arachni 0.4.5.2 → 0.4.6

Sign up to get free protection for your applications and to get access to all the features.
Files changed (621) hide show
  1. checksums.yaml +9 -9
  2. data/CHANGELOG.md +97 -0
  3. data/CONTRIBUTORS.md +1 -0
  4. data/NOTICE +1 -1
  5. data/README.md +4 -4
  6. data/Rakefile +111 -26
  7. data/arachni.gemspec +2 -2
  8. data/bin/arachni +1 -1
  9. data/bin/arachni_console +1 -1
  10. data/bin/arachni_multi +1 -1
  11. data/bin/arachni_rpc +1 -1
  12. data/bin/arachni_rpcd +1 -1
  13. data/bin/arachni_rpcd_monitor +1 -1
  14. data/bin/arachni_script +1 -1
  15. data/external/metasploit/LICENSE +1 -1
  16. data/fingerprinters/frameworks/rack.rb +1 -1
  17. data/fingerprinters/languages/asp.rb +1 -1
  18. data/fingerprinters/languages/aspx.rb +1 -1
  19. data/fingerprinters/languages/jsp.rb +3 -5
  20. data/fingerprinters/languages/php.rb +1 -1
  21. data/fingerprinters/languages/python.rb +1 -1
  22. data/fingerprinters/languages/ruby.rb +1 -1
  23. data/fingerprinters/os/bsd.rb +1 -1
  24. data/fingerprinters/os/linux.rb +1 -1
  25. data/fingerprinters/os/solaris.rb +1 -1
  26. data/fingerprinters/os/unix.rb +1 -1
  27. data/fingerprinters/os/windows.rb +1 -1
  28. data/fingerprinters/servers/apache.rb +1 -1
  29. data/fingerprinters/servers/iis.rb +1 -1
  30. data/fingerprinters/servers/jetty.rb +1 -1
  31. data/fingerprinters/servers/nginx.rb +1 -1
  32. data/fingerprinters/servers/tomcat.rb +1 -1
  33. data/lib/arachni.rb +6 -1
  34. data/lib/arachni/audit_store.rb +1 -1
  35. data/lib/arachni/banner.rb +1 -1
  36. data/lib/arachni/component/manager.rb +1 -1
  37. data/lib/arachni/component/options.rb +1 -1
  38. data/lib/arachni/component/options/address.rb +1 -1
  39. data/lib/arachni/component/options/base.rb +1 -1
  40. data/lib/arachni/component/options/bool.rb +1 -1
  41. data/lib/arachni/component/options/enum.rb +1 -1
  42. data/lib/arachni/component/options/float.rb +1 -1
  43. data/lib/arachni/component/options/int.rb +1 -1
  44. data/lib/arachni/component/options/path.rb +1 -1
  45. data/lib/arachni/component/options/port.rb +1 -1
  46. data/lib/arachni/component/options/string.rb +1 -1
  47. data/lib/arachni/component/options/url.rb +1 -1
  48. data/lib/arachni/element/base.rb +1 -1
  49. data/lib/arachni/element/body.rb +1 -1
  50. data/lib/arachni/element/capabilities/auditable.rb +45 -22
  51. data/lib/arachni/element/capabilities/auditable/rdiff.rb +378 -122
  52. data/lib/arachni/element/capabilities/auditable/taint.rb +57 -20
  53. data/lib/arachni/element/capabilities/auditable/timeout.rb +95 -68
  54. data/lib/arachni/element/capabilities/mutable.rb +77 -40
  55. data/lib/arachni/element/capabilities/refreshable.rb +7 -1
  56. data/lib/arachni/element/cookie.rb +46 -167
  57. data/lib/arachni/element/form.rb +77 -517
  58. data/lib/arachni/element/header.rb +21 -15
  59. data/lib/arachni/element/link.rb +2 -2
  60. data/lib/arachni/element/path.rb +1 -1
  61. data/lib/arachni/element/server.rb +1 -1
  62. data/lib/arachni/element_filter.rb +1 -1
  63. data/lib/arachni/error.rb +1 -1
  64. data/lib/arachni/framework.rb +16 -7
  65. data/lib/arachni/http.rb +111 -118
  66. data/lib/arachni/http/cookie_jar.rb +8 -2
  67. data/lib/arachni/issue.rb +4 -1
  68. data/lib/arachni/mixins/observable.rb +1 -1
  69. data/lib/arachni/mixins/progress_bar.rb +1 -1
  70. data/lib/arachni/mixins/terminal.rb +1 -1
  71. data/lib/arachni/module.rb +1 -1
  72. data/lib/arachni/module/auditor.rb +23 -17
  73. data/lib/arachni/module/base.rb +1 -1
  74. data/lib/arachni/module/manager.rb +4 -4
  75. data/lib/arachni/module/output.rb +1 -1
  76. data/lib/arachni/module/utilities.rb +1 -1
  77. data/lib/arachni/options.rb +28 -7
  78. data/lib/arachni/page.rb +4 -5
  79. data/lib/arachni/parser.rb +3 -2
  80. data/lib/arachni/platform.rb +1 -1
  81. data/lib/arachni/platform/fingerprinter.rb +1 -1
  82. data/lib/arachni/platform/list.rb +11 -29
  83. data/lib/arachni/platform/manager.rb +31 -8
  84. data/lib/arachni/plugin.rb +1 -1
  85. data/lib/arachni/plugin/base.rb +1 -1
  86. data/lib/arachni/plugin/manager.rb +1 -1
  87. data/lib/arachni/processes.rb +1 -1
  88. data/lib/arachni/processes/dispatchers.rb +1 -1
  89. data/lib/arachni/processes/helpers.rb +1 -1
  90. data/lib/arachni/processes/helpers/dispatchers.rb +1 -1
  91. data/lib/arachni/processes/helpers/instances.rb +1 -1
  92. data/lib/arachni/processes/helpers/processes.rb +1 -1
  93. data/lib/arachni/processes/instances.rb +1 -1
  94. data/lib/arachni/processes/manager.rb +1 -1
  95. data/lib/arachni/report.rb +1 -1
  96. data/lib/arachni/report/base.rb +1 -1
  97. data/lib/arachni/report/manager.rb +1 -1
  98. data/lib/arachni/rpc/client/base.rb +1 -1
  99. data/lib/arachni/rpc/client/dispatcher.rb +1 -1
  100. data/lib/arachni/rpc/client/instance.rb +1 -1
  101. data/lib/arachni/rpc/server/active_options.rb +1 -1
  102. data/lib/arachni/rpc/server/base.rb +1 -1
  103. data/lib/arachni/rpc/server/dispatcher.rb +10 -6
  104. data/lib/arachni/rpc/server/dispatcher/handler.rb +1 -1
  105. data/lib/arachni/rpc/server/dispatcher/node.rb +5 -3
  106. data/lib/arachni/rpc/server/framework.rb +5 -3
  107. data/lib/arachni/rpc/server/framework/distributor.rb +24 -19
  108. data/lib/arachni/rpc/server/framework/master.rb +1 -1
  109. data/lib/arachni/rpc/server/framework/multi_instance.rb +7 -1
  110. data/lib/arachni/rpc/server/framework/slave.rb +1 -1
  111. data/lib/arachni/rpc/server/instance.rb +5 -4
  112. data/lib/arachni/rpc/server/module/manager.rb +1 -1
  113. data/lib/arachni/rpc/server/output.rb +1 -1
  114. data/lib/arachni/rpc/server/plugin/manager.rb +1 -1
  115. data/lib/arachni/rpc/server/spider.rb +5 -2
  116. data/lib/arachni/ruby.rb +1 -1
  117. data/lib/arachni/ruby/array.rb +9 -1
  118. data/lib/arachni/ruby/enumerable.rb +1 -1
  119. data/lib/arachni/ruby/hash.rb +24 -5
  120. data/lib/arachni/ruby/io.rb +1 -1
  121. data/lib/arachni/ruby/object.rb +1 -1
  122. data/lib/arachni/ruby/set.rb +1 -1
  123. data/lib/arachni/ruby/string.rb +13 -2
  124. data/lib/arachni/ruby/webrick.rb +3 -15
  125. data/lib/arachni/ruby/webrick/cookie.rb +30 -0
  126. data/lib/arachni/ruby/webrick/httprequest.rb +42 -0
  127. data/lib/arachni/session.rb +21 -8
  128. data/lib/arachni/spider.rb +18 -11
  129. data/lib/arachni/support.rb +3 -1
  130. data/lib/arachni/support/buffer.rb +1 -1
  131. data/lib/arachni/support/buffer/autoflush.rb +1 -1
  132. data/lib/arachni/support/buffer/base.rb +1 -1
  133. data/lib/arachni/support/cache.rb +1 -1
  134. data/lib/arachni/support/cache/base.rb +1 -1
  135. data/lib/arachni/support/cache/least_cost_replacement.rb +1 -1
  136. data/lib/arachni/support/cache/least_recently_used.rb +1 -1
  137. data/lib/arachni/support/cache/preference.rb +1 -1
  138. data/lib/arachni/support/cache/random_replacement.rb +1 -1
  139. data/lib/arachni/support/crypto.rb +1 -1
  140. data/lib/arachni/support/crypto/rsa_aes_cbc.rb +1 -1
  141. data/lib/arachni/support/database.rb +1 -1
  142. data/lib/arachni/support/database/base.rb +5 -5
  143. data/lib/arachni/support/database/hash.rb +1 -1
  144. data/lib/arachni/support/database/queue.rb +52 -69
  145. data/lib/arachni/{module → support}/key_filler.rb +11 -17
