arachni 0.4.7 → 1.0

data/lib/arachni/element/capabilities/auditable/dom.rb

@@ -0,0 +1,156 @@
+=begin
+    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+require_relative '../with_node'
+
+module Arachni
+module Element::Capabilities
+module Auditable
+
+# Provides access to DOM operations for {Element elements}.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+module DOM
+    include WithNode
+    include Auditable
+    extend Forwardable
+
+    INVALID_INPUT_DATA = [ "\0" ]
+
+    # @return   [Element::Base]
+    attr_accessor :parent
+
+    # @return   [Browser]
+    attr_accessor :browser
+
+    attr_reader   :action
+
+    # @!method with_browser_cluster( &block )
+    def_delegator :auditor, :with_browser_cluster
+
+    # @!method with_browser( &block )
+    def_delegator :auditor, :with_browser
+
+    def initialize( options )
+        options = options.dup
+        @parent = options.delete(:parent)
+
+        if parent
+            @url    = parent.url.dup.freeze    if parent.url
+            @action = parent.action.dup.freeze if parent.action
+            @page   = parent.page              if parent.page
+            @html   = parent.html.dup.freeze   if parent.respond_to?(:html) && parent.html
+        else
+            @url    = options[:url].freeze
+            @action = options[:action].freeze
+            @page   = options[:page]
+            @html   = options[:html].freeze
+        end
+
+        @audit_options = {}
+    end
+
+    def url=(*)
+        # NOP
+    end
+
+    def action=(*)
+        # NOP
+    end
+
+    def valid_input_data?( data )
+        !INVALID_INPUT_DATA.find { |c| data.include? c }
+    end
+
+    def page
+        return @page if @page
+        @page = parent.page if parent
+    end
+
+    # @return   [Watir::HTMLElement]
+    def element
+        @element ||= locate
+    end
+
+    # @param  [Hash]  options
+    # @param  [Block]  block
+    #   Callback to be passed the evaluated {Page}.
+    def submit( options = {}, &block )
+        with_browser do |browser|
+            prepare_browser( browser, options )
+
+            # If we've wondered to an out-of-scope resource don't bother calling.
+            # Can be caused by a JS redirect or something akin to that.
+            if (transition = trigger) && (page = browser.to_page)
+                page.dom.transitions << transition
+                block.call page.tap { |p| p.request.performer = self }
+            end
+
+            @element = nil
+            @browser = nil
+        end
+        nil
+    end
+
+    def locator
+        @locator ||= Browser::ElementLocator.from_node( node )
+    end
+
+    # Locates the element in the page.
+    def locate
+        locator.locate( browser )
+    end
+
+    # Triggers the event on the subject {#element}.
+    #
+    # @abstract
+    def trigger
+        fail NotImplementedError
+    end
+
+    # Removes the associated {#page}, {#parent} and {#browser}
+    def prepare_for_report
+        super
+        @page    = nil
+        @parent  = nil
+        @element = nil
+        @browser = nil
+    end
+
+    def dup
+        super.tap { |new| new.parent = parent }
+    end
+
+    def marshal_dump
+        super.reject{ |k, _| [:@parent, :@page, :@browser, :@element].include? k }
+    end
+
+    def initialization_options
+        options = {}
+        options[:url]    = url.dup     if @url
+        options[:action] = @action.dup if @action
+        options[:page]   = page        if page
+        options[:html]   = @html.dup   if @html
+        options
+    end
+
+    private
+
+    def prepare_browser( browser, options )
+        @browser = browser
+        browser.javascript.custom_code = options[:custom_code]
+        browser.javascript.taint       = options[:taint]
+
+        browser.load page
+    end
+
+end
+
+end
+end
+end

