arachni 0.4.7 → 1.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (1585) hide show
  1. checksums.yaml +5 -13
  2. data/AUTHORS.md +1 -1
  3. data/CHANGELOG.md +211 -0
  4. data/CONTRIBUTORS.md +1 -0
  5. data/Gemfile +23 -2
  6. data/LICENSE.md +34 -1
  7. data/README.md +211 -127
  8. data/Rakefile +79 -67
  9. data/arachni.gemspec +54 -62
  10. data/bin/arachni +6 -18
  11. data/bin/arachni_console +5 -13
  12. data/bin/arachni_multi +6 -16
  13. data/bin/arachni_reporter +12 -0
  14. data/bin/arachni_restore +12 -0
  15. data/bin/arachni_rpc +6 -16
  16. data/bin/arachni_rpcd +6 -17
  17. data/bin/arachni_rpcd_monitor +6 -18
  18. data/bin/arachni_script +8 -19
  19. data/components/checks/active/code_injection.rb +123 -0
  20. data/components/checks/active/code_injection_php_input_wrapper.rb +99 -0
  21. data/components/checks/active/code_injection_timing.rb +106 -0
  22. data/components/checks/active/csrf.rb +218 -0
  23. data/components/checks/active/file_inclusion.rb +152 -0
  24. data/components/checks/active/ldap_injection.rb +109 -0
  25. data/{modules/audit/ldapi → components/checks/active/ldap_injection}/errors.txt +0 -0
  26. data/components/checks/active/no_sql_injection.rb +94 -0
  27. data/components/checks/active/no_sql_injection/patterns/mongodb +1 -0
  28. data/{extras/placeholder → components/checks/active/no_sql_injection/regexp_ignore.txt} +0 -0
  29. data/components/checks/active/no_sql_injection_differential.rb +78 -0
  30. data/components/checks/active/os_cmd_injection.rb +116 -0
  31. data/components/checks/active/os_cmd_injection_timing.rb +92 -0
  32. data/components/checks/active/path_traversal.rb +174 -0
  33. data/components/checks/active/response_splitting.rb +94 -0
  34. data/components/checks/active/rfi.rb +172 -0
  35. data/components/checks/active/session_fixation.rb +117 -0
  36. data/components/checks/active/source_code_disclosure.rb +177 -0
  37. data/components/checks/active/sql_injection.rb +123 -0
  38. data/{modules/audit/sqli → components/checks/active/sql_injection}/patterns/access +0 -0
  39. data/{modules/audit/sqli → components/checks/active/sql_injection}/patterns/coldfusion +0 -0
  40. data/{modules/audit/sqli → components/checks/active/sql_injection}/patterns/db2 +0 -0
  41. data/{modules/audit/sqli → components/checks/active/sql_injection}/patterns/emc +0 -0
  42. data/{modules/audit/sqli → components/checks/active/sql_injection}/patterns/firebird +0 -0
  43. data/{modules/audit/sqli → components/checks/active/sql_injection}/patterns/frontbase +0 -0
  44. data/{modules/audit/sqli → components/checks/active/sql_injection}/patterns/hsqldb +0 -0
  45. data/{modules/audit/sqli → components/checks/active/sql_injection}/patterns/informix +0 -0
  46. data/{modules/audit/sqli → components/checks/active/sql_injection}/patterns/ingres +0 -0
  47. data/{modules/audit/sqli → components/checks/active/sql_injection}/patterns/interbase +0 -0
  48. data/{modules/audit/sqli → components/checks/active/sql_injection}/patterns/maxdb +0 -0
  49. data/{modules/audit/sqli → components/checks/active/sql_injection}/patterns/mssql +0 -0
  50. data/{modules/audit/sqli → components/checks/active/sql_injection}/patterns/mysql +0 -0
  51. data/{modules/audit/sqli → components/checks/active/sql_injection}/patterns/oracle +0 -0
  52. data/{modules/audit/sqli → components/checks/active/sql_injection}/patterns/pgsql +0 -0
  53. data/{modules/audit/sqli → components/checks/active/sql_injection}/patterns/sqlite +0 -0
  54. data/{modules/audit/sqli → components/checks/active/sql_injection}/patterns/sybase +0 -0
  55. data/{modules/audit/sqli → components/checks/active/sql_injection}/regexp_ignore.txt +0 -0
  56. data/components/checks/active/sql_injection_differential.rb +114 -0
  57. data/{modules/audit/sqli_blind_rdiff → components/checks/active/sql_injection_differential}/payloads.txt +0 -0
  58. data/components/checks/active/sql_injection_timing.rb +98 -0
  59. data/{modules/audit/sqli_blind_timing → components/checks/active/sql_injection_timing}/mssql.txt +0 -0
  60. data/{modules/audit/sqli_blind_timing → components/checks/active/sql_injection_timing}/mysql.txt +0 -0
  61. data/{modules/audit/sqli_blind_timing → components/checks/active/sql_injection_timing}/pgsql.txt +0 -0
  62. data/components/checks/active/trainer.rb +40 -0
  63. data/components/checks/active/unvalidated_redirect.rb +108 -0
  64. data/components/checks/active/xpath_injection.rb +87 -0
  65. data/{modules/audit/xpath → components/checks/active/xpath_injection}/errors.txt +0 -0
  66. data/components/checks/active/xss.rb +169 -0
  67. data/components/checks/active/xss_dom.rb +119 -0
  68. data/components/checks/active/xss_dom_inputs.rb +132 -0
  69. data/components/checks/active/xss_dom_script_context.rb +118 -0
  70. data/components/checks/active/xss_event.rb +165 -0
  71. data/components/checks/active/xss_path.rb +146 -0
  72. data/components/checks/active/xss_script_context.rb +207 -0
  73. data/components/checks/active/xss_tag.rb +135 -0
  74. data/components/checks/passive/allowed_methods.rb +92 -0
  75. data/components/checks/passive/backdoors.rb +79 -0
  76. data/{modules/recon → components/checks/passive}/backdoors/filenames.txt +0 -0
  77. data/components/checks/passive/backup_directories.rb +86 -0
  78. data/components/checks/passive/backup_directories/formats.txt +56 -0
  79. data/components/checks/passive/backup_files.rb +99 -0
  80. data/components/checks/passive/backup_files/formats.txt +106 -0
  81. data/components/checks/passive/common_directories.rb +81 -0
  82. data/{modules/recon → components/checks/passive}/common_directories/directories.txt +0 -0
  83. data/components/checks/passive/common_files.rb +73 -0
  84. data/components/checks/passive/common_files/filenames.txt +24 -0
  85. data/components/checks/passive/directory_listing.rb +129 -0
  86. data/components/checks/passive/grep/captcha.rb +73 -0
  87. data/components/checks/passive/grep/cookie_set_for_parent_domain.rb +71 -0
  88. data/components/checks/passive/grep/credit_card.rb +124 -0
  89. data/components/checks/passive/grep/cvs_svn_users.rb +75 -0
  90. data/components/checks/passive/grep/emails.rb +53 -0
  91. data/components/checks/passive/grep/form_upload.rb +75 -0
  92. data/components/checks/passive/grep/hsts.rb +74 -0
  93. data/components/checks/passive/grep/html_objects.rb +45 -0
  94. data/components/checks/passive/grep/http_only_cookies.rb +72 -0
  95. data/components/checks/passive/grep/insecure_cookies.rb +74 -0
  96. data/components/checks/passive/grep/mixed_resource.rb +109 -0
  97. data/components/checks/passive/grep/password_autocomplete.rb +80 -0
  98. data/components/checks/passive/grep/private_ip.rb +73 -0
  99. data/components/checks/passive/grep/ssn.rb +62 -0
  100. data/components/checks/passive/grep/unencrypted_password_forms.rb +88 -0
  101. data/components/checks/passive/htaccess_limit.rb +71 -0
  102. data/components/checks/passive/http_put.rb +91 -0
  103. data/components/checks/passive/interesting_responses.rb +88 -0
  104. data/components/checks/passive/localstart_asp.rb +88 -0
  105. data/components/checks/passive/origin_spoof_access_restriction_bypass.rb +83 -0
  106. data/components/checks/passive/webdav.rb +101 -0
  107. data/components/checks/passive/xst.rb +90 -0
  108. data/components/fingerprinters/frameworks/rack.rb +33 -0
  109. data/components/fingerprinters/languages/asp.rb +34 -0
  110. data/components/fingerprinters/languages/aspx.rb +55 -0
  111. data/components/fingerprinters/languages/jsp.rb +34 -0
  112. data/components/fingerprinters/languages/php.rb +35 -0
  113. data/components/fingerprinters/languages/python.rb +32 -0
  114. data/components/fingerprinters/languages/ruby.rb +33 -0
  115. data/components/fingerprinters/os/bsd.rb +28 -0
  116. data/components/fingerprinters/os/linux.rb +34 -0
  117. data/components/fingerprinters/os/solaris.rb +33 -0
  118. data/components/fingerprinters/os/unix.rb +28 -0
  119. data/components/fingerprinters/os/windows.rb +33 -0
  120. data/components/fingerprinters/servers/apache.rb +28 -0
  121. data/components/fingerprinters/servers/iis.rb +28 -0
  122. data/components/fingerprinters/servers/jetty.rb +28 -0
  123. data/components/fingerprinters/servers/nginx.rb +28 -0
  124. data/components/fingerprinters/servers/tomcat.rb +28 -0
  125. data/components/path_extractors/anchors.rb +29 -0
  126. data/components/path_extractors/areas.rb +29 -0
  127. data/components/path_extractors/comments.rb +21 -0
  128. data/components/path_extractors/forms.rb +29 -0
  129. data/components/path_extractors/frames.rb +29 -0
  130. data/components/path_extractors/generic.rb +76 -0
  131. data/components/path_extractors/links.rb +29 -0
  132. data/components/path_extractors/meta_refresh.rb +50 -0
  133. data/components/path_extractors/scripts.rb +31 -0
  134. data/components/plugins/autologin.rb +120 -0
  135. data/components/plugins/beep_notify.rb +43 -0
  136. data/components/plugins/content_types.rb +110 -0
  137. data/components/plugins/cookie_collector.rb +94 -0
  138. data/components/plugins/defaults/autothrottle.rb +73 -0
  139. data/components/plugins/defaults/healthmap.rb +79 -0
  140. data/components/plugins/defaults/meta/remedies/discovery.rb +122 -0
  141. data/components/plugins/defaults/meta/remedies/timing_attacks.rb +98 -0
  142. data/components/plugins/defaults/meta/uniformity.rb +55 -0
  143. data/components/plugins/email_notify.rb +112 -0
  144. data/components/plugins/form_dicattack.rb +128 -0
  145. data/components/plugins/http_dicattack.rb +102 -0
  146. data/components/plugins/proxy.rb +492 -0
  147. data/{plugins → components/plugins}/proxy/panel/403_forbidden.html.erb +0 -0
  148. data/{plugins → components/plugins}/proxy/panel/404_not_found.html.erb +0 -0
  149. data/{plugins → components/plugins}/proxy/panel/css/bootstrap-responsive.css +0 -0
  150. data/{plugins → components/plugins}/proxy/panel/css/bootstrap.min.css +0 -0
  151. data/{plugins → components/plugins}/proxy/panel/css/panel.css +0 -0
  152. data/{plugins → components/plugins}/proxy/panel/help.html.erb +0 -0
  153. data/{plugins → components/plugins}/proxy/panel/img/glyphicons-halflings-white.png +0 -0
  154. data/{plugins → components/plugins}/proxy/panel/img/glyphicons-halflings.png +0 -0
  155. data/{plugins → components/plugins}/proxy/panel/img/record.png +0 -0
