arachni 0.4.6 → 0.4.7

Sign up to get free protection for your applications and to get access to all the features.
Files changed (310) hide show
  1. checksums.yaml +8 -8
  2. data/CHANGELOG.md +21 -0
  3. data/Gemfile +1 -1
  4. data/README.md +1 -1
  5. data/lib/arachni/element/capabilities/auditable/taint.rb +1 -0
  6. data/lib/arachni/element/form.rb +4 -6
  7. data/lib/arachni/http.rb +1 -0
  8. data/lib/arachni/parser.rb +1 -1
  9. data/lib/arachni/spider.rb +14 -2
  10. data/lib/version +1 -1
  11. data/modules/audit/code_injection.rb +36 -10
  12. data/modules/audit/code_injection_php_input_wrapper.rb +38 -5
  13. data/modules/audit/code_injection_timing.rb +36 -13
  14. data/modules/audit/csrf.rb +41 -11
  15. data/modules/audit/file_inclusion.rb +36 -6
  16. data/modules/audit/ldapi.rb +31 -6
  17. data/modules/audit/os_cmd_injection.rb +28 -7
  18. data/modules/audit/os_cmd_injection_timing.rb +29 -15
  19. data/modules/audit/path_traversal.rb +42 -6
  20. data/modules/audit/response_splitting.rb +26 -9
  21. data/modules/audit/rfi.rb +37 -9
  22. data/modules/audit/session_fixation.rb +38 -7
  23. data/modules/audit/source_code_disclosure.rb +41 -5
  24. data/modules/audit/sqli.rb +57 -6
  25. data/modules/audit/sqli_blind_rdiff.rb +54 -9
  26. data/modules/audit/sqli_blind_timing.rb +58 -15
  27. data/modules/audit/unvalidated_redirect.rb +29 -9
  28. data/modules/audit/xpath.rb +35 -8
  29. data/modules/audit/xss.rb +54 -9
  30. data/modules/audit/xss_event.rb +54 -10
  31. data/modules/audit/xss_path.rb +56 -9
  32. data/modules/audit/xss_script_tag.rb +54 -8
  33. data/modules/audit/xss_tag.rb +53 -7
  34. data/modules/recon/allowed_methods.rb +24 -4
  35. data/modules/recon/backdoors.rb +29 -11
  36. data/modules/recon/backup_files.rb +30 -14
  37. data/modules/recon/common_directories.rb +27 -8
  38. data/modules/recon/common_files.rb +27 -7
  39. data/modules/recon/directory_listing.rb +30 -10
  40. data/modules/recon/grep/captcha.rb +26 -8
  41. data/modules/recon/grep/credit_card.rb +25 -6
  42. data/modules/recon/grep/cvs_svn_users.rb +23 -6
  43. data/modules/recon/grep/emails.rb +28 -8
  44. data/modules/recon/grep/form_upload.rb +31 -6
  45. data/modules/recon/grep/http_only_cookies.rb +33 -8
  46. data/modules/recon/grep/insecure_cookies.rb +36 -9
  47. data/modules/recon/grep/mixed_resource.rb +29 -9
  48. data/modules/recon/grep/password_autocomplete.rb +33 -6
  49. data/modules/recon/grep/private_ip.rb +21 -7
  50. data/modules/recon/grep/ssn.rb +17 -6
  51. data/modules/recon/grep/unencrypted_password_forms.rb +28 -9
  52. data/modules/recon/htaccess_limit.rb +23 -8
  53. data/modules/recon/http_put.rb +29 -7
  54. data/modules/recon/interesting_responses.rb +8 -10
  55. data/modules/recon/localstart_asp.rb +35 -5
  56. data/modules/recon/webdav.rb +23 -7
  57. data/modules/recon/x_forwarded_for_access_restriction_bypass.rb +27 -6
  58. data/modules/recon/xst.rb +26 -5
  59. data/plugins/autologin.rb +16 -5
  60. data/plugins/proxy/server.rb +2 -9
  61. data/spec/external/wavsep/active/lfi_spec.rb +6 -6
  62. data/spec/external/wavsep/active/rfi_spec.rb +6 -6
  63. data/spec/external/wavsep/active/sqli_spec.rb +4 -4
  64. data/spec/external/wavsep/active/xss_spec.rb +1 -1
  65. data/spec/support/logs/Dispatcher - 1332-56847.log +9 -0
  66. data/spec/support/logs/Dispatcher - 1361-63434.log +21 -0
  67. data/spec/support/logs/Dispatcher - 1545-55308.log +9 -0
  68. data/spec/support/logs/Dispatcher - 1559-18938.log +19 -0
  69. data/spec/support/logs/Dispatcher - 1568-25013.log +17 -0
  70. data/spec/support/logs/Dispatcher - 1577-55689.log +13 -0
  71. data/spec/support/logs/Dispatcher - 1586-18577.log +9 -0
  72. data/spec/support/logs/Dispatcher - 1595-49353.log +9 -0
  73. data/spec/support/logs/Dispatcher - 1604-27831.log +11 -0
  74. data/spec/support/logs/Dispatcher - 1617-57444.log +11 -0
  75. data/spec/support/logs/Dispatcher - 1631-28737.log +11 -0
  76. data/spec/support/logs/Dispatcher - 1644-21815.log +33 -0
  77. data/spec/support/logs/Dispatcher - 1738-53470.log +21 -0
  78. data/spec/support/logs/Dispatcher - 1747-64173.log +21 -0
  79. data/spec/support/logs/Dispatcher - 1756-11866.log +23 -0
  80. data/spec/support/logs/Dispatcher - 1798-12175.log +19 -0
  81. data/spec/support/logs/Dispatcher - 1807-22790.log +17 -0
  82. data/spec/support/logs/Dispatcher - 1816-57823.log +15 -0
  83. data/spec/support/logs/Dispatcher - 1831-64825.log +11 -0
  84. data/spec/support/logs/Dispatcher - 1845-27623.log +9 -0
  85. data/spec/support/logs/Dispatcher - 1854-26066.log +9 -0
  86. data/spec/support/logs/Dispatcher - 1863-37486.log +9 -0
  87. data/spec/support/logs/Dispatcher - 1874-22463.log +9 -0
  88. data/spec/support/logs/Dispatcher - 1883-41263.log +11 -0
  89. data/spec/support/logs/Dispatcher - 1900-53660.log +9 -0
  90. data/spec/support/logs/Dispatcher - 1909-44423.log +9 -0
  91. data/spec/support/logs/Dispatcher - 1921-58931.log +9 -0
  92. data/spec/support/logs/Dispatcher - 1993-6448.log +63 -0
  93. data/spec/support/logs/Dispatcher - 2002-19206.log +43 -0
  94. data/spec/support/logs/Dispatcher - 2011-11852.log +39 -0
