arachni 0.4.5.2 → 0.4.6

data/modules/audit/code_injection_timing.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2013 Tasos Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2014 Tasos Laskos <tasos.laskos@gmail.com>
 
     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.

data/modules/audit/csrf.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2013 Tasos Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2014 Tasos Laskos <tasos.laskos@gmail.com>
 
     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.

data/modules/audit/file_inclusion.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2013 Tasos Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2014 Tasos Laskos <tasos.laskos@gmail.com>
 
     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 #
-# @version 0.1
+# @version 0.1.1
 #
 # @see http://cwe.mitre.org/data/definitions/98.html
 # @see https://www.owasp.org/index.php/PHP_File_Inclusion
@@ -84,8 +84,8 @@ class Arachni::Modules::FileInclusion < Arachni::Module::Base
                 '/boot.ini',
                 '/windows/win.ini',
                 '/winnt/win.ini'
-            ].map { |payload| [payload, "c:#{payload}", "#{payload}#{'.'* 700}"] }.flatten,
-            tomcat: [ '/WEB-INF/web.xml' ]
+            ].map { |p| [p, "c:#{p}", "#{p}#{'.'* 700}", p.gsub( '/', '\\' ) ] }.flatten,
+            tomcat: [ '/WEB-INF/web.xml', '\WEB-INF\web.xml' ]
         }.inject({}) do |h, (platform, payloads)|
             h.merge platform => payloads.map { |p| [p, "file://#{p}" ] }.flatten
         end
@@ -103,7 +103,7 @@ class Arachni::Modules::FileInclusion < Arachni::Module::Base
                 based on the presence of relevant content or errors in the HTTP responses.},
             elements:    [ Element::FORM, Element::LINK, Element::COOKIE, Element::HEADER ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
-            version:     '0.1',
+            version:     '0.1.1',
             references:  {
                 'OWASP' => 'https://www.owasp.org/index.php/PHP_File_Inclusion'
             },

data/modules/audit/ldapi.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2013 Tasos Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2014 Tasos Laskos <tasos.laskos@gmail.com>
 
     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.

data/modules/audit/os_cmd_injection.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2013 Tasos Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2014 Tasos Laskos <tasos.laskos@gmail.com>
 
     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.

data/modules/audit/os_cmd_injection_timing.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2013 Tasos Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2014 Tasos Laskos <tasos.laskos@gmail.com>
 
     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.
@@ -42,8 +42,9 @@ class Arachni::Modules::OSCmdInjectionTiming < Arachni::Module::Base
     def run
         audit_timeout self.class.payloads,
                        format:          [Format::STRAIGHT],
-                       timeout:         10000,
-                       timeout_divider: 1000
+                       timeout:         4000,
+                       timeout_divider: 1000,
+                       add:             -1000
     end
 
     def self.info

data/modules/audit/path_traversal.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2013 Tasos Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2014 Tasos Laskos <tasos.laskos@gmail.com>
 
     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 #
-# @version 0.4
+# @version 0.4.1
 #
 # @see http://cwe.mitre.org/data/definitions/22.html
 # @see http://www.owasp.org/index.php/Path_Traversal
@@ -68,8 +68,8 @@ class Arachni::Modules::PathTraversal < Arachni::Module::Base
 
         @payloads = {
             unix:    [
-                'proc/self/environ',
-                'etc/passwd'
+                '/proc/self/environ',
+                '/etc/passwd'
             ],
             windows: [
                 'boot.ini',
@@ -107,7 +107,7 @@ class Arachni::Modules::PathTraversal < Arachni::Module::Base
                 based on the presence of relevant content in the HTML responses.},
             elements:    [ Element::FORM, Element::LINK, Element::COOKIE, Element::HEADER ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
-            version:     '0.4',
+            version:     '0.4.1',
             references:  {
                 'OWASP' => 'http://www.owasp.org/index.php/Path_Traversal',
                 'WASC'  => 'http://projects.webappsec.org/Path-Traversal'

data/modules/audit/response_splitting.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2013 Tasos Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2014 Tasos Laskos <tasos.laskos@gmail.com>
 
     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.

data/modules/audit/rfi.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2013 Tasos Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2014 Tasos Laskos <tasos.laskos@gmail.com>
 