  146. data/lib/arachni/support/lookup.rb +1 -1
  147. data/lib/arachni/support/lookup/base.rb +1 -1
  148. data/lib/arachni/support/lookup/hash_set.rb +1 -1
  149. data/lib/arachni/support/lookup/moolb.rb +1 -1
  150. data/lib/arachni/support/queue.rb +1 -1
  151. data/lib/arachni/support/queue/disk.rb +1 -1
  152. data/lib/arachni/support/signature.rb +153 -0
  153. data/lib/arachni/trainer.rb +30 -19
  154. data/lib/arachni/typhoeus/hydra.rb +1 -1
  155. data/lib/arachni/typhoeus/request.rb +1 -1
  156. data/lib/arachni/typhoeus/response.rb +8 -2
  157. data/lib/arachni/typhoeus/utils.rb +1 -1
  158. data/lib/arachni/ui/cli/cli.rb +18 -7
  159. data/lib/arachni/ui/cli/output.rb +28 -1
  160. data/lib/arachni/ui/cli/rpc/dispatcher_monitor.rb +1 -1
  161. data/lib/arachni/ui/cli/rpc/instance.rb +1 -1
  162. data/lib/arachni/ui/cli/rpc/local.rb +1 -1
  163. data/lib/arachni/ui/cli/rpc/remote.rb +1 -1
  164. data/lib/arachni/ui/cli/utilities.rb +14 -29
  165. data/lib/arachni/ui/foo/output.rb +1 -1
  166. data/lib/arachni/uri.rb +2 -3
  167. data/lib/arachni/utilities.rb +1 -1
  168. data/lib/arachni/version.rb +1 -1
  169. data/lib/version +1 -1
  170. data/modules/audit/code_injection.rb +1 -1
  171. data/modules/audit/code_injection_php_input_wrapper.rb +1 -1
  172. data/modules/audit/code_injection_timing.rb +1 -1
  173. data/modules/audit/csrf.rb +1 -1
  174. data/modules/audit/file_inclusion.rb +5 -5
  175. data/modules/audit/ldapi.rb +1 -1
  176. data/modules/audit/os_cmd_injection.rb +1 -1
  177. data/modules/audit/os_cmd_injection_timing.rb +4 -3
  178. data/modules/audit/path_traversal.rb +5 -5
  179. data/modules/audit/response_splitting.rb +1 -1
  180. data/modules/audit/rfi.rb +1 -1
  181. data/modules/audit/session_fixation.rb +1 -1
  182. data/modules/audit/source_code_disclosure.rb +21 -17
  183. data/modules/audit/sqli.rb +11 -8
  184. data/modules/audit/sqli/patterns/pgsql +1 -0
  185. data/modules/audit/sqli/regexp_ignore.txt +1 -0
  186. data/modules/audit/sqli_blind_rdiff.rb +12 -12
  187. data/modules/audit/sqli_blind_rdiff/payloads.txt +1 -5
  188. data/modules/audit/sqli_blind_timing.rb +4 -6
  189. data/modules/audit/sqli_blind_timing/mssql.txt +9 -9
  190. data/modules/audit/sqli_blind_timing/mysql.txt +9 -31
  191. data/modules/audit/sqli_blind_timing/pgsql.txt +6 -28
  192. data/modules/audit/trainer.rb +1 -1
  193. data/modules/audit/unvalidated_redirect.rb +1 -1
  194. data/modules/audit/xpath.rb +1 -1
  195. data/modules/audit/xss.rb +12 -12
  196. data/modules/audit/xss_event.rb +1 -1
  197. data/modules/audit/xss_path.rb +1 -1
  198. data/modules/audit/xss_script_tag.rb +13 -20
  199. data/modules/audit/xss_tag.rb +5 -7
  200. data/modules/recon/allowed_methods.rb +1 -1
  201. data/modules/recon/backdoors.rb +1 -1
  202. data/modules/recon/backup_files.rb +1 -1
  203. data/modules/recon/common_directories.rb +1 -1
  204. data/modules/recon/common_files.rb +1 -1
  205. data/modules/recon/common_files/filenames.txt +1 -0
  206. data/modules/recon/directory_listing.rb +2 -2
  207. data/modules/recon/grep/captcha.rb +1 -1
  208. data/modules/recon/grep/credit_card.rb +1 -1
  209. data/modules/recon/grep/cvs_svn_users.rb +1 -1
  210. data/modules/recon/grep/emails.rb +1 -1
  211. data/modules/recon/grep/form_upload.rb +1 -1
  212. data/modules/recon/grep/html_objects.rb +1 -1
  213. data/modules/recon/grep/http_only_cookies.rb +1 -1
  214. data/modules/recon/grep/insecure_cookies.rb +1 -1
  215. data/modules/recon/grep/mixed_resource.rb +1 -1
  216. data/modules/recon/grep/password_autocomplete.rb +1 -1
  217. data/modules/recon/grep/private_ip.rb +1 -1
  218. data/modules/recon/grep/ssn.rb +1 -1
  219. data/modules/recon/grep/unencrypted_password_forms.rb +1 -1
  220. data/modules/recon/htaccess_limit.rb +1 -1
  221. data/modules/recon/http_put.rb +1 -1
  222. data/modules/recon/interesting_responses.rb +1 -1
  223. data/modules/recon/localstart_asp.rb +5 -5
  224. data/modules/recon/webdav.rb +1 -1
  225. data/modules/recon/x_forwarded_for_access_restriction_bypass.rb +1 -1
  226. data/modules/recon/xst.rb +1 -1
  227. data/path_extractors/anchors.rb +1 -1
  228. data/path_extractors/areas.rb +1 -1
  229. data/path_extractors/forms.rb +1 -1
  230. data/path_extractors/frames.rb +1 -1
  231. data/path_extractors/generic.rb +1 -1
  232. data/path_extractors/links.rb +1 -1
  233. data/path_extractors/meta_refresh.rb +1 -1
  234. data/path_extractors/scripts.rb +1 -1
  235. data/plugins/autologin.rb +16 -8
  236. data/plugins/beep_notify.rb +1 -1
  237. data/plugins/{defaults/content_types.rb → content_types.rb} +1 -1
  238. data/plugins/cookie_collector.rb +21 -11
  239. data/plugins/defaults/autothrottle.rb +1 -1
  240. data/plugins/defaults/healthmap.rb +1 -1
  241. data/plugins/defaults/meta/remedies/discovery.rb +1 -1
  242. data/plugins/defaults/meta/remedies/timing_attacks.rb +6 -8
  243. data/plugins/defaults/meta/uniformity.rb +1 -1
  244. data/plugins/defaults/resolver.rb +1 -1
  245. data/plugins/email_notify.rb +1 -1
  246. data/plugins/form_dicattack.rb +1 -1
  247. data/plugins/http_dicattack.rb +1 -1
  248. data/plugins/libnotify.rb +1 -1
  249. data/plugins/profiler.rb +1 -1
  250. data/plugins/proxy.rb +2 -1
  251. data/plugins/proxy/server.rb +3 -1
  252. data/plugins/proxy/template_scope.rb +1 -1
  253. data/plugins/rescan.rb +1 -1
  254. data/plugins/script.rb +1 -1
  255. data/plugins/uncommon_headers.rb +2 -1
  256. data/plugins/vector_feed.rb +1 -1
  257. data/plugins/waf_detector.rb +1 -1
  258. data/reports/afr.rb +8 -9
  259. data/reports/ap.rb +1 -1
  260. data/reports/html.rb +8 -12
  261. data/reports/html/default.erb +2 -3
  262. data/reports/html/default/issue.erb +0 -12
  263. data/reports/html/default/issues.erb +2 -2
  264. data/reports/json.rb +13 -10
  265. data/reports/marshal.rb +8 -9
  266. data/reports/metareport.rb +9 -10
  267. data/reports/plugin_formatters/html/autologin.rb +1 -1
  268. data/reports/plugin_formatters/html/content_types.rb +1 -1
  269. data/reports/plugin_formatters/html/cookie_collector.rb +1 -1
  270. data/reports/plugin_formatters/html/discovery.rb +1 -1
  271. data/reports/plugin_formatters/html/form_dicattack.rb +1 -1
  272. data/reports/plugin_formatters/html/healthmap.rb +1 -1
  273. data/reports/plugin_formatters/html/http_dicattack.rb +1 -1
  274. data/reports/plugin_formatters/html/profiler.rb +1 -1
  275. data/reports/plugin_formatters/html/resolver.rb +1 -1
  276. data/reports/plugin_formatters/html/timing_attacks.rb +1 -1
  277. data/reports/plugin_formatters/html/uncommon_headers.rb +1 -1
  278. data/reports/plugin_formatters/html/uniformity.rb +1 -1
  279. data/reports/plugin_formatters/html/waf_detector.rb +1 -1
  280. data/reports/plugin_formatters/stdout/autologin.rb +1 -1
  281. data/reports/plugin_formatters/stdout/content_types.rb +1 -1
  282. data/reports/plugin_formatters/stdout/cookie_collector.rb +1 -1
  283. data/reports/plugin_formatters/stdout/discovery.rb +1 -1
  284. data/reports/plugin_formatters/stdout/form_dicattack.rb +1 -1
  285. data/reports/plugin_formatters/stdout/healthmap.rb +2 -4
  286. data/reports/plugin_formatters/stdout/http_dicattack.rb +1 -1
  287. data/reports/plugin_formatters/stdout/profiler.rb +1 -1