  95. data/spec/support/logs/Dispatcher - 2020-65055.log +34 -0
  96. data/spec/support/logs/Dispatcher - 2029-48445.log +28 -0
  97. data/spec/support/logs/Dispatcher - 2038-55271.log +21 -0
  98. data/spec/support/logs/Dispatcher - 2047-45722.log +13 -0
  99. data/spec/support/logs/Dispatcher - 2057-48194.log +9 -0
  100. data/spec/support/logs/Dispatcher - 2189-39843.log +19 -0
  101. data/spec/support/logs/Dispatcher - 2199-15985.log +21 -0
  102. data/spec/support/logs/Dispatcher - 2208-22080.log +15 -0
  103. data/spec/support/logs/Dispatcher - 2221-37690.log +19 -0
  104. data/spec/support/logs/Dispatcher - 2230-47867.log +21 -0
  105. data/spec/support/logs/Dispatcher - 2239-27060.log +15 -0
  106. data/spec/support/logs/Dispatcher - 2358-8967.log +17 -0
  107. data/spec/support/logs/Dispatcher - 2367-27103.log +21 -0
  108. data/spec/support/logs/Dispatcher - 2376-16287.log +13 -0
  109. data/spec/support/logs/Dispatcher - 2389-9109.log +19 -0
  110. data/spec/support/logs/Dispatcher - 2398-62926.log +21 -0
  111. data/spec/support/logs/Dispatcher - 2407-48685.log +15 -0
  112. data/spec/support/logs/Dispatcher - 2459-62480.log +17 -0
  113. data/spec/support/logs/Dispatcher - 2470-57894.log +21 -0
  114. data/spec/support/logs/Dispatcher - 2479-51883.log +13 -0
  115. data/spec/support/logs/Dispatcher - 2493-36944.log +17 -0
  116. data/spec/support/logs/Dispatcher - 2503-59143.log +21 -0
  117. data/spec/support/logs/Dispatcher - 2513-33084.log +13 -0
  118. data/spec/support/logs/Dispatcher - 25430-46306.log +9 -0
  119. data/spec/support/logs/Dispatcher - 25457-10711.log +23 -0
  120. data/spec/support/logs/Dispatcher - 25603-48892.log +9 -0
  121. data/spec/support/logs/Dispatcher - 25613-24775.log +19 -0
  122. data/spec/support/logs/Dispatcher - 25622-59684.log +17 -0
  123. data/spec/support/logs/Dispatcher - 25631-23195.log +13 -0
  124. data/spec/support/logs/Dispatcher - 25640-9810.log +9 -0
  125. data/spec/support/logs/Dispatcher - 25649-52757.log +9 -0
  126. data/spec/support/logs/Dispatcher - 25658-58550.log +11 -0
  127. data/spec/support/logs/Dispatcher - 25671-30871.log +11 -0
  128. data/spec/support/logs/Dispatcher - 25684-48620.log +11 -0
  129. data/spec/support/logs/Dispatcher - 25697-18124.log +37 -0
  130. data/spec/support/logs/Dispatcher - 25762-35321.log +21 -0
  131. data/spec/support/logs/Dispatcher - 25771-64633.log +21 -0
  132. data/spec/support/logs/Dispatcher - 25780-43558.log +23 -0
  133. data/spec/support/logs/Dispatcher - 25821-43561.log +19 -0
  134. data/spec/support/logs/Dispatcher - 25830-39112.log +17 -0
  135. data/spec/support/logs/Dispatcher - 25839-44093.log +15 -0
  136. data/spec/support/logs/Dispatcher - 25852-12057.log +11 -0
  137. data/spec/support/logs/Dispatcher - 25866-49029.log +9 -0
  138. data/spec/support/logs/Dispatcher - 25875-32179.log +9 -0
  139. data/spec/support/logs/Dispatcher - 25884-62703.log +9 -0
  140. data/spec/support/logs/Dispatcher - 25894-4228.log +9 -0
  141. data/spec/support/logs/Dispatcher - 25903-6709.log +11 -0
  142. data/spec/support/logs/Dispatcher - 25917-29651.log +9 -0
  143. data/spec/support/logs/Dispatcher - 25926-12708.log +9 -0
  144. data/spec/support/logs/Dispatcher - 25935-54092.log +9 -0
  145. data/spec/support/logs/Dispatcher - 25990-26756.log +63 -0
  146. data/spec/support/logs/Dispatcher - 25999-4016.log +43 -0
  147. data/spec/support/logs/Dispatcher - 26008-52076.log +39 -0
  148. data/spec/support/logs/Dispatcher - 26017-48497.log +34 -0
  149. data/spec/support/logs/Dispatcher - 26026-28839.log +28 -0
  150. data/spec/support/logs/Dispatcher - 26035-54215.log +21 -0
  151. data/spec/support/logs/Dispatcher - 26044-27216.log +13 -0
  152. data/spec/support/logs/Dispatcher - 26054-53464.log +9 -0
  153. data/spec/support/logs/Dispatcher - 26163-65271.log +19 -0
  154. data/spec/support/logs/Dispatcher - 26173-58105.log +21 -0
  155. data/spec/support/logs/Dispatcher - 26182-40848.log +15 -0
  156. data/spec/support/logs/Dispatcher - 26195-2855.log +19 -0
  157. data/spec/support/logs/Dispatcher - 26204-35297.log +21 -0
  158. data/spec/support/logs/Dispatcher - 26213-59588.log +15 -0
  159. data/spec/support/logs/Dispatcher - 26333-40774.log +17 -0
  160. data/spec/support/logs/Dispatcher - 26342-45541.log +21 -0
  161. data/spec/support/logs/Dispatcher - 26351-3349.log +13 -0
  162. data/spec/support/logs/Dispatcher - 26364-37456.log +19 -0
  163. data/spec/support/logs/Dispatcher - 26373-37340.log +21 -0
  164. data/spec/support/logs/Dispatcher - 26382-54864.log +15 -0
  165. data/spec/support/logs/Dispatcher - 26434-3070.log +17 -0
  166. data/spec/support/logs/Dispatcher - 26448-14295.log +21 -0
  167. data/spec/support/logs/Dispatcher - 26474-30587.log +13 -0
  168. data/spec/support/logs/Dispatcher - 26500-32529.log +17 -0
  169. data/spec/support/logs/Dispatcher - 26509-16952.log +21 -0
  170. data/spec/support/logs/Dispatcher - 26519-43332.log +13 -0
  171. data/spec/support/logs/Dispatcher - 26750-61867.log +19 -0
  172. data/spec/support/logs/Dispatcher - 26759-22532.log +21 -0
  173. data/spec/support/logs/Dispatcher - 26768-18231.log +15 -0
  174. data/spec/support/logs/Dispatcher - 26792-41661.log +21 -0