  156. data/{plugins → components/plugins}/proxy/panel/inspect.html.erb +0 -0
  157. data/{plugins → components/plugins}/proxy/panel/js/bootstrap.min.js +0 -0
  158. data/{plugins → components/plugins}/proxy/panel/js/jquery.min.js +0 -0
  159. data/{plugins → components/plugins}/proxy/panel/js/panel.js +0 -0
  160. data/{plugins → components/plugins}/proxy/panel/layout.html.erb +0 -0
  161. data/components/plugins/proxy/panel/page_accordion.html.erb +67 -0
  162. data/{plugins → components/plugins}/proxy/panel/page_twin_accordion.html.erb +0 -0
  163. data/components/plugins/proxy/panel/panel.html.erb +69 -0
  164. data/{plugins → components/plugins}/proxy/panel/shutdown_message.html.erb +0 -0
  165. data/{plugins → components/plugins}/proxy/panel/sign_in.html.erb +0 -0
  166. data/{plugins → components/plugins}/proxy/panel/vectors.yml.erb +0 -0
  167. data/{plugins → components/plugins}/proxy/panel/verify_login_check.html.erb +0 -0
  168. data/{plugins → components/plugins}/proxy/panel/verify_login_final.html.erb +0 -0
  169. data/components/plugins/proxy/panel/verify_login_sequence.html.erb +45 -0
  170. data/components/plugins/proxy/template_scope.rb +130 -0
  171. data/components/plugins/script.rb +48 -0
  172. data/components/plugins/uncommon_headers.rb +92 -0
  173. data/components/plugins/vector_feed.rb +225 -0
  174. data/components/plugins/waf_detector.rb +169 -0
  175. data/components/reporters/ap.rb +38 -0
  176. data/components/reporters/html.rb +468 -0
  177. data/components/reporters/html/default.erb +68 -0
  178. data/components/reporters/html/default/configuration.erb +78 -0
  179. data/components/reporters/html/default/css/lib/bootstrap-theme.min.css +7 -0
  180. data/components/reporters/html/default/css/lib/bootstrap.min.css +7 -0
  181. data/components/reporters/html/default/css/lib/c3.css +203 -0
  182. data/components/reporters/html/default/css/lib/font-awesome.min.css +4 -0
  183. data/components/reporters/html/default/css/main.css +140 -0
  184. data/components/reporters/html/default/fonts/FontAwesome.otf +0 -0
  185. data/components/reporters/html/default/fonts/fontawesome-webfont.eot +0 -0
  186. data/components/reporters/html/default/fonts/fontawesome-webfont.svg +504 -0
  187. data/components/reporters/html/default/fonts/fontawesome-webfont.ttf +0 -0
  188. data/components/reporters/html/default/fonts/fontawesome-webfont.woff +0 -0
  189. data/components/reporters/html/default/fonts/glyphicons-halflings-regular.eot +0 -0
  190. data/components/reporters/html/default/fonts/glyphicons-halflings-regular.svg +229 -0
  191. data/components/reporters/html/default/fonts/glyphicons-halflings-regular.ttf +0 -0
  192. data/components/reporters/html/default/fonts/glyphicons-halflings-regular.woff +0 -0
  193. data/components/reporters/html/default/issue.erb +81 -0
  194. data/components/reporters/html/default/issue/details.erb +68 -0
  195. data/components/reporters/html/default/issue/info.erb +74 -0
  196. data/components/reporters/html/default/issue/page.erb +117 -0
  197. data/components/reporters/html/default/issue/page/body.erb +42 -0
  198. data/components/reporters/html/default/issue/page/sink/data_flow.erb +95 -0
  199. data/components/reporters/html/default/issue/page/sink/data_flow/arguments.erb +70 -0
  200. data/components/reporters/html/default/issue/page/sink/data_flow/source.erb +1 -0
  201. data/components/reporters/html/default/issue/page/sink/execution_flow.erb +63 -0
  202. data/components/reporters/html/default/issue/page/sink/frame/source.erb +32 -0
  203. data/components/reporters/html/default/issue/page/sink/trace/table.erb +127 -0
  204. data/components/reporters/html/default/issue/page/transitions.erb +86 -0
  205. data/components/reporters/html/default/issue/platform.erb +8 -0
  206. data/components/reporters/html/default/issue/remarks.erb +28 -0
  207. data/components/reporters/html/default/issue/vector.erb +40 -0
  208. data/components/reporters/html/default/issues.erb +46 -0
  209. data/components/reporters/html/default/issues/grouped.erb +147 -0
  210. data/components/reporters/html/default/js/charts.js.erb +117 -0
  211. data/components/reporters/html/default/js/configuration.js.erb +12 -0
  212. data/components/reporters/html/default/js/helpers.js +107 -0
  213. data/components/reporters/html/default/js/init.js.erb +23 -0
  214. data/components/reporters/html/default/js/lib/bootstrap.min.js +6 -0
  215. data/components/reporters/html/default/js/lib/c3.min.js +3 -0
  216. data/components/reporters/html/default/js/lib/d3.min.js +5 -0
  217. data/components/reporters/html/default/js/lib/jquery.min.js +4 -0
  218. data/components/reporters/html/default/navigation.erb +136 -0
  219. data/components/reporters/html/default/plugins.erb +30 -0
  220. data/components/reporters/html/default/shared/hash.erb +10 -0
  221. data/components/reporters/html/default/shared/hash_table.erb +22 -0
  222. data/components/reporters/html/default/sitemap.erb +29 -0
  223. data/components/reporters/html/default/summary.erb +34 -0
  224. data/components/reporters/html/default/summary/charts.erb +67 -0
  225. data/components/reporters/html/default/summary/issues.erb +129 -0
  226. data/components/reporters/json.rb +44 -0
  227. data/components/reporters/marshal.rb +38 -0
  228. data/components/reporters/plugin_formatters/html/autologin.rb +50 -0
  229. data/components/reporters/plugin_formatters/html/content_types.rb +59 -0
  230. data/components/reporters/plugin_formatters/html/cookie_collector.rb +46 -0
  231. data/components/reporters/plugin_formatters/html/form_dicattack.rb +36 -0
  232. data/components/reporters/plugin_formatters/html/healthmap.rb +88 -0
  233. data/components/reporters/plugin_formatters/html/http_dicattack.rb +36 -0
  234. data/components/reporters/plugin_formatters/html/uncommon_headers.rb +40 -0
  235. data/components/reporters/plugin_formatters/html/uniformity.rb +55 -0
  236. data/components/reporters/plugin_formatters/html/waf_detector.rb +69 -0
  237. data/components/reporters/plugin_formatters/stdout/autologin.rb +25 -0
  238. data/components/reporters/plugin_formatters/stdout/content_types.rb +39 -0
  239. data/components/reporters/plugin_formatters/stdout/cookie_collector.rb +31 -0
  240. data/components/reporters/plugin_formatters/stdout/form_dicattack.rb +24 -0
  241. data/components/reporters/plugin_formatters/stdout/healthmap.rb +41 -0
  242. data/components/reporters/plugin_formatters/stdout/http_dicattack.rb +24 -0
  243. data/components/reporters/plugin_formatters/stdout/uncommon_headers.rb +29 -0
  244. data/components/reporters/plugin_formatters/stdout/uniformity.rb +35 -0
  245. data/components/reporters/plugin_formatters/stdout/waf_detector.rb +21 -0
  246. data/components/reporters/plugin_formatters/xml/autologin.rb +28 -0
  247. data/components/reporters/plugin_formatters/xml/content_types.rb +36 -0
  248. data/components/reporters/plugin_formatters/xml/cookie_collector.rb +32 -0
  249. data/components/reporters/plugin_formatters/xml/form_dicattack.rb +22 -0
  250. data/components/reporters/plugin_formatters/xml/healthmap.rb +30 -0
  251. data/components/reporters/plugin_formatters/xml/http_dicattack.rb +22 -0
  252. data/components/reporters/plugin_formatters/xml/uncommon_headers.rb +29 -0
  253. data/components/reporters/plugin_formatters/xml/uniformity.rb +23 -0
  254. data/components/reporters/plugin_formatters/xml/waf_detector.rb +22 -0
  255. data/components/reporters/stdout.rb +226 -0
  256. data/components/reporters/txt.rb +50 -0
  257. data/components/reporters/xml.rb +285 -0
  258. data/components/reporters/xml/schema.xsd +664 -0
  259. data/components/reporters/yaml.rb +37 -0
  260. data/{rpcd_handlers → components/services}/placeholder +0 -0
  261. data/lib/arachni.rb +29 -18
  262. data/lib/arachni/banner.rb +5 -13
  263. data/lib/arachni/browser.rb +1292 -0
  264. data/lib/arachni/browser/element_locator.rb +137 -0
  265. data/lib/arachni/browser/javascript.rb +383 -0
  266. data/lib/arachni/browser/javascript/dom_monitor.rb +31 -0
  267. data/lib/arachni/browser/javascript/proxy.rb +92 -0
  268. data/lib/arachni/browser/javascript/proxy/stub.rb +90 -0
  269. data/lib/arachni/browser/javascript/scripts/dom_monitor.js +146 -0
  270. data/lib/arachni/browser/javascript/scripts/taint_tracer.js +486 -0
  271. data/lib/arachni/browser/javascript/taint_tracer.rb +101 -0
  272. data/lib/arachni/browser/javascript/taint_tracer/frame.rb +73 -0
  273. data/lib/arachni/browser/javascript/taint_tracer/frame/called_function.rb +78 -0
  274. data/lib/arachni/browser/javascript/taint_tracer/sink/base.rb +63 -0
  275. data/lib/arachni/browser/javascript/taint_tracer/sink/data_flow.rb +83 -0
  276. data/lib/arachni/browser/javascript/taint_tracer/sink/execution_flow.rb +30 -0
  277. data/lib/arachni/browser_cluster.rb +414 -0
  278. data/lib/arachni/browser_cluster/job.rb +193 -0
  279. data/lib/arachni/browser_cluster/job/result.rb +29 -0
  280. data/lib/arachni/browser_cluster/jobs/browser_provider.rb +27 -0
  281. data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +60 -0
  282. data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +43 -0
  283. data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result.rb +23 -0
  284. data/lib/arachni/browser_cluster/jobs/resource_exploration/result.rb +23 -0
  285. data/lib/arachni/browser_cluster/jobs/taint_trace.rb +48 -0
  286. data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +33 -0
  287. data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger/result.rb +23 -0
  288. data/lib/arachni/browser_cluster/jobs/taint_trace/result.rb +23 -0
  289. data/lib/arachni/browser_cluster/worker.rb +277 -0
  290. data/lib/arachni/check.rb +12 -0
  291. data/lib/arachni/check/auditor.rb +612 -0
  292. data/lib/arachni/check/base.rb +177 -0
  293. data/lib/arachni/check/manager.rb +137 -0
  294. data/lib/arachni/component.rb +11 -0
  295. data/lib/arachni/component/base.rb +62 -0
  296. data/lib/arachni/component/manager.rb +92 -90
  297. data/lib/arachni/component/options.rb +6 -28
  298. data/lib/arachni/component/options/address.rb +14 -30
  299. data/lib/arachni/component/options/base.rb +96 -81
  300. data/lib/arachni/component/options/bool.rb +20 -37
  301. data/lib/arachni/component/options/float.rb +12 -31
  302. data/lib/arachni/component/options/int.rb +14 -31