  288. data/reports/plugin_formatters/stdout/resolver.rb +1 -1
  289. data/reports/plugin_formatters/stdout/timing_attacks.rb +1 -1
  290. data/reports/plugin_formatters/stdout/uncommon_headers.rb +1 -1
  291. data/reports/plugin_formatters/stdout/uniformity.rb +1 -1
  292. data/reports/plugin_formatters/stdout/waf_detector.rb +1 -1
  293. data/reports/plugin_formatters/xml/autologin.rb +1 -1
  294. data/reports/plugin_formatters/xml/content_types.rb +1 -1
  295. data/reports/plugin_formatters/xml/cookie_collector.rb +1 -1
  296. data/reports/plugin_formatters/xml/discovery.rb +1 -1
  297. data/reports/plugin_formatters/xml/form_dicattack.rb +1 -1
  298. data/reports/plugin_formatters/xml/healthmap.rb +1 -1
  299. data/reports/plugin_formatters/xml/http_dicattack.rb +1 -1
  300. data/reports/plugin_formatters/xml/profiler.rb +1 -1
  301. data/reports/plugin_formatters/xml/resolver.rb +1 -1
  302. data/reports/plugin_formatters/xml/timing_attacks.rb +1 -1
  303. data/reports/plugin_formatters/xml/uncommon_headers.rb +1 -1
  304. data/reports/plugin_formatters/xml/uniformity.rb +1 -1
  305. data/reports/plugin_formatters/xml/waf_detector.rb +1 -1
  306. data/reports/stdout.rb +1 -1
  307. data/reports/txt.rb +1 -1
  308. data/reports/xml.rb +8 -9
  309. data/reports/xml/buffer.rb +2 -2
  310. data/reports/yaml.rb +8 -9
  311. data/spec/arachni/element/capabilities/auditable/rdiff_spec.rb +80 -2
  312. data/spec/arachni/element/capabilities/auditable/timeout_spec.rb +44 -29
  313. data/spec/arachni/element/cookie_spec.rb +1 -1
  314. data/spec/arachni/element/form_spec.rb +31 -13
  315. data/spec/arachni/http/cookie_jar_spec.rb +11 -0
  316. data/spec/arachni/http_spec.rb +33 -7
  317. data/spec/arachni/issue_spec.rb +10 -3
  318. data/spec/arachni/options_spec.rb +18 -1
  319. data/spec/arachni/parser_spec.rb +27 -26
  320. data/spec/arachni/rpc/server/dispatcher/node_spec.rb +10 -1
  321. data/spec/arachni/rpc/server/dispatcher_spec.rb +15 -0
  322. data/spec/arachni/ruby/array_spec.rb +11 -0
  323. data/spec/arachni/ruby/hash_spec.rb +28 -1
  324. data/spec/arachni/ruby/string_spec.rb +14 -1
  325. data/spec/arachni/session_spec.rb +39 -0
  326. data/spec/arachni/spider_spec.rb +23 -14
  327. data/spec/arachni/{module → support}/key_filler.rb +20 -2
  328. data/spec/arachni/support/signature_spec.rb +158 -0
  329. data/spec/arachni/trainer_spec.rb +31 -0
  330. data/spec/arachni/typhoeus/response_spec.rb +17 -0
  331. data/spec/arachni/uri_spec.rb +1 -1
  332. data/spec/external/wavsep/active/lfi_spec.rb +94 -0
  333. data/spec/external/wavsep/active/rfi_spec.rb +35 -0
  334. data/spec/external/wavsep/active/sqli_spec.rb +108 -0
  335. data/spec/external/wavsep/active/xss_spec.rb +41 -0
  336. data/spec/external/wavsep/false_positives/lfi_spec.rb +33 -0
  337. data/spec/external/wavsep/false_positives/rfi_spec.rb +21 -0
  338. data/spec/external/wavsep/false_positives/sqli_spec.rb +32 -0
  339. data/spec/external/wavsep/false_positives/xss_spec.rb +21 -0
  340. data/spec/modules/audit/source_code_disclosure_spec.rb +4 -4
  341. data/spec/modules/audit/sqli_blind_rdiff_spec.rb +1 -1
  342. data/spec/modules/audit/sqli_blind_timing_spec.rb +3 -3
  343. data/spec/modules/audit/sqli_spec.rb +1 -1
  344. data/spec/modules/audit/xss_script_tag_spec.rb +1 -1
  345. data/spec/plugins/autologin_spec.rb +25 -7
  346. data/spec/plugins/cookie_collector_spec.rb +17 -0
  347. data/spec/spec_helper.rb +1 -1
  348. data/spec/support/fixtures/fingerprinters/test.rb +1 -1
  349. data/spec/support/fixtures/modules/test.rb +1 -1
  350. data/spec/support/fixtures/modules/test2.rb +1 -1
  351. data/spec/support/fixtures/modules/test3.rb +1 -1
  352. data/spec/support/fixtures/plugins/bad.rb +1 -1
  353. data/spec/support/fixtures/plugins/defaults/default.rb +1 -1
  354. data/spec/support/fixtures/plugins/distributable.rb +1 -1
  355. data/spec/support/fixtures/plugins/loop.rb +1 -1
  356. data/spec/support/fixtures/plugins/spider_hook.rb +1 -1
  357. data/spec/support/fixtures/plugins/wait.rb +1 -1
  358. data/spec/support/fixtures/plugins/with_options.rb +1 -1
  359. data/spec/support/fixtures/reports/base_spec/plugin_formatters/with_formatters/foobar.rb +1 -1
  360. data/spec/support/fixtures/reports/base_spec/with_formatters.rb +1 -1
  361. data/spec/support/fixtures/reports/base_spec/with_outfile.rb +1 -1
  362. data/spec/support/fixtures/reports/base_spec/without_outfile.rb +1 -1
  363. data/spec/support/fixtures/reports/manager_spec/afr.rb +1 -1
  364. data/spec/support/fixtures/reports/manager_spec/foo.rb +1 -1
  365. data/spec/support/fixtures/run_mod/body.rb +1 -1
  366. data/spec/support/fixtures/run_mod/cookies.rb +1 -1
  367. data/spec/support/fixtures/run_mod/empty.rb +1 -1
  368. data/spec/support/fixtures/run_mod/flch.rb +1 -1
  369. data/spec/support/fixtures/run_mod/forms.rb +1 -1
  370. data/spec/support/fixtures/run_mod/headers.rb +1 -1
  371. data/spec/support/fixtures/run_mod/links.rb +1 -1
  372. data/spec/support/fixtures/run_mod/nil.rb +1 -1
  373. data/spec/support/fixtures/run_mod/path.rb +1 -1
  374. data/spec/support/fixtures/run_mod/server.rb +1 -1
  375. data/spec/support/fixtures/taint_module/taint.rb +1 -1
  376. data/spec/support/fixtures/wait_module/wait.rb +1 -1
  377. data/spec/support/helpers/framework.rb +1 -1
  378. data/spec/support/helpers/misc.rb +1 -1
  379. data/spec/support/helpers/paths.rb +1 -1
  380. data/spec/support/helpers/requires.rb +1 -1
  381. data/spec/support/helpers/resets.rb +1 -1
  382. data/spec/support/helpers/web_server.rb +1 -1
  383. data/spec/support/lib/web_server_manager.rb +1 -1
  384. data/spec/support/logs/Dispatcher - 10129-46995.log +9 -0
  385. data/spec/support/logs/Dispatcher - 10139-63648.log +19 -0
  386. data/spec/support/logs/Dispatcher - 10149-5551.log +17 -0
  387. data/spec/support/logs/Dispatcher - 10158-34385.log +13 -0
  388. data/spec/support/logs/Dispatcher - 10167-55701.log +9 -0
  389. data/spec/support/logs/Dispatcher - 10176-8922.log +9 -0
  390. data/spec/support/logs/Dispatcher - 10185-53716.log +11 -0
  391. data/spec/support/logs/Dispatcher - 10198-44724.log +11 -0
  392. data/spec/support/logs/Dispatcher - 10211-7697.log +11 -0
  393. data/spec/support/logs/Dispatcher - 10224-3751.log +35 -0
  394. data/spec/support/logs/Dispatcher - 10285-7404.log +21 -0
  395. data/spec/support/logs/Dispatcher - 10294-56221.log +21 -0
  396. data/spec/support/logs/Dispatcher - 10303-2483.log +23 -0
  397. data/spec/support/logs/Dispatcher - 10344-60543.log +19 -0
  398. data/spec/support/logs/Dispatcher - 10355-31708.log +17 -0
  399. data/spec/support/logs/Dispatcher - 10364-63170.log +15 -0
  400. data/spec/support/logs/Dispatcher - 10377-37936.log +11 -0
  401. data/spec/support/logs/Dispatcher - 10390-37511.log +9 -0
  402. data/spec/support/logs/Dispatcher - 10400-29603.log +9 -0
  403. data/spec/support/logs/Dispatcher - 10409-57042.log +9 -0
  404. data/spec/support/logs/Dispatcher - 10418-17812.log +9 -0
  405. data/spec/support/logs/Dispatcher - 10427-59862.log +11 -0
  406. data/spec/support/logs/Dispatcher - 10440-48351.log +9 -0
  407. data/spec/support/logs/Dispatcher - 10449-24218.log +9 -0
