arachni 0.4.7 → 1.0

data/lib/arachni/element/cookie/dom.rb

@@ -0,0 +1,67 @@
+=begin
+    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+module Arachni::Element
+class Cookie
+
+# Provides access to DOM operations for {Cookie cookies}.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+class DOM < Base
+    include Capabilities::Auditable::DOM
+
+    def initialize( options )
+        super
+
+        self.inputs     = (options[:inputs] || self.parent.inputs).dup
+        @default_inputs = self.inputs.dup.freeze
+    end
+
+    # Submits the cookie using the configured {#inputs}.
+    def trigger
+        browser.goto action, take_snapshot: false, cookies: self.inputs,
+                     update_transitions: false
+    end
+
+    def name
+        inputs.keys.first
+    end
+
+    def value
+        inputs.values.first
+    end
+
+    def to_set_cookie
+        p = parent.dup
+        p.inputs = inputs
+        p.to_set_cookie
+    end
+
+    def encode( *args )
+        Cookie.encode( *args )
+    end
+
+    def decode( *args )
+        Cookie.decode( *args )
+    end
+
+    def type
+        self.class.type
+    end
+    def self.type
+        :cookie_dom
+    end
+
+    def initialization_options
+        super.merge( inputs: inputs.dup )
+    end
+
+end
+
+end
+end

data/lib/arachni/element/form.rb

@@ -1,42 +1,37 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
-    Licensed under the Apache License, Version 2.0 (the "License");
-    you may not use this file except in compliance with the License.
-    You may obtain a copy of the License at
-
-        http://www.apache.org/licenses/LICENSE-2.0
-
-    Unless required by applicable law or agreed to in writing, software
-    distributed under the License is distributed on an "AS IS" BASIS,
-    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-    See the License for the specific language governing permissions and
-    limitations under the License.
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
 =end
 
-require Arachni::Options.dir['lib'] + 'element/base'
+require_relative 'base'
+require_relative 'capabilities/with_node'
 
 module Arachni::Element
 
-FORM = 'form'
+# Represents an auditable form element
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+class Form < Base
+    require_relative 'form/dom'
 
-class Form < Arachni::Element::Base
+    include Capabilities::WithNode
+    include Capabilities::WithDOM
+    include Capabilities::Analyzable
     include Capabilities::Refreshable
 
-    #
     # {Form} error namespace.
     #
     # All {Form} errors inherit from and live under it.
     #
-    # @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
-    #
+    # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
     class Error < Arachni::Error
 
-        #
         # Raised when a specified form field could not be found/does not exist.
         #
-        # @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
-        #
+        # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
         class FieldNotFound < Error
         end
     end
@@ -44,372 +39,165 @@ class Form < Arachni::Element::Base
     ORIGINAL_VALUES = '__original_values__'
     SAMPLE_VALUES   = '__sample_values__'
 
-    # @return [String] the name of the input name that holds the nonce
-    attr_reader :nonce_name
+    # @return     [String]
+    #   The name of the input name that holds the nonce.
+    attr_reader   :nonce_name
+
+    # @return     [String, nil]
+    #   Name of the form, if it has one.
+    attr_accessor :name
+
+    # @param    [Hash]    options
+    # @option   options [String]    :name
+    #   Form name.
+    # @option   options [String]    :id
+    #   Form ID.
+    # @option   options [String]    :method (:get)
+    #   Form method.
+    # @option   options [String]    :url
+    #   URL of the page which includes the form.
+    # @option   options [String]    :action
+    #   Form action -- defaults to `:url`.
+    # @option   options [Hash]    :inputs
+    #   Form inputs, can either be simple `name => value` pairs or more a
+    #   more detailed representation such as:
+    #
+    #       {
+    #           'my_token'  => {
+    #               type:  :hidden,
+    #               value: 'token-value'
+    #           }
+    #       }
+    def initialize( options )
+        super( options )
+
+        @name = options[:name]
+        @id   = options[:id]
+
+        @input_details = {}
+
+        cinputs = (options[:inputs] || {}).inject({}) do |h, (name, value_or_info)|
+             if value_or_info.is_a? Hash
+                 value_or_info             = value_or_info.symbolize_keys
+                 h[name]                   = value_or_info[:value]
+                 @input_details[name.to_s] = value_or_info
+             else
+                 h[name] = value_or_info
+             end
+                h
+            end
 
-    # @return [Nokogiri::XML::Element]
-    attr_accessor :node
+        self.inputs = (method == :get ?
+            (self.inputs || {}).merge(cinputs) : cinputs )
 
-    #
-    # Creates a new Form element from a URL and auditable data.
-    #
-    # @param    [String]    url
-    #   Owner URL -- URL of the page which contains the form.
-    # @param    [Hash]    raw
-    #   If empty, the element will be initialized without auditable inputs.
-    #
-    #   If a full `Hash` is passed, it will look for an actionable URL
-    #   `String` in the following keys:
-    #
-    #   * `'href'`
-    #   * `:href`
-    #   * `'action'`
-    #   * `:action`
-    #
-    #   For an method `String` in:
-    #
-    #   * `'method'`
-    #   * `:method`
-    #
-    #   Method defaults to 'get'.
-    #
-    #   For an auditable inputs `Hash` in:
-    #
-    #   * `'inputs'`
-    #   * `:inputs`
-    #   * `'auditable'`
-    #
-    #   these should contain inputs in `name => value` pairs.
-    #
-    def initialize( url, raw = {} )
-        super( url, raw )
-
-        was_opts_hash = false
-        begin
-            self.action = @raw['action'] || @raw[:action] || @raw['attrs']['action']
-            was_opts_hash = true
-        rescue
-            self.action = self.url
-        end
+        @default_inputs = self.inputs.dup.freeze
+    end
 
