arachni 0.4.5.2 → 0.4.6
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +9 -9
- data/CHANGELOG.md +97 -0
- data/CONTRIBUTORS.md +1 -0
- data/NOTICE +1 -1
- data/README.md +4 -4
- data/Rakefile +111 -26
- data/arachni.gemspec +2 -2
- data/bin/arachni +1 -1
- data/bin/arachni_console +1 -1
- data/bin/arachni_multi +1 -1
- data/bin/arachni_rpc +1 -1
- data/bin/arachni_rpcd +1 -1
- data/bin/arachni_rpcd_monitor +1 -1
- data/bin/arachni_script +1 -1
- data/external/metasploit/LICENSE +1 -1
- data/fingerprinters/frameworks/rack.rb +1 -1
- data/fingerprinters/languages/asp.rb +1 -1
- data/fingerprinters/languages/aspx.rb +1 -1
- data/fingerprinters/languages/jsp.rb +3 -5
- data/fingerprinters/languages/php.rb +1 -1
- data/fingerprinters/languages/python.rb +1 -1
- data/fingerprinters/languages/ruby.rb +1 -1
- data/fingerprinters/os/bsd.rb +1 -1
- data/fingerprinters/os/linux.rb +1 -1
- data/fingerprinters/os/solaris.rb +1 -1
- data/fingerprinters/os/unix.rb +1 -1
- data/fingerprinters/os/windows.rb +1 -1
- data/fingerprinters/servers/apache.rb +1 -1
- data/fingerprinters/servers/iis.rb +1 -1
- data/fingerprinters/servers/jetty.rb +1 -1
- data/fingerprinters/servers/nginx.rb +1 -1
- data/fingerprinters/servers/tomcat.rb +1 -1
- data/lib/arachni.rb +6 -1
- data/lib/arachni/audit_store.rb +1 -1
- data/lib/arachni/banner.rb +1 -1
- data/lib/arachni/component/manager.rb +1 -1
- data/lib/arachni/component/options.rb +1 -1
- data/lib/arachni/component/options/address.rb +1 -1
- data/lib/arachni/component/options/base.rb +1 -1
- data/lib/arachni/component/options/bool.rb +1 -1
- data/lib/arachni/component/options/enum.rb +1 -1
- data/lib/arachni/component/options/float.rb +1 -1
- data/lib/arachni/component/options/int.rb +1 -1
- data/lib/arachni/component/options/path.rb +1 -1
- data/lib/arachni/component/options/port.rb +1 -1
- data/lib/arachni/component/options/string.rb +1 -1
- data/lib/arachni/component/options/url.rb +1 -1
- data/lib/arachni/element/base.rb +1 -1
- data/lib/arachni/element/body.rb +1 -1
- data/lib/arachni/element/capabilities/auditable.rb +45 -22
- data/lib/arachni/element/capabilities/auditable/rdiff.rb +378 -122
- data/lib/arachni/element/capabilities/auditable/taint.rb +57 -20
- data/lib/arachni/element/capabilities/auditable/timeout.rb +95 -68
- data/lib/arachni/element/capabilities/mutable.rb +77 -40
- data/lib/arachni/element/capabilities/refreshable.rb +7 -1
- data/lib/arachni/element/cookie.rb +46 -167
- data/lib/arachni/element/form.rb +77 -517
- data/lib/arachni/element/header.rb +21 -15
- data/lib/arachni/element/link.rb +2 -2
- data/lib/arachni/element/path.rb +1 -1
- data/lib/arachni/element/server.rb +1 -1
- data/lib/arachni/element_filter.rb +1 -1
- data/lib/arachni/error.rb +1 -1
- data/lib/arachni/framework.rb +16 -7
- data/lib/arachni/http.rb +111 -118
- data/lib/arachni/http/cookie_jar.rb +8 -2
- data/lib/arachni/issue.rb +4 -1
- data/lib/arachni/mixins/observable.rb +1 -1
- data/lib/arachni/mixins/progress_bar.rb +1 -1
- data/lib/arachni/mixins/terminal.rb +1 -1
- data/lib/arachni/module.rb +1 -1
- data/lib/arachni/module/auditor.rb +23 -17
- data/lib/arachni/module/base.rb +1 -1
- data/lib/arachni/module/manager.rb +4 -4
- data/lib/arachni/module/output.rb +1 -1
- data/lib/arachni/module/utilities.rb +1 -1
- data/lib/arachni/options.rb +28 -7
- data/lib/arachni/page.rb +4 -5
- data/lib/arachni/parser.rb +3 -2
- data/lib/arachni/platform.rb +1 -1
- data/lib/arachni/platform/fingerprinter.rb +1 -1
- data/lib/arachni/platform/list.rb +11 -29
- data/lib/arachni/platform/manager.rb +31 -8
- data/lib/arachni/plugin.rb +1 -1
- data/lib/arachni/plugin/base.rb +1 -1
- data/lib/arachni/plugin/manager.rb +1 -1
- data/lib/arachni/processes.rb +1 -1
- data/lib/arachni/processes/dispatchers.rb +1 -1
- data/lib/arachni/processes/helpers.rb +1 -1
- data/lib/arachni/processes/helpers/dispatchers.rb +1 -1
- data/lib/arachni/processes/helpers/instances.rb +1 -1
- data/lib/arachni/processes/helpers/processes.rb +1 -1
- data/lib/arachni/processes/instances.rb +1 -1
- data/lib/arachni/processes/manager.rb +1 -1
- data/lib/arachni/report.rb +1 -1
- data/lib/arachni/report/base.rb +1 -1
- data/lib/arachni/report/manager.rb +1 -1
- data/lib/arachni/rpc/client/base.rb +1 -1
- data/lib/arachni/rpc/client/dispatcher.rb +1 -1
- data/lib/arachni/rpc/client/instance.rb +1 -1
- data/lib/arachni/rpc/server/active_options.rb +1 -1
- data/lib/arachni/rpc/server/base.rb +1 -1
- data/lib/arachni/rpc/server/dispatcher.rb +10 -6
- data/lib/arachni/rpc/server/dispatcher/handler.rb +1 -1
- data/lib/arachni/rpc/server/dispatcher/node.rb +5 -3
- data/lib/arachni/rpc/server/framework.rb +5 -3
- data/lib/arachni/rpc/server/framework/distributor.rb +24 -19
- data/lib/arachni/rpc/server/framework/master.rb +1 -1
- data/lib/arachni/rpc/server/framework/multi_instance.rb +7 -1
- data/lib/arachni/rpc/server/framework/slave.rb +1 -1
- data/lib/arachni/rpc/server/instance.rb +5 -4
- data/lib/arachni/rpc/server/module/manager.rb +1 -1
- data/lib/arachni/rpc/server/output.rb +1 -1
- data/lib/arachni/rpc/server/plugin/manager.rb +1 -1
- data/lib/arachni/rpc/server/spider.rb +5 -2
- data/lib/arachni/ruby.rb +1 -1
- data/lib/arachni/ruby/array.rb +9 -1
- data/lib/arachni/ruby/enumerable.rb +1 -1
- data/lib/arachni/ruby/hash.rb +24 -5
- data/lib/arachni/ruby/io.rb +1 -1
- data/lib/arachni/ruby/object.rb +1 -1
- data/lib/arachni/ruby/set.rb +1 -1
- data/lib/arachni/ruby/string.rb +13 -2
- data/lib/arachni/ruby/webrick.rb +3 -15
- data/lib/arachni/ruby/webrick/cookie.rb +30 -0
- data/lib/arachni/ruby/webrick/httprequest.rb +42 -0
- data/lib/arachni/session.rb +21 -8
- data/lib/arachni/spider.rb +18 -11
- data/lib/arachni/support.rb +3 -1
- data/lib/arachni/support/buffer.rb +1 -1
- data/lib/arachni/support/buffer/autoflush.rb +1 -1
- data/lib/arachni/support/buffer/base.rb +1 -1
- data/lib/arachni/support/cache.rb +1 -1
- data/lib/arachni/support/cache/base.rb +1 -1
- data/lib/arachni/support/cache/least_cost_replacement.rb +1 -1
- data/lib/arachni/support/cache/least_recently_used.rb +1 -1
- data/lib/arachni/support/cache/preference.rb +1 -1
- data/lib/arachni/support/cache/random_replacement.rb +1 -1
- data/lib/arachni/support/crypto.rb +1 -1
- data/lib/arachni/support/crypto/rsa_aes_cbc.rb +1 -1
- data/lib/arachni/support/database.rb +1 -1
- data/lib/arachni/support/database/base.rb +5 -5
- data/lib/arachni/support/database/hash.rb +1 -1
- data/lib/arachni/support/database/queue.rb +52 -69
- data/lib/arachni/{module → support}/key_filler.rb +11 -17
- data/lib/arachni/support/lookup.rb +1 -1
- data/lib/arachni/support/lookup/base.rb +1 -1