  408. data/spec/support/logs/Dispatcher - 10458-54646.log +9 -0
  409. data/spec/support/logs/Dispatcher - 10511-3333.log +63 -0
  410. data/spec/support/logs/Dispatcher - 10520-50009.log +43 -0
  411. data/spec/support/logs/Dispatcher - 10529-44870.log +39 -0
  412. data/spec/support/logs/Dispatcher - 10538-49556.log +34 -0
  413. data/spec/support/logs/Dispatcher - 10547-61887.log +28 -0
  414. data/spec/support/logs/Dispatcher - 10556-31163.log +21 -0
  415. data/spec/support/logs/Dispatcher - 10565-40008.log +13 -0
  416. data/spec/support/logs/Dispatcher - 10575-18836.log +9 -0
  417. data/spec/support/logs/Dispatcher - 10747-32268.log +19 -0
  418. data/spec/support/logs/Dispatcher - 10757-4081.log +21 -0
  419. data/spec/support/logs/Dispatcher - 10766-49190.log +15 -0
  420. data/spec/support/logs/Dispatcher - 10780-46610.log +19 -0
  421. data/spec/support/logs/Dispatcher - 10789-5332.log +21 -0
  422. data/spec/support/logs/Dispatcher - 10798-56243.log +15 -0
  423. data/spec/support/logs/Dispatcher - 10920-32037.log +17 -0
  424. data/spec/support/logs/Dispatcher - 10929-35662.log +21 -0
  425. data/spec/support/logs/Dispatcher - 10938-64010.log +13 -0
  426. data/spec/support/logs/Dispatcher - 10951-44746.log +19 -0
  427. data/spec/support/logs/Dispatcher - 10961-55791.log +21 -0
  428. data/spec/support/logs/Dispatcher - 10972-58913.log +15 -0
  429. data/spec/support/logs/Dispatcher - 11023-45004.log +17 -0
  430. data/spec/support/logs/Dispatcher - 11033-55505.log +21 -0
  431. data/spec/support/logs/Dispatcher - 11042-46123.log +13 -0
  432. data/spec/support/logs/Dispatcher - 11055-26836.log +17 -0
  433. data/spec/support/logs/Dispatcher - 11064-60361.log +21 -0
  434. data/spec/support/logs/Dispatcher - 11073-17507.log +13 -0
  435. data/spec/support/logs/Dispatcher - 11298-28357.log +19 -0
  436. data/spec/support/logs/Dispatcher - 11307-62669.log +21 -0
  437. data/spec/support/logs/Dispatcher - 11316-9391.log +15 -0
  438. data/spec/support/logs/Dispatcher - 11340-45921.log +21 -0
  439. data/spec/support/logs/Dispatcher - 11349-8693.log +25 -0
  440. data/spec/support/logs/Dispatcher - 11358-53753.log +15 -0
  441. data/spec/support/logs/Dispatcher - 11394-29437.log +17 -0
  442. data/spec/support/logs/Dispatcher - 11403-59953.log +21 -0
  443. data/spec/support/logs/Dispatcher - 11412-51134.log +13 -0
  444. data/spec/support/logs/Dispatcher - 11425-42569.log +21 -0
  445. data/spec/support/logs/Dispatcher - 11434-16150.log +25 -0
  446. data/spec/support/logs/Dispatcher - 11443-19072.log +15 -0
  447. data/spec/support/logs/Dispatcher - 11479-39149.log +17 -0
  448. data/spec/support/logs/Dispatcher - 11488-42169.log +21 -0
  449. data/spec/support/logs/Dispatcher - 11497-29822.log +13 -0
  450. data/spec/support/logs/Dispatcher - 11510-8273.log +17 -0
  451. data/spec/support/logs/Dispatcher - 11519-18206.log +21 -0
  452. data/spec/support/logs/Dispatcher - 11528-55825.log +13 -0
  453. data/spec/support/logs/Dispatcher - 9969-52890.log +9 -0
  454. data/spec/support/logs/Dispatcher - 9996-38451.log +21 -0
  455. data/spec/support/logs/{Instance - 12589-35500.error.log → Instance - 10762-33696.error.log } +63 -40
  456. data/spec/support/logs/{Instance - 16415-47240.error.log → Instance - 11038-18065.error.log } +65 -42
  457. data/spec/support/logs/{Instance - 16762-48636.error.log → Instance - 11069-34848.error.log } +162 -139
  458. data/spec/support/logs/{Instance - 16789-61713.error.log → Instance - 11091-33954.error.log } +60 -37
  459. data/spec/support/logs/{Instance - 16795-55306.error.log → Instance - 11097-33191.error.log } +65 -42
  460. data/spec/support/logs/{Instance - 12909-9442.error.log → Instance - 11229-38634.error.log } +60 -37
  461. data/spec/support/servers/arachni/element/capabilities/auditable/rdiff.rb +131 -7
  462. data/spec/support/servers/arachni/element/capabilities/auditable/timeout.rb +4 -0
  463. data/spec/support/servers/arachni/element/form.rb +27 -0
  464. data/spec/support/servers/arachni/element/link.rb +16 -0
  465. data/spec/support/servers/arachni/session.rb +17 -1
  466. data/spec/support/servers/arachni/spider.rb +25 -1
  467. data/spec/support/servers/arachni/trainer.rb +8 -0
  468. data/spec/support/servers/modules/audit/os_cmd_injection_timing.rb +2 -1
  469. data/spec/support/servers/modules/audit/source_code_disclosure.rb +0 -1
  470. data/spec/support/servers/modules/audit/sqli/postgresql +2 -0
  471. data/spec/support/servers/modules/audit/sqli_blind_rdiff.rb +9 -13
  472. data/spec/support/shared/element/capabilities/auditable.rb +62 -3
  473. data/spec/support/shared/element/capabilities/refreshable.rb +27 -0
  474. data/spec/support/shared/external/wavsep.rb +89 -0
  475. metadata +1081 -1206
  476. data/lib/arachni/platforms.rb +0 -499
  477. data/logs/Dispatcher - 12101-7331.log +0 -15
  478. data/spec/support/logs/Dispatcher - 11821-58635.log +0 -9
  479. data/spec/support/logs/Dispatcher - 11848-37716.log +0 -21
  480. data/spec/support/logs/Dispatcher - 11974-31477.log +0 -9
  481. data/spec/support/logs/Dispatcher - 11984-10290.log +0 -19
  482. data/spec/support/logs/Dispatcher - 11993-33501.log +0 -17
  483. data/spec/support/logs/Dispatcher - 12002-62227.log +0 -13
  484. data/spec/support/logs/Dispatcher - 12013-45779.log +0 -9
  485. data/spec/support/logs/Dispatcher - 12022-22434.log +0 -9
  486. data/spec/support/logs/Dispatcher - 12031-41130.log +0 -11
  487. data/spec/support/logs/Dispatcher - 12045-23894.log +0 -11
  488. data/spec/support/logs/Dispatcher - 12059-57317.log +0 -35
  489. data/spec/support/logs/Dispatcher - 12122-60206.log +0 -21
  490. data/spec/support/logs/Dispatcher - 12132-58445.log +0 -21
  491. data/spec/support/logs/Dispatcher - 12141-13273.log +0 -23
  492. data/spec/support/logs/Dispatcher - 12183-2341.log +0 -19
  493. data/spec/support/logs/Dispatcher - 12192-56486.log +0 -17
  494. data/spec/support/logs/Dispatcher - 12201-8840.log +0 -15
  495. data/spec/support/logs/Dispatcher - 12214-47545.log +0 -11
  496. data/spec/support/logs/Dispatcher - 12227-23676.log +0 -9
  497. data/spec/support/logs/Dispatcher - 12236-16018.log +0 -9
  498. data/spec/support/logs/Dispatcher - 12245-61980.log +0 -9
  499. data/spec/support/logs/Dispatcher - 12254-30185.log +0 -9
  500. data/spec/support/logs/Dispatcher - 12263-29578.log +0 -11
  501. data/spec/support/logs/Dispatcher - 12276-64279.log +0 -9
  502. data/spec/support/logs/Dispatcher - 12285-49975.log +0 -9
  503. data/spec/support/logs/Dispatcher - 12347-26600.log +0 -63
  504. data/spec/support/logs/Dispatcher - 12356-43960.log +0 -43
  505. data/spec/support/logs/Dispatcher - 12365-30567.log +0 -39
  506. data/spec/support/logs/Dispatcher - 12374-49263.log +0 -34
  507. data/spec/support/logs/Dispatcher - 12401-6543.log +0 -28
  508. data/spec/support/logs/Dispatcher - 12410-21678.log +0 -21
  509. data/spec/support/logs/Dispatcher - 12419-42381.log +0 -13
  510. data/spec/support/logs/Dispatcher - 12429-25829.log +0 -9
  511. data/spec/support/logs/Dispatcher - 12574-63838.log +0 -19
  512. data/spec/support/logs/Dispatcher - 12584-33256.log +0 -21
  513. data/spec/support/logs/Dispatcher - 12593-45982.log +0 -15
  514. data/spec/support/logs/Dispatcher - 12606-64171.log +0 -19