data/lib/arachni/element/capabilities/inputtable.rb

@@ -0,0 +1,267 @@
+=begin
+    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+module Arachni
+module Element
+
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+module Capabilities::Inputtable
+
+    # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+    class Error < Capabilities::Error
+
+        # On invalid input data.
+        #
+        # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+        class InvalidData < Error
+
+            # @see Inputtable#valid_input_data?
+            # @see Inputtable#valid_input_name?
+            #
+            # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+            class Name < InvalidData
+            end
+
+            # @see Inputtable#valid_input_data?
+            # @see Inputtable#valid_input_value?
+            #
+            # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+            class Value < InvalidData
+            end
+
+        end
+    end
+
+    # Frozen version of {#inputs}, has all the original names and values.
+    #
+    # @return   [Hash]
+    attr_reader :default_inputs
+
+    # @note Can be modified via {#update}, {#[]=} or {#inputs=}.
+    #
+    # @return   [Hash]
+    #   Frozen effective inputs.
+    attr_reader :inputs
+
+    # @note Will convert keys and values to strings.
+    #
+    # @param  [Hash]  hash
+    #   Inputs data.
+    #
+    # @raise   [Error::InvalidData::Name]
+    # @raise   [Error::InvalidData::Value]
+    def inputs=( hash )
+        sanitized = {}
+
+        (hash || {}).each do |name, value|
+            name  = name.to_s
+            value = value.to_s
+
+            fail_if_invalid( name, value )
+
+            sanitized[name.freeze] = value.freeze
+        end
+
+        @inputs = sanitized.freeze
+    end
+
+    # Checks whether or not the given inputs match the inputs ones.
+    #
+    # @param    [Hash, Array, String, Symbol]   args
+    #   Names of inputs to check (also accepts var-args).
+    #
+    # @return   [Bool]
+    def has_inputs?( *args )
+        if (h = args.first).is_a?( Hash )
+            h.each { |k, v| return false if self[k] != v }
+            true
+        else
+            keys = args.flatten.compact.map { |a| [a].map(&:to_s) }.flatten
+            (@inputs.keys & keys).size == keys.size
+        end
+    end
+
+    # @return   [Hash]
+    #   Returns changes make to the {#inputs}'s inputs.
+    def changes
+        (@default_inputs.keys | @inputs.keys).inject( {} ) do |h, k|
+            if @default_inputs[k] != @inputs[k]
+                h[k] = @inputs[k]
+            end
+            h
+        end
+    end
+
+    # Resets the inputs to their original format/values.
+    def reset
+        super if defined?( super )
+        self.inputs = @default_inputs.dup
+        self
+    end
+
+    # Shorthand {#inputs} reader.
+    #
+    # @param    [#to_s] name
+    #   Name.
+    #
+    # @return   [String]
+    def []( name )
+        @inputs[name.to_s]
+    end
+
+    # Shorthand {#inputs} writer.
+    #
+    # @param    [#to_s] name
+    #   Name.
+    # @param    [#to_s] value
+    #   Value.
+    #
+    # @raise   [Error::InvalidData::Name]
+    # @raise   [Error::InvalidData::Value]
+    def []=( name, value )
+        update( name.to_s => value.to_s )
+        self[name]
+    end
+
+    # @param    [Hash]  hash
+    #   Inputs with which to update the {#inputs} inputs.
+    #
+    # @return   [Auditable]   `self`
+    #
+    # @raise   [Error::InvalidData::Name]
+    # @raise   [Error::InvalidData::Value]
+    def update( hash )
+        self.inputs = @inputs.merge( hash )
+        self
+    end
+
+    # @param    [String]    name
+    #   Name to check.
+    #
+    # @return   [Bool]
+    #   `true` if the name can be carried by the element's inputs, `false`
+    #   otherwise.
+    #
+    # @abstract
+    def valid_input_name?( name )
+        true
+    end
+
+    # @param    [String]    name
+    #   Name to check.
+    #
+    # @return   [Bool]
+    #   `true` if `name` is both a {#valid_input_name?} and contains
+    #   {#valid_input_data?}.
+    def valid_input_name_data?( name )
+        valid_input_name?( name ) && valid_input_data?( name )
+    end
+
+    # @param    [String]    value
+    #   Value to check.
+    #
+    # @return   [Bool]
+    #   `true` if the value can be carried by the element's inputs, `false`
+    #   otherwise.
+    #
+    # @abstract
+    def valid_input_value?( value )
+        true
+    end
+
+    # @param    [String]    value
+    #   Value to check.
+    #
+    # @return   [Bool]
+    #   `true` if `value` is both a {#valid_input_value?} and contains
+    #   {#valid_input_data?}.
+    def valid_input_value_data?( value )
+        valid_input_value?( value ) && valid_input_data?( value )
+    end
+
+    # @param    [String]    data
+    #   Data to check.
+    #
+    # @return   [Bool]
+    #   `true` if the data can be carried by the element's inputs, `false`
+    #   otherwise.
+    #
+    # @abstract
+    def valid_input_data?( data )
+        true
+    end
+
+    # Performs an input operation and silently handles {Error::InvalidData}.
+    #
+    # @param    [Block] block
+    #   Input operation to try to perform.
+    #
+    # @return   [Bool]
+    #   `true` if the operation was successful, `false` otherwise.
+    def try_input( &block )
+        block.call
+        true
+    rescue Error::InvalidData => e
+        return false if !respond_to?( :print_debug_level_1 )
+
+        print_debug_level_1 e.to_s
+        e.backtrace.each { |l| print_debug_level_1 l }
+        false
+    end
+
+    def dup
+        copy_inputtable( super )
+    end
+
+    # @return   [String]
+    #   Uniquely identifies the {#inputs}.
+    def inputtable_id
+        inputs.sort_by { |k,_| k }.to_s
+    end
+
+    def to_h
+        (defined?( super ) ? super : {}).merge(
+            inputs:         inputs,
+            default_inputs: default_inputs
+        )
+    end
+
+    private
+
+    def fail_if_invalid( name, value )
+        if !valid_input_data?( name.to_s )
+            fail Error::InvalidData::Name,
+                 "Invalid data in input name for #{self.class}: #{name.inspect}"
+        end
+
+        if !valid_input_data?( value.to_s )
+            fail Error::InvalidData::Value,
+                 "Invalid data in input value for #{self.class}: #{value.inspect}"
+        end
+
+        if !valid_input_name?( name.to_s )
+            fail Error::InvalidData::Name,
+                 "Invalid name for #{self.class}: #{name.inspect}"
+        end
+
+        if !valid_input_value?( value.to_s )
+            fail Error::InvalidData::Value,
+                 "Invalid value for #{self.class}: #{value.inspect}"
+        end
+
+    end
+
+    def copy_inputtable( other )
+        other.inputs = self.inputs.dup
+        other
+    end
+
+end
+
+end
+end