-        begin
-            self.method = @raw['method'] || @raw[:method] || @raw['attrs']['method']
-            was_opts_hash = true
-        rescue
-            self.method = 'get'
-        end
+    # @return   [DOM]
+    def dom
+        return @dom if @dom
+        return if !node || inputs.empty?
+        super
+    end
+
+    def force_train?
+        mutation_with_original_values? || mutation_with_sample_values?
+    end
 
-        if !was_opts_hash && (@raw.keys & [:inputs, 'inputs', 'auditable']).empty?
-            self.auditable = @raw
+    # @param    (see Capabilities::Submittable#action=)
+    # @@return  (see Capabilities::Submittable#action=)
+    def action=( url )
+        if self.method == :get
+            rewritten   = uri_parse( url ).rewrite
+            self.inputs = rewritten.query_parameters.merge( self.inputs || {} )
+
+            super rewritten.without_query
         else
-            self.auditable = @raw[:inputs] || @raw['inputs'] || simple['auditable']
+            super url
         end
+    end
 
-        self.auditable ||= {}
-
-        @orig = self.auditable.dup
-        @orig.freeze
+    # @param    [String]    input
+    #   Input name.
+    #
+    # @return   [Hash]
+    #   Information about the given input's attributes.
+    def details_for( input )
+        @input_details[input.to_s] || {}
     end
 
-    def to_html
-        return if !node
-        node.to_html
+    # @return   [String]
+    #   Name of ID HTML attributes for this form.
+    def name_or_id
+        name || @id
     end
 
-    #
-    # @example
-    #    p f = Form.from_document( 'http://stuff.com', '<form name="stuff"></form>' ).first
-    #    #=> #<Arachni::Element::Form:0x00000001ddfa08 @raw={"attrs"=>{"name"=>"stuff", "action"=>"http://stuff.com/", "method"=>"get"}, "textarea"=>[], "input"=>[], "select"=>[], "auditable"=>[]}, @url="http://stuff.com/", @hash=1935432807676141374, @opts={}, @action="http://stuff.com/", @method="get", @auditable={}, @orig={}>
-    #
-    #    p f.name
-    #    #=> "stuff"
-    #
-    #    p f = Form.new( 'http://stuff.com', 'attrs' => { 'name' => 'john' } )
-    #    #=> #<Arachni::Element::Form:0x00000002b46160 @raw={"attrs"=>{"name"=>"john"}}, @url="http://stuff.com/", @hash=2710248079644781147, @opts={}, @action="http://stuff.com/", @method=nil, @auditable={}, @orig={}>
-    #
-    #    p f.name
-    #    #=> "john"
-    #
-    #    p Form.new( 'http://stuff.com' ).name
-    #    #=> nil
-    #
-    # @return   [String, nil]   Name of the form, if it has one.
-    #
-    def name
-        return if !@raw['attrs'].is_a?( Hash )
-        @raw['attrs']['name']
+    # @return   [Hash]
+    #   A simple representation of self including attributes and inputs.
+    def simple
+        @initialization_options.merge( url: url, action: action, inputs: inputs )
     end
 
-    def name_or_id
-        return if !@raw['attrs'].is_a?( Hash )
-        name || @raw['attrs']['id']
+    # @return   [Bool]
+    #   `true` if the element has not been mutated, `false` otherwise.
+    def mutation_with_original_values?
+        !!@mutation_with_original_values
     end
 
-    #
-    # @example
-    #    p f = Form.new( 'http://stuff.com', inputs: { name: 'value' } )
-    #    #=> #<Arachni::Element::Form:0x00000002190f80 @raw={:inputs=>{:name=>"value"}}, @url="http://stuff.com/", @hash=-432844557667991308, @opts={}, @action="http://stuff.com/", @method="post", @auditable={"name"=>"value"}, @orig={"name"=>"value"}>
-    #
-    #    p f.action
-    #    #=> "http://stuff.com/"
-    #
-    #    p f.method
-    #    #=> "post"
-    #
-    #    p f.auditable.keys
-    #    #=> ["name"]
-    #
-    #    p f.id
-    #    #=> "http://stuff.com/::post::[\"name\"]"
-    #
-    # @return   [String]    Unique form ID.
-    #
-    def id
-        id_from :auditable
+    def mutation_with_original_values
+        @mutation_with_original_values = true
     end
 