- data/lib/arachni/support/lookup/hash_set.rb +1 -1
- data/lib/arachni/support/lookup/moolb.rb +1 -1
- data/lib/arachni/support/queue.rb +1 -1
- data/lib/arachni/support/queue/disk.rb +1 -1
- data/lib/arachni/support/signature.rb +153 -0
- data/lib/arachni/trainer.rb +30 -19
- data/lib/arachni/typhoeus/hydra.rb +1 -1
- data/lib/arachni/typhoeus/request.rb +1 -1
- data/lib/arachni/typhoeus/response.rb +8 -2
- data/lib/arachni/typhoeus/utils.rb +1 -1
- data/lib/arachni/ui/cli/cli.rb +18 -7
- data/lib/arachni/ui/cli/output.rb +28 -1
- data/lib/arachni/ui/cli/rpc/dispatcher_monitor.rb +1 -1
- data/lib/arachni/ui/cli/rpc/instance.rb +1 -1
- data/lib/arachni/ui/cli/rpc/local.rb +1 -1
- data/lib/arachni/ui/cli/rpc/remote.rb +1 -1
- data/lib/arachni/ui/cli/utilities.rb +14 -29
- data/lib/arachni/ui/foo/output.rb +1 -1
- data/lib/arachni/uri.rb +2 -3
- data/lib/arachni/utilities.rb +1 -1
- data/lib/arachni/version.rb +1 -1
- data/lib/version +1 -1
- data/modules/audit/code_injection.rb +1 -1
- data/modules/audit/code_injection_php_input_wrapper.rb +1 -1
- data/modules/audit/code_injection_timing.rb +1 -1
- data/modules/audit/csrf.rb +1 -1
- data/modules/audit/file_inclusion.rb +5 -5
- data/modules/audit/ldapi.rb +1 -1
- data/modules/audit/os_cmd_injection.rb +1 -1
- data/modules/audit/os_cmd_injection_timing.rb +4 -3
- data/modules/audit/path_traversal.rb +5 -5
- data/modules/audit/response_splitting.rb +1 -1
- data/modules/audit/rfi.rb +1 -1
- data/modules/audit/session_fixation.rb +1 -1
- data/modules/audit/source_code_disclosure.rb +21 -17
- data/modules/audit/sqli.rb +11 -8
- data/modules/audit/sqli/patterns/pgsql +1 -0
- data/modules/audit/sqli/regexp_ignore.txt +1 -0
- data/modules/audit/sqli_blind_rdiff.rb +12 -12
- data/modules/audit/sqli_blind_rdiff/payloads.txt +1 -5
- data/modules/audit/sqli_blind_timing.rb +4 -6
- data/modules/audit/sqli_blind_timing/mssql.txt +9 -9
- data/modules/audit/sqli_blind_timing/mysql.txt +9 -31
- data/modules/audit/sqli_blind_timing/pgsql.txt +6 -28
- data/modules/audit/trainer.rb +1 -1
- data/modules/audit/unvalidated_redirect.rb +1 -1
- data/modules/audit/xpath.rb +1 -1
- data/modules/audit/xss.rb +12 -12
- data/modules/audit/xss_event.rb +1 -1
- data/modules/audit/xss_path.rb +1 -1
- data/modules/audit/xss_script_tag.rb +13 -20
- data/modules/audit/xss_tag.rb +5 -7
- data/modules/recon/allowed_methods.rb +1 -1
- data/modules/recon/backdoors.rb +1 -1
- data/modules/recon/backup_files.rb +1 -1
- data/modules/recon/common_directories.rb +1 -1
- data/modules/recon/common_files.rb +1 -1
- data/modules/recon/common_files/filenames.txt +1 -0
- data/modules/recon/directory_listing.rb +2 -2
- data/modules/recon/grep/captcha.rb +1 -1
- data/modules/recon/grep/credit_card.rb +1 -1
- data/modules/recon/grep/cvs_svn_users.rb +1 -1
- data/modules/recon/grep/emails.rb +1 -1
- data/modules/recon/grep/form_upload.rb +1 -1
- data/modules/recon/grep/html_objects.rb +1 -1
- data/modules/recon/grep/http_only_cookies.rb +1 -1
- data/modules/recon/grep/insecure_cookies.rb +1 -1
- data/modules/recon/grep/mixed_resource.rb +1 -1
- data/modules/recon/grep/password_autocomplete.rb +1 -1
- data/modules/recon/grep/private_ip.rb +1 -1
- data/modules/recon/grep/ssn.rb +1 -1
- data/modules/recon/grep/unencrypted_password_forms.rb +1 -1
- data/modules/recon/htaccess_limit.rb +1 -1
- data/modules/recon/http_put.rb +1 -1
- data/modules/recon/interesting_responses.rb +1 -1
- data/modules/recon/localstart_asp.rb +5 -5
- data/modules/recon/webdav.rb +1 -1
- data/modules/recon/x_forwarded_for_access_restriction_bypass.rb +1 -1
- data/modules/recon/xst.rb +1 -1
- data/path_extractors/anchors.rb +1 -1
- data/path_extractors/areas.rb +1 -1
- data/path_extractors/forms.rb +1 -1
- data/path_extractors/frames.rb +1 -1
- data/path_extractors/generic.rb +1 -1
- data/path_extractors/links.rb +1 -1
- data/path_extractors/meta_refresh.rb +1 -1
- data/path_extractors/scripts.rb +1 -1
- data/plugins/autologin.rb +16 -8
- data/plugins/beep_notify.rb +1 -1
- data/plugins/{defaults/content_types.rb → content_types.rb} +1 -1
- data/plugins/cookie_collector.rb +21 -11
- data/plugins/defaults/autothrottle.rb +1 -1
- data/plugins/defaults/healthmap.rb +1 -1
- data/plugins/defaults/meta/remedies/discovery.rb +1 -1
- data/plugins/defaults/meta/remedies/timing_attacks.rb +6 -8
- data/plugins/defaults/meta/uniformity.rb +1 -1
- data/plugins/defaults/resolver.rb +1 -1
- data/plugins/email_notify.rb +1 -1
- data/plugins/form_dicattack.rb +1 -1
- data/plugins/http_dicattack.rb +1 -1
- data/plugins/libnotify.rb +1 -1
- data/plugins/profiler.rb +1 -1
- data/plugins/proxy.rb +2 -1
- data/plugins/proxy/server.rb +3 -1
- data/plugins/proxy/template_scope.rb +1 -1
- data/plugins/rescan.rb +1 -1
- data/plugins/script.rb +1 -1
- data/plugins/uncommon_headers.rb +2 -1
- data/plugins/vector_feed.rb +1 -1
- data/plugins/waf_detector.rb +1 -1
- data/reports/afr.rb +8 -9
- data/reports/ap.rb +1 -1
- data/reports/html.rb +8 -12
- data/reports/html/default.erb +2 -3
- data/reports/html/default/issue.erb +0 -12
- data/reports/html/default/issues.erb +2 -2
- data/reports/json.rb +13 -10
- data/reports/marshal.rb +8 -9
- data/reports/metareport.rb +9 -10
- data/reports/plugin_formatters/html/autologin.rb +1 -1
- data/reports/plugin_formatters/html/content_types.rb +1 -1
- data/reports/plugin_formatters/html/cookie_collector.rb +1 -1
- data/reports/plugin_formatters/html/discovery.rb +1 -1
- data/reports/plugin_formatters/html/form_dicattack.rb +1 -1
- data/reports/plugin_formatters/html/healthmap.rb +1 -1
- data/reports/plugin_formatters/html/http_dicattack.rb +1 -1
- data/reports/plugin_formatters/html/profiler.rb +1 -1
- data/reports/plugin_formatters/html/resolver.rb +1 -1
- data/reports/plugin_formatters/html/timing_attacks.rb +1 -1
- data/reports/plugin_formatters/html/uncommon_headers.rb +1 -1
- data/reports/plugin_formatters/html/uniformity.rb +1 -1
- data/reports/plugin_formatters/html/waf_detector.rb +1 -1
- data/reports/plugin_formatters/stdout/autologin.rb +1 -1
- data/reports/plugin_formatters/stdout/content_types.rb +1 -1
- data/reports/plugin_formatters/stdout/cookie_collector.rb +1 -1
- data/reports/plugin_formatters/stdout/discovery.rb +1 -1
- data/reports/plugin_formatters/stdout/form_dicattack.rb +1 -1
- data/reports/plugin_formatters/stdout/healthmap.rb +2 -4
- data/reports/plugin_formatters/stdout/http_dicattack.rb +1 -1
- data/reports/plugin_formatters/stdout/profiler.rb +1 -1
- data/reports/plugin_formatters/stdout/resolver.rb +1 -1
- data/reports/plugin_formatters/stdout/timing_attacks.rb +1 -1
- data/reports/plugin_formatters/stdout/uncommon_headers.rb +1 -1