data/lib/arachni/element/capabilities/mutable.rb

@@ -1,30 +1,30 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
-    Licensed under the Apache License, Version 2.0 (the "License");
-    you may not use this file except in compliance with the License.
-    You may obtain a copy of the License at
-
-        http://www.apache.org/licenses/LICENSE-2.0
-
-    Unless required by applicable law or agreed to in writing, software
-    distributed under the License is distributed on an "AS IS" BASIS,
-    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-    See the License for the specific language governing permissions and
-    limitations under the License.
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
 =end
 
 module Arachni
-require Options.dir['lib'] + 'module/utilities'
-
 module Element::Capabilities
+
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 module Mutable
 
-    # @return   [String]    Name of the altered/mutated parameter.
-    attr_accessor :altered
+    # @return     [String]
+    #   Name of the mutated parameter.
+    attr_accessor :affected_input_name
 
-    # Holds constant bitfields that describe the preferred formatting
-    # of injection strings.
+    # @return     [String]
+    #   Original seed used for the {#mutations}.
+    attr_accessor :seed
+
+    attr_accessor :format
+
+    # Bitfields that describe the common payload formatting options.
+    #
+    # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
     module Format
 
       # Leaves the injection string as is.
@@ -37,12 +37,12 @@ module Mutable
       # Terminates the injection string with a null character.
       NULL     = 1 << 2
 
-      # Prefix the string with a ';', useful for command injection modules
+      # Prefix the string with a ';', useful for command injection checks
       SEMICOLON = 1 << 3
 
     end
 
-    # Default formatting and permutation options
+    # Default formatting and mutation options.
     MUTATION_OPTIONS = {
         #
         # Formatting of the injection strings.
@@ -51,206 +51,257 @@ module Mutable
         #
         # Values can be OR'ed bitfields of all available constants of {Format}.
         #
-        format:     [ Format::STRAIGHT, Format::APPEND,
-                     Format::NULL, Format::APPEND | Format::NULL ],
-
-
-        # Skip mutation with default/original values
-        # (for {Arachni::Element::Form} elements).
-        skip_orig:  false,
+        format:         [ Format::STRAIGHT, Format::APPEND,
+                            Format::NULL, Format::APPEND | Format::NULL ],
 