     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.

data/modules/audit/session_fixation.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2013 Tasos Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2014 Tasos Laskos <tasos.laskos@gmail.com>
 
     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.

data/modules/audit/source_code_disclosure.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2013 Tasos Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2014 Tasos Laskos <tasos.laskos@gmail.com>
 
     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 #
-# @version 0.1
+# @version 0.2
 #
 # @see http://cwe.mitre.org/data/definitions/540.html
 class Arachni::Modules::SourceCodeDisclosure < Arachni::Module::Base
@@ -77,13 +77,27 @@ class Arachni::Modules::SourceCodeDisclosure < Arachni::Module::Base
         @payload
     end
 
+    def self.payloads
+        return [] if !payload
+
+        parsed_url    = uri_parse( payload )
+        directories   = parsed_url.path.split( '/' )
+        resource_name = directories.pop
+
+        directories.reject!{ |d| d.empty? }
+
+        ["/#{resource_name}"] + directories.reverse.inject([]) do |plds, directory|
+            plds << "#{directory}/#{plds.last}"
+        end.map { |pld| "/#{pld}#{resource_name}" }
+    end
+
     def self.supported_extensions
         @supported_extensions ||=
             Set.new([ 'jsp', 'asp', 'aspx', 'php', 'htm', 'html' ])
     end
 
     def prepare
-        # Let's look for fresh a payload -- i.e. an identifiable server-side page.
+        # Let's look for fresh a payload -- i.e. an identifiable server-side resource.
         page.paths.each do |path|
             parsed_path = uri_parse( path )
             next if !self.class.supported_extensions.include?( parsed_path.resource_extension )
@@ -94,23 +108,13 @@ class Arachni::Modules::SourceCodeDisclosure < Arachni::Module::Base
     end
 
     def run
-        return if !self.class.payload
+        return if self.class.payloads.empty?
 
-        candidate_elements.each do |element|
-            payload = calculate_path_to_payload_from( element.action )
-            next if !payload
-
-            element.taint_analysis( payload, self.class.options )
+        each_candidate_element do |element|
+            element.taint_analysis( self.class.payloads, self.class.options )
         end
     end
 
-    def calculate_path_to_payload_from( url )
-        return if !(up_to_path = uri_parse( url ).up_to_path)
-
-        Pathname.new( self.class.payload ).
-            relative_path_from( Pathname.new( uri_parse( up_to_path ).path ) ).to_s
-    end
-
     def self.info
         {
             name:        'Source code disclosure',
@@ -118,7 +122,7 @@ class Arachni::Modules::SourceCodeDisclosure < Arachni::Module::Base
                 can be forced to reveal source code.},
             elements:    [ Element::FORM, Element::LINK, Element::COOKIE, Element::HEADER ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            version:     '0.1',
+            version:     '0.2',
             targets:     %w(PHP ASP JSP),
             references:  {
                 'CWE' => 'http://cwe.mitre.org/data/definitions/540.html'

data/modules/audit/sqli.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2013 Tasos Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2014 Tasos Laskos <tasos.laskos@gmail.com>
 
     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 #
-# @version 0.2
+# @version 0.2.1
 #
 # @see http://cwe.mitre.org/data/definitions/89.html
 # @see http://unixwiz.net/techtips/sql-injection.html
@@ -33,7 +33,9 @@ class Arachni::Modules::SQLInjection < Arachni::Module::Base
         @error_patterns = {}
         Dir[File.dirname( __FILE__ ) + '/sqli/patterns/*'].each do |file|
             @error_patterns[File.basename( file ).to_sym] =
-                IO.read( file ).split( "\n" )
+                IO.read( file ).split( "\n" ).map do |pattern|
+                    Regexp.new( pattern, Regexp::IGNORECASE )
+                end
         end
 
         @error_patterns
@@ -51,10 +53,11 @@ class Arachni::Modules::SQLInjection < Arachni::Module::Base
 
     def self.options
         @options ||= {
-            format:     [Format::APPEND],
-            regexp:     error_patterns,
-            ignore:     ignore_patterns,
-            param_flip: true
+            format:                    [Format::APPEND],
+            regexp:                    error_patterns,
+            ignore:                    ignore_patterns,
+            param_flip:                true,
+            longest_word_optimization: true
         }
     end
 