- data/reports/plugin_formatters/stdout/uniformity.rb +1 -1
- data/reports/plugin_formatters/stdout/waf_detector.rb +1 -1
- data/reports/plugin_formatters/xml/autologin.rb +1 -1
- data/reports/plugin_formatters/xml/content_types.rb +1 -1
- data/reports/plugin_formatters/xml/cookie_collector.rb +1 -1
- data/reports/plugin_formatters/xml/discovery.rb +1 -1
- data/reports/plugin_formatters/xml/form_dicattack.rb +1 -1
- data/reports/plugin_formatters/xml/healthmap.rb +1 -1
- data/reports/plugin_formatters/xml/http_dicattack.rb +1 -1
- data/reports/plugin_formatters/xml/profiler.rb +1 -1
- data/reports/plugin_formatters/xml/resolver.rb +1 -1
- data/reports/plugin_formatters/xml/timing_attacks.rb +1 -1
- data/reports/plugin_formatters/xml/uncommon_headers.rb +1 -1
- data/reports/plugin_formatters/xml/uniformity.rb +1 -1
- data/reports/plugin_formatters/xml/waf_detector.rb +1 -1
- data/reports/stdout.rb +1 -1
- data/reports/txt.rb +1 -1
- data/reports/xml.rb +8 -9
- data/reports/xml/buffer.rb +2 -2
- data/reports/yaml.rb +8 -9
- data/spec/arachni/element/capabilities/auditable/rdiff_spec.rb +80 -2
- data/spec/arachni/element/capabilities/auditable/timeout_spec.rb +44 -29
- data/spec/arachni/element/cookie_spec.rb +1 -1
- data/spec/arachni/element/form_spec.rb +31 -13
- data/spec/arachni/http/cookie_jar_spec.rb +11 -0
- data/spec/arachni/http_spec.rb +33 -7
- data/spec/arachni/issue_spec.rb +10 -3
- data/spec/arachni/options_spec.rb +18 -1
- data/spec/arachni/parser_spec.rb +27 -26
- data/spec/arachni/rpc/server/dispatcher/node_spec.rb +10 -1
- data/spec/arachni/rpc/server/dispatcher_spec.rb +15 -0
- data/spec/arachni/ruby/array_spec.rb +11 -0
- data/spec/arachni/ruby/hash_spec.rb +28 -1
- data/spec/arachni/ruby/string_spec.rb +14 -1
- data/spec/arachni/session_spec.rb +39 -0
- data/spec/arachni/spider_spec.rb +23 -14
- data/spec/arachni/{module → support}/key_filler.rb +20 -2
- data/spec/arachni/support/signature_spec.rb +158 -0
- data/spec/arachni/trainer_spec.rb +31 -0
- data/spec/arachni/typhoeus/response_spec.rb +17 -0
- data/spec/arachni/uri_spec.rb +1 -1
- data/spec/external/wavsep/active/lfi_spec.rb +94 -0
- data/spec/external/wavsep/active/rfi_spec.rb +35 -0
- data/spec/external/wavsep/active/sqli_spec.rb +108 -0
- data/spec/external/wavsep/active/xss_spec.rb +41 -0
- data/spec/external/wavsep/false_positives/lfi_spec.rb +33 -0
- data/spec/external/wavsep/false_positives/rfi_spec.rb +21 -0
- data/spec/external/wavsep/false_positives/sqli_spec.rb +32 -0
- data/spec/external/wavsep/false_positives/xss_spec.rb +21 -0
- data/spec/modules/audit/source_code_disclosure_spec.rb +4 -4
- data/spec/modules/audit/sqli_blind_rdiff_spec.rb +1 -1
- data/spec/modules/audit/sqli_blind_timing_spec.rb +3 -3
- data/spec/modules/audit/sqli_spec.rb +1 -1
- data/spec/modules/audit/xss_script_tag_spec.rb +1 -1
- data/spec/plugins/autologin_spec.rb +25 -7
- data/spec/plugins/cookie_collector_spec.rb +17 -0
- data/spec/spec_helper.rb +1 -1
- data/spec/support/fixtures/fingerprinters/test.rb +1 -1
- data/spec/support/fixtures/modules/test.rb +1 -1
- data/spec/support/fixtures/modules/test2.rb +1 -1
- data/spec/support/fixtures/modules/test3.rb +1 -1
- data/spec/support/fixtures/plugins/bad.rb +1 -1
- data/spec/support/fixtures/plugins/defaults/default.rb +1 -1
- data/spec/support/fixtures/plugins/distributable.rb +1 -1
- data/spec/support/fixtures/plugins/loop.rb +1 -1
- data/spec/support/fixtures/plugins/spider_hook.rb +1 -1
- data/spec/support/fixtures/plugins/wait.rb +1 -1
- data/spec/support/fixtures/plugins/with_options.rb +1 -1
- data/spec/support/fixtures/reports/base_spec/plugin_formatters/with_formatters/foobar.rb +1 -1
- data/spec/support/fixtures/reports/base_spec/with_formatters.rb +1 -1
- data/spec/support/fixtures/reports/base_spec/with_outfile.rb +1 -1
- data/spec/support/fixtures/reports/base_spec/without_outfile.rb +1 -1
- data/spec/support/fixtures/reports/manager_spec/afr.rb +1 -1
- data/spec/support/fixtures/reports/manager_spec/foo.rb +1 -1
- data/spec/support/fixtures/run_mod/body.rb +1 -1
- data/spec/support/fixtures/run_mod/cookies.rb +1 -1
- data/spec/support/fixtures/run_mod/empty.rb +1 -1
- data/spec/support/fixtures/run_mod/flch.rb +1 -1
- data/spec/support/fixtures/run_mod/forms.rb +1 -1
- data/spec/support/fixtures/run_mod/headers.rb +1 -1
- data/spec/support/fixtures/run_mod/links.rb +1 -1
- data/spec/support/fixtures/run_mod/nil.rb +1 -1
- data/spec/support/fixtures/run_mod/path.rb +1 -1
- data/spec/support/fixtures/run_mod/server.rb +1 -1
- data/spec/support/fixtures/taint_module/taint.rb +1 -1
- data/spec/support/fixtures/wait_module/wait.rb +1 -1
- data/spec/support/helpers/framework.rb +1 -1
- data/spec/support/helpers/misc.rb +1 -1
- data/spec/support/helpers/paths.rb +1 -1
- data/spec/support/helpers/requires.rb +1 -1
- data/spec/support/helpers/resets.rb +1 -1
- data/spec/support/helpers/web_server.rb +1 -1
- data/spec/support/lib/web_server_manager.rb +1 -1
- data/spec/support/logs/Dispatcher - 10129-46995.log +9 -0
- data/spec/support/logs/Dispatcher - 10139-63648.log +19 -0
- data/spec/support/logs/Dispatcher - 10149-5551.log +17 -0
- data/spec/support/logs/Dispatcher - 10158-34385.log +13 -0
- data/spec/support/logs/Dispatcher - 10167-55701.log +9 -0
- data/spec/support/logs/Dispatcher - 10176-8922.log +9 -0
- data/spec/support/logs/Dispatcher - 10185-53716.log +11 -0
- data/spec/support/logs/Dispatcher - 10198-44724.log +11 -0
- data/spec/support/logs/Dispatcher - 10211-7697.log +11 -0
- data/spec/support/logs/Dispatcher - 10224-3751.log +35 -0
- data/spec/support/logs/Dispatcher - 10285-7404.log +21 -0
- data/spec/support/logs/Dispatcher - 10294-56221.log +21 -0
- data/spec/support/logs/Dispatcher - 10303-2483.log +23 -0
- data/spec/support/logs/Dispatcher - 10344-60543.log +19 -0
- data/spec/support/logs/Dispatcher - 10355-31708.log +17 -0
- data/spec/support/logs/Dispatcher - 10364-63170.log +15 -0
- data/spec/support/logs/Dispatcher - 10377-37936.log +11 -0
- data/spec/support/logs/Dispatcher - 10390-37511.log +9 -0
- data/spec/support/logs/Dispatcher - 10400-29603.log +9 -0
- data/spec/support/logs/Dispatcher - 10409-57042.log +9 -0
- data/spec/support/logs/Dispatcher - 10418-17812.log +9 -0
- data/spec/support/logs/Dispatcher - 10427-59862.log +11 -0
- data/spec/support/logs/Dispatcher - 10440-48351.log +9 -0
- data/spec/support/logs/Dispatcher - 10449-24218.log +9 -0
- data/spec/support/logs/Dispatcher - 10458-54646.log +9 -0
- data/spec/support/logs/Dispatcher - 10511-3333.log +63 -0
- data/spec/support/logs/Dispatcher - 10520-50009.log +43 -0
- data/spec/support/logs/Dispatcher - 10529-44870.log +39 -0