  175. data/spec/support/logs/Dispatcher - 26801-14384.log +25 -0
  176. data/spec/support/logs/Dispatcher - 26810-2591.log +15 -0
  177. data/spec/support/logs/Dispatcher - 26846-14591.log +17 -0
  178. data/spec/support/logs/Dispatcher - 26855-15708.log +21 -0
  179. data/spec/support/logs/Dispatcher - 26864-2062.log +13 -0
  180. data/spec/support/logs/Dispatcher - 26877-14471.log +21 -0
  181. data/spec/support/logs/Dispatcher - 26886-49795.log +25 -0
  182. data/spec/support/logs/Dispatcher - 26895-21093.log +15 -0
  183. data/spec/support/logs/Dispatcher - 26931-30049.log +17 -0
  184. data/spec/support/logs/Dispatcher - 26940-34273.log +21 -0
  185. data/spec/support/logs/Dispatcher - 26949-30040.log +13 -0
  186. data/spec/support/logs/Dispatcher - 26962-8152.log +17 -0
  187. data/spec/support/logs/Dispatcher - 26971-53062.log +21 -0
  188. data/spec/support/logs/Dispatcher - 26980-7548.log +13 -0
  189. data/spec/support/logs/Dispatcher - 2737-20989.log +19 -0
  190. data/spec/support/logs/Dispatcher - 2746-5423.log +21 -0
  191. data/spec/support/logs/Dispatcher - 2755-53393.log +15 -0
  192. data/spec/support/logs/Dispatcher - 27615-41812.log +19 -0
  193. data/spec/support/logs/Dispatcher - 27624-43683.log +21 -0
  194. data/spec/support/logs/Dispatcher - 27633-11593.log +15 -0
  195. data/spec/support/logs/Dispatcher - 27658-12186.log +21 -0
  196. data/spec/support/logs/Dispatcher - 27667-15575.log +25 -0
  197. data/spec/support/logs/Dispatcher - 27676-17207.log +15 -0
  198. data/spec/support/logs/Dispatcher - 27712-2233.log +17 -0
  199. data/spec/support/logs/Dispatcher - 27721-3842.log +21 -0
  200. data/spec/support/logs/Dispatcher - 27730-22695.log +13 -0
  201. data/spec/support/logs/Dispatcher - 27743-8364.log +21 -0
  202. data/spec/support/logs/Dispatcher - 27752-6140.log +25 -0
  203. data/spec/support/logs/Dispatcher - 27761-25015.log +15 -0
  204. data/spec/support/logs/Dispatcher - 27797-9270.log +17 -0
  205. data/spec/support/logs/Dispatcher - 2780-58168.log +21 -0
  206. data/spec/support/logs/Dispatcher - 27806-48623.log +21 -0
  207. data/spec/support/logs/Dispatcher - 27815-58778.log +13 -0
  208. data/spec/support/logs/Dispatcher - 27828-29742.log +17 -0
  209. data/spec/support/logs/Dispatcher - 27837-46211.log +21 -0
  210. data/spec/support/logs/Dispatcher - 27846-16143.log +13 -0
  211. data/spec/support/logs/Dispatcher - 2789-29375.log +25 -0
  212. data/spec/support/logs/Dispatcher - 2798-10983.log +15 -0
  213. data/spec/support/logs/Dispatcher - 2836-2354.log +17 -0
  214. data/spec/support/logs/Dispatcher - 2845-65341.log +21 -0
  215. data/spec/support/logs/Dispatcher - 2854-18936.log +13 -0
  216. data/spec/support/logs/Dispatcher - 2867-51979.log +21 -0
  217. data/spec/support/logs/Dispatcher - 2876-21086.log +25 -0
  218. data/spec/support/logs/Dispatcher - 2887-17393.log +15 -0
  219. data/spec/support/logs/Dispatcher - 2930-37394.log +17 -0
  220. data/spec/support/logs/Dispatcher - 2943-46737.log +21 -0
  221. data/spec/support/logs/Dispatcher - 2956-37866.log +13 -0
  222. data/spec/support/logs/Dispatcher - 2976-21012.log +17 -0
  223. data/spec/support/logs/Dispatcher - 2990-48082.log +21 -0
  224. data/spec/support/logs/Dispatcher - 2999-16391.log +13 -0
  225. data/spec/support/logs/{Instance - 10762-33696.error.log → Instance - 2204-45164.error.log } +59 -40
  226. data/spec/support/logs/{Instance - 11038-18065.error.log → Instance - 2475-49789.error.log } +61 -42
  227. data/spec/support/logs/{Instance - 11069-34848.error.log → Instance - 2509-39450.error.log } +158 -139
  228. data/spec/support/logs/{Instance - 11229-38634.error.log → Instance - 2533-5785.error.log } +56 -37
  229. data/spec/support/logs/Instance - 2539-42941.error.log +356 -0
  230. data/spec/support/logs/Instance - 26178-57631.error.log +324 -0
  231. data/spec/support/logs/Instance - 26458-60253.error.log +326 -0
  232. data/spec/support/logs/Instance - 26514-44685.error.log +423 -0
  233. data/spec/support/logs/Instance - 26538-43093.error.log +322 -0
  234. data/spec/support/logs/Instance - 26544-52217.error.log +328 -0
  235. data/spec/support/logs/{Instance - 11097-33191.error.log → Instance - 26682-37056.error.log } +65 -57
  236. data/spec/support/logs/{Instance - 11091-33954.error.log → Instance - 2669-56818.error.log } +56 -37
  237. data/spec/support/logs/Instance - 27547-3928.error.log +309 -0
  238. data/spec/support/servers/plugins/autologin.rb +13 -1
  239. metadata +974 -782
  240. data/spec/support/logs/Dispatcher - 10129-46995.log +0 -9
  241. data/spec/support/logs/Dispatcher - 10139-63648.log +0 -19
  242. data/spec/support/logs/Dispatcher - 10149-5551.log +0 -17
  243. data/spec/support/logs/Dispatcher - 10158-34385.log +0 -13
  244. data/spec/support/logs/Dispatcher - 10167-55701.log +0 -9
  245. data/spec/support/logs/Dispatcher - 10176-8922.log +0 -9
  246. data/spec/support/logs/Dispatcher - 10185-53716.log +0 -11
  247. data/spec/support/logs/Dispatcher - 10198-44724.log +0 -11
  248. data/spec/support/logs/Dispatcher - 10211-7697.log +0 -11
  249. data/spec/support/logs/Dispatcher - 10224-3751.log +0 -35
