audit/sqli/maxdb
898
+ - spec/support/servers/modules/audit/sqli/firebird
798
899
  - spec/support/servers/modules/audit/sqli/sqlite
900
+ - spec/support/servers/modules/audit/sqli/ingres
799
901
  - spec/support/servers/modules/audit/sqli/sybase
800
902
  - spec/support/servers/modules/audit/sqli/jdbc
801
903
  - spec/support/servers/modules/audit/sqli/mssql
802
904
  - spec/support/servers/modules/audit/sqli/informix
905
+ - spec/support/servers/modules/audit/sqli/frontbase
803
906
  - spec/support/servers/modules/audit/sqli/db2
804
907
  - spec/support/servers/modules/audit/sqli/interbase
805
908
  - spec/support/servers/modules/audit/sqli/mysql
806
909
  - spec/support/servers/modules/audit/sqli/postgresql
807
910
  - spec/support/servers/modules/audit/sqli/coldfusion
911
+ - spec/support/servers/modules/audit/sqli/hsqldb
912
+ - spec/support/servers/modules/audit/sqli/access
808
913
  - spec/support/servers/modules/audit/ldapi.rb
809
914
  - spec/support/servers/modules/audit/rfi.rb
810
915
  - spec/support/servers/modules/audit/session_fixation.rb
@@ -832,6 +937,7 @@ files:
832
937
  - spec/support/servers/modules/module_server.rb
833
938
  - spec/support/servers/modules/recon/xst.rb
834
939
  - spec/support/servers/modules/recon/x_forwarded_for_access_restriction_bypass.rb
940
+ - spec/support/servers/modules/recon/localstart_asp.rb
835
941
  - spec/support/servers/modules/recon/htaccess_limit.rb
836
942
  - spec/support/servers/modules/recon/http_put.rb
837
943
  - spec/support/servers/modules/recon/webdav.rb
@@ -857,6 +963,7 @@ files:
857
963
  - spec/support/servers/modules/recon/grep/password_autocomplete.rb
858
964
  - spec/support/lib/web_server_manager.rb
859
965
  - spec/plugins/script_spec.rb
966
+ - spec/plugins/uncommon_headers_spec.rb
860
967
  - spec/plugins/http_dicattack_spec.rb
861
968
  - spec/plugins/vector_feed_spec.rb
862
969
  - spec/plugins/rescan_spec.rb
@@ -984,6 +1091,7 @@ files:
984
1091
  - spec/modules/audit/unvalidated_redirect_spec.rb
985
1092
  - spec/modules/audit/xss_script_tag_spec.rb
986
1093
  - spec/modules/audit/os_cmd_injection_spec.rb
1094
+ - spec/modules/audit/file_inclusion_spec.rb
987
1095
  - spec/modules/audit/code_injection_timing_spec.rb
988
1096
  - spec/modules/audit/sqli_spec.rb
989
1097
  - spec/modules/audit/session_fixation_spec.rb
@@ -1005,6 +1113,7 @@ files:
1005
1113
  - spec/modules/audit/ldapi_spec.rb
1006
1114
  - spec/modules/recon/common_files_spec.rb
1007
1115
  - spec/modules/recon/allowed_methods_spec.rb
1116
+ - spec/modules/recon/localstart_asp_spec.rb
1008
1117
  - spec/modules/recon/xst_spec.rb
1009
1118
  - spec/modules/recon/directory_listing_spec.rb
1010
1119
  - spec/modules/recon/http_put_spec.rb
@@ -1033,6 +1142,7 @@ files:
1033
1142
  - spec/path_extractors/frames_spec.rb
1034
1143
  - spec/path_extractors/generic_spec.rb
1035
1144
  - spec/path_extractors/scripts_spec.rb
1145
+ - spec/path_extractors/comments_spec.rb
1036
1146
  - spec/path_extractors/meta_refresh_spec.rb
1037
1147
  - spec/path_extractors/links_spec.rb
1038
1148
  - spec/path_extractors/anchors_spec.rb
@@ -1140,7 +1250,82 @@ test_files:
1140
1250
  - spec/support/helpers/resets.rb
1141
1251
  - spec/support/helpers/paths.rb
1142
1252
  - spec/support/helpers/auditor.rb
1253
+ - spec/support/logs/Dispatcher - 2776-6861.log
1254
+ - spec/support/logs/Dispatcher - 2615-56847.log
1255
+ - spec/support/logs/Instance - 3054-17565.error.log
1256
+ - spec/support/logs/Dispatcher - 1973-27626.log
1257
+ - spec/support/logs/Dispatcher - 3148-33704.log
1258
+ - spec/support/logs/Dispatcher - 3172-16517.log
1259
+ - spec/support/logs/Dispatcher - 2234-36714.log
1260
+ - spec/support/logs/Dispatcher - 2225-7249.log
1261
+ - spec/support/logs/Dispatcher - 1920-39032.log
1262
+ - spec/support/logs/Dispatcher - 2132-43806.log
1143
1263
  - spec/support/logs/placeholder
1264
+ - spec/support/logs/Dispatcher - 2176-6021.log