- data/spec/support/logs/Dispatcher - 10538-49556.log +34 -0
- data/spec/support/logs/Dispatcher - 10547-61887.log +28 -0
- data/spec/support/logs/Dispatcher - 10556-31163.log +21 -0
- data/spec/support/logs/Dispatcher - 10565-40008.log +13 -0
- data/spec/support/logs/Dispatcher - 10575-18836.log +9 -0
- data/spec/support/logs/Dispatcher - 10747-32268.log +19 -0
- data/spec/support/logs/Dispatcher - 10757-4081.log +21 -0
- data/spec/support/logs/Dispatcher - 10766-49190.log +15 -0
- data/spec/support/logs/Dispatcher - 10780-46610.log +19 -0
- data/spec/support/logs/Dispatcher - 10789-5332.log +21 -0
- data/spec/support/logs/Dispatcher - 10798-56243.log +15 -0
- data/spec/support/logs/Dispatcher - 10920-32037.log +17 -0
- data/spec/support/logs/Dispatcher - 10929-35662.log +21 -0
- data/spec/support/logs/Dispatcher - 10938-64010.log +13 -0
- data/spec/support/logs/Dispatcher - 10951-44746.log +19 -0
- data/spec/support/logs/Dispatcher - 10961-55791.log +21 -0
- data/spec/support/logs/Dispatcher - 10972-58913.log +15 -0
- data/spec/support/logs/Dispatcher - 11023-45004.log +17 -0
- data/spec/support/logs/Dispatcher - 11033-55505.log +21 -0
- data/spec/support/logs/Dispatcher - 11042-46123.log +13 -0
- data/spec/support/logs/Dispatcher - 11055-26836.log +17 -0
- data/spec/support/logs/Dispatcher - 11064-60361.log +21 -0
- data/spec/support/logs/Dispatcher - 11073-17507.log +13 -0
- data/spec/support/logs/Dispatcher - 11298-28357.log +19 -0
- data/spec/support/logs/Dispatcher - 11307-62669.log +21 -0
- data/spec/support/logs/Dispatcher - 11316-9391.log +15 -0
- data/spec/support/logs/Dispatcher - 11340-45921.log +21 -0
- data/spec/support/logs/Dispatcher - 11349-8693.log +25 -0
- data/spec/support/logs/Dispatcher - 11358-53753.log +15 -0
- data/spec/support/logs/Dispatcher - 11394-29437.log +17 -0
- data/spec/support/logs/Dispatcher - 11403-59953.log +21 -0
- data/spec/support/logs/Dispatcher - 11412-51134.log +13 -0
- data/spec/support/logs/Dispatcher - 11425-42569.log +21 -0
- data/spec/support/logs/Dispatcher - 11434-16150.log +25 -0
- data/spec/support/logs/Dispatcher - 11443-19072.log +15 -0
- data/spec/support/logs/Dispatcher - 11479-39149.log +17 -0
- data/spec/support/logs/Dispatcher - 11488-42169.log +21 -0
- data/spec/support/logs/Dispatcher - 11497-29822.log +13 -0
- data/spec/support/logs/Dispatcher - 11510-8273.log +17 -0
- data/spec/support/logs/Dispatcher - 11519-18206.log +21 -0
- data/spec/support/logs/Dispatcher - 11528-55825.log +13 -0
- data/spec/support/logs/Dispatcher - 9969-52890.log +9 -0
- data/spec/support/logs/Dispatcher - 9996-38451.log +21 -0
- data/spec/support/logs/{Instance - 12589-35500.error.log → Instance - 10762-33696.error.log } +63 -40
- data/spec/support/logs/{Instance - 16415-47240.error.log → Instance - 11038-18065.error.log } +65 -42
- data/spec/support/logs/{Instance - 16762-48636.error.log → Instance - 11069-34848.error.log } +162 -139
- data/spec/support/logs/{Instance - 16789-61713.error.log → Instance - 11091-33954.error.log } +60 -37
- data/spec/support/logs/{Instance - 16795-55306.error.log → Instance - 11097-33191.error.log } +65 -42
- data/spec/support/logs/{Instance - 12909-9442.error.log → Instance - 11229-38634.error.log } +60 -37
- data/spec/support/servers/arachni/element/capabilities/auditable/rdiff.rb +131 -7
- data/spec/support/servers/arachni/element/capabilities/auditable/timeout.rb +4 -0
- data/spec/support/servers/arachni/element/form.rb +27 -0
- data/spec/support/servers/arachni/element/link.rb +16 -0
- data/spec/support/servers/arachni/session.rb +17 -1
- data/spec/support/servers/arachni/spider.rb +25 -1
- data/spec/support/servers/arachni/trainer.rb +8 -0
- data/spec/support/servers/modules/audit/os_cmd_injection_timing.rb +2 -1
- data/spec/support/servers/modules/audit/source_code_disclosure.rb +0 -1
- data/spec/support/servers/modules/audit/sqli/postgresql +2 -0
- data/spec/support/servers/modules/audit/sqli_blind_rdiff.rb +9 -13
- data/spec/support/shared/element/capabilities/auditable.rb +62 -3
- data/spec/support/shared/element/capabilities/refreshable.rb +27 -0
- data/spec/support/shared/external/wavsep.rb +89 -0
- metadata +1081 -1206
- data/lib/arachni/platforms.rb +0 -499
- data/logs/Dispatcher - 12101-7331.log +0 -15
- data/spec/support/logs/Dispatcher - 11821-58635.log +0 -9
- data/spec/support/logs/Dispatcher - 11848-37716.log +0 -21
- data/spec/support/logs/Dispatcher - 11974-31477.log +0 -9
- data/spec/support/logs/Dispatcher - 11984-10290.log +0 -19
- data/spec/support/logs/Dispatcher - 11993-33501.log +0 -17
- data/spec/support/logs/Dispatcher - 12002-62227.log +0 -13
- data/spec/support/logs/Dispatcher - 12013-45779.log +0 -9
- data/spec/support/logs/Dispatcher - 12022-22434.log +0 -9
- data/spec/support/logs/Dispatcher - 12031-41130.log +0 -11
- data/spec/support/logs/Dispatcher - 12045-23894.log +0 -11
- data/spec/support/logs/Dispatcher - 12059-57317.log +0 -35
- data/spec/support/logs/Dispatcher - 12122-60206.log +0 -21
- data/spec/support/logs/Dispatcher - 12132-58445.log +0 -21
- data/spec/support/logs/Dispatcher - 12141-13273.log +0 -23
- data/spec/support/logs/Dispatcher - 12183-2341.log +0 -19
- data/spec/support/logs/Dispatcher - 12192-56486.log +0 -17
- data/spec/support/logs/Dispatcher - 12201-8840.log +0 -15
- data/spec/support/logs/Dispatcher - 12214-47545.log +0 -11
- data/spec/support/logs/Dispatcher - 12227-23676.log +0 -9
- data/spec/support/logs/Dispatcher - 12236-16018.log +0 -9
- data/spec/support/logs/Dispatcher - 12245-61980.log +0 -9
- data/spec/support/logs/Dispatcher - 12254-30185.log +0 -9
- data/spec/support/logs/Dispatcher - 12263-29578.log +0 -11
- data/spec/support/logs/Dispatcher - 12276-64279.log +0 -9
- data/spec/support/logs/Dispatcher - 12285-49975.log +0 -9
- data/spec/support/logs/Dispatcher - 12347-26600.log +0 -63
- data/spec/support/logs/Dispatcher - 12356-43960.log +0 -43
- data/spec/support/logs/Dispatcher - 12365-30567.log +0 -39
- data/spec/support/logs/Dispatcher - 12374-49263.log +0 -34
- data/spec/support/logs/Dispatcher - 12401-6543.log +0 -28
- data/spec/support/logs/Dispatcher - 12410-21678.log +0 -21
- data/spec/support/logs/Dispatcher - 12419-42381.log +0 -13
- data/spec/support/logs/Dispatcher - 12429-25829.log +0 -9
- data/spec/support/logs/Dispatcher - 12574-63838.log +0 -19
- data/spec/support/logs/Dispatcher - 12584-33256.log +0 -21
- data/spec/support/logs/Dispatcher - 12593-45982.log +0 -15
- data/spec/support/logs/Dispatcher - 12606-64171.log +0 -19
- data/spec/support/logs/Dispatcher - 12615-52258.log +0 -21
- data/spec/support/logs/Dispatcher - 12624-48032.log +0 -15