  303. data/lib/arachni/component/options/multiple_choice.rb +40 -0
  304. data/lib/arachni/component/options/object.rb +16 -0
  305. data/lib/arachni/component/options/path.rb +12 -25
  306. data/lib/arachni/component/options/port.rb +15 -25
  307. data/lib/arachni/component/options/string.rb +10 -32
  308. data/lib/arachni/component/options/url.rb +15 -30
  309. data/lib/arachni/component/output.rb +33 -0
  310. data/lib/arachni/component/utilities.rb +49 -0
  311. data/lib/arachni/data.rb +109 -0
  312. data/lib/arachni/data/framework.rb +160 -0
  313. data/lib/arachni/data/framework/rpc.rb +68 -0
  314. data/lib/arachni/data/issues.rb +227 -0
  315. data/lib/arachni/data/plugins.rb +109 -0
  316. data/lib/arachni/data/session.rb +48 -0
  317. data/lib/arachni/element/base.rb +131 -82
  318. data/lib/arachni/element/body.rb +43 -13
  319. data/lib/arachni/element/capabilities/analyzable.rb +46 -0
  320. data/lib/arachni/element/capabilities/analyzable/differential.rb +436 -0
  321. data/lib/arachni/element/capabilities/analyzable/taint.rb +218 -0
  322. data/lib/arachni/element/capabilities/analyzable/timeout.rb +433 -0
  323. data/lib/arachni/element/capabilities/auditable.rb +172 -577
  324. data/lib/arachni/element/capabilities/auditable/dom.rb +156 -0
  325. data/lib/arachni/element/capabilities/inputtable.rb +267 -0
  326. data/lib/arachni/element/capabilities/mutable.rb +197 -155
  327. data/lib/arachni/element/capabilities/refreshable.rb +31 -24
  328. data/lib/arachni/element/capabilities/submittable.rb +128 -0
  329. data/lib/arachni/element/capabilities/with_auditor.rb +60 -0
  330. data/lib/arachni/element/capabilities/with_auditor/output.rb +33 -0
  331. data/lib/arachni/element/capabilities/with_dom.rb +40 -0
  332. data/lib/arachni/element/capabilities/with_node.rb +52 -0
  333. data/lib/arachni/element/capabilities/with_scope.rb +25 -0
  334. data/lib/arachni/element/capabilities/with_scope/scope.rb +38 -0
  335. data/lib/arachni/element/cookie.rb +337 -862
  336. data/lib/arachni/element/cookie/dom.rb +67 -0
  337. data/lib/arachni/element/form.rb +326 -756
  338. data/lib/arachni/element/form/dom.rb +52 -0
  339. data/lib/arachni/element/generic_dom.rb +133 -0
  340. data/lib/arachni/element/header.rb +46 -46
  341. data/lib/arachni/element/link.rb +134 -172
  342. data/lib/arachni/element/link/dom.rb +128 -0
  343. data/lib/arachni/element/link_template.rb +268 -0
  344. data/lib/arachni/element/link_template/dom.rb +143 -0
  345. data/lib/arachni/element/path.rb +24 -13
  346. data/lib/arachni/element/server.rb +89 -13
  347. data/lib/arachni/element_filter.rb +101 -99
  348. data/lib/arachni/error.rb +5 -15
  349. data/lib/arachni/ethon/easy.rb +22 -0
  350. data/lib/arachni/framework.rb +841 -476
  351. data/lib/arachni/http.rb +6 -714
  352. data/lib/arachni/http/client.rb +801 -0
  353. data/lib/arachni/http/cookie_jar.rb +50 -51
  354. data/lib/arachni/http/headers.rb +122 -0
  355. data/lib/arachni/http/message.rb +76 -0
  356. data/lib/arachni/http/message/scope.rb +35 -0
  357. data/lib/arachni/http/proxy_server.rb +303 -0
  358. data/{plugins/proxy → lib/arachni/http/proxy_server}/ssl-interceptor-cert.pem +0 -0
  359. data/{plugins/proxy → lib/arachni/http/proxy_server}/ssl-interceptor-pkey.pem +0 -0
  360. data/lib/arachni/http/request.rb +471 -0
  361. data/lib/arachni/http/request/scope.rb +30 -0
  362. data/lib/arachni/http/response.rb +226 -0
  363. data/lib/arachni/http/response/scope.rb +67 -0
  364. data/lib/arachni/issue.rb +389 -223
  365. data/lib/arachni/issue/severity.rb +34 -0
  366. data/lib/arachni/issue/severity/base.rb +39 -0
  367. data/lib/arachni/option_group.rb +137 -0
  368. data/lib/arachni/option_groups.rb +13 -0
  369. data/lib/arachni/option_groups/audit.rb +226 -0
  370. data/lib/arachni/option_groups/browser_cluster.rb +50 -0
  371. data/lib/arachni/option_groups/datastore.rb +31 -0
  372. data/lib/arachni/option_groups/dispatcher.rb +132 -0
  373. data/lib/arachni/option_groups/http.rb +174 -0
  374. data/lib/arachni/option_groups/input.rb +156 -0
  375. data/lib/arachni/option_groups/output.rb +22 -0
  376. data/lib/arachni/option_groups/paths.rb +63 -0
  377. data/lib/arachni/option_groups/rpc.rb +87 -0
  378. data/lib/arachni/option_groups/scope.rb +233 -0
  379. data/lib/arachni/option_groups/session.rb +54 -0
  380. data/lib/arachni/option_groups/snapshot.rb +22 -0
  381. data/lib/arachni/options.rb +286 -1486
  382. data/lib/arachni/page.rb +504 -108
  383. data/lib/arachni/page/dom.rb +280 -0
  384. data/lib/arachni/page/dom/transition.rb +302 -0
  385. data/lib/arachni/page/scope.rb +53 -0
  386. data/lib/arachni/parser.rb +177 -210
  387. data/lib/arachni/platform.rb +5 -13
  388. data/lib/arachni/platform/fingerprinter.rb +24 -23
  389. data/lib/arachni/platform/list.rb +48 -27
  390. data/lib/arachni/platform/manager.rb +146 -83
  391. data/lib/arachni/plugin.rb +5 -13
  392. data/lib/arachni/plugin/base.rb +90 -110
  393. data/lib/arachni/plugin/formatter.rb +40 -0
  394. data/lib/arachni/plugin/manager.rb +129 -108
  395. data/lib/arachni/processes.rb +6 -14
  396. data/lib/arachni/processes/dispatchers.rb +51 -58
  397. data/lib/arachni/processes/executables/base.rb +9 -0
  398. data/lib/arachni/processes/executables/dispatcher.rb +6 -0
  399. data/lib/arachni/processes/executables/instance.rb +13 -0
  400. data/lib/arachni/processes/helpers.rb +4 -12
  401. data/lib/arachni/processes/helpers/dispatchers.rb +8 -12
  402. data/lib/arachni/processes/helpers/instances.rb +13 -13
  403. data/lib/arachni/processes/helpers/processes.rb +8 -28
  404. data/lib/arachni/processes/instances.rb +86 -63
  405. data/lib/arachni/processes/manager.rb +89 -52
  406. data/lib/arachni/report.rb +282 -15
  407. data/lib/arachni/reporter.rb +12 -0
  408. data/lib/arachni/reporter/base.rb +126 -0
  409. data/lib/arachni/reporter/formatter_manager.rb +20 -0
  410. data/lib/arachni/reporter/manager.rb +54 -0
  411. data/lib/arachni/reporter/options.rb +47 -0
  412. data/lib/arachni/rpc/client/base.rb +27 -35
  413. data/lib/arachni/rpc/client/dispatcher.rb +13 -21
  414. data/lib/arachni/rpc/client/instance.rb +45 -40
  415. data/lib/arachni/rpc/client/instance/framework.rb +88 -0
  416. data/lib/arachni/rpc/client/instance/service.rb +106 -0
  417. data/lib/arachni/rpc/serializer.rb +98 -0
  418. data/lib/arachni/rpc/server/active_options.rb +26 -42
  419. data/lib/arachni/rpc/server/base.rb +35 -26
  420. data/lib/arachni/rpc/server/check/manager.rb +38 -0
  421. data/lib/arachni/rpc/server/dispatcher.rb +125 -211
  422. data/lib/arachni/rpc/server/dispatcher/node.rb +36 -50
  423. data/lib/arachni/rpc/server/dispatcher/service.rb +153 -0
  424. data/lib/arachni/rpc/server/framework.rb +83 -176
  425. data/lib/arachni/rpc/server/framework/distributor.rb +292 -271
  426. data/lib/arachni/rpc/server/framework/master.rb +164 -296
  427. data/lib/arachni/rpc/server/framework/multi_instance.rb +96 -128
  428. data/lib/arachni/rpc/server/framework/slave.rb +79 -89
  429. data/lib/arachni/rpc/server/instance.rb +362 -413
  430. data/lib/arachni/rpc/server/output.rb +33 -147
  431. data/lib/arachni/rpc/server/plugin/manager.rb +18 -54
  432. data/lib/arachni/ruby.rb +5 -14
  433. data/lib/arachni/ruby/array.rb +4 -14
  434. data/lib/arachni/ruby/hash.rb +47 -15
  435. data/lib/arachni/ruby/io.rb +4 -14
  436. data/lib/arachni/ruby/object.rb +10 -52
  437. data/lib/arachni/ruby/set.rb +4 -12
  438. data/lib/arachni/ruby/string.rb +60 -40
  439. data/lib/arachni/ruby/webrick.rb +4 -12
  440. data/lib/arachni/ruby/webrick/cookie.rb +4 -12
  441. data/lib/arachni/ruby/webrick/httprequest.rb +4 -12
  442. data/lib/arachni/scope.rb +40 -0
  443. data/lib/arachni/selenium/webdriver/remote/http/typhoeus.rb +46 -0
  444. data/lib/arachni/session.rb +150 -173
  445. data/lib/arachni/snapshot.rb +181 -0
  446. data/lib/arachni/state.rb +122 -0
  447. data/lib/arachni/state/audit.rb +57 -0
  448. data/lib/arachni/state/element_filter.rb +67 -0
  449. data/lib/arachni/state/framework.rb +419 -0
  450. data/lib/arachni/state/framework/rpc.rb +63 -0
  451. data/lib/arachni/state/http.rb +60 -0
  452. data/lib/arachni/state/options.rb +39 -0
  453. data/lib/arachni/state/plugins.rb +94 -0
  454. data/lib/arachni/support.rb +6 -15
  455. data/lib/arachni/support/buffer.rb +5 -13
  456. data/lib/arachni/support/buffer/autoflush.rb +5 -15
  457. data/lib/arachni/support/buffer/base.rb +41 -70
  458. data/lib/arachni/support/cache.rb +5 -13
  459. data/lib/arachni/support/cache/base.rb +45 -50
  460. data/lib/arachni/support/cache/least_cost_replacement.rb +9 -19
  461. data/lib/arachni/support/cache/least_recently_used.rb +5 -15
  462. data/lib/arachni/support/cache/preference.rb +11 -20
  463. data/lib/arachni/support/cache/random_replacement.rb +10 -15
  464. data/lib/arachni/support/crypto.rb +5 -13
  465. data/lib/arachni/support/crypto/rsa_aes_cbc.rb +15 -27
  466. data/lib/arachni/support/database.rb +5 -13
  467. data/lib/arachni/support/database/base.rb +20 -37
  468. data/lib/arachni/support/database/hash.rb +265 -350
  469. data/lib/arachni/support/database/queue.rb +86 -27
  470. data/lib/arachni/support/lookup.rb +5 -13
  471. data/lib/arachni/support/lookup/base.rb +33 -26
  472. data/lib/arachni/support/lookup/hash_set.rb +11 -15
  473. data/lib/arachni/support/lookup/moolb.rb +9 -20
  474. data/lib/arachni/support/mixins.rb +14 -0
  475. data/lib/arachni/support/mixins/observable.rb +105 -0
  476. data/lib/arachni/support/mixins/terminal.rb +65 -0
  477. data/lib/arachni/support/profiler.rb +130 -0
  478. data/lib/arachni/support/signature.rb +37 -67
  479. data/lib/arachni/trainer.rb +57 -97
  480. data/lib/arachni/ui/foo/output.rb +31 -33
  481. data/lib/arachni/uri.rb +456 -462
  482. data/lib/arachni/uri/scope.rb +168 -0
  483. data/lib/arachni/utilities.rb +125 -147
  484. data/lib/arachni/version.rb +4 -12
  485. data/lib/arachni/watir/element.rb +17 -0
  486. data/lib/version +1 -1
  487. data/{spec/support/servers/modules/audit/sqli/jdbc → profiles/placeholder} +0 -0
  488. data/spec/arachni/browser/element_locator_spec.rb +228 -0
  489. data/spec/arachni/browser/javascript/dom_monitor_spec.rb +195 -0
  490. data/spec/arachni/browser/javascript/proxy/stub_spec.rb +106 -0
  491. data/spec/arachni/browser/javascript/proxy_spec.rb +144 -0