  250. data/spec/support/logs/Dispatcher - 10285-7404.log +0 -21
  251. data/spec/support/logs/Dispatcher - 10294-56221.log +0 -21
  252. data/spec/support/logs/Dispatcher - 10303-2483.log +0 -23
  253. data/spec/support/logs/Dispatcher - 10344-60543.log +0 -19
  254. data/spec/support/logs/Dispatcher - 10355-31708.log +0 -17
  255. data/spec/support/logs/Dispatcher - 10364-63170.log +0 -15
  256. data/spec/support/logs/Dispatcher - 10377-37936.log +0 -11
  257. data/spec/support/logs/Dispatcher - 10390-37511.log +0 -9
  258. data/spec/support/logs/Dispatcher - 10400-29603.log +0 -9
  259. data/spec/support/logs/Dispatcher - 10409-57042.log +0 -9
  260. data/spec/support/logs/Dispatcher - 10418-17812.log +0 -9
  261. data/spec/support/logs/Dispatcher - 10427-59862.log +0 -11
  262. data/spec/support/logs/Dispatcher - 10440-48351.log +0 -9
  263. data/spec/support/logs/Dispatcher - 10449-24218.log +0 -9
  264. data/spec/support/logs/Dispatcher - 10458-54646.log +0 -9
  265. data/spec/support/logs/Dispatcher - 10511-3333.log +0 -63
  266. data/spec/support/logs/Dispatcher - 10520-50009.log +0 -43
  267. data/spec/support/logs/Dispatcher - 10529-44870.log +0 -39
  268. data/spec/support/logs/Dispatcher - 10538-49556.log +0 -34
  269. data/spec/support/logs/Dispatcher - 10547-61887.log +0 -28
  270. data/spec/support/logs/Dispatcher - 10556-31163.log +0 -21
  271. data/spec/support/logs/Dispatcher - 10565-40008.log +0 -13
  272. data/spec/support/logs/Dispatcher - 10575-18836.log +0 -9
  273. data/spec/support/logs/Dispatcher - 10747-32268.log +0 -19
  274. data/spec/support/logs/Dispatcher - 10757-4081.log +0 -21
  275. data/spec/support/logs/Dispatcher - 10766-49190.log +0 -15
  276. data/spec/support/logs/Dispatcher - 10780-46610.log +0 -19
  277. data/spec/support/logs/Dispatcher - 10789-5332.log +0 -21
  278. data/spec/support/logs/Dispatcher - 10798-56243.log +0 -15
  279. data/spec/support/logs/Dispatcher - 10920-32037.log +0 -17
  280. data/spec/support/logs/Dispatcher - 10929-35662.log +0 -21
  281. data/spec/support/logs/Dispatcher - 10938-64010.log +0 -13
  282. data/spec/support/logs/Dispatcher - 10951-44746.log +0 -19
  283. data/spec/support/logs/Dispatcher - 10961-55791.log +0 -21
  284. data/spec/support/logs/Dispatcher - 10972-58913.log +0 -15
  285. data/spec/support/logs/Dispatcher - 11023-45004.log +0 -17
  286. data/spec/support/logs/Dispatcher - 11033-55505.log +0 -21
  287. data/spec/support/logs/Dispatcher - 11042-46123.log +0 -13
  288. data/spec/support/logs/Dispatcher - 11055-26836.log +0 -17
  289. data/spec/support/logs/Dispatcher - 11064-60361.log +0 -21
  290. data/spec/support/logs/Dispatcher - 11073-17507.log +0 -13
  291. data/spec/support/logs/Dispatcher - 11298-28357.log +0 -19
  292. data/spec/support/logs/Dispatcher - 11307-62669.log +0 -21
  293. data/spec/support/logs/Dispatcher - 11316-9391.log +0 -15
  294. data/spec/support/logs/Dispatcher - 11340-45921.log +0 -21
  295. data/spec/support/logs/Dispatcher - 11349-8693.log +0 -25
  296. data/spec/support/logs/Dispatcher - 11358-53753.log +0 -15
  297. data/spec/support/logs/Dispatcher - 11394-29437.log +0 -17
  298. data/spec/support/logs/Dispatcher - 11403-59953.log +0 -21
  299. data/spec/support/logs/Dispatcher - 11412-51134.log +0 -13
  300. data/spec/support/logs/Dispatcher - 11425-42569.log +0 -21
  301. data/spec/support/logs/Dispatcher - 11434-16150.log +0 -25
  302. data/spec/support/logs/Dispatcher - 11443-19072.log +0 -15
  303. data/spec/support/logs/Dispatcher - 11479-39149.log +0 -17
  304. data/spec/support/logs/Dispatcher - 11488-42169.log +0 -21
  305. data/spec/support/logs/Dispatcher - 11497-29822.log +0 -13
  306. data/spec/support/logs/Dispatcher - 11510-8273.log +0 -17
  307. data/spec/support/logs/Dispatcher - 11519-18206.log +0 -21
  308. data/spec/support/logs/Dispatcher - 11528-55825.log +0 -13
  309. data/spec/support/logs/Dispatcher - 9969-52890.log +0 -9
  310. data/spec/support/logs/Dispatcher - 9996-38451.log +0 -21
data/modules/audit/xss.rb CHANGED
@@ -21,7 +21,7 @@
21
21
  #
22
22
  # @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
23
23
  #
24
- # @version 0.3.3
24
+ # @version 0.3.4
25
25
  #
26
26
  # @see http://cwe.mitre.org/data/definitions/79.html
27
27
  # @see http://ha.ckers.org/xss.html
@@ -85,23 +85,68 @@ class Arachni::Modules::XSS < Arachni::Module::Base
85
85
  },
86
86
  elements: [Element::FORM, Element::LINK, Element::COOKIE, Element::HEADER],
87
87
  author: 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
88
- version: '0.3.2',
88
+ version: '0.3.4',
89
89
  references: {
90
90
  'ha.ckers' => 'http://ha.ckers.org/xss.html',
91
- 'Secunia' => 'http://secunia.com/advisories/9716/'
91
+ 'Secunia' => 'http://secunia.com/advisories/9716/',
92
+ 'WASC' => 'http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting',
93
+ 'OWASP' => 'www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet'
92
94
  },
93
95
  targets: %w(Generic),
94
96
  issue: {
95
97
  name: %q{Cross-Site Scripting (XSS)},
96
- description: %q{Client-side code (like JavaScript) can
97
- be injected into the web application which is then returned to the user's browser.