- data/spec/support/logs/Dispatcher - 12744-31691.log +0 -17
- data/spec/support/logs/Dispatcher - 12753-9777.log +0 -21
- data/spec/support/logs/Dispatcher - 12762-14195.log +0 -13
- data/spec/support/logs/Dispatcher - 12775-52778.log +0 -19
- data/spec/support/logs/Dispatcher - 12784-33121.log +0 -21
- data/spec/support/logs/Dispatcher - 12793-23476.log +0 -15
- data/spec/support/logs/Dispatcher - 12845-33401.log +0 -17
- data/spec/support/logs/Dispatcher - 12854-58592.log +0 -21
- data/spec/support/logs/Dispatcher - 12863-38667.log +0 -13
- data/spec/support/logs/Dispatcher - 12876-18504.log +0 -17
- data/spec/support/logs/Dispatcher - 12885-8765.log +0 -21
- data/spec/support/logs/Dispatcher - 12894-7708.log +0 -13
- data/spec/support/logs/Dispatcher - 13112-20247.log +0 -19
- data/spec/support/logs/Dispatcher - 13121-37610.log +0 -21
- data/spec/support/logs/Dispatcher - 13130-55144.log +0 -15
- data/spec/support/logs/Dispatcher - 13154-11476.log +0 -21
- data/spec/support/logs/Dispatcher - 13163-28157.log +0 -25
- data/spec/support/logs/Dispatcher - 13172-1403.log +0 -15
- data/spec/support/logs/Dispatcher - 13208-39214.log +0 -17
- data/spec/support/logs/Dispatcher - 13217-25789.log +0 -21
- data/spec/support/logs/Dispatcher - 13226-32449.log +0 -13
- data/spec/support/logs/Dispatcher - 13239-50344.log +0 -21
- data/spec/support/logs/Dispatcher - 13248-35317.log +0 -25
- data/spec/support/logs/Dispatcher - 13257-20820.log +0 -15
- data/spec/support/logs/Dispatcher - 13293-39307.log +0 -17
- data/spec/support/logs/Dispatcher - 13302-62417.log +0 -21
- data/spec/support/logs/Dispatcher - 13311-57144.log +0 -13
- data/spec/support/logs/Dispatcher - 13324-35654.log +0 -17
- data/spec/support/logs/Dispatcher - 13333-9999.log +0 -21
- data/spec/support/logs/Dispatcher - 13342-64466.log +0 -13
- data/spec/support/logs/Dispatcher - 15092-40680.log +0 -9
- data/spec/support/logs/Dispatcher - 15119-21562.log +0 -21
- data/spec/support/logs/Dispatcher - 15680-63471.log +0 -9
- data/spec/support/logs/Dispatcher - 15690-15104.log +0 -19
- data/spec/support/logs/Dispatcher - 15699-36034.log +0 -17
- data/spec/support/logs/Dispatcher - 15708-21275.log +0 -13
- data/spec/support/logs/Dispatcher - 15717-6134.log +0 -9
- data/spec/support/logs/Dispatcher - 15727-5906.log +0 -9
- data/spec/support/logs/Dispatcher - 15736-27941.log +0 -11
- data/spec/support/logs/Dispatcher - 15749-31464.log +0 -11
- data/spec/support/logs/Dispatcher - 15762-52837.log +0 -35
- data/spec/support/logs/Dispatcher - 15823-2486.log +0 -21
- data/spec/support/logs/Dispatcher - 15832-34792.log +0 -21
- data/spec/support/logs/Dispatcher - 15841-3367.log +0 -23
- data/spec/support/logs/Dispatcher - 15886-2171.log +0 -19
- data/spec/support/logs/Dispatcher - 15895-6022.log +0 -17
- data/spec/support/logs/Dispatcher - 15904-51624.log +0 -15
- data/spec/support/logs/Dispatcher - 15917-11227.log +0 -11
- data/spec/support/logs/Dispatcher - 15930-17170.log +0 -9
- data/spec/support/logs/Dispatcher - 15939-24891.log +0 -9
- data/spec/support/logs/Dispatcher - 15948-26858.log +0 -9
- data/spec/support/logs/Dispatcher - 15957-12278.log +0 -9
- data/spec/support/logs/Dispatcher - 15967-37642.log +0 -11
- data/spec/support/logs/Dispatcher - 15981-57959.log +0 -9
- data/spec/support/logs/Dispatcher - 16000-51003.log +0 -9
- data/spec/support/logs/Dispatcher - 16064-25969.log +0 -63
- data/spec/support/logs/Dispatcher - 16073-13164.log +0 -43
- data/spec/support/logs/Dispatcher - 16083-21729.log +0 -39
- data/spec/support/logs/Dispatcher - 16092-48691.log +0 -34
- data/spec/support/logs/Dispatcher - 16101-7385.log +0 -28
- data/spec/support/logs/Dispatcher - 16110-24222.log +0 -21
- data/spec/support/logs/Dispatcher - 16119-29645.log +0 -13
- data/spec/support/logs/Dispatcher - 16129-23325.log +0 -9
- data/spec/support/logs/Dispatcher - 16399-42716.log +0 -19
- data/spec/support/logs/Dispatcher - 16410-3301.log +0 -21
- data/spec/support/logs/Dispatcher - 16419-8500.log +0 -15
- data/spec/support/logs/Dispatcher - 16432-2467.log +0 -19
- data/spec/support/logs/Dispatcher - 16441-27407.log +0 -21
- data/spec/support/logs/Dispatcher - 16450-28157.log +0 -15
- data/spec/support/logs/Dispatcher - 16607-37339.log +0 -17
- data/spec/support/logs/Dispatcher - 16616-50971.log +0 -21
- data/spec/support/logs/Dispatcher - 16625-28154.log +0 -13
- data/spec/support/logs/Dispatcher - 16638-17094.log +0 -19
- data/spec/support/logs/Dispatcher - 16647-25657.log +0 -21
- data/spec/support/logs/Dispatcher - 16656-11108.log +0 -15
- data/spec/support/logs/Dispatcher - 16716-31067.log +0 -17
- data/spec/support/logs/Dispatcher - 16726-34466.log +0 -21
- data/spec/support/logs/Dispatcher - 16735-55150.log +0 -13
- data/spec/support/logs/Dispatcher - 16748-7910.log +0 -17
- data/spec/support/logs/Dispatcher - 16757-62118.log +0 -21
- data/spec/support/logs/Dispatcher - 16766-31937.log +0 -13
- data/spec/support/logs/Dispatcher - 16999-6441.log +0 -19
- data/spec/support/logs/Dispatcher - 17008-51788.log +0 -21
- data/spec/support/logs/Dispatcher - 17017-20096.log +0 -15
- data/spec/support/logs/Dispatcher - 17041-15877.log +0 -21
- data/spec/support/logs/Dispatcher - 17050-42137.log +0 -25
- data/spec/support/logs/Dispatcher - 17059-12767.log +0 -15
- data/spec/support/logs/Dispatcher - 17095-3041.log +0 -17
- data/spec/support/logs/Dispatcher - 17104-42336.log +0 -21
- data/spec/support/logs/Dispatcher - 17113-11660.log +0 -13
- data/spec/support/logs/Dispatcher - 17126-64859.log +0 -21
- data/spec/support/logs/Dispatcher - 17135-11634.log +0 -25
- data/spec/support/logs/Dispatcher - 17144-37598.log +0 -15
- data/spec/support/logs/Dispatcher - 17180-55804.log +0 -17
- data/spec/support/logs/Dispatcher - 17189-5599.log +0 -21
- data/spec/support/logs/Dispatcher - 17198-13188.log +0 -13
- data/spec/support/logs/Dispatcher - 17211-23553.log +0 -17
- data/spec/support/logs/Dispatcher - 17220-36701.log +0 -21
- data/spec/support/logs/Dispatcher - 17229-41502.log +0 -13
- data/spec/support/logs/Instance - 12859-23151.error.log +0 -314
- data/spec/support/logs/Instance - 12890-17901.error.log +0 -413
- data/spec/support/logs/Instance - 12915-45947.error.log +0 -314
- data/spec/support/logs/Instance - 13044-48074.error.log +0 -312
- data/spec/support/logs/Instance - 16731-60738.error.log +0 -314
- data/spec/support/logs/Instance - 16931-37511.error.log +0 -312
@@ -1,5 +1,5 @@
|
|
1
1
|
=begin
|
2
|
-
Copyright 2010-
|
2
|
+
Copyright 2010-2014 Tasos Laskos <tasos.laskos@gmail.com>
|
3
3
|
|
4
4
|
Licensed under the Apache License, Version 2.0 (the "License");
|
5
5
|
you may not use this file except in compliance with the License.