  492. data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +72 -0
  493. data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +46 -0
  494. data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +81 -0
  495. data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +47 -0
  496. data/spec/arachni/browser/javascript/taint_tracer_spec.rb +1304 -0
  497. data/spec/arachni/browser/javascript_spec.rb +355 -0
  498. data/spec/arachni/browser_cluster/job/result_spec.rb +14 -0
  499. data/spec/arachni/browser_cluster/job_spec.rb +264 -0
  500. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +7 -0
  501. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +68 -0
  502. data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +7 -0
  503. data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +89 -0
  504. data/spec/arachni/browser_cluster/jobs/taint_tracer_spec.rb +149 -0
  505. data/spec/arachni/browser_cluster/worker_spec.rb +314 -0
  506. data/spec/arachni/browser_cluster_spec.rb +543 -0
  507. data/spec/arachni/browser_spec.rb +2368 -0
  508. data/spec/arachni/check/auditor_spec.rb +1089 -0
  509. data/spec/arachni/check/base_spec.rb +33 -0
  510. data/spec/arachni/check/manager_spec.rb +100 -0
  511. data/spec/arachni/component/base_spec.rb +64 -0
  512. data/spec/arachni/component/manager_spec.rb +37 -26
  513. data/spec/arachni/component/options/address_spec.rb +5 -11
  514. data/spec/arachni/component/options/base_spec.rb +29 -81
  515. data/spec/arachni/component/options/bool_spec.rb +16 -19
  516. data/spec/arachni/component/options/float_spec.rb +17 -16
  517. data/spec/arachni/component/options/int_spec.rb +17 -20
  518. data/spec/arachni/component/options/multiple_choice_spec.rb +82 -0
  519. data/spec/arachni/component/options/object_spec.rb +24 -0
  520. data/spec/arachni/component/options/path_spec.rb +8 -11
  521. data/spec/arachni/component/options/port_spec.rb +16 -15
  522. data/spec/arachni/component/options/string_spec.rb +8 -17
  523. data/spec/arachni/component/options/url_spec.rb +16 -14
  524. data/spec/arachni/component/utilities_spec.rb +30 -0
  525. data/spec/arachni/{module → component}/utilities_spec/read_file.txt +0 -0
  526. data/spec/arachni/data/framework/rpc_spec.rb +72 -0
  527. data/spec/arachni/data/framework_spec.rb +266 -0
  528. data/spec/arachni/data/issues_spec.rb +347 -0
  529. data/spec/arachni/data/plugins_spec.rb +102 -0
  530. data/spec/arachni/data/session_spec.rb +59 -0
  531. data/spec/arachni/data_spec.rb +71 -0
  532. data/spec/arachni/element/body_spec.rb +63 -4
  533. data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +135 -0
  534. data/spec/arachni/element/capabilities/analyzable/taint_spec.rb +355 -0
  535. data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +386 -0
  536. data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +25 -0
  537. data/spec/arachni/element/cookie/dom_spec.rb +145 -0
  538. data/spec/arachni/element/cookie_spec.rb +147 -108
  539. data/spec/arachni/element/form/dom_spec.rb +146 -0
  540. data/spec/arachni/element/form_spec.rb +519 -271
  541. data/spec/arachni/element/generic_dom_spec.rb +113 -0
  542. data/spec/arachni/element/header_spec.rb +68 -20
  543. data/spec/arachni/element/link/dom_spec.rb +206 -0
  544. data/spec/arachni/element/link_spec.rb +218 -130
  545. data/spec/arachni/element/link_template/dom_spec.rb +218 -0
  546. data/spec/arachni/element/link_template_spec.rb +403 -0
  547. data/spec/arachni/element/path_spec.rb +28 -4
  548. data/spec/arachni/element/server_spec.rb +171 -4
  549. data/spec/arachni/element_filter_spec.rb +227 -96
  550. data/spec/arachni/framework_spec.rb +1099 -759
  551. data/spec/arachni/http/client_spec.rb +1470 -0
  552. data/spec/arachni/http/cookie_jar_spec.rb +164 -130
  553. data/spec/arachni/http/headers_spec.rb +111 -0
  554. data/spec/arachni/http/message_spec.rb +5 -0
  555. data/spec/arachni/http/proxy_server_spec.rb +354 -0
  556. data/spec/arachni/http/request_spec.rb +602 -0
  557. data/spec/arachni/http/response/scope_spec.rb +135 -0
  558. data/spec/arachni/http/response_spec.rb +350 -0
  559. data/spec/arachni/issue/severity/base_spec.rb +15 -0
  560. data/spec/arachni/issue/severity_spec.rb +43 -0
  561. data/spec/arachni/issue_spec.rb +547 -284
  562. data/spec/arachni/option_groups/audit_spec.rb +298 -0
  563. data/spec/arachni/option_groups/browser_cluster_spec.rb +12 -0
  564. data/spec/arachni/option_groups/datastore_spec.rb +54 -0
  565. data/spec/arachni/option_groups/dispatcher_spec.rb +123 -0
  566. data/spec/arachni/option_groups/http_spec.rb +42 -0
  567. data/spec/arachni/option_groups/input_spec.rb +202 -0
  568. data/spec/arachni/option_groups/output_spec.rb +11 -0
  569. data/spec/arachni/option_groups/paths_spec.rb +34 -0
  570. data/spec/arachni/option_groups/rpc_spec.rb +13 -0
  571. data/spec/arachni/option_groups/scope_spec.rb +237 -0
  572. data/spec/arachni/option_groups/session_spec.rb +51 -0
  573. data/spec/arachni/option_groups/snapshot_spec.rb +11 -0
  574. data/spec/arachni/options_spec.rb +202 -756
  575. data/spec/arachni/page/dom/transition_spec.rb +515 -0
  576. data/spec/arachni/page/dom_spec.rb +308 -0
  577. data/spec/arachni/page/scope_spec.rb +80 -0
  578. data/spec/arachni/page_spec.rb +789 -175
  579. data/spec/arachni/parser_spec.rb +308 -200
  580. data/spec/arachni/platform/fingerprinter_spec.rb +51 -52
  581. data/spec/arachni/platform/manager_spec.rb +146 -34
  582. data/spec/arachni/plugin/base_spec.rb +97 -0
  583. data/spec/arachni/plugin/manager_spec.rb +186 -80
  584. data/spec/arachni/report_spec.rb +275 -0
  585. data/spec/arachni/reporter/base_spec.rb +96 -0
  586. data/spec/arachni/reporter/manager_spec.rb +38 -0
  587. data/spec/arachni/reporter/options_spec.rb +48 -0
  588. data/spec/arachni/rpc/client/base_spec.rb +43 -45
  589. data/spec/arachni/rpc/client/dispatcher_spec.rb +3 -3
  590. data/spec/arachni/rpc/client/instance_spec.rb +18 -40
  591. data/spec/arachni/rpc/server/active_options_spec.rb +35 -296
  592. data/spec/arachni/rpc/server/base_spec.rb +12 -6
  593. data/spec/arachni/rpc/server/checks/manager_spec.rb +48 -0
  594. data/spec/arachni/rpc/server/dispatcher/node_spec.rb +47 -74
  595. data/spec/arachni/rpc/server/dispatcher/service_spec.rb +99 -0
  596. data/spec/arachni/rpc/server/dispatcher_spec.rb +77 -38
  597. data/spec/arachni/rpc/server/framework/distributor_spec.rb +356 -396
  598. data/spec/arachni/rpc/server/framework_multi_spec.rb +336 -0
  599. data/spec/arachni/rpc/server/framework_spec.rb +396 -0
  600. data/spec/arachni/rpc/server/instance_spec.rb +480 -281
  601. data/spec/arachni/rpc/server/output_spec.rb +9 -212
  602. data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -11
  603. data/spec/arachni/ruby/hash_spec.rb +30 -0
  604. data/spec/arachni/ruby/object_spec.rb +0 -16
  605. data/spec/arachni/ruby/string_spec.rb +98 -6
  606. data/spec/arachni/scope_spec.rb +13 -0
  607. data/spec/arachni/session_spec.rb +279 -251
  608. data/spec/arachni/snapshot_spec.rb +127 -0
  609. data/spec/arachni/state/audit_spec.rb +107 -0
  610. data/spec/arachni/state/element_filter_spec.rb +66 -0
  611. data/spec/arachni/state/framework/rpc_spec.rb +85 -0
  612. data/spec/arachni/state/framework_spec.rb +853 -0
  613. data/spec/arachni/state/http_spec.rb +63 -0
  614. data/spec/arachni/state/options_spec.rb +55 -0
  615. data/spec/arachni/state/plugins_spec.rb +76 -0
  616. data/spec/arachni/state_spec.rb +87 -0
  617. data/spec/arachni/support/cache/least_cost_replacement_spec.rb +30 -32
  618. data/spec/arachni/support/cache/least_recently_used_spec.rb +39 -40
  619. data/spec/arachni/support/cache/preference_spec.rb +17 -18
  620. data/spec/arachni/support/cache/random_replacement_spec.rb +19 -20
  621. data/spec/arachni/support/database/queue_spec.rb +200 -32
  622. data/spec/arachni/support/lookup/hash_set_spec.rb +74 -0
  623. data/spec/arachni/support/mixins/observable_spec.rb +81 -0
  624. data/spec/arachni/support/signature_spec.rb +9 -25
  625. data/spec/arachni/trainer_spec.rb +141 -124
  626. data/spec/arachni/uri/scope_spec.rb +416 -0
  627. data/spec/arachni/uri_spec.rb +187 -195
  628. data/spec/arachni/utilities_spec.rb +178 -525
  629. data/spec/components/checks/active/code_injection_spec.rb +26 -0
  630. data/spec/components/checks/active/code_injection_timing_spec.rb +26 -0
  631. data/spec/components/checks/active/csrf_spec.rb +44 -0
  632. data/spec/components/checks/active/file_inclusion_spec.rb +56 -0
  633. data/spec/components/checks/active/ldap_injection_spec.rb +16 -0
  634. data/spec/components/checks/active/no_sql_injection_differential_spec.rb +15 -0
  635. data/spec/components/checks/active/no_sql_injection_spec.rb +28 -0
  636. data/spec/components/checks/active/os_cmd_injection_spec.rb +26 -0
  637. data/spec/components/checks/active/os_cmd_injection_timing_spec.rb +26 -0
  638. data/spec/components/checks/active/path_traversal_spec.rb +42 -0
  639. data/spec/components/checks/active/response_splitting_spec.rb +22 -0
  640. data/spec/components/checks/active/rfi_spec.rb +20 -0
  641. data/spec/components/checks/active/session_fixation_spec.rb +20 -0
  642. data/spec/components/checks/active/source_code_disclosure_spec.rb +26 -0
  643. data/spec/components/checks/active/sql_injection_differential_spec.rb +15 -0
  644. data/spec/components/checks/active/sql_injection_spec.rb +142 -0
  645. data/spec/components/checks/active/sql_injection_timing_spec.rb +24 -0
  646. data/spec/components/checks/active/trainer_spec.rb +36 -0
  647. data/spec/components/checks/active/unvalidated_redirect_spec.rb +20 -0
  648. data/spec/components/checks/active/xpath_injection_spec.rb +16 -0
  649. data/spec/components/checks/active/xss_dom_inputs_spec.rb +32 -0
  650. data/spec/components/checks/active/xss_dom_script_context_spec.rb +63 -0
  651. data/spec/components/checks/active/xss_dom_spec.rb +67 -0
  652. data/spec/components/checks/active/xss_event_spec.rb +15 -0
  653. data/spec/components/checks/active/xss_path_spec.rb +15 -0
  654. data/spec/components/checks/active/xss_script_context_spec.rb +22 -0
  655. data/spec/components/checks/active/xss_spec.rb +22 -0
  656. data/spec/components/checks/active/xss_tag_spec.rb +15 -0
  657. data/spec/components/checks/passive/allowed_methods_spec.rb +15 -0
  658. data/spec/components/checks/passive/backdoors_spec.rb +15 -0