  515. data/spec/support/logs/Dispatcher - 12615-52258.log +0 -21
  516. data/spec/support/logs/Dispatcher - 12624-48032.log +0 -15
  517. data/spec/support/logs/Dispatcher - 12744-31691.log +0 -17
  518. data/spec/support/logs/Dispatcher - 12753-9777.log +0 -21
  519. data/spec/support/logs/Dispatcher - 12762-14195.log +0 -13
  520. data/spec/support/logs/Dispatcher - 12775-52778.log +0 -19
  521. data/spec/support/logs/Dispatcher - 12784-33121.log +0 -21
  522. data/spec/support/logs/Dispatcher - 12793-23476.log +0 -15
  523. data/spec/support/logs/Dispatcher - 12845-33401.log +0 -17
  524. data/spec/support/logs/Dispatcher - 12854-58592.log +0 -21
  525. data/spec/support/logs/Dispatcher - 12863-38667.log +0 -13
  526. data/spec/support/logs/Dispatcher - 12876-18504.log +0 -17
  527. data/spec/support/logs/Dispatcher - 12885-8765.log +0 -21
  528. data/spec/support/logs/Dispatcher - 12894-7708.log +0 -13
  529. data/spec/support/logs/Dispatcher - 13112-20247.log +0 -19
  530. data/spec/support/logs/Dispatcher - 13121-37610.log +0 -21
  531. data/spec/support/logs/Dispatcher - 13130-55144.log +0 -15
  532. data/spec/support/logs/Dispatcher - 13154-11476.log +0 -21
  533. data/spec/support/logs/Dispatcher - 13163-28157.log +0 -25
  534. data/spec/support/logs/Dispatcher - 13172-1403.log +0 -15
  535. data/spec/support/logs/Dispatcher - 13208-39214.log +0 -17
  536. data/spec/support/logs/Dispatcher - 13217-25789.log +0 -21
  537. data/spec/support/logs/Dispatcher - 13226-32449.log +0 -13
  538. data/spec/support/logs/Dispatcher - 13239-50344.log +0 -21
  539. data/spec/support/logs/Dispatcher - 13248-35317.log +0 -25
  540. data/spec/support/logs/Dispatcher - 13257-20820.log +0 -15
  541. data/spec/support/logs/Dispatcher - 13293-39307.log +0 -17
  542. data/spec/support/logs/Dispatcher - 13302-62417.log +0 -21
  543. data/spec/support/logs/Dispatcher - 13311-57144.log +0 -13
  544. data/spec/support/logs/Dispatcher - 13324-35654.log +0 -17
  545. data/spec/support/logs/Dispatcher - 13333-9999.log +0 -21
  546. data/spec/support/logs/Dispatcher - 13342-64466.log +0 -13
  547. data/spec/support/logs/Dispatcher - 15092-40680.log +0 -9
  548. data/spec/support/logs/Dispatcher - 15119-21562.log +0 -21
  549. data/spec/support/logs/Dispatcher - 15680-63471.log +0 -9
  550. data/spec/support/logs/Dispatcher - 15690-15104.log +0 -19
  551. data/spec/support/logs/Dispatcher - 15699-36034.log +0 -17
  552. data/spec/support/logs/Dispatcher - 15708-21275.log +0 -13
  553. data/spec/support/logs/Dispatcher - 15717-6134.log +0 -9
  554. data/spec/support/logs/Dispatcher - 15727-5906.log +0 -9
  555. data/spec/support/logs/Dispatcher - 15736-27941.log +0 -11
  556. data/spec/support/logs/Dispatcher - 15749-31464.log +0 -11
  557. data/spec/support/logs/Dispatcher - 15762-52837.log +0 -35
  558. data/spec/support/logs/Dispatcher - 15823-2486.log +0 -21
  559. data/spec/support/logs/Dispatcher - 15832-34792.log +0 -21
  560. data/spec/support/logs/Dispatcher - 15841-3367.log +0 -23
  561. data/spec/support/logs/Dispatcher - 15886-2171.log +0 -19
  562. data/spec/support/logs/Dispatcher - 15895-6022.log +0 -17
  563. data/spec/support/logs/Dispatcher - 15904-51624.log +0 -15
  564. data/spec/support/logs/Dispatcher - 15917-11227.log +0 -11
  565. data/spec/support/logs/Dispatcher - 15930-17170.log +0 -9
  566. data/spec/support/logs/Dispatcher - 15939-24891.log +0 -9
  567. data/spec/support/logs/Dispatcher - 15948-26858.log +0 -9
  568. data/spec/support/logs/Dispatcher - 15957-12278.log +0 -9
  569. data/spec/support/logs/Dispatcher - 15967-37642.log +0 -11
  570. data/spec/support/logs/Dispatcher - 15981-57959.log +0 -9
  571. data/spec/support/logs/Dispatcher - 16000-51003.log +0 -9
  572. data/spec/support/logs/Dispatcher - 16064-25969.log +0 -63
  573. data/spec/support/logs/Dispatcher - 16073-13164.log +0 -43
  574. data/spec/support/logs/Dispatcher - 16083-21729.log +0 -39
  575. data/spec/support/logs/Dispatcher - 16092-48691.log +0 -34
  576. data/spec/support/logs/Dispatcher - 16101-7385.log +0 -28
  577. data/spec/support/logs/Dispatcher - 16110-24222.log +0 -21
  578. data/spec/support/logs/Dispatcher - 16119-29645.log +0 -13
  579. data/spec/support/logs/Dispatcher - 16129-23325.log +0 -9
  580. data/spec/support/logs/Dispatcher - 16399-42716.log +0 -19
  581. data/spec/support/logs/Dispatcher - 16410-3301.log +0 -21
  582. data/spec/support/logs/Dispatcher - 16419-8500.log +0 -15
  583. data/spec/support/logs/Dispatcher - 16432-2467.log +0 -19
  584. data/spec/support/logs/Dispatcher - 16441-27407.log +0 -21
  585. data/spec/support/logs/Dispatcher - 16450-28157.log +0 -15
  586. data/spec/support/logs/Dispatcher - 16607-37339.log +0 -17
  587. data/spec/support/logs/Dispatcher - 16616-50971.log +0 -21
  588. data/spec/support/logs/Dispatcher - 16625-28154.log +0 -13
  589. data/spec/support/logs/Dispatcher - 16638-17094.log +0 -19
  590. data/spec/support/logs/Dispatcher - 16647-25657.log +0 -21
  591. data/spec/support/logs/Dispatcher - 16656-11108.log +0 -15
  592. data/spec/support/logs/Dispatcher - 16716-31067.log +0 -17
  593. data/spec/support/logs/Dispatcher - 16726-34466.log +0 -21
  594. data/spec/support/logs/Dispatcher - 16735-55150.log +0 -13
  595. data/spec/support/logs/Dispatcher - 16748-7910.log +0 -17
  596. data/spec/support/logs/Dispatcher - 16757-62118.log +0 -21
  597. data/spec/support/logs/Dispatcher - 16766-31937.log +0 -13
  598. data/spec/support/logs/Dispatcher - 16999-6441.log +0 -19
  599. data/spec/support/logs/Dispatcher - 17008-51788.log +0 -21
  600. data/spec/support/logs/Dispatcher - 17017-20096.log +0 -15
  601. data/spec/support/logs/Dispatcher - 17041-15877.log +0 -21
  602. data/spec/support/logs/Dispatcher - 17050-42137.log +0 -25
  603. data/spec/support/logs/Dispatcher - 17059-12767.log +0 -15
  604. data/spec/support/logs/Dispatcher - 17095-3041.log +0 -17
  605. data/spec/support/logs/Dispatcher - 17104-42336.log +0 -21
  606. data/spec/support/logs/Dispatcher - 17113-11660.log +0 -13
  607. data/spec/support/logs/Dispatcher - 17126-64859.log +0 -21
  608. data/spec/support/logs/Dispatcher - 17135-11634.log +0 -25
  609. data/spec/support/logs/Dispatcher - 17144-37598.log +0 -15
  610. data/spec/support/logs/Dispatcher - 17180-55804.log +0 -17
  611. data/spec/support/logs/Dispatcher - 17189-5599.log +0 -21
  612. data/spec/support/logs/Dispatcher - 17198-13188.log +0 -13
  613. data/spec/support/logs/Dispatcher - 17211-23553.log +0 -17
  614. data/spec/support/logs/Dispatcher - 17220-36701.log +0 -21
  615. data/spec/support/logs/Dispatcher - 17229-41502.log +0 -13
  616. data/spec/support/logs/Instance - 12859-23151.error.log +0 -314
  617. data/spec/support/logs/Instance - 12890-17901.error.log +0 -413
  618. data/spec/support/logs/Instance - 12915-45947.error.log +0 -314
  619. data/spec/support/logs/Instance - 13044-48074.error.log +0 -312
  620. data/spec/support/logs/Instance - 16731-60738.error.log +0 -314
  621. data/spec/support/logs/Instance - 16931-37511.error.log +0 -312
@@ -1,5 +1,5 @@
1
1
  =begin
2
- Copyright 2010-2013 Tasos Laskos <tasos.laskos@gmail.com>
2
+ Copyright 2010-2014 Tasos Laskos <tasos.laskos@gmail.com>
3
3
 