1265
+ - spec/support/logs/Dispatcher - 2745-54916.log
1266
+ - spec/support/logs/Dispatcher - 3181-26384.log
1267
+ - spec/support/logs/Dispatcher - 2428-13197.log
1268
+ - spec/support/logs/Dispatcher - 2291-34161.log
1269
+ - spec/support/logs/Dispatcher - 1755-58492.log
1270
+ - spec/support/logs/Dispatcher - 2141-1327.log
1271
+ - spec/support/logs/Dispatcher - 3367-34935.log
1272
+ - spec/support/logs/Dispatcher - 2320-25486.log
1273
+ - spec/support/logs/Dispatcher - 3344-33205.log
1274
+ - spec/support/logs/Dispatcher - 2212-25563.log
1275
+ - spec/support/logs/Dispatcher - 2185-22991.log
1276
+ - spec/support/logs/Dispatcher - 2010-10568.log
1277
+ - spec/support/logs/Dispatcher - 2090-18129.log
1278
+ - spec/support/logs/Dispatcher - 1931-5309.log
1279
+ - spec/support/logs/Dispatcher - 2444-26232.log
1280
+ - spec/support/logs/Dispatcher - 2409-35315.log
1281
+ - spec/support/logs/Dispatcher - 3232-40996.log
1282
+ - spec/support/logs/Dispatcher - 1943-59691.log
1283
+ - spec/support/logs/Dispatcher - 3190-37513.log
1284
+ - spec/support/logs/Dispatcher - 2072-29284.log
1285
+ - spec/support/logs/Dispatcher - 3139-17731.log
1286
+ - spec/support/logs/Dispatcher - 1962-41002.log
1287
+ - spec/support/logs/Dispatcher - 2309-26961.log
1288
+ - spec/support/logs/Dispatcher - 2785-19122.log
1289
+ - spec/support/logs/Instance - 2861-5917.error.log
1290
+ - spec/support/logs/Dispatcher - 3250-40285.log
1291
+ - spec/support/logs/Dispatcher - 2194-15317.log
1292
+ - spec/support/logs/Dispatcher - 2888-5399.log
1293
+ - spec/support/logs/Dispatcher - 2394-20678.log
1294
+ - spec/support/logs/Dispatcher - 2878-27922.log
1295
+ - spec/support/logs/Dispatcher - 3272-2729.log
1296
+ - spec/support/logs/Instance - 2919-17549.error.log
1297
+ - spec/support/logs/Dispatcher - 3376-35370.log
1298
+ - spec/support/logs/Instance - 2893-61274.error.log
1299
+ - spec/support/logs/Dispatcher - 2081-3234.log
1300
+ - spec/support/logs/Dispatcher - 2150-52559.log
1301
+ - spec/support/logs/Dispatcher - 2624-51835.log
1302
+ - spec/support/logs/Instance - 2588-19460.error.log
1303
+ - spec/support/logs/Dispatcher - 1983-18043.log
1304
+ - spec/support/logs/Dispatcher - 2573-19232.log
1305
+ - spec/support/logs/Dispatcher - 3335-17008.log
1306
+ - spec/support/logs/Dispatcher - 1783-39171.log
1307
+ - spec/support/logs/Dispatcher - 2300-29645.log
1308
+ - spec/support/logs/Dispatcher - 2754-32405.log
1309
+ - spec/support/logs/Dispatcher - 1953-29898.log
1310
+ - spec/support/logs/Dispatcher - 2763-13372.log
1311
+ - spec/support/logs/Dispatcher - 2897-6079.log
1312
+ - spec/support/logs/Dispatcher - 1996-23139.log
1313
+ - spec/support/logs/Dispatcher - 3385-26487.log
1314
+ - spec/support/logs/Dispatcher - 2847-13871.log
1315
+ - spec/support/logs/Dispatcher - 2163-60400.log
1316
+ - spec/support/logs/Dispatcher - 2856-56546.log
1317
+ - spec/support/logs/Dispatcher - 3297-52308.log
1318
+ - spec/support/logs/Instance - 2913-11030.error.log
1319
+ - spec/support/logs/Dispatcher - 3263-26987.log
1320
+ - spec/support/logs/Dispatcher - 3241-14948.log
1321
+ - spec/support/logs/Dispatcher - 2606-55321.log
1322
+ - spec/support/logs/Dispatcher - 2203-51674.log
1323
+ - spec/support/logs/Dispatcher - 2583-26954.log
1324
+ - spec/support/logs/Dispatcher - 3353-22917.log
1325
+ - spec/support/logs/Dispatcher - 3129-24131.log
1326
+ - spec/support/logs/Dispatcher - 2592-57040.log
1327
+ - spec/support/logs/Dispatcher - 2865-22921.log
1328
+ - spec/support/logs/Dispatcher - 2794-54279.log
1144
1329
  - spec/support/pems/cacert.pem
1145
1330
  - spec/support/pems/server/key.pem
1146
1331
  - spec/support/pems/server/cert.pem
@@ -1189,6 +1374,7 @@ test_files:
1189
1374
  - spec/support/servers/plugins/cookie_collector.rb
1190
1375
  - spec/support/servers/plugins/http_dicattack_secure.rb
1191
1376
  - spec/support/servers/plugins/profiler.rb