|
@@ -18,40 +18,49 @@ module Arachni
|
|
18
18
|
|
19
19
|
module Element::Capabilities
|
20
20
|
|
21
|
+
module Auditable
|
22
|
+
|
23
|
+
# Performs boolean injection and behavioral analysis (using differential analysis
|
24
|
+
# techniques based on {Support::Signature} comparisons) in order to determine
|
25
|
+
# whether the web application is responding to the injected data and how.
|
21
26
|
#
|
22
|
-
#
|
23
|
-
#
|
24
|
-
#
|
25
|
-
# If the behavior can be manipulated by the injected data in ways that it's not supposed to
|
26
|
-
# (like when evaluating injected code) then the element is deemed vulnerable.
|
27
|
+
# If the behavior can be manipulated by the injected data in ways that it's not
|
28
|
+
# supposed to (like when evaluating injected code) then the element is deemed
|
29
|
+
# vulnerable.
|
27
30
|
#
|
28
31
|
# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
29
|
-
|
30
|
-
module Auditable::RDiff
|
31
|
-
|
32
|
-
def self.included( mod )
|
33
|
-
# the rdiff attack performs it own redundancy checks so we need this to
|
34
|
-
# keep track of audited elements
|
35
|
-
@@rdiff_audited ||= Support::LookUp::HashSet.new
|
36
|
-
end
|
32
|
+
module RDiff
|
37
33
|
|
38
34
|
RDIFF_OPTIONS = {
|
39
|
-
#
|
40
|
-
format:
|
35
|
+
# Append our seeds to the default values.
|
36
|
+
format: [Mutable::Format::STRAIGHT],
|
37
|
+
|
38
|
+
# Amount of refinement operations to remove context-irrelevant dynamic
|
39
|
+
# content -- like banners etc.
|
40
|
+
precision: 2,
|
41
|
+
|
42
|
+
# Override global fuzzing settings and only use the default method of the
|
43
|
+
# element under audit.
|
44
|
+
respect_method: true,
|
41
45
|
|
42
|
-
#
|
43
|
-
|
46
|
+
# Don't generate or submit any mutations with default or sample inputs.
|
47
|
+
skip_orig: true,
|
44
48
|
|
45
|
-
#
|
46
|
-
|
49
|
+
# Allow redundant audits, we need multiple ones for noise-reduction.
|
50
|
+
redundant: true,
|
47
51
|
|
48
|
-
|
52
|
+
# Don't let #audit print output, we'll handle that ourselves.
|
53
|
+
silent: true,
|
54
|
+
|
55
|
+
# Default value for a forceful 'false' response.
|
56
|
+
false: '-1'
|
49
57
|
}
|
50
58
|
|
51
59
|
#
|
52
60
|
# Performs differential analysis and logs an issue should there be one.
|
53
61
|
#
|
54
62
|
# opts = {
|
63
|
+
# false: 'false resource id',
|
55
64
|
# pairs: [
|
56
65
|
# { 'true expression' => 'false expression' }
|
57
66
|
# ]
|
@@ -61,13 +70,15 @@ module Auditable::RDiff
|
|
61
70
|
#
|
62
71
|
# Here's how it goes:
|
63
72
|
#
|
64
|
-
# * let `control` be the
|
65
|
-
# * let `true_response`
|
66
|
-
# * let `false_response`
|
73
|
+
# * let `control` be the response of the injection of 'false resource id'
|
74
|
+
# * let `true_response` be the response of the injection of 'true expression'
|
75
|
+
# * let `false_response` be the response of the injection of 'false expression'
|
76
|
+
# * let `control_verification` be a fresh control
|
67
77
|
#
|
68
78
|
# A vulnerability is logged if:
|
69
79
|
#
|
70
|
-
# control ==
|
80
|
+
# control == control_verification && control == false_response AND
|
81
|
+
# true_response.code == 200 AND false_response != true_response
|
71
82
|
#
|
72
83
|
# The `bool` response is also checked in order to determine if it's a custom
|
73
84
|
# 404, if it is then it'll be skipped.
|
@@ -82,14 +93,19 @@ module Auditable::RDiff
|
|
82
93
|
# @option opts [Array<Hash>] :pairs
|
83
94
|
# Pair of strings that should yield different results when interpreted.
|
84
95
|
# Keys should be the `true` expressions.
|
85
|
-
# @
|
86
|
-
#
|
96
|
+
# @option opts [String] :false
|
97
|
+
# A string which would illicit a 'false' response but without any code.
|
87
98
|
#
|
88
99
|
# @return [Bool]
|
89
100
|
# `true` if the audit was scheduled successfully, `false` otherwise (like
|
90
101
|
# if the resource is out of scope or already audited).
|
91
102
|
#
|
92
|
-
def rdiff_analysis( opts = {}
|
103
|
+
def rdiff_analysis( opts = {} )
|
104
|
+
return if self.auditable.empty?
|
105
|
+
|
106
|
+
return false if audited? audit_id
|
107
|
+
audited audit_id
|
108
|
+
|
93
109
|
if skip_path? self.action
|
94
110
|
print_debug "Element's action matches skip rule, bailing out."
|
95
111
|
return false
|
@@ -97,137 +113,377 @@ module Auditable::RDiff
|
|
97
113
|
|
98
114
|
opts = self.class::MUTATION_OPTIONS.merge( RDIFF_OPTIONS.merge( opts ) )
|
99
115
|
|
100
|
-
|
116
|
+
mutations_size = 0
|
117
|
+
each_mutation( opts[:false], opts ) { mutations_size += 1 }
|
118
|
+
mutations_size *= opts[:precision]
|
119
|
+
|
120
|
+
@data_gathering = {
|
121
|
+
mutations_size: mutations_size,
|
122
|
+
expected_responses: mutations_size + (mutations_size * opts[:pairs].size * 2),
|
123
|
+
received_responses: 0,
|
124
|
+
done: false,
|
125
|
+
controls: {}
|
126
|
+
}
|
127
|
+
|
128
|
+
# Holds all the data from the probes.
|
129
|
+
signatures = {
|
130
|
+
# Control baseline per input.
|
131
|
+
controls: {},
|
132
|
+
|
133
|
+
# Verification control baseline per input.
|
134
|
+
controls_verification: {},
|
101
135
|
|
102
|
-
|
103
|
-
|
136
|
+
# Corrupted baselines per input.
|
137
|
+
corrupted: {},
|
104
138
|
|
105
|
-
|
106
|
-
|
139
|
+
# Rest of the data are dynamically populated using input pairs
|
140
|
+
# as keys.
|
141
|
+
}
|
107
142
|
|
108
|
-
|
109
|
-
|
143
|
+
# Populate the baseline/control forced-false signatures.
|
144
|
+
populate_control_signatures( opts, signatures )
|
145
|
+
|
146
|
+
http.after_run do
|
147
|
+
# Populate the 'true' signatures.
|
148
|
+
populate_true_signatures( opts, signatures )
|
149
|
+
|
150
|
+
# Populate the 'false' signatures.
|
151
|
+
populate_false_signatures( opts, signatures )
|
152
|
+
end
|
153
|
+
|
154
|
+
true
|
155
|
+
end
|
156
|
+
|
157
|
+
private
|
158
|
+
|
159
|
+
# Performs requests using the 'false' control seed and generates/stores
|
160
|
+
# signatures based on the response bodies.
|
161
|
+
def populate_control_signatures( opts, signatures )
|
162
|
+
gathered = {}
|
110
163
|
opts[:precision].times do
|
111
|
-
|
112
|
-
|
113
|
-
|
114
|
-
|
164
|
+
audit( opts[:false], opts ) do |res, _, elem|
|
165
|
+
altered_hash = elem.altered.hash
|
166
|
+
|
167
|
+
next if signatures[:corrupted][altered_hash]
|
168
|
+
|
169
|
+
gathered[altered_hash] ||= 0
|
170
|
+
gathered[altered_hash] += 1
|
171
|
+
|
172
|
+
response_check( res, signatures, elem )
|
173
|
+
|
174
|
+
if gathered[altered_hash] == @data_gathering[:mutations_size]
|
175
|
+
print_status "Got default/control response for #{elem.type} " +
|
176
|
+
"variable '#{elem.altered}' with action '#{elem.action}'."