98
- This can lead to a compromise of the client's system or serve as a pivoting point for other attacks.},
99
- tags: %w(xss regexp injection script),
98
+ description: %q{Client side scripts are used extensively by
99
+ modern web applications. They perform simple functions such
100
+ as the formatting of text to full manipulation of client
101
+ side data and operating system interaction. Cross Site
102
+ Scripting (XSS) is where the client is able to inject
103
+ scripts into a request and have the server return the script
104
+ to the client. This occurs because the application is taking
105
+ untrusted data (in this example from the client) and reusing
106
+ it without performing any data validation or sanitisation.
107
+ If the injected script is returned immediately this is known
108
+ as reflected XSS. If the injected script is stored by the
109
+ server and returned to any client visiting the affected page
110
+ then this is known as persistent XSS (also stored XSS). A
111
+ common attack used by cyber-criminals is to steal a client's
112
+ session token by injecting JavaScript, however XSS
113
+ vulnerabilities can also be abused to exploit clients for
114
+ example by visiting the page either directly or through a
115
+ crafted HTTP link delivered via a social engineering email.
116
+ Note: many modern browsers attempt to implement some form of
117
+ XSS protection, however these do not protect against all
118
+ methods of attack, and in some cases can easily be bypassed.
119
+ Arachni has discovered that it is possible to insert script
120
+ content directly into HTML element content. For example
121
+ '<body> INJECTION_HERE </body>' where INJECTION_HERE
122
+ represents the location where the Arachni payload was
123
+ detected.},
100
124
  cwe: '79',
101
125
  severity: Severity::HIGH,
102
126
  cvssv2: '9.0',
103
- remedy_guidance: 'User inputs must be validated and filtered
104
- before being returned as part of the HTML code of a page.',
127
+ remedy_guidance: %q{To remediate XSS vulnerabilities it is
128
+ important to never use untrusted or unfiltered data within
129
+ the code of a HTML page. Untrusted data can originate not
130
+ only form the client but potentially a third party, or
131
+ previously uploaded file etc. Filtering of untrusted data
132
+ typically involves converting special characters to their
133
+ HTML entity encoding equivalent (however other methods do
134
+ exist. see ref.). These special characters include (ignoring
135
+ commas) '&, <, >, ", ', /'. An example of HTML entity encode
136
+ is converting a '<' to '&lt;'. Although it is possible to
137
+ filter untrusted input, there are five locations within a
138
+ HTML page where untrusted input (even if it has been
139
+ filtered) should never be placed. These locations include 1.
140
+ Directly in a script. 2. inside a HTML comment. 3. in an
141
+ attribute name. 4. in a tag name. 5. Directly in CSS. Where
142
+ untrusted data is inserted into HTML element content, HTML
143
+ common attributes, JavaScript data values, JSON values, HTML
144
+ style property values, or HTML URL parameter values it must
145
+ be filtered. Each of these locations have their own form of
146
+ escaping and filtering.
147
+ Because many browsers attempt to implement XSS protection,
148
+ any manual verification of this finding should be conducted
149
+ utilising multiple different browsers and browser versions.},
105
150
  }
106
151
  }
107
152
  end
data/modules/audit/xss_event.rb CHANGED
@@ -14,17 +14,15 @@
14
14
  limitations under the License.
15
15
  =end
16
16
 
17
- #
18
17
  # It injects a string and checks if it appears inside an event attribute of any HTML tag.
19
18
  #
20
19
  # @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
21
20
  #
22
- # @version 0.1.3
21
+ # @version 0.1.4
23
22
  #
24
23
  # @see http://cwe.mitre.org/data/definitions/79.html
25
24
  # @see http://ha.ckers.org/xss.html
26
25
  # @see http://secunia.com/advisories/9716/
27
- #
28
26
  class Arachni::Modules::XSSEvent < Arachni::Module::Base
29
27
 
30
28
  EVENT_ATTRS = [
@@ -84,23 +82,69 @@ class Arachni::Modules::XSSEvent < Arachni::Module::Base
84
82
  description: %q{Cross-Site Scripting in event tag of HTML element.},
85
83
  elements: [Element::FORM, Element::LINK, Element::COOKIE, Element::HEADER],
86
84
  author: 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
87
- version: '0.1.3',
85
+ version: '0.1.4',
88
86
  references: {
89
87
  'ha.ckers' => 'http://ha.ckers.org/xss.html',
90
- 'Secunia' => 'http://secunia.com/advisories/9716/'
88
+ 'Secunia' => 'http://secunia.com/advisories/9716/',
89
+ 'WASC' => 'http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting',
90
+ 'OWASP' => 'www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet'
91
91
  },
92
92
  targets: %w(Generic),
93
93
  issue: {
94
94
  name: %q{Cross-Site Scripting in event tag of HTML element},
95
- description: %q{Unvalidated user input is being embedded inside an HMTL event element such as "onmouseover".
96
- This makes Cross-Site Scripting attacks much easier to mount since the user input
97
- lands in code waiting to be executed.},
95
+ description: %q{Client side scripts are used extensively by
96
+ modern web applications. They perform simple functions such
97
+ as the formatting of text to full manipulation of client
98
+ side data and operating system interaction. Cross Site
99
+ Scripting (XSS) is where the client is able to inject
100
+ scripts into a request and have the server return the script
101
+ to the client. This occurs because the application is taking
102
+ untrusted data (in this example from the client) and reusing
103
+ it without performing any data validation or sanitisation.