4
4
  Licensed under the Apache License, Version 2.0 (the "License");
5
5
  you may not use this file except in compliance with the License.
@@ -18,40 +18,49 @@ module Arachni
18
18
 
19
19
  module Element::Capabilities
20
20
 
21
+ module Auditable
22
+
23
+ # Performs boolean injection and behavioral analysis (using differential analysis
24
+ # techniques based on {Support::Signature} comparisons) in order to determine
25
+ # whether the web application is responding to the injected data and how.
21
26
  #
22
- # Performs boolean, fault injection and behavioral analysis (using the rDiff algorithm)
23
- # in order to determine whether the web application is responding to the injected data and how.
24
- #
25
- # If the behavior can be manipulated by the injected data in ways that it's not supposed to
26
- # (like when evaluating injected code) then the element is deemed vulnerable.
27
+ # If the behavior can be manipulated by the injected data in ways that it's not
28
+ # supposed to (like when evaluating injected code) then the element is deemed
29
+ # vulnerable.
27
30
  #
28
31
  # @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
29
- #
30
- module Auditable::RDiff
31
-
32
- def self.included( mod )
33
- # the rdiff attack performs it own redundancy checks so we need this to
34
- # keep track of audited elements
35
- @@rdiff_audited ||= Support::LookUp::HashSet.new
36
- end
32
+ module RDiff
37
33
 
38
34
  RDIFF_OPTIONS = {
39
- # append our seeds to the default values
40
- format: [Mutable::Format::APPEND],
35
+ # Append our seeds to the default values.
36
+ format: [Mutable::Format::STRAIGHT],
37
+
38
+ # Amount of refinement operations to remove context-irrelevant dynamic
39
+ # content -- like banners etc.
40
+ precision: 2,
41
+
42
+ # Override global fuzzing settings and only use the default method of the
43
+ # element under audit.
44
+ respect_method: true,
41
45
 
42
- # allow duplicate requests
43
- redundant: true,
46
+ # Don't generate or submit any mutations with default or sample inputs.
47
+ skip_orig: true,
44
48
 
45
- # amount of rdiff iterations
46
- precision: 2,
49
+ # Allow redundant audits, we need multiple ones for noise-reduction.
50
+ redundant: true,
47
51
 
48
- respect_method: true
52
+ # Don't let #audit print output, we'll handle that ourselves.
53
+ silent: true,
54
+
55
+ # Default value for a forceful 'false' response.
56
+ false: '-1'
49
57
  }
50
58
 
51
59
  #
52
60
  # Performs differential analysis and logs an issue should there be one.
53
61
  #
54
62
  # opts = {
63
+ # false: 'false resource id',
55
64
  # pairs: [
56
65
  # { 'true expression' => 'false expression' }
57
66
  # ]
@@ -61,13 +70,15 @@ module Auditable::RDiff
61
70
  #
62
71
  # Here's how it goes:
63
72
  #
64
- # * let `control` be the control/control response
65
- # * let `true_response` be the response of the injection of 'true expression'
66
- # * let `false_response` be the response of the injection of 'false expression'
73
+ # * let `control` be the response of the injection of 'false resource id'
74
+ # * let `true_response` be the response of the injection of 'true expression'
75
+ # * let `false_response` be the response of the injection of 'false expression'
76
+ # * let `control_verification` be a fresh control
67
77
  #
68
78
  # A vulnerability is logged if:
69
79
  #
70
- # control == true_response AND true_response.code == 200 AND false_response != true_response
80
+ # control == control_verification && control == false_response AND
81
+ # true_response.code == 200 AND false_response != true_response
71
82
  #
72
83
  # The `bool` response is also checked in order to determine if it's a custom
73
84
  # 404, if it is then it'll be skipped.
@@ -82,14 +93,19 @@ module Auditable::RDiff
82
93
  # @option opts [Array<Hash>] :pairs
83
94
  # Pair of strings that should yield different results when interpreted.
84
95
  # Keys should be the `true` expressions.
85
- # @param [Block] block
86
- # To be used for custom analysis of gathered data.
96
+ # @option opts [String] :false
97
+ # A string which would illicit a 'false' response but without any code.
87
98
  #
88
99
  # @return [Bool]
89
100
  # `true` if the audit was scheduled successfully, `false` otherwise (like
90
101
  # if the resource is out of scope or already audited).
91
102
  #
92
- def rdiff_analysis( opts = {}, &block )
103
+ def rdiff_analysis( opts = {} )
104
+ return if self.auditable.empty?
105
+
106
+ return false if audited? audit_id
107
+ audited audit_id
108
+
93
109
  if skip_path? self.action
94
110
  print_debug "Element's action matches skip rule, bailing out."
95
111
  return false
@@ -97,137 +113,377 @@ module Auditable::RDiff
97
113
 
98
114
  opts = self.class::MUTATION_OPTIONS.merge( RDIFF_OPTIONS.merge( opts ) )
99
115
 
100
- return false if auditable.empty?
116
+ mutations_size = 0
117
+ each_mutation( opts[:false], opts ) { mutations_size += 1 }
118
+ mutations_size *= opts[:precision]
119
+
120
+ @data_gathering = {
121
+ mutations_size: mutations_size,
122
+ expected_responses: mutations_size + (mutations_size * opts[:pairs].size * 2),
123
+ received_responses: 0,
124
+ done: false,
125
+ controls: {}
126
+ }
127
+
128
+ # Holds all the data from the probes.
129
+ signatures = {
130
+ # Control baseline per input.
131
+ controls: {},
132
+
133
+ # Verification control baseline per input.
134
+ controls_verification: {},
101
135
 