         # Flip injection value and input name.
-        param_flip: false,
+        param_flip:     false,
 
         # Array of parameter names remain untouched.
-        skip:       [],
+        skip:           [],
 
-        # `nil`:   Use system settings (!Options.fuzz_methods).
+        # `nil`:   Use system settings (!Options.audit.with_both_http_methods).
         # `true`:  Don't create mutations with other methods (GET/POST).
         # `false`: Create mutations with other methods (GET/POST).
         respect_method: nil
     }
 
-    # @return   [String]    Value of the altered input.
-    def altered_value
-        self[altered].to_s
+    # Resets the inputs to their original format/values.
+    def reset
+        super
+        @affected_input_name = nil
+        @seed                = nil
+        self
+    end
+
+    # @return   [ni, String]
+    #   `nil` if no input has been fuzzed, the `String` value of the fuzzed
+    #   input.
+    def affected_input_value
+        return if !affected_input_name
+        self[affected_input_name].to_s
     end
 
-    # @param    [String]    value   Sets the value for the altered input.
-    def altered_value=( value )
-        self[altered] = value
+    # @param    [String]    value
+    #   Sets the value for the fuzzed input.
+    def affected_input_value=( value )
+        self[affected_input_name] = value
     end
 
-    # @return   [Bool]  `true` if the element has not been mutated, `false` otherwise.
-    def original?
-        self.altered.nil?
+    # @param    [String]    value
+    #   Sets the name of the fuzzed input.
+    def affected_input_name=( value )
+        @affected_input_name = value.to_s
     end
 
-    # @return   [Bool]  `true` if the element has been mutated, `false` otherwise.
-    def mutated?
-        !original?
+    # @param    [String]    value
+    #   Sets the value for the fuzzed input.
+    def seed=( value )
+        @seed = value.to_s
     end
 
-    # @return   [Set]   Names of input vectors to be excluded from {#mutations}.
+    # @return   [Bool]
+    #   `true` if the element has been mutated, `false` otherwise.
+    def mutation?
+        !!self.affected_input_name
+    end
+
+    # @return   [Set]
+    #   Names of input vectors to be excluded from {#mutations}.
     def immutables
         @immutables ||= Set.new
     end
 
-    # Injects the `injection_str` in self's values according to formatting options
-    # and returns an array of permutations of self.
+    # @note Vector names in {#immutables} will be excluded.
     #
-    # Vector names in {#immutables} will be excluded.
+    # Injects the `payload` in self's values according to formatting options
+    # and returns an array of mutations of self.
     #
-    # @param    [String]  injection_str  The string to inject.
-    # @param    [Hash]    opts           {MUTATION_OPTIONS}
+    # @param    [String]  payload
+    #   String to inject.
+    # @param    [Hash]    opts
+    #   {MUTATION_OPTIONS}
     #
-    # @yield       [mutation]  Each generated mutation.
+    # @yield       [mutation]
+    #   Each generated mutation.
     # @yieldparam [Mutable]
     #
     # @see #immutables
-    def each_mutation( injection_str, opts = {} )
-        return [] if self.auditable.empty?
+    def each_mutation( payload, opts = {} )
+        return if self.inputs.empty?
+
+        if !valid_input_data?( payload )
+            print_debug_level_2 "Payload not supported by #{self}: #{payload.inspect}"
+            return
+        end
+
+        print_debug_trainer( opts )
+        print_debug_formatting( opts )
 
         opts = MUTATION_OPTIONS.merge( opts )
-        opts[:respect_method] = !Options.fuzz_methods? if opts[:respect_method].nil?
+        opts[:respect_method] = !Options.audit.with_both_http_methods? if opts[:respect_method].nil?
 
-        inputs  = auditable.dup
-        cinputs = Support::KeyFiller.fill( inputs )
+        dinputs = inputs.dup
+        cinputs = Options.input.fill( inputs )
 
-        generated = Support::LookUp::HashSet.new
+        generated = Support::LookUp::HashSet.new( hasher: :mutable_id )
 
-        inputs.keys.each do |k|
+        dinputs.keys.each do |k|
             # Don't audit parameter flips.
-            next if inputs[k] == seed || immutables.include?( k )
+            next if dinputs[k] == seed || immutables.include?( k )
 
             opts[:format].each do |format|
+                str = format_str( payload, cinputs[k], format )
+
+                if !valid_input_value_data?( str )
+                    print_debug_level_2 'Payload not supported as input value by' <<
+                                            " #{audit_id}: #{str.inspect}"
+                    next
+                end
 