104
+ If the injected script is returned immediately this is known
105
+ as reflected XSS. If the injected script is stored by the
106
+ server and returned to any client visiting the affected page
107
+ then this is known as persistent XSS (also stored XSS). A
108
+ common attack used by cyber-criminals is to steal a client's
109
+ session token by injecting JavaScript, however XSS
110
+ vulnerabilities can also be abused to exploit clients for
111
+ example by visiting the page either directly or through a
112
+ crafted HTTP link delivered via a social engineering email.
113
+ Note: many modern browsers attempt to implement some form of
114
+ XSS protection, however these do not protect against all
115
+ methods of attack, and in some cases can easily be bypassed.
116
+ Arachni has discovered that it is possible to insert script
117
+ content directly into HTML event. For example
118
+ '<div onmouseover="x=INJECTION_HERE"</div>' where
119
+ INJECTION_HERE represents the location where the Arachni
120
+ payload was detected.},
98
121
  tags: %w(xss event injection regexp dom attribute),
99
122
  cwe: '79',
100
123
  severity: Severity::HIGH,
101
124
  cvssv2: '9.0',
102
- remedy_guidance: 'User inputs must be validated and filtered
103
- before being included in executable code or not be included at all.',
125
+ remedy_guidance: %q{To remediate XSS vulnerabilities it is
126
+ important to never use untrusted or unfiltered data within
127
+ the code of a HTML page. Untrusted data can originate not
128
+ only form the client but potentially a third party, or
129
+ previously uploaded file etc. Filtering of untrusted data
130
+ typically involves converting special characters to their
131
+ HTML entity encoding equivalent (however other methods do
132
+ exist. see ref.). These special characters include (ignoring
133
+ commas) '&, <, >, ", ', /'. An example of HTML entity encode
134
+ is converting a '<' to '&lt;'. Although it is possible to
135
+ filter untrusted input, there are five locations within a
136
+ HTML page where untrusted input (even if it has been
137
+ filtered) should never be placed. These locations include 1.
138
+ Directly in a script. 2. inside a HTML comment. 3. in an
139
+ attribute name. 4. in a tag name. 5. Directly in CSS. Where
140
+ untrusted data is inserted into HTML element content, HTML
141
+ common attributes, JavaScript data values, JSON values, HTML
142
+ style property values, or HTML URL parameter values it must
143
+ be filtered. Each of these locations have their own form of
144
+ escaping and filtering.
145
+ Because many browsers attempt to implement XSS protection,
146
+ any manual verification of this finding should be conducted
147
+ utilising multiple different browsers and browser versions.},
104
148
  }
105
149
 
106
150
  }
data/modules/audit/xss_path.rb CHANGED
@@ -14,17 +14,15 @@
14
14
  limitations under the License.
15
15
  =end
16
16
 
17
- #
18
17
  # XSS in path audit module.
19
18
  #
20
19
  # @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
21
20
  #
22
- # @version 0.1.8
21
+ # @version 0.1.9
23
22
  #
24
23
  # @see http://cwe.mitre.org/data/definitions/79.html
25
24
  # @see http://ha.ckers.org/xss.html
26
25
  # @see http://secunia.com/advisories/9716/
27
- #
28
26
  class Arachni::Modules::XSSPath < Arachni::Module::Base
29
27
 
30
28
  def self.tag
@@ -81,22 +79,71 @@ class Arachni::Modules::XSSPath < Arachni::Module::Base
81
79
  description: %q{Cross-Site Scripting module for path injection},
82
80
  elements: [ Element::PATH ],
83
81
  author: 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
84
- version: '0.1.8',
82
+ version: '0.1.9',
85
83
  references: {
86
84
  'ha.ckers' => 'http://ha.ckers.org/xss.html',
87
- 'Secunia' => 'http://secunia.com/advisories/9716/'
85
+ 'Secunia' => 'http://secunia.com/advisories/9716/',
86
+ 'WASC' => 'http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting',
87
+ 'OWASP' => 'www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet'
88
88
  },
89
89
  targets: %w(Generic),
90
90
  issue: {
91
91
  name: %q{Cross-Site Scripting (XSS) in path},
92
- description: %q{Client-side code, like JavaScript, can
93
- be injected into the web application.},
92
+ description: %q{Client side scripts are used extensively by
93
+ modern web applications. They perform simple functions such
94
+ as the formatting of text to full manipulation of client
95
+ side data and operating system interaction. Cross Site
96
+ Scripting (XSS) is where the client is able to inject
97
+ scripts into a request and have the server return the script
98
+ to the client. This occurs because the application is taking
99
+ untrusted data (in this example from the client) and reusing
100
+ it without performing any data validation or sanitisation.
101
+ If the injected script is returned immediately this is known
102
+ as reflected XSS. If the injected script is stored by the
103
+ server and returned to any client visiting the affected page
104
+ then this is known as persistent XSS (also stored XSS). A
105
+ common attack used by cyber-criminals is to steal a client's
106
+ session token by injecting JavaScript, however XSS
107
+ vulnerabilities can also be abused to exploit clients for
108
+ example by visiting the page either directly or through a
109
+ crafted HTTP link delivered via a social engineering email.
110
+ Note: many modern browsers attempt to implement some form of
111
+ XSS protection, however these do not protect against all
112
+ methods of attack, and in some cases can easily be bypassed.
113
+ Arachni has discovered that it is possible to insert script
114
+ content directly into the requests PATH, or within a request
115
+ header, and have it returned in the server's response. For
116
+ example 'HTTP://yoursite.com/INJECTION_HERE/' or
117
+ 'referer: HTTP://yoursite.com/INJECTION_HERE' where
118
+ INJECTION_HERE represents the location where the Arachni
119
+ payload was injected.},
94
120
  tags: %w(xss path injection regexp),
95
121
  cwe: '79',
96
122
  severity: Severity::HIGH,
97
123
  cvssv2: '9.0',
98
- remedy_guidance: %q{Path must be validated and filtered
99
- before being returned as part of the HTML code of a page.}
124
+ remedy_guidance: %q{To remediate XSS vulnerabilities it is
125
+ important to never use untrusted or unfiltered data within
126
+ the code of a HTML page. Untrusted data can originate not
127
+ only form the client but potentially a third party, or
128
+ previously uploaded file etc. Filtering of untrusted data
129
+ typically involves converting special characters to their
130
+ HTML entity encoding equivalent (however other methods do
131
+ exist. see ref.). These special characters include (ignoring
132
+ commas) '&, <, >, ", ', /'. An example of HTML entity encode
133
+ is converting a '<' to '&lt;'. Although it is possible to
134
+ filter untrusted input, there are five locations within a
135
+ HTML page where untrusted input (even if it has been
136
+ filtered) should never be placed. These locations include 1.