102
- # Don't continue if there's a missing value.
103
- auditable.values.each { |val| return if val.to_s.empty? }
136
+ # Corrupted baselines per input.
137
+ corrupted: {},
104
138
 
105
- return false if rdiff_audited?
106
- rdiff_audited
139
+ # Rest of the data are dynamically populated using input pairs
140
+ # as keys.
141
+ }
107
142
 
108
- responses = {}
109
- control = nil
143
+ # Populate the baseline/control forced-false signatures.
144
+ populate_control_signatures( opts, signatures )
145
+
146
+ http.after_run do
147
+ # Populate the 'true' signatures.
148
+ populate_true_signatures( opts, signatures )
149
+
150
+ # Populate the 'false' signatures.
151
+ populate_false_signatures( opts, signatures )
152
+ end
153
+
154
+ true
155
+ end
156
+
157
+ private
158
+
159
+ # Performs requests using the 'false' control seed and generates/stores
160
+ # signatures based on the response bodies.
161
+ def populate_control_signatures( opts, signatures )
162
+ gathered = {}
110
163
  opts[:precision].times do
111
- # Get the default response.
112
- submit do |res|
113
- if control
114
- print_status 'Got default/control response.'
164
+ audit( opts[:false], opts ) do |res, _, elem|
165
+ altered_hash = elem.altered.hash
166
+
167
+ next if signatures[:corrupted][altered_hash]
168
+
169
+ gathered[altered_hash] ||= 0
170
+ gathered[altered_hash] += 1
171
+
172
+ response_check( res, signatures, elem )
173
+
174
+ if gathered[altered_hash] == @data_gathering[:mutations_size]
175
+ print_status "Got default/control response for #{elem.type} " +
176
+ "variable '#{elem.altered}' with action '#{elem.action}'."
177
+
178
+ @data_gathering[:controls][altered_hash] = true
115
179
  end
116
180
 
117
- # Remove context-irrelevant dynamic content like banners and such.
118
- control = (control ? control.rdiff( res.body ) : res.body)
181
+ # Create a signature from the response body and refine it with
182
+ # subsequent ones to remove noise (like context-irrelevant dynamic
183
+ # content such as banners etc.).
184
+ signatures[:controls][altered_hash] =
185
+ signatures[:controls][altered_hash] ?
186
+ signatures[:controls][altered_hash].refine!(res.body) :
187
+ Support::Signature.new(res.body)
188
+
189
+ @data_gathering[:received_responses] += 1
190
+
191
+ finalize_if_done( opts, signatures )
119
192
  end
120
193
  end
194
+ end
195
+
196
+ # Performs requests using the 'true' seeds and generates/stores signatures
197
+ # based on the response bodies.
198
+ def populate_true_signatures( opts, signatures )
199
+ gathered = {}
121
200
 
122
201
  opts[:pairs].each do |pair|
123
- responses[pair] ||= {}
124
- true_expr, false_expr = pair.to_a.first
202
+ pair_hash = pair.hash
203
+
204
+ signatures[pair_hash] ||= {}
205
+ @data_gathering[pair_hash] ||= {}
206
+ gathered[pair_hash] ||= {}
207
+
208
+ true_expr = pair.to_a.first[0]
209
+
210
+ print_status "Gathering 'true' data for #{self.type} with " <<
211
+ "action '#{self.action}' using seed: #{true_expr}"
125
212
 
126
213
  opts[:precision].times do
127
- mutations( true_expr, opts ).each do |elem|
128
- print_status elem.status_string
129
-
130
- # Submit the mutation and store the response.
131
- elem.submit( opts ) do |res|
132
- if responses[pair][elem.altered][:true]
133
- elem.print_status "Gathering data for '#{elem.altered}' " <<
134
- "#{type} input -- Got true response:" <<
135
- " #{true_expr}"
136
- end
137
-
138
- responses[pair][elem.altered] ||= {}
139
- responses[pair][elem.altered][:mutation] = elem
140
-
141
- # Keep the latest response for the {Arachni::Issue}.
142
- responses[pair][elem.altered][:response] = res
143
- responses[pair][elem.altered][:injected_string] = true_expr
144
-
145
- responses[pair][elem.altered][:true] ||= res.body.clone
146
- # Remove context-irrelevant dynamic content like banners
147
- # and such from the error page.
148
- responses[pair][elem.altered][:true] =
149
- responses[pair][elem.altered][:true].rdiff( res.body.clone )
214
+ audit( true_expr, opts ) do |res, _, elem|
215
+ altered_hash = elem.altered.hash
216
+
217
+ gathered[pair_hash][altered_hash] ||= 0
218
+ gathered[pair_hash][altered_hash] += 1
219
+
220
+ signatures[pair_hash][altered_hash] ||= {}
221
+ @data_gathering[pair_hash][altered_hash] ||= {}
222
+
223
+ next if signatures[pair_hash][altered_hash][:corrupted] ||
224
+ signatures[:corrupted][altered_hash]
225
+
226
+ response_check( res, signatures, elem, pair_hash )
227
+
228
+ next if signature_sieve( altered_hash, signatures, pair_hash )
229
+
230
+ if gathered[pair_hash][altered_hash] == opts[:precision]
231
+ elem.print_status "Got 'true' response for #{elem.type} " <<
232
+ "variable '#{elem.altered}' with action '#{elem.action}'" <<
233
+ " using seed: #{true_expr}"
234
+ @data_gathering[pair_hash][altered_hash][:true_probes] = true
150
235
  end
236
+
237
+ # Store the mutation for the {Arachni::Issue}.
238
+ signatures[pair_hash][altered_hash][:mutation] = elem
239
+
240
+ # Keep the latest response for the {Arachni::Issue}.
241
+ signatures[pair_hash][altered_hash][:response] = res
242
+
243
+ signatures[pair_hash][altered_hash][:injected_string] = true_expr
244
+
245
+ # Create a signature from the response body and refine it with
246
+ # subsequent ones to remove noise (like context-irrelevant dynamic
247
+ # content such as banners etc.).
248
+ signatures[pair_hash][altered_hash][:true] =
249
+ signatures[pair_hash][altered_hash][:true] ?
250
+ signatures[pair_hash][altered_hash][:true].refine!(res.body) :
251
+ Support::Signature.new(res.body)
252
+
253
+ signature_sieve( altered_hash, signatures, pair_hash )
254
+
255
+ @data_gathering[:received_responses] += 1
256
+ finalize_if_done( opts, signatures )
151
257
  end
258
+ end
259
+ end
260
+ end
261
+
262
+ # Performs requests using the 'false' seeds and generates/stores signatures
263
+ # based on the response bodies.
264
+ def populate_false_signatures( opts, signatures )
265
+ gathered = {}
266
+
267
+ opts[:pairs].each do |pair|
268
+ pair_hash = pair.hash
269
+
270
+ signatures[pair_hash] ||= {}
271
+ @data_gathering[pair_hash] ||= {}
272
+ gathered[pair_hash] ||= {}
273
+
274
+ false_expr = pair.to_a.first[1]
152
275
 
153
- mutations( false_expr, opts ).each do |elem|
154
- responses[pair][elem.altered] ||= {}
276
+ print_status "Gathering 'false' data for #{self.type} with " <<
277
+ "action '#{self.action}' using seed: #{false_expr}"
155
278
 
156
- # Submit the mutation and store the response.
157
- elem.submit( opts ) do |res|
158
- if responses[pair][elem.altered][:false]
159
- elem.print_status "Gathering data for '#{elem.altered}'" <<
160
- " #{type} input -- Got false " <<
161
- "response: #{false_expr}"
162
- end
279
+ opts[:precision].times do
280
+ audit( false_expr, opts ) do |res, _, elem|
281
+ altered_hash = elem.altered.hash
282
+
283
+ gathered[pair_hash][altered_hash] ||= 0
284
+ gathered[pair_hash][altered_hash] += 1
285
+
286
+ signatures[pair_hash][altered_hash] ||= {}
287
+ @data_gathering[pair_hash][altered_hash] ||= {}
163
288
 
164
- responses[pair][elem.altered][:false] ||= res.body.clone
289
+ next if signatures[pair_hash][altered_hash][:corrupted] ||
290
+ signatures[:corrupted][altered_hash]
165
291
 