+    # @return   [Bool]
+    #   `true` if the element has been populated with sample
+    #   ({Arachni::OptionGroups::Input.fill}) values, `false` otherwise.
     #
-    # @example
-    #    ap f = Form.new( 'http://stuff.com', inputs: { name: 'value' } )
-    #    #=> #<Arachni::Element::Form:0x01da8d78
-    #    #     attr_accessor :action = "http://stuff.com/",
-    #    #     attr_accessor :auditable = {
-    #    #         "name" => "value"
-    #    #     },
-    #    #     attr_accessor :method = "get",
-    #    #     attr_accessor :url = "http://stuff.com/",
-    #    #     attr_reader :hash = -277024459210456651,
-    #    #     attr_reader :opts = {},
-    #    #     attr_reader :orig = {
-    #    #         "name" => "value"
-    #    #     },
-    #    #     attr_reader :raw = {
-    #    #         :inputs => {
-    #    #             :name => "value"
-    #    #         }
-    #    #     }
-    #    # >
-    #
-    #    p f.action
-    #    #=> "http://stuff.com/"
-    #
-    #    p f.method
-    #    #=> "post"
-    #
-    #    p f.auditable.keys
-    #    #=> ["name"]
-    #
-    #    p f.id_from :auditable
-    #    #=> "http://stuff.com/::post::[\"name\"]"
-    #
-    #    p f.id
-    #    #=> "http://stuff.com/::post::[\"name\"]"
-    #
-    #    p f.id_from :original
-    #    #=> "http://stuff.com/::post::[\"name\"]"
-    #
-    #    f['new-input'] = 'new value'
-    #
-    #    p f.id_from :auditable
-    #    #=> "http://stuff.com/::post::[\"name\", \"new-input\"]"
-    #
-    #    p f.id
-    #    #=> "http://stuff.com/::post::[\"name\", \"new-input\"]"
-    #
-    #    p f.id_from :original
-    #    #=> "http://stuff.com/::post::[\"name\"]"
-    #
-    def id_from( type = :auditable )
-        query_vars = parse_url_vars( self.action )
-        "#{self.action.split( '?' ).first.to_s.split( ';' ).first}::" <<
-            "#{self.method}::#{query_vars.merge( self.send( type ) ).keys.compact.sort.to_s}"
+    # @see Arachni::OptionGroups::Input
+    def mutation_with_sample_values?
+        !!@mutation_with_sample_values
     end
 
-    #
-    # @example
-    #    p Form.new( 'http://stuff.com', inputs: { name: 'value' } ).simple
-    #    #=> {"auditable"=>{"name"=>"value"}, "attrs"=>{"method"=>"post", "action"=>"http://stuff.com/"}}
-    #
-    #    p Form.new( 'http://stuff.com', method: 'post', inputs: { name: 'value' } ).simple
-    #    #=> {"auditable"=>{"name"=>"value"}, "attrs"=>{"method"=>'post', "action"=>"http://stuff.com/"}}
-    #
-    # @return   [Hash]    a simple representation of self including attributes and auditables
-    #
-    def simple
-        form = {}
+    def mutation_with_sample_values
+        @mutation_with_sample_values = true
+    end
 
-        form['auditable'] = {}
-        if @raw['auditable'] && !@raw['auditable'].empty?
-            @raw['auditable'].each do |item|
-                next if !item['name']
-                form['auditable'][item['name']] = item['value']
-            end
+    def audit_status_message
+        override = nil
+        if mutation_with_original_values?
+            override = 'original'
+        elsif mutation_with_sample_values?
+            override = 'sample'
         end
 
-        if @raw['attrs']
-            form['attrs'] = @raw['attrs']
+        if override
+            "Submitting form with #{override} values for #{inputs.keys.join(', ')}" <<
+                " at '#{@action}'."
         else
-            form['attrs'] = {
-                'method' => @method,
-                'action' => @action
-            }
+            super
         end
-
-        if form['auditable'].empty? && @auditable && !@auditable.empty?
-            form['auditable'] = @auditable
-        end
-
-        form.dup
-    end
-
-    #
-    # @example
-    #    mutations = Form.new( 'http://stuff.com', inputs: { name: 'value' } ).mutations( 'seed' )
-    #
-    #    # mutations generally have seeds injected into their auditable inputs
-    #    ap mutations.first
-    #    #=> <Arachni::Element::Form:0x0327fdf0
-    #    #    attr_accessor :action = "http://stuff.com/",
-    #    #    attr_accessor :altered = "name",
-    #    #    attr_accessor :auditable = {
-    #    #        "name" => "seed"
-    #    #    },
-    #    #    attr_accessor :auditor = nil,
-    #    #    attr_accessor :method = "get",
-    #    #    attr_accessor :url = "http://stuff.com/",
-    #    #    attr_reader :hash = -3646163768215054761,
-    #    #    attr_reader :opts = {},
-    #    #    attr_reader :orig = {
-    #    #        "name" => "value"
-    #    #    },
-    #    #    attr_reader :raw = {
-    #    #        :inputs => {
-    #    #            :name => "value"
-    #    #        }
-    #    #    }
-    #    #>
-    #
-    #    p mutations.first.original?
-    #    #=> false
-    #
-    #    # but forms need to also be submitted with their default values
-    #    # for training purposes
-    #    ap original = mutations.select { |m| m.altered == Form::ORIGINAL_VALUES }.first
-    #    #=> #<Arachni::Element::Form:0x022a5a60
-    #    #     attr_accessor :action = "http://stuff.com/",
-    #    #     attr_accessor :altered = "__original_values__",
-    #    #     attr_accessor :auditable = {
-    #    #         "name" => "value"
-    #    #     },
-    #    #     attr_accessor :auditor = nil,
-    #    #     attr_accessor :method = "get",
-    #    #     attr_accessor :url = "http://stuff.com/",
-    #    #     attr_reader :hash = -608155834642701428,
-    #    #     attr_reader :opts = {},
-    #    #     attr_reader :orig = {
-    #    #         "name" => "value"
-    #    #     },
-    #    #     attr_reader :raw = {
-    #    #         :inputs => {
-    #    #             :name => "value"
-    #    #         }
-    #    #     }
-    #    # >
-    #
-    #    p original.original?
-    #    #=> true
-    #
-    # @return   [Bool]  `true` if the element has not been mutated, `false` otherwise.
-    #
-    def original?
-        self.altered == ORIGINAL_VALUES
     end
 