137
+ Directly in a script. 2. inside a HTML comment. 3. in an
138
+ attribute name. 4. in a tag name. 5. Directly in CSS. Where
139
+ untrusted data is inserted into HTML element content, HTML
140
+ common attributes, JavaScript data values, JSON values, HTML
141
+ style property values, or HTML URL parameter values it must
142
+ be filtered. Each of these locations have their own form of
143
+ escaping and filtering.
144
+ Because many browsers attempt to implement XSS protection,
145
+ any manual verification of this finding should be conducted
146
+ utilising multiple different browsers and browser versions.}
100
147
  }
101
148
 
102
149
  }
data/modules/audit/xss_script_tag.rb CHANGED
@@ -19,7 +19,7 @@
19
19
  #
20
20
  # @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
21
21
  #
22
- # @version 0.1.4
22
+ # @version 0.1.5
23
23
  #
24
24
  # @see http://cwe.mitre.org/data/definitions/79.html
25
25
  # @see http://ha.ckers.org/xss.html
@@ -67,23 +67,69 @@ class Arachni::Modules::XSSScriptTag < Arachni::Module::Base
67
67
  description: %q{Injects strings and checks if they appear inside HTML 'script' tags.},
68
68
  elements: [Element::FORM, Element::LINK, Element::COOKIE, Element::HEADER],
69
69
  author: 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
70
- version: '0.1.4',
70
+ version: '0.1.5',
71
71
  references: {
72
72
  'ha.ckers' => 'http://ha.ckers.org/xss.html',
73
- 'Secunia' => 'http://secunia.com/advisories/9716/'
73
+ 'Secunia' => 'http://secunia.com/advisories/9716/',
74
+ 'WASC' => 'http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting',
75
+ 'OWASP' => 'www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet'
74
76
  },
75
77
  targets: %w(Generic),
76
78
  issue: {
77
79
  name: %q{Cross-Site Scripting in HTML \'script\' tag},
78
- description: %q{Unvalidated user input is being embedded inside a <script> element.
79
- This makes Cross-Site Scripting attacks much easier to mount since user input lands inside
80
- a trusted script.},
80
+ description: %q{Client side scripts are used extensively by
81
+ modern web applications. They perform simple functions such
82
+ as the formatting of text to full manipulation of client
83
+ side data and operating system interaction. Cross Site
84
+ Scripting (XSS) is where the client is able to inject
85
+ scripts into a request and have the server return the script
86
+ to the client. This occurs because the application is taking
87
+ untrusted data (in this example from the client) and reusing
88
+ it without performing any data validation or sanitisation.
89
+ If the injected script is returned immediately this is known
90
+ as reflected XSS. If the injected script is stored by the
91
+ server and returned to any client visiting the affected page
92
+ then this is known as persistent XSS (also stored XSS). A
93
+ common attack used by cyber-criminals is to steal a client's
94
+ session token by injecting JavaScript, however XSS
95
+ vulnerabilities can also be abused to exploit clients for
96
+ example by visiting the page either directly or through a
97
+ crafted HTTP link delivered via a social engineering email.
98
+ Note: many modern browsers attempt to implement some form of
99
+ XSS protection, however these do not protect against all
100
+ methods of attack, and in some cases can easily be bypassed.
101
+ Arachni has discovered that it is possible to insert content
102
+ directly into a script. For example
103
+ '<script> INJECTION_HERE </script>' where INJECTION_HERE
104
+ represents the location where the Arachni payload was
105
+ detected.},
81
106
  tags: %w(xss script tag regexp dom attribute injection),
82
107
  cwe: '79',
83
108
  severity: Severity::HIGH,
84
109
  cvssv2: '9.0',
85
- remedy_guidance: 'User inputs must be validated and filtered
86
- before being included in executable code or not be included at all.',
110
+ remedy_guidance: %q{To remediate XSS vulnerabilities it is
111
+ important to never use untrusted or unfiltered data within
112
+ the code of a HTML page. Untrusted data can originate not
113
+ only form the client but potentially a third party, or
114
+ previously uploaded file etc. Filtering of untrusted data
115
+ typically involves converting special characters to their
116
+ HTML entity encoding equivalent (however other methods do
117
+ exist. see ref.). These special characters include (ignoring
118
+ commas) '&, <, >, ", ', /'. An example of HTML entity encode
119
+ is converting a '<' to '&lt;'. Although it is possible to
120
+ filter untrusted input, there are five locations within a
121
+ HTML page where untrusted input (even if it has been
122
+ filtered) should never be placed. These locations include 1.
123
+ Directly in a script. 2. inside a HTML comment. 3. in an
124
+ attribute name. 4. in a tag name. 5. Directly in CSS. Where
125
+ untrusted data is inserted into HTML element content, HTML
126
+ common attributes, JavaScript data values, JSON values, HTML
127
+ style property values, or HTML URL parameter values it must
128
+ be filtered. Each of these locations have their own form of
129
+ escaping and filtering.
130
+ Because many browsers attempt to implement XSS protection,
131
+ any manual verification of this finding should be conducted
132
+ utilising multiple different browsers and browser versions.}
87
133
  }
88
134
  }
89
135
  end
data/modules/audit/xss_tag.rb CHANGED
@@ -19,7 +19,7 @@
19
19
  #
20
20
  # @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
21
21
  #
22
- # @version 0.1.5
22
+ # @version 0.1.6
23
23
  #
24
24
  # @see http://cwe.mitre.org/data/definitions/79.html
25
25
  # @see http://ha.ckers.org/xss.html
@@ -67,22 +67,68 @@ class Arachni::Modules::XSSHTMLTag < Arachni::Module::Base
67
67
  description: %q{Cross-Site Scripting in HTML tag.},
68
68
  elements: [ Element::FORM, Element::LINK, Element::COOKIE, Element::HEADER ],
69
69
  author: 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> ',
70
- version: '0.1.5',
70
+ version: '0.1.6',
71
71
  references: {
72
72
  'ha.ckers' => 'http://ha.ckers.org/xss.html',
73
- 'Secunia' => 'http://secunia.com/advisories/9716/'
73
+ 'Secunia' => 'http://secunia.com/advisories/9716/',
74
+ 'WASC' => 'http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting'
74
75
  },
75
76
  targets: %w(Generic),
76
77
  issue: {
77
78
  name: %q{Cross-Site Scripting (XSS) in HTML tag},
78
- description: %q{Unvalidated user input is being embedded in a HTML element.