@@ -68,7 +71,7 @@ class Arachni::Modules::SQLInjection < Arachni::Module::Base
             description: %q{SQL injection module, uses known SQL DB errors to identify vulnerabilities.},
             elements:    [Element::LINK, Element::FORM, Element::COOKIE, Element::HEADER],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            version:     '0.2',
+            version:     '0.2.1',
             references:  {
                 'UnixWiz'    => 'http://unixwiz.net/techtips/sql-injection.html',
                 'Wikipedia'  => 'http://en.wikipedia.org/wiki/SQL_injection',

data/modules/audit/sqli/patterns/pgsql

@@ -6,3 +6,4 @@ PostgreSQL.*ERROR
 Warning.*pg_.*
 valid PostgreSQL result
 Npgsql\.
+PG::([a-zA-Z]*)Error

data/modules/audit/sqli/regexp_ignore.txt

@@ -1,2 +1,3 @@
 String or binary data would be truncated
 Access denied for user
+Invalid Input for SQL

data/modules/audit/sqli_blind_rdiff.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2013 Tasos Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2014 Tasos Laskos <tasos.laskos@gmail.com>
 
     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.
@@ -21,7 +21,7 @@
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 #
-# @version 0.4
+# @version 0.4.1
 #
 # @see http://cwe.mitre.org/data/definitions/89.html
 # @see http://capec.mitre.org/data/definitions/7.html
@@ -32,7 +32,9 @@ class Arachni::Modules::BlindrDiffSQLInjection < Arachni::Module::Base
 
     def self.queries_for_expression( expression )
         (@templates ||= read_file( 'payloads.txt' )).map do |template|
-            [ '\'', '"', '' ].map{ |quote| template.gsub( '%q%', quote ) + " #{expression}" }
+            [ '\'', '"', '' ].map do |quote|
+                template.gsub( '%q%', quote ) + " #{expression.gsub( '%q%', quote )}"
+            end
         end.flatten
     end
 
@@ -41,13 +43,13 @@ class Arachni::Modules::BlindrDiffSQLInjection < Arachni::Module::Base
         return @options if @options
 
         pairs  = []
-        falses = queries_for_expression( '1=2' )
+        falses = queries_for_expression( '1=%q%2' )
 
-        queries_for_expression( '1=1' ).each.with_index do |true_expr, i|
+        queries_for_expression( '1=%q%1' ).each.with_index do |true_expr, i|
             pairs << { true_expr => falses[i] }
         end
 
-        @options = { pairs: pairs }
+        @options = { false: '-1', pairs: pairs }
     end
 
     def run
@@ -57,14 +59,12 @@ class Arachni::Modules::BlindrDiffSQLInjection < Arachni::Module::Base
     def self.info
         {
             name:        'Blind SQL Injection (differential analysis)',
-            description: %q{It uses rDiff analysis to decide how different inputs affect
-                the behavior of the the web pages.
-                Using that as a basis it extrapolates about what inputs are vulnerable to blind SQL injection.
-                (Note: This module may get confused by certain types of XSS vulnerabilities.
-                    If this module returns a positive result you should investigate nonetheless.)},
+            description: %q{It uses differential analysis to determine how different inputs affect
+                the behavior of the web application and checks if the displayed behavior is consistent
+                with that of a vulnerable application.},
             elements:    [ Element::LINK, Element::FORM, Element::COOKIE ],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            version:     '0.4',
+            version:     '0.4.1',
             references:  {
                 'OWASP'         => 'http://www.owasp.org/index.php/Blind_SQL_Injection',
                 'MITRE - CAPEC' => 'http://capec.mitre.org/data/definitions/7.html'

data/modules/audit/sqli_blind_rdiff/payloads.txt

@@ -1,5 +1 @@
-%q% and %q%
-%q%) and %q%
-%q%)) and %q%
-%q%))) and %q%
-%q%)))) and %q%
+-1%q% or

data/modules/audit/sqli_blind_timing.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2013 Tasos Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2014 Tasos Laskos <tasos.laskos@gmail.com>
 