-    #
-    # @example
-    #    mutations = Form.new( 'http://stuff.com', inputs: { name: '' } ).mutations( 'seed' )
-    #
-    #    # mutations generally have seeds injected into their auditable inputs
-    #    ap mutations.first
-    #    #=> <Arachni::Element::Form:0x0327fdf0
-    #    #    attr_accessor :action = "http://stuff.com/",
-    #    #    attr_accessor :altered = "name",
-    #    #    attr_accessor :auditable = {
-    #    #        "name" => "seed"
-    #    #    },
-    #    #    attr_accessor :auditor = nil,
-    #    #    attr_accessor :method = "get",
-    #    #    attr_accessor :url = "http://stuff.com/",
-    #    #    attr_reader :hash = -3646163768215054761,
-    #    #    attr_reader :opts = {},
-    #    #    attr_reader :orig = {
-    #    #        "name" => "value"
-    #    #    },
-    #    #    attr_reader :raw = {
-    #    #        :inputs => {
-    #    #            :name => "value"
-    #    #        }
-    #    #    }
-    #    #>
-    #
-    #    # when values are missing the inputs are filled in using sample values
-    #    ap sample = mutations.select { |m| m.altered == Form::SAMPLE_VALUES }.first
-    #    #=> #<Arachni::Element::Form:0x02b23020
-    #    #     attr_accessor :action = "http://stuff.com/",
-    #    #     attr_accessor :altered = "__sample_values__",
-    #    #     attr_accessor :auditable = {
-    #    #         "name" => "arachni_name"
-    #    #     },
-    #    #     attr_accessor :auditor = nil,
-    #    #     attr_accessor :method = "get",
-    #    #     attr_accessor :url = "http://stuff.com/",
-    #    #     attr_reader :hash = 205637814585882034,
-    #    #     attr_reader :opts = {},
-    #    #     attr_reader :orig = {
-    #    #         "name" => ""
-    #    #     },
-    #    #     attr_reader :raw = {
-    #    #         :inputs => {
-    #    #             :name => ""
-    #    #         }
-    #    #     }
-    #    # >
-    #
-    #    p sample.sample?
-    #    #=> true
-    #
-    #
-    # @return   [Bool]
-    #   `true` if the element has been populated with sample
-    #   ({Support::KeyFiller}) values, `false` otherwise.
-    #
-    # @see Arachni::Support::KeyFiller.fill
-    #
-    def sample?
-        self.altered == SAMPLE_VALUES
-    end
-
-    def audit_id( injection_str = '', opts = {} )
-        str = if original?
-                  opts[:no_auditor] = true
-                  ORIGINAL_VALUES
-              elsif sample?
-                  opts[:no_auditor] = true
-                  SAMPLE_VALUES
-              else
-                  injection_str
-              end
-
-        super( str, opts )
+    # @param   (see Capabilities::Auditable#audit_id)
+    # @return  (see Capabilities::Auditable#audit_id)
+    def audit_id( payload = nil )
+        force_train? ? id : super( payload )
     end
 
     # Overrides {Arachni::Element::Mutable#each_mutation} adding support
     # for mutations with:
     #
-    # * Sample values (filled by {Arachni::Support::KeyFiller.fill}).
+    # * Sample values (filled by {Arachni::OptionGroups::Input.fill}).
     # * Original values.
     # * Password fields requiring identical values (in order to pass
-    #   server-side validation).
+    #   server-side validation)
+    #
+    # @param    [String]    payload
+    #   Payload to inject.
+    # @param    [Hash]      opts
+    #   Mutation options.
+    # @option   opts    [Bool]  :skip_original
+    #   Whether or not to skip adding a mutation holding original values and
+    #   sample values.
     #
     # @param (see Capabilities::Mutable#each_mutation)
     # @return (see Capabilities::Mutable#each_mutation)
@@ -417,32 +205,54 @@ class Form < Arachni::Element::Base
     # @yieldparam (see Capabilities::Mutable#each_mutation)
     #
     # @see Capabilities::Mutable#each_mutation
-    # @see Support::KeyFiller.fill
-    def each_mutation( seed, opts = {} )
+    # @see Arachni::OptionGroups::Input.fill
+    def each_mutation( payload, opts = {} )
         opts = MUTATION_OPTIONS.merge( opts )
 
-        generated = Arachni::Support::LookUp::HashSet.new
+        generated = Arachni::Support::LookUp::HashSet.new( hasher: :mutable_id )
 
-        super( seed, opts ) do |elem|
+        super( payload, opts ) do |elem|
             elem.mirror_password_fields
             yield elem if !generated.include?( elem )
             generated << elem
         end
 
-        return if opts[:skip_orig]
+        return if opts[:skip_original]
 
-        # this is the original hash, in case the default values
-        # are valid and present us with new attack vectors
         elem = self.dup
-        elem.altered = ORIGINAL_VALUES
+        elem.mutation_with_original_values
+        elem.affected_input_name = ORIGINAL_VALUES
         yield elem if !generated.include?( elem )
         generated << elem
 