  659. data/spec/components/checks/passive/backup_directories_spec.rb +15 -0
  660. data/spec/components/checks/passive/backup_files_spec.rb +15 -0
  661. data/spec/components/checks/passive/common_directories_spec.rb +15 -0
  662. data/spec/components/checks/passive/common_files_spec.rb +15 -0
  663. data/spec/components/checks/passive/directory_listing_spec.rb +15 -0
  664. data/spec/components/checks/passive/grep/captcha_spec.rb +15 -0
  665. data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +15 -0
  666. data/spec/components/checks/passive/grep/credit_card_spec.rb +15 -0
  667. data/spec/components/checks/passive/grep/cvs_svn_users_spec.rb +15 -0
  668. data/spec/components/checks/passive/grep/emails_spec.rb +15 -0
  669. data/spec/components/checks/passive/grep/form_upload_spec.rb +15 -0
  670. data/spec/components/checks/passive/grep/hsts_spec.rb +17 -0
  671. data/spec/components/checks/passive/grep/html_objects_spec.rb +15 -0
  672. data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +15 -0
  673. data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +15 -0
  674. data/spec/components/checks/passive/grep/mixed_resource_spec.rb +16 -0
  675. data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +15 -0
  676. data/spec/components/checks/passive/grep/private_ip_spec.rb +22 -0
  677. data/spec/components/checks/passive/grep/ssn_spec.rb +15 -0
  678. data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +15 -0
  679. data/spec/components/checks/passive/htaccess_limit_spec.rb +15 -0
  680. data/spec/components/checks/passive/http_put_spec.rb +15 -0
  681. data/spec/components/checks/passive/interesting_responses_spec.rb +23 -0
  682. data/spec/components/checks/passive/localstart_asp_spec.rb +15 -0
  683. data/spec/components/checks/passive/origin_spoof_access_restriction_bypass_spec.rb +15 -0
  684. data/spec/components/checks/passive/webdav_spec.rb +15 -0
  685. data/spec/components/checks/passive/xst_spec.rb +15 -0
  686. data/spec/components/fingerprinters/frameworks/rack_spec.rb +42 -0
  687. data/spec/components/fingerprinters/languages/asp_spec.rb +38 -0
  688. data/spec/components/fingerprinters/languages/aspx_spec.rb +79 -0
  689. data/spec/components/fingerprinters/languages/jsp_spec.rb +56 -0
  690. data/spec/components/fingerprinters/languages/php_spec.rb +59 -0
  691. data/spec/components/fingerprinters/languages/python_spec.rb +23 -0
  692. data/spec/components/fingerprinters/languages/ruby.rb +34 -0
  693. data/spec/components/fingerprinters/os/bsd_spec.rb +26 -0
  694. data/spec/components/fingerprinters/os/linux_spec.rb +34 -0
  695. data/spec/components/fingerprinters/os/solaris_spec.rb +34 -0
  696. data/spec/components/fingerprinters/os/unix_spec.rb +26 -0
  697. data/spec/components/fingerprinters/os/windows_spec.rb +34 -0
  698. data/spec/components/fingerprinters/servers/apache_spec.rb +26 -0
  699. data/spec/components/fingerprinters/servers/iis_spec.rb +28 -0
  700. data/spec/components/fingerprinters/servers/jetty_spec.rb +28 -0
  701. data/spec/components/fingerprinters/servers/nginx_spec.rb +26 -0
  702. data/spec/components/fingerprinters/servers/tomcat_spec.rb +28 -0
  703. data/spec/{path_extractors → components/path_extractors}/anchors_spec.rb +0 -0
  704. data/spec/{path_extractors → components/path_extractors}/areas_spec.rb +0 -0
  705. data/spec/components/path_extractors/comments_spec.rb +23 -0
  706. data/spec/{path_extractors → components/path_extractors}/forms_spec.rb +0 -0
  707. data/spec/{path_extractors → components/path_extractors}/frames_spec.rb +0 -0
  708. data/spec/{path_extractors → components/path_extractors}/generic_spec.rb +0 -0
  709. data/spec/{path_extractors → components/path_extractors}/links_spec.rb +0 -0
  710. data/spec/{path_extractors → components/path_extractors}/meta_refresh_spec.rb +0 -0
  711. data/spec/components/path_extractors/scripts_spec.rb +30 -0
  712. data/spec/components/plugins/autologin_spec.rb +96 -0
  713. data/spec/components/plugins/autothrottle_spec.rb +56 -0
  714. data/spec/components/plugins/content_types_spec.rb +91 -0
  715. data/spec/components/plugins/cookie_collector_spec.rb +41 -0
  716. data/spec/components/plugins/form_dicattack_spec.rb +54 -0
  717. data/spec/components/plugins/healthmap_spec.rb +40 -0
  718. data/spec/components/plugins/http_dicattack_spec.rb +40 -0
  719. data/spec/components/plugins/meta/remedies/discovery_spec.rb +23 -0
  720. data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +31 -0
  721. data/spec/components/plugins/meta/uniformity_spec.rb +29 -0
  722. data/spec/components/plugins/script_spec.rb +13 -0
  723. data/spec/components/plugins/uncommon_headers_spec.rb +64 -0
  724. data/spec/components/plugins/vector_feed_spec.rb +169 -0
  725. data/spec/components/plugins/waf_detector_spec.rb +50 -0
  726. data/spec/components/reporters/ap_spec.rb +9 -0
  727. data/spec/components/reporters/html_spec.rb +9 -0
  728. data/spec/components/reporters/json_spec.rb +17 -0
  729. data/spec/components/reporters/marshal_spec.rb +13 -0
  730. data/spec/components/reporters/stdout_spec.rb +9 -0
  731. data/spec/components/reporters/txt_spec.rb +8 -0
  732. data/spec/components/reporters/xml_spec.rb +9 -0
  733. data/spec/components/reporters/yaml_spec.rb +14 -0
  734. data/spec/external/wavsep/active/lfi_spec.rb +1 -1
  735. data/spec/external/wavsep/active/obsolete_files_spec.rb +225 -0
  736. data/spec/external/wavsep/active/rfi_spec.rb +1 -1
  737. data/spec/external/wavsep/active/sqli_spec.rb +8 -6
  738. data/spec/external/wavsep/active/unvalidated_redirect_spec.rb +57 -0
  739. data/spec/external/wavsep/active/xss_dom_spec.rb +27 -0
  740. data/spec/external/wavsep/active/xss_spec.rb +13 -3
  741. data/spec/external/wavsep/false_positives/lfi_spec.rb +4 -16
  742. data/spec/external/wavsep/false_positives/obsolete_files_spec.rb +21 -0
  743. data/spec/external/wavsep/false_positives/rfi_spec.rb +2 -2
  744. data/spec/external/wavsep/false_positives/sqli_spec.rb +4 -15
  745. data/spec/external/wavsep/false_positives/unvalidated_redirect_spec.rb +21 -0
  746. data/spec/external/wavsep/false_positives/xss_spec.rb +2 -2
  747. data/spec/spec_helper.rb +17 -18
  748. data/spec/support/factories/browser/javascript/taint_tracer/frame.rb +10 -0
  749. data/spec/support/factories/browser/javascript/taint_tracer/frame/called_function.rb +11 -0
  750. data/spec/support/factories/browser/javascript/taint_tracer/sink/data_flow.rb +14 -0
  751. data/spec/support/factories/browser/javascript/taint_tracer/sink/execution_flow.rb +10 -0
  752. data/spec/support/factories/browser_cluster/job.rb +27 -0
  753. data/spec/support/factories/element/cookie.rb +7 -0
  754. data/spec/support/factories/element/form.rb +12 -0
  755. data/spec/support/factories/element/header.rb +5 -0
  756. data/spec/support/factories/element/link.rb +11 -0
  757. data/spec/support/factories/element/link_template.rb +11 -0
  758. data/spec/support/factories/http/request.rb +9 -0
  759. data/spec/support/factories/http/response.rb +42 -0
  760. data/spec/support/factories/issue.rb +67 -0
  761. data/spec/support/factories/page.rb +7 -0
  762. data/spec/support/factories/page/dom.rb +13 -0
  763. data/spec/support/factories/page/dom/transition.rb +21 -0
  764. data/spec/support/factories/scan_report.rb +35 -0
  765. data/spec/support/factories/vector.rb +32 -0
  766. data/spec/support/fixtures/check_with_invalid_platforms/with_invalid_platforms.rb +37 -0
  767. data/spec/support/fixtures/checks/test.rb +58 -0
  768. data/spec/support/fixtures/checks/test2.rb +41 -0
  769. data/spec/support/fixtures/checks/test3.rb +41 -0
  770. data/spec/support/fixtures/executables/node.rb +47 -0
  771. data/spec/support/fixtures/fingerprinters/test.rb +5 -13
  772. data/spec/support/fixtures/option_groups/input.yml +2 -0
  773. data/spec/support/fixtures/plugins/bad.rb +5 -13
  774. data/spec/support/fixtures/plugins/defaults/default.rb +6 -14
  775. data/spec/support/fixtures/plugins/distributable.rb +7 -15
  776. data/spec/support/fixtures/plugins/loop.rb +5 -13
  777. data/spec/support/fixtures/plugins/suspendable.rb +44 -0
  778. data/spec/support/fixtures/plugins/wait.rb +6 -14
  779. data/spec/support/fixtures/plugins/with_options.rb +20 -16
  780. data/spec/support/fixtures/plugins_with_priorities/p0.rb +17 -0
  781. data/spec/support/fixtures/plugins_with_priorities/p00.rb +17 -0
  782. data/spec/support/fixtures/plugins_with_priorities/p1.rb +17 -0
  783. data/spec/support/fixtures/plugins_with_priorities/p2.rb +17 -0
  784. data/spec/support/fixtures/plugins_with_priorities/p22.rb +17 -0
  785. data/spec/support/fixtures/plugins_with_priorities/p222.rb +17 -0
  786. data/spec/support/fixtures/plugins_with_priorities/p_nil.rb +16 -0
  787. data/spec/support/fixtures/plugins_with_priorities/p_nil2.rb +16 -0
  788. data/spec/support/fixtures/report.afr +0 -0
  789. data/spec/support/fixtures/reporters/base_spec/plugin_formatters/with_formatters/foobar.rb +13 -0
  790. data/spec/support/fixtures/reporters/base_spec/with_formatters.rb +15 -0
  791. data/spec/support/fixtures/reporters/base_spec/with_outfile.rb +16 -0
  792. data/spec/support/fixtures/reporters/base_spec/without_outfile.rb +12 -0
  793. data/spec/support/fixtures/reporters/manager_spec/afr.rb +13 -0
  794. data/spec/support/fixtures/reporters/manager_spec/foo.rb +18 -0
  795. data/spec/support/fixtures/rescan.afr.tpl +4 -5
  796. data/spec/support/fixtures/run_check/body.rb +48 -0
  797. data/spec/support/fixtures/run_check/cookies.rb +48 -0
  798. data/spec/support/fixtures/run_check/empty.rb +34 -0
  799. data/spec/support/fixtures/run_check/flch.rb +53 -0
  800. data/spec/support/fixtures/run_check/forms.rb +48 -0
  801. data/spec/support/fixtures/run_check/headers.rb +48 -0
  802. data/spec/support/fixtures/run_check/links.rb +48 -0
  803. data/spec/support/fixtures/run_check/nil.rb +47 -0
  804. data/spec/support/fixtures/run_check/path.rb +48 -0
  805. data/spec/support/fixtures/run_check/server.rb +48 -0
  806. data/spec/support/fixtures/services/echo.rb +64 -0
  807. data/spec/support/fixtures/taint_check/taint.rb +38 -0
  808. data/spec/support/fixtures/wait_check/wait.rb +38 -0
  809. data/spec/support/helpers/auditor.rb +18 -5
  810. data/spec/support/helpers/browser.rb +6 -0
  811. data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +32 -0