166
- # Remove context-irrelevant dynamic content like banners
167
- # and such from the error page.
168
- responses[pair][elem.altered][:false] =
169
- responses[pair][elem.altered][:false].rdiff( res.body.clone )
292
+ response_check( res, signatures, elem, pair_hash )
293
+
294
+ next if signature_sieve( altered_hash, signatures, pair_hash )
295
+
296
+ if gathered[pair_hash][altered_hash] == opts[:precision]
297
+ elem.print_status "Got 'false' response for #{elem.type} " <<
298
+ "variable '#{elem.altered}' with action '#{elem.action}'" <<
299
+ " using seed: #{false_expr}"
300
+ @data_gathering[pair_hash][altered_hash][:false_probes] = true
170
301
  end
302
+
303
+ # Create a signature from the response body and refine it with
304
+ # subsequent ones to remove noise (like context-irrelevant dynamic
305
+ # content such as banners etc.).
306
+ signatures[pair_hash][altered_hash][:false] =
307
+ signatures[pair_hash][altered_hash][:false] ?
308
+ signatures[pair_hash][altered_hash][:false].refine!(res.body) :
309
+ Support::Signature.new(res.body)
310
+
311
+ signature_sieve( altered_hash, signatures, pair_hash )
312
+
313
+ @data_gathering[:received_responses] += 1
314
+ finalize_if_done( opts, signatures )
171
315
  end
172
316
  end
173
317
  end
318
+ end
174
319
 
320
+ # Check if we're done with data gathering and proceed to establishing a
321
+ # {#populate_control_verification_signatures verification control baseline}
322
+ # and {#match_signatures final analysis}.
323
+ def finalize_if_done( opts, signatures )
324
+ return if @data_gathering[:done] ||
325
+ @data_gathering[:expected_responses] != @data_gathering[:received_responses]
326
+ @data_gathering[:done] = true
327
+
328
+ # Lastly, we need to re-establish a new baseline in order to compare
329
+ # it with the initial one so as to be sure that server behavior
330
+ # hasn't suddenly changed in a way that would corrupt our analysis.
331
+ populate_control_verification_signatures( opts, signatures )
332
+ end
175
333
 
176
- # When this runs the "responses" hash will have been populated and we
177
- # can continue with analysis.
178
- http.after_run do
179
- responses.each do |pair, data|
180
- if block
181
- exception_jail( false ){ block.call( pair, data ) }
334
+ # Re-establishes a control baseline at the end of the audit, to make sure
335
+ # that website behavior has remained stable, otherwise its behavior won't
336
+ # be trustworthy.
337
+ def populate_control_verification_signatures( opts, signatures )
338
+ received_responses = 0
339
+ gathered = {}
340
+
341
+ opts[:precision].times do
342
+ audit( opts[:false], opts ) do |res, _, elem|
343
+ altered_hash = elem.altered.hash
344
+
345
+ gathered[altered_hash] ||= 0
346
+ gathered[altered_hash] += 1
347
+
348
+ next if signatures[:corrupted][altered_hash]
349
+
350
+ response_check( res, signatures, elem )
351
+
352
+ if gathered[altered_hash] == opts[:precision]
353
+ print_status 'Got control verification response ' <<
354
+ "for #{elem.type} variable '#{elem.altered}' with" <<
355
+ " action '#{elem.action}'."
356
+ end
357
+
358
+ # Create a signature from the response body and refine it with
359
+ # subsequent ones to remove noise (like context-irrelevant dynamic
360
+ # content such as banners etc.).
361
+ signatures[:controls_verification][altered_hash] =
362
+ signatures[:controls_verification][altered_hash] ?
363
+ signatures[:controls_verification][altered_hash].refine!(res.body) :
364
+ Support::Signature.new(res.body)
365
+
366
+ received_responses += 1
367
+ next if received_responses != @data_gathering[:mutations_size]
368
+
369
+ # Once the new baseline has been established and we've got all the
370
+ # data we need, crunch them and see if server behavior indicates
371
+ # a vulnerability.
372
+ match_signatures( signatures )
373
+ end
374
+ end
375
+ end
376
+
377
+ def match_signatures( signatures )
378
+ controls = signatures.delete( :controls )
379
+ controls_verification = signatures.delete( :controls_verification )
380
+ corrupted = signatures.delete( :corrupted )
381
+
382
+ signatures.each do |_, data|
383
+ data.each do |input, result|
384
+ next if result[:corrupted] || corrupted[input]
385
+
386
+ # If the initial and verification baselines differ, bail out;
387
+ # server behavior is too unstable.
388
+ if controls[input] != controls_verification[input]
389
+ result[:mutation].print_bad 'Control baseline too unstable, ' <<
390
+ "aborting analysis for #{result[:mutation].type} " <<
391
+ "variable '#{result[:mutation].altered}' with action " <<
392
+ "'#{result[:mutation].action}'"
182
393
  next
183
394
  end
184
395
 
185
- data.each do |input_name, result|
186
- # if default_response_body == true_response_body AND
187
- # false_response_body != true_response_code AND
188
- # true_response_code == 200
189
- if control == result[:true] &&
190
- result[:false] != result[:true] &&
191
- result[:response].code == 200
192
-
193
- # Check to see if the `true` response we're analyzing
194
- # is a custom 404 page.
195
- http.custom_404?( result[:response] ) do |custom_404|
196
- # If this is a custom 404 page bail out.
197
- next if custom_404
198
-
199
- @auditor.log({
200
- var: input_name,
201
- opts: {
202
- injected_orig: result[:injected_string],
203
- combo: result[:mutation].auditable
204
- },
205
- injected: result[:mutation].altered_value,
206
- elem: type
207
- }, result[:response]
208
- )
209
- end
210
- end
396
+ # To have gotten here the following must be true:
397
+ #
398
+ # force_false_baseline == false_response_body AND
399
+ # false_response_body != true_response_body AND
400
+ # force_false_response_code == 200 AND
401
+ # true_response_code == 200 AND
402
+ # false_response_code == 200
403
+
404
+ # Check to see if the `true` response we're analyzing
405
+ # is a custom 404 page.
406
+ http.custom_404?( result[:response] ) do |is_custom_404|
407
+ # If this is a custom 404 page bail out.
408
+ next if is_custom_404
409
+
410
+ @auditor.log({
411
+ var: result[:mutation].altered,
412
+ opts: {
413
+ injected_orig: result[:injected_string],
414
+ combo: result[:mutation].auditable
415
+ },
416
+ injected: result[:mutation].altered_value,
417
+ elem: type
418
+ }, result[:response]
419
+ )
211
420
  end
212
421
  end
213
422
  end
214
-
215
- true
216
423
  end
217
424
 
218
- private
219
- def rdiff_audited
220
- @@rdiff_audited << rdiff_audit_id
221
- end
425
+ def response_check( response, signatures, elem, pair = nil )
426
+ corrupted = false
427
+
428
+ if response.code != 200
429
+ print_status 'Server returned non 200 status,' <<
430
+ " aborting analysis for #{elem.type} variable " <<
431
+ "'#{elem.altered}' with action '#{elem.action}'."
432
+ corrupted = true
433
+ end
222
434
 
223
- def rdiff_audited?
224
- @@rdiff_audited.include?( rdiff_audit_id )
435
+ if response.body.to_s.empty?
436
+ print_status 'Server returned empty response body,' <<
437
+ " aborting analysis for #{elem.type} variable " <<
438
+ "'#{elem.altered}' with action '#{self.action}'."
439
+ corrupted = true
440
+ end
441
+
442
+ return if !corrupted
443
+
444
+ if pair
445
+ signatures[pair][elem.altered.hash][:corrupted] = true
446
+ else
447
+ signatures[:corrupted][elem.altered.hash] = true
448
+ end
225
449
  end
226
450
 
227
- def rdiff_audit_id
228
- @action + @auditable.keys.to_s
451
+ def signature_sieve( input, signatures, pair )
452
+ gathered = @data_gathering[pair][input]
453
+ signature = signatures[pair][input]
454
+
455
+ # If data has been corrupted for the given input, remove it.
456
+ if signature[:corrupted]
457
+ signatures[pair].delete( input )
458
+ return true
459
+ end
460
+
461
+ # 1st check: force_false_baseline == false_response_body
462
+ #
463
+ # * Make sure the necessary data has been gathered.
464
+ # * Remove the data if forced-false and boolean-false signatures
465
+ # don't match.
466
+ if (@data_gathering[:controls][input] && gathered[:false_probes]) &&
467
+ (signatures[:controls][input] != signature[:false])
468
+ signatures[pair].delete( input )
469
+ return true
470
+ end
471
+
472
+ # 2nd check: false_response_baseline != true_response_baseline
473
+ #
474
+ # * Make sure the necessary data has been gathered.
475
+ # * Remove the data if boolean-false and boolean-true signatures
476
+ # are too similar.
477
+ if (gathered[:false_probes] && gathered[:true_probes]) &&
478
+ signature[:false].similar?( signature[:true], 5 )
479
+ signatures[pair].delete( input )
480
+ return true
481
+ end
482
+
483
+ false
229
484
  end
230
485
 
231
486
  end
232
487
  end
233
488
  end
489
+ end