-        elem = self.dup
-        elem.auditable = Arachni::Support::KeyFiller.fill( auditable.dup )
-        elem.altered = SAMPLE_VALUES
-        yield elem if !generated.include?( elem )
-        generated << elem
+        # Default values, in case they reveal new resources.
+        if node
+            inputs.keys.each do |input|
+                next if field_type_for( input ) != :select
+
+                node.xpath( "select[@name=\"#{input}\"]" ).css('option').each do |option|
+                    try_input do
+                        elem = self.dup
+                        elem.mutation_with_original_values
+                        elem.affected_input_name  = input
+                        elem.affected_input_value = option['value'] || option.text
+                        yield elem if !generated.include?( elem )
+                        generated << elem
+                    end
+                end
+
+            end
+        end
+
+        try_input do
+            # Sample values, in case they reveal new resources.
+            elem = self.dup
+            elem.inputs = Arachni::Options.input.fill( inputs.dup )
+            elem.affected_input_name = SAMPLE_VALUES
+            elem.mutation_with_sample_values
+            yield elem if !generated.include?( elem )
+            generated << elem
+        end
     end
 
     def mirror_password_fields
@@ -451,8 +261,8 @@ class Form < Arachni::Element::Base
         # if there are two password type fields in the form there's a good
         # chance that it's a 'please retype your password' thing so make sure
         # that we have a variation which has identical password values
-        password_fields = auditable.keys.
-            select { |input| field_type_for( input ) == 'password' }
+        password_fields = inputs.keys.
+            select { |input| field_type_for( input ) == :password }
 
         return if password_fields.size != 2
 
@@ -461,56 +271,22 @@ class Form < Arachni::Element::Base
         nil
     end
 
-    #
     # Checks whether or not the form contains 1 or more password fields.
     #
-    # @example With password
-    #    html_form = <<-HTML
-    #       <form>
-    #            <input type='password' name='pasword' />
-    #       </form>
-    #    HTML
-    #
-    #    p Form.from_document( 'http://stuff.com', html_form ).first.requires_password?
-    #    #=> true
-    #
-    # @example Without password
-    #    html_form = <<-HTML
-    #       <form>
-    #            <input type='text' name='stuff' />
-    #       </form>
-    #    HTML
-    #
-    #    p Form.from_document( 'http://stuff.com', html_form ).first.requires_password?
-    #    #=> false
-    #
     # @return   [Bool]
     #   `true` if the form contains passwords fields, `false` otherwise.
-    #
     def requires_password?
         return @requires_password if !@requires_password.nil?
-
-        return @requires_password = false if !self.raw.is_a?( Hash ) || !self.raw['input'].is_a?( Array )
-        @requires_password = self.raw['input'].select { |i| i['type'] == 'password' }.any?
+        inputs.each { |k, _| return @requires_password = true if field_type_for( k ) == :password }
+        @requires_password = false
     end
 
-    #
-    # @example
-    #    f = Form.new( 'http://stuff.com', { nonce_input: '' } )
-    #    p f.has_nonce?
-    #    #=> false
-    #
-    #    f.nonce_name = 'nonce_input'
-    #    p f.has_nonce?
-    #    #=> true
-    #
-    # @return   [Bool]  `true` if the form contains a nonce, `false` otherwise.
-    #
+    # @return   [Bool]
+    #   `true` if the form contains a nonce, `false` otherwise.
     def has_nonce?
         !!nonce_name
     end
 
-    #
     # When `nonce_name` is set the value of the equivalent input will be
     # refreshed every time the form is to be submitted.
     #
@@ -521,12 +297,13 @@ class Form < Arachni::Element::Base
     #
     # @example
     #   Form.new( 'http://stuff.com', { nonce_input: '' } ).nonce_name = 'blah'
-    #   #=> #<RuntimeError: Could not find field named 'blah'.>
+    #   #=> #<Error::FieldNotFound: Could not find field named 'blah'.>
     #
-    # @param    [String]    field_name  Name of the field holding the nonce.
-    #
-    # @raise    [Error::FieldNotFound]  If `field_name` is not a form input.
+    # @param    [String]    field_name
+    #   Name of the field holding the nonce.
     #
+    # @raise    [Error::FieldNotFound]
+    #   If `field_name` is not a form input.
     def nonce_name=( field_name )
         if !has_inputs?( field_name )
             fail Error::FieldNotFound, "Could not find field named '#{field_name}'."
@@ -534,7 +311,6 @@ class Form < Arachni::Element::Base
         @nonce_name = field_name
     end
 