  812. data/spec/support/helpers/framework.rb +5 -13
  813. data/spec/support/helpers/misc.rb +4 -12
  814. data/spec/support/helpers/pages.rb +18 -0
  815. data/spec/support/helpers/paths.rb +4 -12
  816. data/spec/support/helpers/requires.rb +5 -13
  817. data/spec/support/helpers/resets.rb +12 -19
  818. data/spec/support/helpers/web_server.rb +11 -15
  819. data/spec/support/lib/factory.rb +115 -0
  820. data/spec/support/lib/web_server_client.rb +49 -0
  821. data/spec/support/lib/web_server_dispatcher.rb +33 -0
  822. data/spec/support/lib/web_server_manager.rb +29 -32
  823. data/spec/support/pems/cacert.pem +35 -37
  824. data/spec/support/pems/client/cert.pem +35 -37
  825. data/spec/support/pems/client/key.pem +49 -49
  826. data/spec/support/pems/server/cert.pem +35 -37
  827. data/spec/support/pems/server/key.pem +49 -49
  828. data/spec/support/servers/arachni/browser.rb +836 -0
  829. data/spec/support/servers/arachni/browser/javascript.rb +7 -0
  830. data/spec/support/servers/arachni/browser/javascript/angular-1.2.8.js +20554 -0
  831. data/spec/support/servers/arachni/browser/javascript/angular-route.js +911 -0
  832. data/spec/support/servers/arachni/browser/javascript/dom_monitor.rb +90 -0
  833. data/spec/support/servers/arachni/browser/javascript/jquery-2.0.3.js +8829 -0
  834. data/spec/support/servers/arachni/browser/javascript/proxy.rb +17 -0
  835. data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +714 -0
  836. data/spec/support/servers/arachni/browser_cluster/jobs/event_trigger.rb +25 -0
  837. data/spec/support/servers/arachni/browser_https.rb +60 -0
  838. data/spec/support/servers/arachni/check/auditor.rb +247 -0
  839. data/spec/support/servers/arachni/element/body.rb +5 -0
  840. data/spec/support/servers/arachni/element/capabilities/analyzable/differential.rb +162 -0
  841. data/spec/support/servers/arachni/element/capabilities/{auditable → analyzable}/taint.rb +0 -0
  842. data/spec/support/servers/arachni/element/capabilities/analyzable/timeout.rb +37 -0
  843. data/spec/support/servers/arachni/element/cookie.rb +1 -1
  844. data/spec/support/servers/arachni/element/cookie/cookie_dom.rb +21 -0
  845. data/spec/support/servers/arachni/element/form.rb +6 -22
  846. data/spec/support/servers/arachni/element/form/form_dom.rb +50 -0
  847. data/spec/support/servers/arachni/element/header.rb +7 -8
  848. data/spec/support/servers/arachni/element/link.rb +15 -7
  849. data/spec/support/servers/arachni/element/link/link_dom.rb +49 -0
  850. data/spec/support/servers/arachni/element/link_template.rb +11 -0
  851. data/spec/support/servers/arachni/element/link_template/link_template_dom.rb +43 -0
  852. data/spec/support/servers/arachni/framework.rb +18 -0
  853. data/spec/support/servers/arachni/http/client.rb +176 -0
  854. data/spec/support/servers/arachni/http/proxy_server.rb +9 -0
  855. data/spec/support/servers/arachni/http/proxy_server_https.rb +25 -0
  856. data/spec/support/servers/arachni/page/page_dom.rb +83 -0
  857. data/spec/support/servers/arachni/parser.rb +4 -0
  858. data/spec/support/servers/arachni/rpc/server/{framework_hpg.rb → framework_multi.rb} +0 -0
  859. data/spec/support/servers/arachni/session.rb +43 -9
  860. data/spec/support/servers/arachni/trainer.rb +11 -7
  861. data/spec/support/servers/checks/active/code_injection.rb +163 -0
  862. data/spec/support/servers/checks/active/code_injection_timing.rb +134 -0
  863. data/spec/support/servers/{modules/audit → checks/active}/csrf.rb +0 -0
  864. data/spec/support/servers/checks/active/file_inclusion.rb +228 -0
  865. data/spec/support/servers/checks/active/ldap_injection.rb +88 -0
  866. data/spec/support/servers/checks/active/no_sql_injection.rb +134 -0
  867. data/spec/support/servers/checks/active/no_sql_injection/mongodb +1 -0
  868. data/spec/support/servers/checks/active/no_sql_injection_differential.rb +61 -0
  869. data/spec/support/servers/checks/active/os_cmd_injection.rb +172 -0
  870. data/spec/support/servers/checks/active/os_cmd_injection_timing.rb +118 -0
  871. data/spec/support/servers/checks/active/path_traversal.rb +219 -0
  872. data/spec/support/servers/checks/active/response_splitting.rb +138 -0
  873. data/spec/support/servers/{modules/audit → checks/active}/rfi.rb +0 -0
  874. data/spec/support/servers/checks/active/session_fixation.rb +111 -0
  875. data/spec/support/servers/checks/active/source_code_disclosure.rb +118 -0
  876. data/spec/support/servers/checks/active/sql_injection.rb +133 -0
  877. data/spec/support/servers/{modules/audit/sqli → checks/active/sql_injection}/access +0 -0
  878. data/spec/support/servers/{modules/audit/sqli → checks/active/sql_injection}/coldfusion +0 -0
  879. data/spec/support/servers/{modules/audit/sqli → checks/active/sql_injection}/db2 +0 -0
  880. data/spec/support/servers/{modules/audit/sqli → checks/active/sql_injection}/emc +0 -0
  881. data/spec/support/servers/{modules/audit/sqli → checks/active/sql_injection}/firebird +0 -0
  882. data/spec/support/servers/{modules/audit/sqli → checks/active/sql_injection}/frontbase +0 -0
  883. data/spec/support/servers/{modules/audit/sqli → checks/active/sql_injection}/hsqldb +0 -0
  884. data/spec/support/servers/{modules/audit/sqli → checks/active/sql_injection}/informix +0 -0
  885. data/spec/support/servers/{modules/audit/sqli → checks/active/sql_injection}/ingres +0 -0
  886. data/spec/support/servers/{modules/audit/sqli → checks/active/sql_injection}/interbase +0 -0
  887. data/spec/support/servers/checks/active/sql_injection/jdbc +0 -0
  888. data/spec/support/servers/{modules/audit/sqli → checks/active/sql_injection}/maxdb +0 -0
  889. data/spec/support/servers/{modules/audit/sqli → checks/active/sql_injection}/mssql +0 -0
  890. data/spec/support/servers/{modules/audit/sqli → checks/active/sql_injection}/mysql +0 -0
  891. data/spec/support/servers/{modules/audit/sqli → checks/active/sql_injection}/oracle +0 -0
  892. data/spec/support/servers/{modules/audit/sqli/postgresql → checks/active/sql_injection/pgsql} +0 -0
  893. data/spec/support/servers/{modules/audit/sqli → checks/active/sql_injection}/sqlite +0 -0
  894. data/spec/support/servers/{modules/audit/sqli → checks/active/sql_injection}/sybase +0 -0
  895. data/spec/support/servers/{modules/audit/sqli_blind_rdiff.rb → checks/active/sql_injection_differential.rb} +0 -0
  896. data/spec/support/servers/checks/active/sql_injection_timing.rb +145 -0
  897. data/spec/support/servers/{modules/audit/trainer_module.rb → checks/active/trainer_check.rb} +0 -0
  898. data/spec/support/servers/checks/active/unvalidated_redirect.rb +141 -0
  899. data/spec/support/servers/checks/active/xpath_injection.rb +121 -0
  900. data/spec/support/servers/{modules/audit/xpath → checks/active/xpath_injection}/dotnet +0 -0
  901. data/spec/support/servers/{modules/audit/xpath → checks/active/xpath_injection}/general +0 -0
  902. data/spec/support/servers/{modules/audit/xpath → checks/active/xpath_injection}/java +0 -0
  903. data/spec/support/servers/{modules/audit/xpath → checks/active/xpath_injection}/libxml2 +0 -0
  904. data/spec/support/servers/{modules/audit/xpath → checks/active/xpath_injection}/php +0 -0
  905. data/spec/support/servers/checks/active/xss.rb +239 -0
  906. data/spec/support/servers/checks/active/xss_dom.rb +133 -0
  907. data/spec/support/servers/checks/active/xss_dom_inputs.rb +35 -0
  908. data/spec/support/servers/checks/active/xss_dom_script_context.rb +139 -0
  909. data/spec/support/servers/checks/active/xss_event.rb +80 -0
  910. data/spec/support/servers/{modules/audit → checks/active}/xss_path.rb +0 -0
  911. data/spec/support/servers/checks/active/xss_script_context.rb +90 -0
  912. data/spec/support/servers/{modules/audit → checks/active}/xss_tag.rb +0 -0
  913. data/spec/support/servers/checks/check_server.rb +14 -0
  914. data/spec/support/servers/{modules/recon → checks/passive}/allowed_methods.rb +0 -0
  915. data/spec/support/servers/checks/passive/backdoors.rb +4 -0
  916. data/spec/support/servers/checks/passive/backup_directories.rb +15 -0
  917. data/spec/support/servers/checks/passive/backup_files.rb +15 -0
  918. data/spec/support/servers/checks/passive/common_directories.rb +6 -0
  919. data/spec/support/servers/checks/passive/common_files.rb +6 -0
  920. data/spec/support/servers/checks/passive/directory_listing.rb +30 -0
  921. data/spec/support/servers/{modules/recon → checks/passive}/grep/captcha.rb +0 -0
  922. data/spec/support/servers/checks/passive/grep/cookie_set_for_parent_domain.rb +21 -0
  923. data/spec/support/servers/{modules/recon → checks/passive}/grep/credit_card.rb +0 -0
  924. data/spec/support/servers/{modules/recon → checks/passive}/grep/cvs_svn_users.rb +0 -0
  925. data/spec/support/servers/checks/passive/grep/emails.rb +23 -0
  926. data/spec/support/servers/{modules/recon → checks/passive}/grep/form_upload.rb +0 -0
  927. data/spec/support/servers/checks/passive/grep/hsts_https.rb +37 -0
  928. data/spec/support/servers/{modules/recon → checks/passive}/grep/html_objects.rb +0 -0
  929. data/spec/support/servers/{modules/recon → checks/passive}/grep/http_only_cookies.rb +0 -0
  930. data/spec/support/servers/checks/passive/grep/insecure_cookies_https.rb +40 -0
  931. data/spec/support/servers/checks/passive/grep/mixed_resource_https.rb +69 -0
  932. data/spec/support/servers/checks/passive/grep/password_autocomplete.rb +33 -0
  933. data/spec/support/servers/{modules/recon → checks/passive}/grep/private_ip.rb +0 -0
  934. data/spec/support/servers/{modules/recon → checks/passive}/grep/ssn.rb +0 -0
  935. data/spec/support/servers/checks/passive/grep/unencrypted_password_forms.rb +33 -0
  936. data/spec/support/servers/{modules/recon → checks/passive}/htaccess_limit.rb +0 -0
  937. data/spec/support/servers/checks/passive/http_put.rb +7 -0
  938. data/spec/support/servers/checks/passive/interesting_responses.rb +5 -0
  939. data/spec/support/servers/{modules/recon → checks/passive}/localstart_asp.rb +0 -0
  940. data/spec/support/servers/checks/passive/origin_spoof_access_restriction_bypass.rb +30 -0
  941. data/spec/support/servers/checks/passive/webdav.rb +25 -0
  942. data/spec/support/servers/{modules/recon → checks/passive}/xst.rb +0 -0
  943. data/spec/support/servers/plugins/meta/remedies/discovery.rb +2 -2
  944. data/spec/support/servers/plugins/meta/remedies/timing_attacks.rb +2 -0