1377
+ - spec/support/servers/plugins/uncommon_headers.rb
1192
1378
  - spec/support/servers/plugins/rescan.rb
1193
1379
  - spec/support/servers/plugins/http_dicattack.rb
1194
1380
  - spec/support/servers/plugins/meta/remedies/timing_attacks.rb
@@ -1219,18 +1405,25 @@ test_files:
1219
1405
  - spec/support/servers/modules/audit/code_injection.rb
1220
1406
  - spec/support/servers/modules/audit/path_traversal.rb
1221
1407
  - spec/support/servers/modules/audit/sqli_blind_rdiff.rb
1408
+ - spec/support/servers/modules/audit/file_inclusion.rb
1222
1409
  - spec/support/servers/modules/audit/sqli/oracle
1223
1410
  - spec/support/servers/modules/audit/sqli/emc
1411
+ - spec/support/servers/modules/audit/sqli/maxdb
1412
+ - spec/support/servers/modules/audit/sqli/firebird
1224
1413
  - spec/support/servers/modules/audit/sqli/sqlite
1414
+ - spec/support/servers/modules/audit/sqli/ingres
1225
1415
  - spec/support/servers/modules/audit/sqli/sybase
1226
1416
  - spec/support/servers/modules/audit/sqli/jdbc
1227
1417
  - spec/support/servers/modules/audit/sqli/mssql
1228
1418
  - spec/support/servers/modules/audit/sqli/informix
1419
+ - spec/support/servers/modules/audit/sqli/frontbase
1229
1420
  - spec/support/servers/modules/audit/sqli/db2
1230
1421
  - spec/support/servers/modules/audit/sqli/interbase
1231
1422
  - spec/support/servers/modules/audit/sqli/mysql
1232
1423
  - spec/support/servers/modules/audit/sqli/postgresql
1233
1424
  - spec/support/servers/modules/audit/sqli/coldfusion
1425
+ - spec/support/servers/modules/audit/sqli/hsqldb
1426
+ - spec/support/servers/modules/audit/sqli/access
1234
1427
  - spec/support/servers/modules/audit/ldapi.rb
1235
1428
  - spec/support/servers/modules/audit/rfi.rb
1236
1429
  - spec/support/servers/modules/audit/session_fixation.rb
@@ -1258,6 +1451,7 @@ test_files:
1258
1451
  - spec/support/servers/modules/module_server.rb
1259
1452
  - spec/support/servers/modules/recon/xst.rb
1260
1453
  - spec/support/servers/modules/recon/x_forwarded_for_access_restriction_bypass.rb
1454
+ - spec/support/servers/modules/recon/localstart_asp.rb
1261
1455
  - spec/support/servers/modules/recon/htaccess_limit.rb
1262
1456
  - spec/support/servers/modules/recon/http_put.rb
1263
1457
  - spec/support/servers/modules/recon/webdav.rb
@@ -1283,6 +1477,7 @@ test_files:
1283
1477
  - spec/support/servers/modules/recon/grep/password_autocomplete.rb
1284
1478
  - spec/support/lib/web_server_manager.rb
1285
1479
  - spec/plugins/script_spec.rb
1480
+ - spec/plugins/uncommon_headers_spec.rb
1286
1481
  - spec/plugins/http_dicattack_spec.rb
1287
1482
  - spec/plugins/vector_feed_spec.rb
1288
1483
  - spec/plugins/rescan_spec.rb
@@ -1410,6 +1605,7 @@ test_files:
1410
1605
  - spec/modules/audit/unvalidated_redirect_spec.rb
1411
1606
  - spec/modules/audit/xss_script_tag_spec.rb
1412
1607
  - spec/modules/audit/os_cmd_injection_spec.rb
1608
+ - spec/modules/audit/file_inclusion_spec.rb
1413
1609
  - spec/modules/audit/code_injection_timing_spec.rb
1414
1610
  - spec/modules/audit/sqli_spec.rb
1415
1611
  - spec/modules/audit/session_fixation_spec.rb
@@ -1431,6 +1627,7 @@ test_files:
1431
1627
  - spec/modules/audit/ldapi_spec.rb
1432
1628
  - spec/modules/recon/common_files_spec.rb
1433
1629
  - spec/modules/recon/allowed_methods_spec.rb
1630
+ - spec/modules/recon/localstart_asp_spec.rb
1434
1631
  - spec/modules/recon/xst_spec.rb
1435
1632
  - spec/modules/recon/directory_listing_spec.rb
1436
1633
  - spec/modules/recon/http_put_spec.rb
@@ -1459,6 +1656,7 @@ test_files:
1459
1656
  - spec/path_extractors/frames_spec.rb
1460
1657
  - spec/path_extractors/generic_spec.rb
1461
1658
  - spec/path_extractors/scripts_spec.rb
1659
+ - spec/path_extractors/comments_spec.rb
1462
1660
  - spec/path_extractors/meta_refresh_spec.rb
1463
1661
  - spec/path_extractors/links_spec.rb
1464
1662
  - spec/path_extractors/anchors_spec.rb