-                str = format_str( injection_str, cinputs[k], format )
+                elem                     = self.dup
+                elem.seed                = payload
+                elem.affected_input_name = k.dup
+                elem.inputs              = cinputs.merge( k => str )
+                elem.format              = format
 
-                elem           = self.dup
-                elem.altered   = k.dup
-                elem.auditable = cinputs.merge( k => str )
+                if !generated.include?( elem )
+                    print_debug_mutation elem
+                    yield elem
+                end
 
-                yield elem if !generated.include?( elem )
                 generated << elem
 
                 next if opts[:respect_method]
 
                 celem = elem.switch_method
-                yield celem if !generated.include?( celem )
+                if !generated.include?( celem )
+                    print_debug_mutation elem
+                    yield celem
+                end
                 generated << celem
             end
         end
 
-        return if !opts[:param_flip]
-
-        elem = self.dup
-
-        # When under HPG mode element auditing is strictly regulated
-        # and when we flip params we essentially create a new element
-        # which won't be on the whitelist.
-        elem.override_instance_scope
-
-        elem.altered = 'Parameter flip'
-        elem[injection_str] = seed
-
-        yield elem if !generated.include?( elem )
-        generated << elem
-
-        return if opts[:respect_method]
+        if opts[:param_flip]
+            if valid_input_name_data?( payload )
+                elem                     = self.dup
+                elem.affected_input_name = 'Parameter flip'
+                elem[payload]            = seed
+                elem.seed                = payload
+
+                if !generated.include?( elem )
+                    print_debug_mutation elem
+                    yield elem
+                end
+                generated << elem
+            else
+                print_debug_level_2 'Payload not supported as input name by' <<
+                                        " #{audit_id}: #{payload.inspect}"
+                return
+            end
+        end
 
-        elem = elem.switch_method
-        yield elem if !generated.include?( elem )
-        generated << elem
+        if !opts[:respect_method]
+            elem = switch_method
+            if !generated.include?( elem )
+                print_debug_mutation elem
+                yield elem
+            end
+            generated << elem
+        end
 
         nil
     end
 
     def switch_method
-        c = self.dup
-        if c.method.to_s.downcase.to_sym == :get
-            # Strip the query from the action if we're fuzzing a link
-            # otherwise the GET params might get precedence.
-            c.action = c.action.split( '?' ).first if c.is_a? Link
-            c.method = 'post'
-        else
-            c.method = 'get'
-        end
-        c
+        self.dup.tap { |c| c.method = (c.method == :get ? :post : :get) }
     end
 
-    #
-    # Injects the `injection_str` in self's values according to formatting options
-    # and returns an array of permutations of self.
+    # Injects the `payload` in self's values according to formatting
+    # options and returns an array of mutations of self.
     #
     # Vector names in {#immutables} will be excluded.
     #
-    # @param    [String]  injection_str  The string to inject.
-    # @param    [Hash]    opts           {MUTATION_OPTIONS}
+    # @param    [String]  payload
+    #   The string to inject.
+    # @param    [Hash]    opts
+    #   {MUTATION_OPTIONS}
     #
     # @return    [Array]
     #
     # @see #immutables
-    #
-    def mutations( injection_str, opts = {} )
+    def mutations( payload, opts = {} )
         combo = []
-        each_mutation( injection_str, opts ) { |m| combo << m }
-        print_debug_injection_set( combo, opts )
+        each_mutation( payload, opts ) { |m| combo << m }
         combo
     end
 
-    # Alias for {#mutations}.
-    def mutations_for( *args )
-        mutations( *args )
+    def to_h
+        h = super
+
+        if mutation?
+            h[:affected_input_name]  = self.affected_input_name
+            h[:affected_input_value] = self.affected_input_value
+            h[:seed]                 = self.seed
+        end
+
+        h
     end
-    # Alias for {#mutations}.
-    def permutations( *args )
-        mutations( *args )
+
+    def dup
+        copy_mutable( super )
     end
-    # Alias for {#mutations}.
-    def permutations_for( *args )
-        permutations( *args )
+
+    protected
+
+    def mutable_id
+        "#{self.method}:#{inputtable_id}"
     end
 