  945. data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +36 -0
  946. data/spec/support/shared/check.rb +198 -0
  947. data/spec/support/shared/component.rb +15 -4
  948. data/spec/support/shared/component/options/base.rb +187 -0
  949. data/spec/support/shared/element/base.rb +131 -0
  950. data/spec/support/shared/element/capabilities/auditable.rb +371 -604
  951. data/spec/support/shared/element/capabilities/auditable/dom.rb +303 -0
  952. data/spec/support/shared/element/capabilities/inputtable.rb +499 -0
  953. data/spec/support/shared/element/capabilities/mutable.rb +362 -0
  954. data/spec/support/shared/element/capabilities/refreshable.rb +26 -26
  955. data/spec/support/shared/element/capabilities/submitable.rb +155 -0
  956. data/spec/support/shared/element/capabilities/with_auditor.rb +75 -0
  957. data/spec/support/shared/element/capabilities/with_dom.rb +39 -0
  958. data/spec/support/shared/element/capabilities/with_node.rb +42 -0
  959. data/spec/support/shared/element/capabilities/with_scope.rb +22 -0
  960. data/spec/support/shared/external/wavsep.rb +30 -9
  961. data/spec/support/shared/http/message.rb +72 -0
  962. data/spec/support/shared/option_group.rb +98 -0
  963. data/spec/support/shared/path_extractor.rb +1 -1
  964. data/spec/support/shared/plugin.rb +33 -16
  965. data/spec/support/shared/reporter.rb +41 -0
  966. data/spec/support/shared/support/cache.rb +341 -0
  967. data/spec/support/shared/support/lookup.rb +93 -13
  968. data/ui/cli/framework.rb +466 -0
  969. data/ui/cli/framework/option_parser.rb +628 -0
  970. data/ui/cli/option_parser.rb +104 -0
  971. data/ui/cli/output.rb +377 -0
  972. data/ui/cli/reporter.rb +52 -0
  973. data/ui/cli/reporter/option_parser.rb +102 -0
  974. data/ui/cli/restored_framework.rb +127 -0
  975. data/ui/cli/restored_framework/option_parser.rb +115 -0
  976. data/ui/cli/rpc/client/dispatcher_monitor.rb +157 -0
  977. data/ui/cli/rpc/client/dispatcher_monitor/option_parser.rb +41 -0
  978. data/ui/cli/rpc/client/instance.rb +294 -0
  979. data/ui/cli/rpc/client/local.rb +65 -0
  980. data/ui/cli/rpc/client/local/option_parser.rb +35 -0
  981. data/ui/cli/rpc/client/remote.rb +84 -0
  982. data/ui/cli/rpc/client/remote/option_parser.rb +99 -0
  983. data/ui/cli/rpc/server/dispatcher.rb +36 -0
  984. data/ui/cli/rpc/server/dispatcher/option_parser.rb +165 -0
  985. data/ui/cli/utilities.rb +228 -0
  986. metadata +1260 -1266
  987. data/EXPLOITATION.md +0 -431
  988. data/HACKING.md +0 -120
  989. data/NOTICE +0 -12
  990. data/data/crypto/public.pem +0 -9
  991. data/external/metasploit/LICENSE +0 -24
  992. data/external/metasploit/plugins/arachni.rb +0 -516
  993. data/external/metasploit/plugins/arachni/modules/auxiliary/arachni_sqlmap.rb +0 -91
  994. data/external/metasploit/plugins/arachni/modules/exploits/unix/webapp/arachni_exec.rb +0 -142
  995. data/external/metasploit/plugins/arachni/modules/exploits/unix/webapp/arachni_path_traversal.rb +0 -113
  996. data/external/metasploit/plugins/arachni/modules/exploits/unix/webapp/arachni_php_eval.rb +0 -150
  997. data/external/metasploit/plugins/arachni/modules/exploits/unix/webapp/arachni_php_include.rb +0 -141
  998. data/fingerprinters/frameworks/rack.rb +0 -41
  999. data/fingerprinters/languages/asp.rb +0 -42
  1000. data/fingerprinters/languages/aspx.rb +0 -63
  1001. data/fingerprinters/languages/jsp.rb +0 -42
  1002. data/fingerprinters/languages/php.rb +0 -43
  1003. data/fingerprinters/languages/python.rb +0 -40
  1004. data/fingerprinters/languages/ruby.rb +0 -41
  1005. data/fingerprinters/os/bsd.rb +0 -36
  1006. data/fingerprinters/os/linux.rb +0 -42
  1007. data/fingerprinters/os/solaris.rb +0 -41
  1008. data/fingerprinters/os/unix.rb +0 -36
  1009. data/fingerprinters/os/windows.rb +0 -41
  1010. data/fingerprinters/servers/apache.rb +0 -36
  1011. data/fingerprinters/servers/iis.rb +0 -36
  1012. data/fingerprinters/servers/jetty.rb +0 -36
  1013. data/fingerprinters/servers/nginx.rb +0 -36
  1014. data/fingerprinters/servers/tomcat.rb +0 -36
  1015. data/gfx/README.md +0 -18
  1016. data/gfx/compiled/banner.png +0 -0
  1017. data/gfx/compiled/favicon.ico +0 -0
  1018. data/gfx/compiled/icon.png +0 -0
  1019. data/gfx/compiled/logo.png +0 -0
  1020. data/gfx/compiled/spider.png +0 -0
  1021. data/gfx/font/Beneath_the_Surface.ttf +0 -0
  1022. data/gfx/font/bts_readme.txt +0 -14
  1023. data/gfx/source/banner.svg +0 -999
  1024. data/gfx/source/icon.svg +0 -627
  1025. data/gfx/source/logo.svg +0 -672
  1026. data/gfx/source/spider.png +0 -0
  1027. data/gfx/source/spider.svg +0 -277
  1028. data/lib/arachni/audit_store.rb +0 -321
  1029. data/lib/arachni/component/options/enum.rb +0 -51
  1030. data/lib/arachni/element/capabilities/auditable/rdiff.rb +0 -489
  1031. data/lib/arachni/element/capabilities/auditable/taint.rb +0 -238
  1032. data/lib/arachni/element/capabilities/auditable/timeout.rb +0 -469
  1033. data/lib/arachni/mixins/observable.rb +0 -91
  1034. data/lib/arachni/mixins/progress_bar.rb +0 -87
  1035. data/lib/arachni/mixins/terminal.rb +0 -112
  1036. data/lib/arachni/module.rb +0 -20
  1037. data/lib/arachni/module/auditor.rb +0 -618
  1038. data/lib/arachni/module/base.rb +0 -188
  1039. data/lib/arachni/module/manager.rb +0 -255
  1040. data/lib/arachni/module/output.rb +0 -68
  1041. data/lib/arachni/module/utilities.rb +0 -64
  1042. data/lib/arachni/report/base.rb +0 -201
  1043. data/lib/arachni/report/manager.rb +0 -86
  1044. data/lib/arachni/rpc/server/dispatcher/handler.rb +0 -166
  1045. data/lib/arachni/rpc/server/module/manager.rb +0 -46
  1046. data/lib/arachni/rpc/server/spider.rb +0 -404
  1047. data/lib/arachni/ruby/enumerable.rb +0 -29
  1048. data/lib/arachni/spider.rb +0 -477
  1049. data/lib/arachni/support/key_filler.rb +0 -68
  1050. data/lib/arachni/support/queue.rb +0 -18
  1051. data/lib/arachni/support/queue/disk.rb +0 -171
  1052. data/lib/arachni/typhoeus/hydra.rb +0 -56
  1053. data/lib/arachni/typhoeus/request.rb +0 -80
  1054. data/lib/arachni/typhoeus/response.rb +0 -103
  1055. data/lib/arachni/typhoeus/utils.rb +0 -25
  1056. data/lib/arachni/ui/cli/cli.rb +0 -469
  1057. data/lib/arachni/ui/cli/output.rb +0 -391
  1058. data/lib/arachni/ui/cli/rpc/dispatcher_monitor.rb +0 -188
  1059. data/lib/arachni/ui/cli/rpc/instance.rb +0 -407
  1060. data/lib/arachni/ui/cli/rpc/local.rb +0 -80
  1061. data/lib/arachni/ui/cli/rpc/remote.rb +0 -134
  1062. data/lib/arachni/ui/cli/utilities.rb +0 -509
  1063. data/modules/audit/code_injection.rb +0 -137
  1064. data/modules/audit/code_injection_php_input_wrapper.rb +0 -109
  1065. data/modules/audit/code_injection_timing.rb +0 -122
  1066. data/modules/audit/csrf.rb +0 -225
  1067. data/modules/audit/file_inclusion.rb +0 -156
  1068. data/modules/audit/ldapi.rb +0 -97
  1069. data/modules/audit/os_cmd_injection.rb +0 -109
  1070. data/modules/audit/os_cmd_injection_timing.rb +0 -98
  1071. data/modules/audit/path_traversal.rb +0 -170
  1072. data/modules/audit/response_splitting.rb +0 -99
  1073. data/modules/audit/rfi.rb +0 -181
  1074. data/modules/audit/session_fixation.rb +0 -117
  1075. data/modules/audit/source_code_disclosure.rb +0 -179
  1076. data/modules/audit/sqli.rb +0 -148
  1077. data/modules/audit/sqli_blind_rdiff.rb +0 -138
  1078. data/modules/audit/sqli_blind_timing.rb +0 -126
  1079. data/modules/audit/trainer.rb +0 -49
  1080. data/modules/audit/unvalidated_redirect.rb +0 -91
  1081. data/modules/audit/xpath.rb +0 -97
  1082. data/modules/audit/xss.rb +0 -154
  1083. data/modules/audit/xss_event.rb +0 -153
  1084. data/modules/audit/xss_path.rb +0 -152
  1085. data/modules/audit/xss_script_tag.rb +0 -137
  1086. data/modules/audit/xss_tag.rb +0 -137
  1087. data/modules/recon/allowed_methods.rb +0 -99
  1088. data/modules/recon/backdoors.rb +0 -82
  1089. data/modules/recon/backup_files.rb +0 -100
  1090. data/modules/recon/backup_files/extensions.txt +0 -28
  1091. data/modules/recon/common_directories.rb +0 -87
  1092. data/modules/recon/common_files.rb +0 -78
  1093. data/modules/recon/common_files/filenames.txt +0 -21
  1094. data/modules/recon/directory_listing.rb +0 -133
  1095. data/modules/recon/grep/captcha.rb +0 -74
  1096. data/modules/recon/grep/credit_card.rb +0 -128
  1097. data/modules/recon/grep/cvs_svn_users.rb +0 -81
  1098. data/modules/recon/grep/emails.rb +0 -73
  1099. data/modules/recon/grep/form_upload.rb +0 -86
  1100. data/modules/recon/grep/html_objects.rb +0 -56
  1101. data/modules/recon/grep/http_only_cookies.rb +0 -82
  1102. data/modules/recon/grep/insecure_cookies.rb +0 -82
  1103. data/modules/recon/grep/mixed_resource.rb +0 -113
  1104. data/modules/recon/grep/password_autocomplete.rb +0 -85
  1105. data/modules/recon/grep/private_ip.rb +0 -70
  1106. data/modules/recon/grep/ssn.rb +0 -66
  1107. data/modules/recon/grep/unencrypted_password_forms.rb +0 -103
  1108. data/modules/recon/htaccess_limit.rb +0 -76
  1109. data/modules/recon/http_put.rb +0 -95
  1110. data/modules/recon/interesting_responses.rb +0 -91
  1111. data/modules/recon/localstart_asp.rb +0 -97
  1112. data/modules/recon/webdav.rb +0 -106
  1113. data/modules/recon/x_forwarded_for_access_restriction_bypass.rb +0 -76
  1114. data/modules/recon/xst.rb +0 -103
  1115. data/path_extractors/anchors.rb +0 -37
  1116. data/path_extractors/areas.rb +0 -37
  1117. data/path_extractors/forms.rb +0 -37
  1118. data/path_extractors/frames.rb +0 -37
  1119. data/path_extractors/generic.rb +0 -84
  1120. data/path_extractors/links.rb +0 -37
  1121. data/path_extractors/meta_refresh.rb +0 -58
  1122. data/path_extractors/scripts.rb +0 -38
  1123. data/plugins/autologin.rb +0 -133
  1124. data/plugins/beep_notify.rb +0 -49
  1125. data/plugins/content_types.rb +0 -107
  1126. data/plugins/cookie_collector.rb +0 -85
  1127. data/plugins/defaults/autothrottle.rb +0 -78
  1128. data/plugins/defaults/healthmap.rb +0 -89
  1129. data/plugins/defaults/meta/remedies/discovery.rb +0 -138
  1130. data/plugins/defaults/meta/remedies/timing_attacks.rb +0 -117
  1131. data/plugins/defaults/meta/uniformity.rb +0 -82
  1132. data/plugins/defaults/resolver.rb +0 -60
  1133. data/plugins/email_notify.rb +0 -106
  1134. data/plugins/form_dicattack.rb +0 -123
  1135. data/plugins/http_dicattack.rb +0 -108
  1136. data/plugins/libnotify.rb +0 -82