-    #
     # Retrieves a field type for the given field `name`.
     #
     # @example
@@ -549,271 +325,33 @@ class Form < Arachni::Element::Base
     #    f = Form.from_document( 'http://stuff.com', html_form ).first
     #
     #    p f.field_type_for 'text-input'
-    #    #=> "text"
+    #    #=> :text
     #
     #    p f.field_type_for 'passwd'
-    #    #=> "password"
+    #    #=> :password
     #
     #    p f.field_type_for 'cant-see-this'
-    #    #=> "hidden"
+    #    #=> :hidden
     #
-    # @param    [String]    name    Field name.
+    # @param    [String]    name
+    #   Field name.
     #
     # @return   [String]
-    #
     def field_type_for( name )
-        return if !@raw['auditable']
-
-        field = @raw['auditable'].select { |f| f['name'] == name }.first
-        return if !field
-
-        field['type'].to_s.downcase
-    end
-
-    # @return   [String]    'form'
-    def type
-        Arachni::Element::FORM
-    end
-
-    def marshal_dump
-        instance_variables.inject( {} ) do |h, iv|
-            if iv == :@node
-                h[iv] = instance_variable_get( iv ).to_s
-            else
-                h[iv] = instance_variable_get( iv )
-            end
-
-            h
-        end
-    end
-
-    def marshal_load( h )
-        self.node = Nokogiri::HTML( h.delete(:@node) ).css('form').first
-        h.each { |k, v| instance_variable_set( k, v ) }
-    end
-
-    #
-    # Extracts forms by parsing the body of an HTTP response.
-    #
-    # @example
-    #    body = <<-HTML
-    #       <form action='/submit'>
-    #            <input type='text' name='text-input' />
-    #       </form>
-    #    HTML
-    #
-    #    res = Typhoeus::Response.new( effective_url: 'http://host', body: body )
-    #
-    #    ap Form.from_response( res ).first
-    #    #=> #<Arachni::Element::Form:0x017c7788
-    #    #    attr_accessor :action = "http://host/submit",
-    #    #    attr_accessor :auditable = {
-    #    #        "text-input" => ""
-    #    #    },
-    #    #    attr_accessor :method = "get",
-    #    #    attr_accessor :url = "http://host/",
-    #    #    attr_reader :hash = 343244616730070569,
-    #    #    attr_reader :opts = {},
-    #    #    attr_reader :orig = {
-    #    #        "text-input" => ""
-    #    #    },
-    #    #    attr_reader :raw = {
-    #    #            "attrs" => {
-    #    #            "action" => "http://host/submit",
-    #    #            "method" => "get"
-    #    #        },
-    #    #         "textarea" => [],
-    #    #            "input" => [
-    #    #            [0] {
-    #    #                "type" => "text",
-    #    #                "name" => "text-input"
-    #    #            }
-    #    #        ],
-    #    #           "select" => [],
-    #    #        "auditable" => [
-    #    #            [0] {
-    #    #                "type" => "text",
-    #    #                "name" => "text-input"
-    #    #            }
-    #    #        ]
-    #    #    }
-    #    #>
-    #
-    # @param   [Typhoeus::Response]    response
-    #
-    # @return   [Array<Form>]
-    #
-    def self.from_response( response )
-        from_document( response.effective_url, response.body )
+        details_for( name )[:type] || :text
     end
 
+    # @param   (see .encode)
+    # @return  (see .encode)
     #
-    # Extracts forms from an HTML document.
-    #
-    # @example
-    #    html_form = <<-HTML
-    #    <form action='/submit'>
-    #        <input type='text' name='text-input' />
-    #    </form>
-    #    HTML
-    #
-    #    ap Form.from_document( 'http://stuff.com', html_form ).first
-    #    #=> #<Arachni::Element::Form:0x03123600
-    #    #    attr_accessor :action = "http://stuff.com/submit",
-    #    #    attr_accessor :auditable = {
-    #    #        "text-input" => ""
-    #    #    },
-    #    #    attr_accessor :method = "get",
-    #    #    attr_accessor :url = "http://stuff.com/",
-    #    #    attr_reader :hash = 3370163854416367834,
-    #    #    attr_reader :opts = {},
-    #    #    attr_reader :orig = {
-    #    #        "text-input" => ""
-    #    #    },
-    #    #    attr_reader :raw = {
-    #    #            "attrs" => {
-    #    #            "action" => "http://stuff.com/submit",
-    #    #            "method" => "get"
-    #    #        },
-    #    #         "textarea" => [],
-    #    #            "input" => [
-    #    #            [0] {
-    #    #                "type" => "text",
-    #    #                "name" => "text-input"
-    #    #            }
-    #    #        ],
-    #    #           "select" => [],
-    #    #        "auditable" => [
-    #    #            [0] {
-    #    #                "type" => "text",
-    #    #                "name" => "text-input"
-    #    #            }
-    #    #        ]
-    #    #    }
-    #    #>
-    #
-    #    ap Form.from_document( 'http://stuff.com', Nokogiri::HTML( html_form ) ).first
-    #    #=> #<Arachni::Element::Form:0x03123600
-    #    #    attr_accessor :action = "http://stuff.com/submit",
-    #    #    attr_accessor :auditable = {
-    #    #        "text-input" => ""
-    #    #    },
-    #    #    attr_accessor :method = "get",
-    #    #    attr_accessor :url = "http://stuff.com/",
-    #    #    attr_reader :hash = 3370163854416367834,
-    #    #    attr_reader :opts = {},
-    #    #    attr_reader :orig = {
-    #    #        "text-input" => ""
-    #    #    },
-    #    #    attr_reader :raw = {
-    #    #            "attrs" => {
-    #    #            "action" => "http://stuff.com/submit",
-    #    #            "method" => "get"
-    #    #        },
-    #    #         "textarea" => [],
-    #    #            "input" => [
-    #    #            [0] {
-    #    #                "type" => "text",
-    #    #                "name" => "text-input"
-    #    #            }
-    #    #        ],
-    #    #           "select" => [],
-    #    #        "auditable" => [
-    #    #            [0] {
-    #    #                "type" => "text",
-    #    #                "name" => "text-input"
-    #    #            }
-    #    #        ]
-    #    #    }
-    #    #>
-    #
-    #
-    # @param    [String]    url
-    #   URL of the document -- used for path normalization purposes.
-    # @param    [String, Nokogiri::HTML::Document]    document
-    #
-    # @return   [Array<Form>]
-    #
-    def self.from_document( url, document )
-        document = Nokogiri::HTML( document.to_s ) if !document.is_a?( Nokogiri::HTML::Document )
-
-        base_url = document.search( '//base[@href]' )[0]['href'] rescue nil
-        base_url = url if base_url.to_s.empty?
-
-        document.search( '//form' ).map do |cform|
-            next if !(form = form_from_element( base_url, cform ))
-            form.url = url
-
-            # We do it this way to remove references to parents etc.
-            form.node = Nokogiri::HTML.fragment( cform.to_html ).css( 'form' ).first
-
-            form
-        end.compact
-    end
-
-    #
-    # Parses an HTTP request body generated by submitting a form.
-    #
-    # @example Simple
-    #    p Form.parse_request_body 'first_name=John&last_name=Doe'
-    #    #=> {"first_name"=>"John", "last_name"=>"Doe"}
-    #
-    # @example Weird
-    #    body = 'testID=53738&deliveryID=53618&testIDs=&deliveryIDs=&selectedRows=2' +
-    #        '&event=&section=&event%3Dmanage%26amp%3Bsection%3Dexam=Manage+selected+exam'
-    #    p Form.parse_request_body body
-    #    #=> {"testID"=>"53738", "deliveryID"=>"53618", "testIDs"=>"", "deliveryIDs"=>"", "selectedRows"=>"2", "event"=>"", "section"=>"", "event=manage&amp;section=exam"=>"Manage selected exam"}
-    #
-    # @param    [String]    body
-    #
-    # @return   [Hash]      Parameters.
-    #
-    def self.parse_request_body( body )
-        body.to_s.split( '&' ).inject( {} ) do |h, pair|
-            name, value = pair.split( '=', 2 )
-            h[decode( name.to_s )] = decode( value )
-            h
-        end
-    end
-    # @see .parse_request_body
-    def parse_request_body( body )
-        self.class.parse_request_body( body )
-    end
-
-    #
-    # Encodes a {String}'s reserved characters in order to prepare it
-    # to be included in a request body.
-    #
-    # #example
-    #    p Form.encode "+% ;&\\=\0"
-    #    #=> "%2B%25+%3B%26%5C%3D%00"
-    #
-    # @param    [String]    str
-    #
-    # @return   [String]
-    #
-    def self.encode( str )
-        ::URI.encode( ::URI.encode( str, '+%' ).recode.gsub( ' ', '+' ), ";&\\=\0" )
-    end
     # @see .encode
     def encode( str )
         self.class.encode( str )
     end
 