|
177
|
+
|
178
|
+
@data_gathering[:controls][altered_hash] = true
|
115
179
|
end
|
116
180
|
|
117
|
-
#
|
118
|
-
|
181
|
+
# Create a signature from the response body and refine it with
|
182
|
+
# subsequent ones to remove noise (like context-irrelevant dynamic
|
183
|
+
# content such as banners etc.).
|
184
|
+
signatures[:controls][altered_hash] =
|
185
|
+
signatures[:controls][altered_hash] ?
|
186
|
+
signatures[:controls][altered_hash].refine!(res.body) :
|
187
|
+
Support::Signature.new(res.body)
|
188
|
+
|
189
|
+
@data_gathering[:received_responses] += 1
|
190
|
+
|
191
|
+
finalize_if_done( opts, signatures )
|
119
192
|
end
|
120
193
|
end
|
194
|
+
end
|
195
|
+
|
196
|
+
# Performs requests using the 'true' seeds and generates/stores signatures
|
197
|
+
# based on the response bodies.
|
198
|
+
def populate_true_signatures( opts, signatures )
|
199
|
+
gathered = {}
|
121
200
|
|
122
201
|
opts[:pairs].each do |pair|
|
123
|
-
|
124
|
-
|
202
|
+
pair_hash = pair.hash
|
203
|
+
|
204
|
+
signatures[pair_hash] ||= {}
|
205
|
+
@data_gathering[pair_hash] ||= {}
|
206
|
+
gathered[pair_hash] ||= {}
|
207
|
+
|
208
|
+
true_expr = pair.to_a.first[0]
|
209
|
+
|
210
|
+
print_status "Gathering 'true' data for #{self.type} with " <<
|
211
|
+
"action '#{self.action}' using seed: #{true_expr}"
|
125
212
|
|
126
213
|
opts[:precision].times do
|
127
|
-
|
128
|
-
|
129
|
-
|
130
|
-
|
131
|
-
|
132
|
-
|
133
|
-
|
134
|
-
|
135
|
-
|
136
|
-
|
137
|
-
|
138
|
-
|
139
|
-
|
140
|
-
|
141
|
-
|
142
|
-
|
143
|
-
|
144
|
-
|
145
|
-
|
146
|
-
|
147
|
-
|
148
|
-
responses[pair][elem.altered][:true] =
|
149
|
-
responses[pair][elem.altered][:true].rdiff( res.body.clone )
|
214
|
+
audit( true_expr, opts ) do |res, _, elem|
|
215
|
+
altered_hash = elem.altered.hash
|
216
|
+
|
217
|
+
gathered[pair_hash][altered_hash] ||= 0
|
218
|
+
gathered[pair_hash][altered_hash] += 1
|
219
|
+
|
220
|
+
signatures[pair_hash][altered_hash] ||= {}
|
221
|
+
@data_gathering[pair_hash][altered_hash] ||= {}
|
222
|
+
|
223
|
+
next if signatures[pair_hash][altered_hash][:corrupted] ||
|
224
|
+
signatures[:corrupted][altered_hash]
|
225
|
+
|
226
|
+
response_check( res, signatures, elem, pair_hash )
|
227
|
+
|
228
|
+
next if signature_sieve( altered_hash, signatures, pair_hash )
|
229
|
+
|
230
|
+
if gathered[pair_hash][altered_hash] == opts[:precision]
|
231
|
+
elem.print_status "Got 'true' response for #{elem.type} " <<
|
232
|
+
"variable '#{elem.altered}' with action '#{elem.action}'" <<
|
233
|
+
" using seed: #{true_expr}"
|
234
|
+
@data_gathering[pair_hash][altered_hash][:true_probes] = true
|
150
235
|
end
|
236
|
+
|
237
|
+
# Store the mutation for the {Arachni::Issue}.
|
238
|
+
signatures[pair_hash][altered_hash][:mutation] = elem
|
239
|
+
|
240
|
+
# Keep the latest response for the {Arachni::Issue}.
|
241
|
+
signatures[pair_hash][altered_hash][:response] = res
|
242
|
+
|
243
|
+
signatures[pair_hash][altered_hash][:injected_string] = true_expr
|
244
|
+
|
245
|
+
# Create a signature from the response body and refine it with
|
246
|
+
# subsequent ones to remove noise (like context-irrelevant dynamic
|
247
|
+
# content such as banners etc.).
|
248
|
+
signatures[pair_hash][altered_hash][:true] =
|
249
|
+
signatures[pair_hash][altered_hash][:true] ?
|
250
|
+
signatures[pair_hash][altered_hash][:true].refine!(res.body) :
|
251
|
+
Support::Signature.new(res.body)
|
252
|
+
|
253
|
+
signature_sieve( altered_hash, signatures, pair_hash )
|
254
|
+
|
255
|
+
@data_gathering[:received_responses] += 1
|
256
|
+
finalize_if_done( opts, signatures )
|
151
257
|
end
|
258
|
+
end
|
259
|
+
end
|
260
|
+
end
|
261
|
+
|
262
|
+
# Performs requests using the 'false' seeds and generates/stores signatures
|
263
|
+
# based on the response bodies.
|
264
|
+
def populate_false_signatures( opts, signatures )
|
265
|
+
gathered = {}
|
266
|
+
|
267
|
+
opts[:pairs].each do |pair|
|
268
|
+
pair_hash = pair.hash
|
269
|
+
|
270
|
+
signatures[pair_hash] ||= {}
|
271
|
+
@data_gathering[pair_hash] ||= {}
|
272
|
+
gathered[pair_hash] ||= {}
|
273
|
+
|
274
|
+
false_expr = pair.to_a.first[1]
|
152
275
|
|
153
|
-
|
154
|
-
|
276
|
+
print_status "Gathering 'false' data for #{self.type} with " <<
|
277
|
+
"action '#{self.action}' using seed: #{false_expr}"
|
155
278
|
|
156
|
-
|
157
|
-
|
158
|
-
|
159
|
-
|
160
|
-
|
161
|
-
|
162
|
-
|
279
|
+
opts[:precision].times do
|
280
|
+
audit( false_expr, opts ) do |res, _, elem|
|
281
|
+
altered_hash = elem.altered.hash
|
282
|
+
|
283
|
+
gathered[pair_hash][altered_hash] ||= 0
|
284
|
+
gathered[pair_hash][altered_hash] += 1
|
285
|
+
|
286
|
+
signatures[pair_hash][altered_hash] ||= {}
|
287
|
+
@data_gathering[pair_hash][altered_hash] ||= {}
|
163
288
|
|
164
|
-
|
289
|
+
next if signatures[pair_hash][altered_hash][:corrupted] ||
|
290
|
+
signatures[:corrupted][altered_hash]
|
165
291
|
|
166
|
-
|
167
|
-
|
168
|
-
|
169
|
-
|
292
|
+
response_check( res, signatures, elem, pair_hash )
|
293
|
+
|
294
|
+
next if signature_sieve( altered_hash, signatures, pair_hash )
|
295
|
+
|
296
|
+
if gathered[pair_hash][altered_hash] == opts[:precision]
|
297
|
+
elem.print_status "Got 'false' response for #{elem.type} " <<
|
298
|
+
"variable '#{elem.altered}' with action '#{elem.action}'" <<
|
299
|
+
" using seed: #{false_expr}"
|
300
|
+
@data_gathering[pair_hash][altered_hash][:false_probes] = true
|
170
301
|
end
|
302
|
+
|
303
|
+
# Create a signature from the response body and refine it with
|
304
|
+
# subsequent ones to remove noise (like context-irrelevant dynamic
|
305
|
+
# content such as banners etc.).
|
306
|
+
signatures[pair_hash][altered_hash][:false] =
|
307
|
+
signatures[pair_hash][altered_hash][:false] ?