     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.
@@ -14,17 +14,15 @@
     limitations under the License.
 =end
 
-#
 # Blind SQL Injection module using timing attacks.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
 #
-# @version 0.3
+# @version 0.3.1
 #
 # @see http://cwe.mitre.org/data/definitions/89.html
 # @see http://capec.mitre.org/data/definitions/7.html
 # @see http://www.owasp.org/index.php/Blind_SQL_Injection
-#
 class Arachni::Modules::BlindTimingSQLInjection < Arachni::Module::Base
 
     prefer :sqli
@@ -34,12 +32,12 @@ class Arachni::Modules::BlindTimingSQLInjection < Arachni::Module::Base
             mysql: read_file( 'mysql.txt' ),
             pgsql: read_file( 'pgsql.txt' ),
             mssql: read_file( 'mssql.txt' )
-        }
+        }.inject({}){ |h, (k,v)| h.merge( k => v.map { |s| s.gsub( '[space]', ' ' ) } ) }
     end
 
     def run
         audit_timeout self.class.payloads,
-            format:          [Format::STRAIGHT, Format::APPEND],
+            format:          [Format::APPEND],
             timeout:         4000,
             timeout_divider: 1000
     end

data/modules/audit/sqli_blind_timing/mssql.txt

@@ -1,9 +1,9 @@
-;waitfor delay '0:0:__TIME__'--
-);waitfor delay '0:0:__TIME__'--
-';waitfor delay '0:0:__TIME__'--
-";waitfor delay '0:0:__TIME__'--
-');waitfor delay '0:0:__TIME__'--
-");waitfor delay '0:0:__TIME__'--
-));waitfor delay '0:0:__TIME__'--
-'));waitfor delay '0:0:__TIME__'--
-"));waitfor delay '0:0:__TIME__'--
+;waitfor delay '0:0:__TIME__'--[space]
+';waitfor delay '0:0:__TIME__'--[space]
+";waitfor delay '0:0:__TIME__'--[space]
+);waitfor delay '0:0:__TIME__'--[space]
+');waitfor delay '0:0:__TIME__'--[space]
+");waitfor delay '0:0:__TIME__'--[space]
+));waitfor delay '0:0:__TIME__'--[space]
+'));waitfor delay '0:0:__TIME__'--[space]
+"));waitfor delay '0:0:__TIME__'--[space]

data/modules/audit/sqli_blind_timing/mysql.txt

@@ -1,32 +1,10 @@
-sleep(__TIME__)#
-1 or sleep(__TIME__)#
-" or sleep(__TIME__)#
-' or sleep(__TIME__)#
-" or sleep(__TIME__)="
-' or sleep(__TIME__)='
-1) or sleep(__TIME__)#
-") or sleep(__TIME__)="
-') or sleep(__TIME__)='
-1)) or sleep(__TIME__)#
-")) or sleep(__TIME__)="
-')) or sleep(__TIME__)='
-1 and sleep(__TIME__)#
-" and sleep(__TIME__)#
-' and sleep(__TIME__)#
-" and sleep(__TIME__)="
+[space]and sleep(__TIME__)
+[space]or sleep(__TIME__) #[space]
 ' and sleep(__TIME__)='
-1) and sleep(__TIME__)#
-") and sleep(__TIME__)="
-') and sleep(__TIME__)='
-1)) and sleep(__TIME__)#
-")) and sleep(__TIME__)="
-')) and sleep(__TIME__)='
-1; SELECT sleep(__TIME__)#
-" ; SELECT sleep(__TIME__)#
-' ; SELECT sleep(__TIME__)#
-1) ; SELECT sleep(__TIME__)#
-") ; SELECT sleep(__TIME__)#
-') ; SELECT sleep(__TIME__)#
-1)) ; SELECT sleep(__TIME__)#
-")) ; SELECT sleep(__TIME__)#
-')) ; SELECT sleep(__TIME__)#
+' and sleep(__TIME__) #[space]
+" and sleep(__TIME__)="
+' or sleep(__TIME__) #[space]
+" or sleep(__TIME__) #[space]
+'=sleep(__TIME__)='
+"=sleep(__TIME__)="
+' where sleep(__TIME__) #[space]