79
- This can lead to a Cross-Site Scripting vulnerability or a form of HTML manipulation.},
79
+ description: %q{Client side scripts are used extensively by
80
+ modern web applications. They perform simple functions such
81
+ as the formatting of text to full manipulation of client
82
+ side data and operating system interaction. Cross Site
83
+ Scripting (XSS) is where the client is able to inject
84
+ scripts into a request and have the server return the script
85
+ to the client. This occurs because the application is taking
86
+ untrusted data (in this example from the client) and reusing
87
+ it without performing any data validation or sanitisation.
88
+ If the injected script is returned immediately this is known
89
+ as reflected XSS. If the injected script is stored by the
90
+ server and returned to any client visiting the affected page
91
+ then this is known as persistent XSS (also stored XSS). A
92
+ common attack used by cyber-criminals is to steal a client's
93
+ session token by injecting JavaScript, however XSS
94
+ vulnerabilities can also be abused to exploit clients for
95
+ example by visiting the page either directly or through a
96
+ crafted HTTP link delivered via a social engineering email.
97
+ Note: many modern browsers attempt to implement some form of
98
+ XSS protection, however these do not protect against all
99
+ methods of attack, and in some cases can easily be bypassed.
100
+ Arachni has discovered that it is possible to insert content
101
+ directly into a HTML tag. for example
102
+ '<INJECTION_HERE href=.......etc>' where INJECTION_HERE
103
+ represents the location where the Arachni payload was
104
+ detected.},
80
105
  tags: %w(xss script tag regexp dom attribute injection),
81
106
  cwe: '79',
82
107
  severity: Severity::HIGH,
83
108
  cvssv2: '9.0',
84
- remedy_guidance: 'User inputs must be validated and filtered
85
- before being returned as part of the HTML code of a page.',
109
+ remedy_guidance: %q{To remediate XSS vulnerabilities it is
110
+ important to never use untrusted or unfiltered data within
111
+ the code of a HTML page. Untrusted data can originate not
112
+ only form the client but potentially a third party, or
113
+ previously uploaded file etc. Filtering of untrusted data
114
+ typically involves converting special characters to their
115
+ HTML entity encoding equivalent (however other methods do
116
+ exist. see ref.). These special characters include (ignoring
117
+ commas) '&, <, >, ", ', /'. An example of HTML entity encode
118
+ is converting a '<' to '&lt;'. Although it is possible to
119
+ filter untrusted input, there are five locations within a
120
+ HTML page where untrusted input (even if it has been
121
+ filtered) should never be placed. These locations include
122
+ 1. Directly in a script. 2. inside a HTML comment. 3. in an
123
+ attribute name. 4. in a tag name. 5. Directly in CSS. Where
124
+ untrusted data is inserted into HTML element content, HTML
125
+ common attributes, JavaScript data values, JSON values, HTML
126
+ style property values, or HTML URL parameter values it must
127
+ be filtered. Each of these locations have their own form of
128
+ escaping and filtering.
129
+ Because many browsers attempt to implement XSS protection,
130
+ any manual verification of this finding should be conducted
131
+ utilising multiple different browsers and browser versions.},
86
132
  }
87
133
 
88
134
  }
data/modules/recon/allowed_methods.rb CHANGED
@@ -19,7 +19,7 @@
19
19
  #
20
20
  # @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
21
21
  #
22
- # @version 0.1.4
22
+ # @version 0.1.5
23
23
  #
24
24
  # @see http://en.wikipedia.org/wiki/WebDAV
25
25
  # @see http://www.webdav.org/specs/rfc4918.html
@@ -61,17 +61,37 @@ class Arachni::Modules::AllowedMethods < Arachni::Module::Base
61
61
  description: %q{Checks for supported HTTP methods.},
62
62
  elements: [Element::SERVER],
63
63
  author: 'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
64
- version: '0.1.4',
64
+ version: '0.1.5',
65
65
  targets: %w(Generic),
66
66
  references: {
67
67
  'Apache.org' => 'http://httpd.apache.org/docs/2.2/mod/core.html#limitexcept'
68
68
  },
69
69
  issue: {
70
70
  name: %q{Allowed HTTP methods},
71
- description: %q{The webserver claims that it supports the logged methods.},
71
+ description: %q{There are a number of HTTP methods that can
72
+ be used on a webserver, for example OPTIONS, HEAD, GET,
73
+ POST, PUT, DELETE etc. Each of these methods perform a
74
+ different function, and each have an associate level of risk
75
+ when their use is permitted on the webserver. A client can use
76
+ the OPTION method within a request to query a server to
77
+ determine which methods are allowed. Cyber-criminals will
78
+ almost always perform this simple test as it will give a
79
+ very quick indication of any risk methods being permitted by
80
+ the server. Arachni discovered that several methods
81
+ supported by the server.},
72
82
  tags: %w(http methods options),
73
83
  severity: Severity::INFORMATIONAL,
74
- remedy_guidance: %q{Configure your web server to disallow unnecessary HTTP method.}
84
+ remedy_guidance: %q{It is recommended that a whitelisting
85
+ approach be taken to explicitly permit the HTTP methods required
86
+ by the application and block all others.
87
+ Typically the only HTTP methods required for most
88
+ applications are the GET and POST . All other
89
+ methods perform actions that are rarely required, or perform
90
+ actions that are inherently risky. These risky methods (such
91
+ as PUT, DELETE, etc) should be protected by strict
92
+ limitations such as ensuring that the channel is secure
93
+ (SSL/TLS enabled), and only authorised and trusted clients
94
+ are permitted to use them.}
75
95
  }
76
96
  }
77
97
  end