+    # @param   (see .decode)
+    # @return  (see .decode)
     #
-    # Decodes a {String} encoded for an HTTP request's body.
-    #
-    # @example
-    #    p Form.decode "%2B%25+%3B%26%5C%3D%5C0"
-    #    #=> "+% ;&\\=\\0"
-    #
-    # @param    [String]    str
-    #
-    # @return   [String]
-    #
-    def self.decode( str )
-        URI.decode( str.to_s.recode.gsub( '+', ' ' ) )
-    end
     # @see .decode
     def decode( str )
         self.class.decode( str )
@@ -822,139 +360,171 @@ class Form < Arachni::Element::Base
     def dup
         super.tap do |f|
             f.nonce_name = nonce_name.dup if nonce_name
-            f.requires_password = requires_password?
-        end
-    end
-
-    protected
-
-    def requires_password=( bool )
-        @requires_password = bool
-    end
 
-    private
+            f.mutation_with_original_values if mutation_with_original_values?
+            f.mutation_with_sample_values   if mutation_with_sample_values?
 
-    def skip?( elem )
-        if elem.original? || elem.sample?
-            id = elem.audit_id
-            return true if audited?( id )
-            audited( id )
+            f.requires_password = requires_password?
         end
-        false
     end
 
-    def self.form_from_element( url, form )
-        c_form = {}
-        c_form['attrs'] = attributes_to_hash( form.attributes )
+    class <<self
 
-        if !c_form['attrs'] || !c_form['attrs']['action']
-            action = url.to_s
-        else
-            action = url_sanitize( c_form['attrs']['action'] )
+        # Extracts forms by parsing the body of an HTTP response.
+        #
+        # @param   [Arachni::HTTP::Response]    response
+        #
+        # @return   [Array<Form>]
+        def from_response( response )
+            from_document( response.url, response.body )
         end
 
-        action = to_absolute( action.to_s, url ).to_s
+        # Extracts forms from an HTML document.
+        #
+        # @param    [String]    url
+        #   URL of the document -- used for path normalization purposes.
+        # @param    [String, Nokogiri::HTML::Document]    document
+        #
+        # @return   [Array<Form>]
+        def from_document( url, document )
+            document = Nokogiri::HTML( document.to_s ) if !document.is_a?( Nokogiri::HTML::Document )
+            base_url = (document.search( '//base[@href]' )[0]['href'] rescue url)
+
+            document.search( '//form' ).map do |node|
+                next if !(form = from_node( base_url, node ))
+                form.url = url.freeze
+                form
+            end.compact
+        end
 
-        c_form['attrs']['action'] = action
+        def from_node( url, node )
+            options          = attributes_to_hash( node.attributes )
+            options[:url]    = url.freeze
+            options[:action] = to_absolute( options[:action], url ).freeze
+            options[:inputs] = {}
+            options[:html]   = node.to_html.freeze
 
-        if !c_form['attrs']['method']
-            c_form['attrs']['method'] = 'get'
-        else
-            c_form['attrs']['method'] = c_form['attrs']['method'].downcase
-        end
+            if (parsed_url = Arachni::URI( options[:action] ))
+                return if parsed_url.scope.out?
+            end
 