|
308
|
+
signatures[pair_hash][altered_hash][:false].refine!(res.body) :
|
309
|
+
Support::Signature.new(res.body)
|
310
|
+
|
311
|
+
signature_sieve( altered_hash, signatures, pair_hash )
|
312
|
+
|
313
|
+
@data_gathering[:received_responses] += 1
|
314
|
+
finalize_if_done( opts, signatures )
|
171
315
|
end
|
172
316
|
end
|
173
317
|
end
|
318
|
+
end
|
174
319
|
|
320
|
+
# Check if we're done with data gathering and proceed to establishing a
|
321
|
+
# {#populate_control_verification_signatures verification control baseline}
|
322
|
+
# and {#match_signatures final analysis}.
|
323
|
+
def finalize_if_done( opts, signatures )
|
324
|
+
return if @data_gathering[:done] ||
|
325
|
+
@data_gathering[:expected_responses] != @data_gathering[:received_responses]
|
326
|
+
@data_gathering[:done] = true
|
327
|
+
|
328
|
+
# Lastly, we need to re-establish a new baseline in order to compare
|
329
|
+
# it with the initial one so as to be sure that server behavior
|
330
|
+
# hasn't suddenly changed in a way that would corrupt our analysis.
|
331
|
+
populate_control_verification_signatures( opts, signatures )
|
332
|
+
end
|
175
333
|
|
176
|
-
|
177
|
-
|
178
|
-
|
179
|
-
|
180
|
-
|
181
|
-
|
334
|
+
# Re-establishes a control baseline at the end of the audit, to make sure
|
335
|
+
# that website behavior has remained stable, otherwise its behavior won't
|
336
|
+
# be trustworthy.
|
337
|
+
def populate_control_verification_signatures( opts, signatures )
|
338
|
+
received_responses = 0
|
339
|
+
gathered = {}
|
340
|
+
|
341
|
+
opts[:precision].times do
|
342
|
+
audit( opts[:false], opts ) do |res, _, elem|
|
343
|
+
altered_hash = elem.altered.hash
|
344
|
+
|
345
|
+
gathered[altered_hash] ||= 0
|
346
|
+
gathered[altered_hash] += 1
|
347
|
+
|
348
|
+
next if signatures[:corrupted][altered_hash]
|
349
|
+
|
350
|
+
response_check( res, signatures, elem )
|
351
|
+
|
352
|
+
if gathered[altered_hash] == opts[:precision]
|
353
|
+
print_status 'Got control verification response ' <<
|
354
|
+
"for #{elem.type} variable '#{elem.altered}' with" <<
|
355
|
+
" action '#{elem.action}'."
|
356
|
+
end
|
357
|
+
|
358
|
+
# Create a signature from the response body and refine it with
|
359
|
+
# subsequent ones to remove noise (like context-irrelevant dynamic
|
360
|
+
# content such as banners etc.).
|
361
|
+
signatures[:controls_verification][altered_hash] =
|
362
|
+
signatures[:controls_verification][altered_hash] ?
|
363
|
+
signatures[:controls_verification][altered_hash].refine!(res.body) :
|
364
|
+
Support::Signature.new(res.body)
|
365
|
+
|
366
|
+
received_responses += 1
|
367
|
+
next if received_responses != @data_gathering[:mutations_size]
|
368
|
+
|
369
|
+
# Once the new baseline has been established and we've got all the
|
370
|
+
# data we need, crunch them and see if server behavior indicates
|
371
|
+
# a vulnerability.
|
372
|
+
match_signatures( signatures )
|
373
|
+
end
|
374
|
+
end
|
375
|
+
end
|
376
|
+
|
377
|
+
def match_signatures( signatures )
|
378
|
+
controls = signatures.delete( :controls )
|
379
|
+
controls_verification = signatures.delete( :controls_verification )
|
380
|
+
corrupted = signatures.delete( :corrupted )
|
381
|
+
|
382
|
+
signatures.each do |_, data|
|
383
|
+
data.each do |input, result|
|
384
|
+
next if result[:corrupted] || corrupted[input]
|
385
|
+
|
386
|
+
# If the initial and verification baselines differ, bail out;
|
387
|
+
# server behavior is too unstable.
|
388
|
+
if controls[input] != controls_verification[input]
|
389
|
+
result[:mutation].print_bad 'Control baseline too unstable, ' <<
|
390
|
+
"aborting analysis for #{result[:mutation].type} " <<
|
391
|
+
"variable '#{result[:mutation].altered}' with action " <<
|
392
|
+
"'#{result[:mutation].action}'"
|
182
393
|
next
|
183
394
|
end
|
184
395
|
|
185
|
-
|
186
|
-
|
187
|
-
|
188
|
-
|
189
|
-
|
190
|
-
|
191
|
-
|
192
|
-
|
193
|
-
|
194
|
-
|
195
|
-
|
196
|
-
|
197
|
-
|
198
|
-
|
199
|
-
|
200
|
-
|
201
|
-
|
202
|
-
|
203
|
-
|
204
|
-
|
205
|
-
|
206
|
-
|
207
|
-
|
208
|
-
|
209
|
-
end
|
210
|
-
end
|
396
|
+
# To have gotten here the following must be true:
|
397
|
+
#
|
398
|
+
# force_false_baseline == false_response_body AND
|
399
|
+
# false_response_body != true_response_body AND
|
400
|
+
# force_false_response_code == 200 AND
|
401
|
+
# true_response_code == 200 AND
|
402
|
+
# false_response_code == 200
|
403
|
+
|
404
|
+
# Check to see if the `true` response we're analyzing
|
405
|
+
# is a custom 404 page.
|
406
|
+
http.custom_404?( result[:response] ) do |is_custom_404|
|
407
|
+
# If this is a custom 404 page bail out.
|
408
|
+
next if is_custom_404
|
409
|
+
|
410
|
+
@auditor.log({
|
411
|
+
var: result[:mutation].altered,
|
412
|
+
opts: {
|
413
|
+
injected_orig: result[:injected_string],
|
414
|
+
combo: result[:mutation].auditable
|
415
|
+
},
|
416
|
+
injected: result[:mutation].altered_value,
|
417
|
+
elem: type
|
418
|
+
}, result[:response]
|
419
|
+
)
|
211
420
|
end
|
212
421
|
end
|
213
422
|
end
|
214
|
-
|
215
|
-
true
|
216
423
|
end
|
217
424
|
|
218
|
-
|
219
|
-
|
220
|
-
|
221
|
-
|
425
|
+
def response_check( response, signatures, elem, pair = nil )
|
426
|
+
corrupted = false
|
427
|
+
|
428
|
+
if response.code != 200
|
429
|
+
print_status 'Server returned non 200 status,' <<
|
430
|
+
" aborting analysis for #{elem.type} variable " <<
|
431
|
+
"'#{elem.altered}' with action '#{elem.action}'."
|
432
|
+
corrupted = true
|
433
|
+
end
|
222
434
|
|
223
|
-
|
224
|
-
|
435
|
+
if response.body.to_s.empty?
|
436
|
+
print_status 'Server returned empty response body,' <<
|
437
|
+
" aborting analysis for #{elem.type} variable " <<
|
438
|
+
"'#{elem.altered}' with action '#{self.action}'."
|
439
|
+
corrupted = true
|
440
|
+
end
|
441
|
+
|
442
|
+
return if !corrupted
|
443
|
+
|
444
|
+
if pair
|
445
|
+
signatures[pair][elem.altered.hash][:corrupted] = true
|
446
|
+
else
|
447
|
+
signatures[:corrupted][elem.altered.hash] = true
|
448
|
+
end
|
225
449
|
end
|
226
450
|
|
227
|
-
def
|
228
|
-
|
451
|
+
def signature_sieve( input, signatures, pair )
|
452
|
+
gathered = @data_gathering[pair][input]
|
453
|
+
signature = signatures[pair][input]
|
454
|
+
|
455
|
+
# If data has been corrupted for the given input, remove it.
|
456
|
+
if signature[:corrupted]
|
457
|
+
signatures[pair].delete( input )
|
458
|
+
return true
|
459
|
+
end
|
460
|
+
|
461
|
+
# 1st check: force_false_baseline == false_response_body
|
462
|
+
#
|
463
|
+
# * Make sure the necessary data has been gathered.
|
464
|
+
# * Remove the data if forced-false and boolean-false signatures
|
465
|
+
# don't match.
|
466
|
+
if (@data_gathering[:controls][input] && gathered[:false_probes]) &&
|
467
|
+
(signatures[:controls][input] != signature[:false])
|
468
|
+
signatures[pair].delete( input )
|
469
|
+
return true
|
470
|
+
end
|
471
|
+
|
472
|
+
# 2nd check: false_response_baseline != true_response_baseline
|
473
|
+
#
|
474
|
+
# * Make sure the necessary data has been gathered.
|
475
|
+
# * Remove the data if boolean-false and boolean-true signatures
|
476
|
+
# are too similar.
|
477
|
+
if (gathered[:false_probes] && gathered[:true_probes]) &&
|
478
|
+
signature[:false].similar?( signature[:true], 5 )
|
479
|
+
signatures[pair].delete( input )
|
480
|
+
return true
|
481
|
+
end
|
482
|
+
|
483
|
+
false
|
229
484
|
end
|
230
485
|
|
231
486
|
end
|
232
487
|
end
|
233
488
|
end
|
489
|
+
end
|