     private
 
-    #
-    # Prepares an injection string following the specified formating options
+    def copy_mutable( other )
+        if self.affected_input_name
+            other.affected_input_name = self.affected_input_name.dup
+        end
+
+        other.seed   = self.seed.dup if self.seed
+        other.format = self.format
+        other
+    end
+
+    # Prepares an injection string following the specified formatting options
     # as contained in the format bitfield.
     #
-    # @see Format
-    # @param  [String]  injection_str
-    # @param  [String]  default_str  default value to be appended by the
-    #                                 injection string if {Format::APPEND} is set in 'format'
-    # @param  [Integer]  format     bitfield describing formating preferencies
+    # @param  [String]  payload
+    # @param  [String]  default_str
+    #   Default value to be appended by the injection string if {Format::APPEND}
+    #   is set in 'format'.
+    # @param  [Integer]  format
+    #   Bitfield describing formatting preferences.
     #
     # @return  [String]
     #
-    def format_str( injection_str, default_str, format  )
-        semicolon = null = append = ''
-
-        null   = "\0"        if ( format & Format::NULL )     != 0
-        semicolon   = ';'    if ( format & Format::SEMICOLON )   != 0
-        append = default_str if ( format & Format::APPEND )   != 0
-        semicolon = append = null = ''   if ( format & Format::STRAIGHT ) != 0
-
-        semicolon + append + injection_str.to_s + null
-    end
+    # @see Format
+    def format_str( payload, default_str, format  )
+        semicolon = null = append = nil
 
-    def print_debug_injection_set( var_combo, opts )
-        return if !debug?
+        null      = "\0"               if (format & Format::NULL)      != 0
+        semicolon = ';'                if (format & Format::SEMICOLON) != 0
+        append    = default_str        if (format & Format::APPEND)    != 0
+        semicolon = append = null = '' if (format & Format::STRAIGHT)  != 0
 
-        print_debug
-        print_debug_trainer( opts )
-        print_debug_formatting( opts )
-        print_debug_combos( var_combo )
+        "#{semicolon}#{append}#{payload}#{null}"
     end
 
     def print_debug_formatting( opts )
-        print_debug '------------'
+        return if !opts[:format] || !debug_level_2?
 
-        print_debug 'Injection string format combinations set to:'
-        print_debug '|'
+        print_debug_level_2
+
+        print_debug_level_2 'Formatting set to:'
+        print_debug_level_2 '|'
         msg = []
         opts[:format].each do |format|
             if( format & Format::NULL ) != 0
@@ -265,41 +316,32 @@ module Mutable
                 msg << 'straight, leave as is (Format::STRAIGHT)'
             end
 
-            prep = msg.join( ' and ' ).capitalize + ". [Combo mask: #{format}]"
+            prep = "#{msg.join( ' and ' ).capitalize}. [Format mask: #{format}]"
             prep.gsub!( 'format::null', "Format::NULL [#{Format::NULL}]" )
             prep.gsub!( 'format::append', "Format::APPEND [#{Format::APPEND}]" )
             prep.gsub!( 'format::straight', "Format::STRAIGHT [#{Format::STRAIGHT}]" )
 
-            print_debug "|----> #{prep}"
+            print_debug_level_2 "|----> #{prep}"
 
             msg.clear
         end
         nil
     end
 
-    def print_debug_combos( combos )
-        print_debug
-        print_debug 'Prepared combinations:'
-        print_debug '|'
-
-        combos.each do |elem|
-          altered = elem.altered
-          combo   = elem.auditable
+    def print_debug_mutation( mutation )
+        return if !debug_level_2?
 
-          print_debug '|'
-          print_debug "|--> Auditing: #{altered}"
-          print_debug "|--> Combo: "
+        print_debug_level_2 '|'
+        print_debug_level_2 "|--> Auditing: #{mutation.affected_input_name}"
 
-          combo.each { |c_combo| print_debug "|------> #{c_combo}" }
+        print_debug_level_2 '|--> Inputs: '
+        mutation.inputs.each do |k, v|
+            print_debug_level_2 "|----> #{k.inspect} => #{v.inspect}"
         end
-
-        print_debug
-        print_debug '------------'
-        print_debug
     end
 
     def print_debug_trainer( opts )
-        print_debug 'Trainer set to: ' + ( opts[:train] ? 'ON' : 'OFF' )
+        print_debug_level_2 "Trainer set to: #{opts[:train] ? 'ON' : 'OFF'}"
     end
 
 end