-        %w(textarea input select button).each do |attr|
-            c_form[attr] ||= []
-            form.search( ".//#{attr}" ).each do |elem|
-
-                elem_attrs = attributes_to_hash( elem.attributes )
-                c_form[elem.name] ||= []
-                if elem.name != 'select'
-                    c_form[elem.name] << elem_attrs
-                else
-                    auditables = elem.children.map do |child|
-                        h = attributes_to_hash( child.attributes )
-                        h['value'] ||= child.text
-                        h['options'] ||= {}
-                        h
+            %w(textarea input select button).each do |attr|
+                options[attr] ||= []
+                node.search( ".//#{attr}" ).each do |elem|
+                    elem_attrs = attributes_to_hash( elem.attributes )
+                    elem_attrs[:type] = elem_attrs[:type].to_sym if elem_attrs[:type]
+
+                    name = elem_attrs[:name] || elem_attrs[:id]
+                    next if !name
+
+                    # Handle the easy stuff first...
+                    if elem.name != 'select'
+                        options[:inputs][name]           = elem_attrs
+                        options[:inputs][name][:type]  ||= :text
+                        options[:inputs][name][:value] ||= ''
+                        next
                     end
 
-                    c_form[elem.name] << {
-                        'attrs'   => elem_attrs,
-                        'options' => auditables
-                    }
+                    # If the select has options figure out which to use.
+                    if elem.children.css('option').any?
+                        elem.children.css('option').each do |child|
+                            h = attributes_to_hash( child.attributes )
+                            h[:type] = :select
+
+                            # Prefer the selected or first option.
+                            if h[:selected]
+                                h[:value] ||= child.text
+                                options[:inputs][name] = h
+                            else
+                                h[:value] ||= child.text
+                                options[:inputs][name] ||= h
+                            end
+                        end
+
+                        # The select has no options, use an empty string.
+                    else
+                        options[:inputs][name] = {
+                            type:  :select,
+                            value: ''
+                        }
+                    end
                 end
             end
+
+            new options
+        end
+
+        def attributes_to_hash( attributes )
+            attributes.inject( {} ){ |h, (k, v)| h[k.to_sym] = v.to_s; h }
+        end
+
+        # Encodes a {String}'s reserved characters in order to prepare it
+        # to be included in a request body.
+        #
+        # @param    [String]    str
+        #
+        # @return   [String]
+        def encode( str )
+            ::URI.encode(
+                ::URI.encode( str, '+%' ).recode.gsub( ' ', '+' ),
+                ";&\\=\0"
+            )
         end
 
-        # merge the form elements to make auditing easier
-        c_form['auditable'] = c_form['input'] | c_form['textarea'] | c_form['button']
-        c_form['auditable'] =
-            merge_select_with_input( c_form['auditable'], c_form['select'] )
+        # Decodes a {String} encoded for an HTTP request's body.
+        #
+        # @param    [String]    str
+        #
+        # @return   [String]
+        def decode( str )
+            URI.decode( str.to_s.recode.gsub( '+', ' ' ) )
+        end
 
-        new( url, c_form )
     end
 
-    def self.attributes_to_hash( attributes )
-        attributes.inject( {} ){ |h, (k, v)| h[k] = v.to_s; h }
+    protected
+
+    def requires_password=( bool )
+        @requires_password = bool
     end
 
-    #
-    # Merges an array of form inputs with an array of form selects
-    #
-    # @param    [Array]  inputs
-    # @param    [Array]  selects
-    #
-    # @return   [Array]  merged array
-    #
-    def self.merge_select_with_input( inputs, selects )
-        selected = nil
-        inputs | selects.map do |select|
-            select['options'].each do |option|
-                if option.include?( 'selected' )
-                    selected = option['value']
-                    break
-                end
-            end
+    private
 
-            select['attrs']['value'] = selected || begin
-                select['options'].first['value']
-            rescue
-            end
-            select['attrs']
+    def skip?( elem )
+        if elem.mutation_with_original_values? || elem.mutation_with_sample_values?
+            id = elem.audit_id
+            return true if audited?( id )
+            audited( id )
         end
+        false
     end
 
-    def http_request( opts, &block )
-        if (original? || sample?) && opts[:train] != false
-            state = original? ? 'original' : 'sample'
-            print_debug "Submitting form with #{state} values; overriding trainer option."
-            opts[:train] = true
-            print_debug_trainer( opts )
+    def http_request( options, &block )
+        if force_train? && options[:train] != false
+            print_debug 'Submitting form with default or sample values,' <<
+                            ' overriding trainer option.'
+            options[:train] = true
+            print_debug_trainer( options )
         end
 
-        opts = opts.dup
-        opts[:method] = self.method.downcase.to_s.to_sym
+        options = options.dup
 
         if has_nonce?
             print_info "Refreshing nonce for '#{nonce_name}'."
 
-            f = self.class.from_response( http.get( @url, async: false ).response ).
-                    select { |f| f.auditable.keys == auditable.keys }.first
-
-            if !f
-                print_bad 'Could not refresh nonce because the form could not be found.'
+            if !refresh
+                print_bad 'Could not refresh nonce because the original form ' <<
+                              'could not be found.'
             else
-                nonce = f.auditable[nonce_name]
-
-                print_info "Got new nonce '#{nonce}'."
-
-                opts[:params][nonce_name] = nonce
-                opts[:async] = false
+                print_info "Got new nonce '#{inputs[nonce_name]}'."
+                options[:mode]       = :sync
+                options[:parameters] = inputs
             end
         end
 
-        http.request( self.action, opts, &block )
+        self.method == :post ?
+            http.post( self.action, options, &block ) :
+            http.get( self.action, options, &block )
     end
 
 end