  1137. data/plugins/profiler.rb +0 -179
  1138. data/plugins/proxy.rb +0 -502
  1139. data/plugins/proxy/panel/page_accordion.html.erb +0 -67
  1140. data/plugins/proxy/panel/panel.html.erb +0 -69
  1141. data/plugins/proxy/panel/verify_login_sequence.html.erb +0 -45
  1142. data/plugins/proxy/server.rb +0 -215
  1143. data/plugins/proxy/template_scope.rb +0 -138
  1144. data/plugins/rescan.rb +0 -59
  1145. data/plugins/script.rb +0 -53
  1146. data/plugins/uncommon_headers.rb +0 -92
  1147. data/plugins/vector_feed.rb +0 -226
  1148. data/plugins/waf_detector.rb +0 -167
  1149. data/profiles/full.afp +0 -48
  1150. data/reports/afr.rb +0 -44
  1151. data/reports/ap.rb +0 -46
  1152. data/reports/html.rb +0 -273
  1153. data/reports/html/default.erb +0 -82
  1154. data/reports/html/default/configuration.erb +0 -126
  1155. data/reports/html/default/css/jquery-ui.css +0 -570
  1156. data/reports/html/default/css/jquery.jqplot.min.css +0 -1
  1157. data/reports/html/default/css/main.css +0 -391
  1158. data/reports/html/default/headers.erb +0 -19
  1159. data/reports/html/default/issue.erb +0 -178
  1160. data/reports/html/default/issues.erb +0 -52
  1161. data/reports/html/default/js/charts.js +0 -147
  1162. data/reports/html/default/js/helpers.js +0 -53
  1163. data/reports/html/default/js/init.js +0 -72
  1164. data/reports/html/default/js/lib/jqplot.barRenderer.min.js +0 -57
  1165. data/reports/html/default/js/lib/jqplot.categoryAxisRenderer.min.js +0 -57
  1166. data/reports/html/default/js/lib/jqplot.cursor.min.js +0 -57
  1167. data/reports/html/default/js/lib/jqplot.pieRenderer.min.js +0 -57
  1168. data/reports/html/default/js/lib/jqplot.pointLabels.min.js +0 -57
  1169. data/reports/html/default/js/lib/jquery-ui.min.js +0 -404
  1170. data/reports/html/default/js/lib/jquery.jqplot.min.js +0 -57
  1171. data/reports/html/default/js/lib/jquery.min.js +0 -167
  1172. data/reports/html/default/plugins.erb +0 -22
  1173. data/reports/html/default/search.erb +0 -8
  1174. data/reports/html/default/sitemap.erb +0 -15
  1175. data/reports/html/default/summary.erb +0 -75
  1176. data/reports/html/default/summary_issue.erb +0 -20
  1177. data/reports/json.rb +0 -52
  1178. data/reports/marshal.rb +0 -46
  1179. data/reports/metareport.rb +0 -104
  1180. data/reports/plugin_formatters/html/autologin.rb +0 -45
  1181. data/reports/plugin_formatters/html/content_types.rb +0 -67
  1182. data/reports/plugin_formatters/html/cookie_collector.rb +0 -52
  1183. data/reports/plugin_formatters/html/discovery.rb +0 -45
  1184. data/reports/plugin_formatters/html/form_dicattack.rb +0 -40
  1185. data/reports/plugin_formatters/html/healthmap.rb +0 -60
  1186. data/reports/plugin_formatters/html/http_dicattack.rb +0 -40
  1187. data/reports/plugin_formatters/html/profiler.rb +0 -36
  1188. data/reports/plugin_formatters/html/profiler/template.erb +0 -84
  1189. data/reports/plugin_formatters/html/resolver.rb +0 -55
  1190. data/reports/plugin_formatters/html/timing_attacks.rb +0 -51
  1191. data/reports/plugin_formatters/html/uncommon_headers.rb +0 -47
  1192. data/reports/plugin_formatters/html/uniformity.rb +0 -54
  1193. data/reports/plugin_formatters/html/waf_detector.rb +0 -38
  1194. data/reports/plugin_formatters/stdout/autologin.rb +0 -38
  1195. data/reports/plugin_formatters/stdout/content_types.rb +0 -51
  1196. data/reports/plugin_formatters/stdout/cookie_collector.rb +0 -43
  1197. data/reports/plugin_formatters/stdout/discovery.rb +0 -37
  1198. data/reports/plugin_formatters/stdout/form_dicattack.rb +0 -34
  1199. data/reports/plugin_formatters/stdout/healthmap.rb +0 -49
  1200. data/reports/plugin_formatters/stdout/http_dicattack.rb +0 -34
  1201. data/reports/plugin_formatters/stdout/profiler.rb +0 -66
  1202. data/reports/plugin_formatters/stdout/resolver.rb +0 -29
  1203. data/reports/plugin_formatters/stdout/timing_attacks.rb +0 -37
  1204. data/reports/plugin_formatters/stdout/uncommon_headers.rb +0 -37
  1205. data/reports/plugin_formatters/stdout/uniformity.rb +0 -48
  1206. data/reports/plugin_formatters/stdout/waf_detector.rb +0 -31
  1207. data/reports/plugin_formatters/xml/autologin.rb +0 -41
  1208. data/reports/plugin_formatters/xml/content_types.rb +0 -61
  1209. data/reports/plugin_formatters/xml/cookie_collector.rb +0 -45
  1210. data/reports/plugin_formatters/xml/discovery.rb +0 -38
  1211. data/reports/plugin_formatters/xml/form_dicattack.rb +0 -34
  1212. data/reports/plugin_formatters/xml/healthmap.rb +0 -58
  1213. data/reports/plugin_formatters/xml/http_dicattack.rb +0 -33
  1214. data/reports/plugin_formatters/xml/profiler.rb +0 -80
  1215. data/reports/plugin_formatters/xml/resolver.rb +0 -33
  1216. data/reports/plugin_formatters/xml/timing_attacks.rb +0 -39
  1217. data/reports/plugin_formatters/xml/uncommon_headers.rb +0 -38
  1218. data/reports/plugin_formatters/xml/uniformity.rb +0 -54
  1219. data/reports/plugin_formatters/xml/waf_detector.rb +0 -34
  1220. data/reports/stdout.rb +0 -203
  1221. data/reports/txt.rb +0 -58
  1222. data/reports/xml.rb +0 -176
  1223. data/reports/xml/buffer.rb +0 -97
  1224. data/reports/yaml.rb +0 -46
  1225. data/spec/arachni/audit_store_spec.rb +0 -239
  1226. data/spec/arachni/component/options/enum_spec.rb +0 -51
  1227. data/spec/arachni/element/base_spec.rb +0 -138
  1228. data/spec/arachni/element/capabilities/auditable/rdiff_spec.rb +0 -134
  1229. data/spec/arachni/element/capabilities/auditable/taint_spec.rb +0 -409
  1230. data/spec/arachni/element/capabilities/auditable/timeout_spec.rb +0 -157
  1231. data/spec/arachni/element/capabilities/mutable_spec.rb +0 -284
  1232. data/spec/arachni/http_spec.rb +0 -962
  1233. data/spec/arachni/mixins/observable_spec.rb +0 -75
  1234. data/spec/arachni/mixins/progress_bar_spec.rb +0 -47
  1235. data/spec/arachni/module/auditor_spec.rb +0 -544
  1236. data/spec/arachni/module/manager_spec.rb +0 -150
  1237. data/spec/arachni/module/utilities_spec.rb +0 -30
  1238. data/spec/arachni/report/base_spec.rb +0 -61
  1239. data/spec/arachni/report/manager_spec.rb +0 -82
  1240. data/spec/arachni/rpc/server/dispatcher/handler_spec.rb +0 -102
  1241. data/spec/arachni/rpc/server/framework_hpg_spec.rb +0 -376
  1242. data/spec/arachni/rpc/server/framework_simple_spec.rb +0 -501
  1243. data/spec/arachni/rpc/server/modules/manager_spec.rb +0 -47
  1244. data/spec/arachni/rpc/server/spider_spec.rb +0 -68
  1245. data/spec/arachni/ruby/enumerable_spec.rb +0 -37
  1246. data/spec/arachni/spider_spec.rb +0 -539
  1247. data/spec/arachni/support/cache/base_spec.rb +0 -282
  1248. data/spec/arachni/support/key_filler.rb +0 -60
  1249. data/spec/arachni/support/queue/disk_spec.rb +0 -116
  1250. data/spec/arachni/typhoeus/requrest_spec.rb +0 -58
  1251. data/spec/arachni/typhoeus/response_spec.rb +0 -171
  1252. data/spec/fingerprinters/frameworks/rack_spec.rb +0 -41
  1253. data/spec/fingerprinters/languages/asp_spec.rb +0 -40
  1254. data/spec/fingerprinters/languages/aspx_spec.rb +0 -78
  1255. data/spec/fingerprinters/languages/jsp_spec.rb +0 -58
  1256. data/spec/fingerprinters/languages/php_spec.rb +0 -61
  1257. data/spec/fingerprinters/languages/python_spec.rb +0 -23
  1258. data/spec/fingerprinters/languages/ruby.rb +0 -34
  1259. data/spec/fingerprinters/os/bsd_spec.rb +0 -26
  1260. data/spec/fingerprinters/os/linux_spec.rb +0 -34
  1261. data/spec/fingerprinters/os/solaris_spec.rb +0 -34
  1262. data/spec/fingerprinters/os/unix_spec.rb +0 -26
  1263. data/spec/fingerprinters/os/windows_spec.rb +0 -34
  1264. data/spec/fingerprinters/servers/apache_spec.rb +0 -26
  1265. data/spec/fingerprinters/servers/iis_spec.rb +0 -28
  1266. data/spec/fingerprinters/servers/jetty_spec.rb +0 -28
  1267. data/spec/fingerprinters/servers/nginx_spec.rb +0 -26
  1268. data/spec/fingerprinters/servers/tomcat_spec.rb +0 -28
  1269. data/spec/modules/audit/code_injection_spec.rb +0 -25
  1270. data/spec/modules/audit/code_injection_timing_spec.rb +0 -24
  1271. data/spec/modules/audit/csrf_spec.rb +0 -45
  1272. data/spec/modules/audit/file_inclusion_spec.rb +0 -25
  1273. data/spec/modules/audit/ldapi_spec.rb +0 -19
  1274. data/spec/modules/audit/os_cmd_injection_spec.rb +0 -24
  1275. data/spec/modules/audit/os_cmd_injection_timing_spec.rb +0 -24
  1276. data/spec/modules/audit/path_traversal_spec.rb +0 -23
  1277. data/spec/modules/audit/response_splitting_spec.rb +0 -19
  1278. data/spec/modules/audit/rfi_spec.rb +0 -19
  1279. data/spec/modules/audit/session_fixation_spec.rb +0 -23
  1280. data/spec/modules/audit/source_code_disclosure_spec.rb +0 -24
  1281. data/spec/modules/audit/sqli_blind_rdiff_spec.rb +0 -19
  1282. data/spec/modules/audit/sqli_blind_timing_spec.rb +0 -23
  1283. data/spec/modules/audit/sqli_spec.rb +0 -25
  1284. data/spec/modules/audit/trainer_spec.rb +0 -35
  1285. data/spec/modules/audit/unvalidated_redirect_spec.rb +0 -24
  1286. data/spec/modules/audit/xpath_spec.rb +0 -25
  1287. data/spec/modules/audit/xss_event_spec.rb +0 -19
  1288. data/spec/modules/audit/xss_path_spec.rb +0 -19
  1289. data/spec/modules/audit/xss_script_tag_spec.rb +0 -27
  1290. data/spec/modules/audit/xss_spec.rb +0 -24
  1291. data/spec/modules/audit/xss_tag_spec.rb +0 -19
  1292. data/spec/modules/recon/allowed_methods_spec.rb +0 -19
  1293. data/spec/modules/recon/backdoors_spec.rb +0 -19
  1294. data/spec/modules/recon/backup_files_spec.rb +0 -19
  1295. data/spec/modules/recon/common_directories_spec.rb +0 -19
  1296. data/spec/modules/recon/common_files_spec.rb +0 -19
  1297. data/spec/modules/recon/directory_listing_spec.rb +0 -19
  1298. data/spec/modules/recon/grep/captcha_spec.rb +0 -19
  1299. data/spec/modules/recon/grep/credit_card_spec.rb +0 -19
  1300. data/spec/modules/recon/grep/cvs_svn_users_spec.rb +0 -19
  1301. data/spec/modules/recon/grep/emails_spec.rb +0 -19
  1302. data/spec/modules/recon/grep/form_upload_spec.rb +0 -19
  1303. data/spec/modules/recon/grep/html_objects_spec.rb +0 -19
  1304. data/spec/modules/recon/grep/http_only_cookies_spec.rb +0 -19
  1305. data/spec/modules/recon/grep/insecure_cookies_spec.rb +0 -19
  1306. data/spec/modules/recon/grep/mixed_resource_spec.rb +0 -20
  1307. data/spec/modules/recon/grep/password_autocomplete_spec.rb +0 -19
  1308. data/spec/modules/recon/grep/private_ip_spec.rb +0 -26
  1309. data/spec/modules/recon/grep/ssn_spec.rb +0 -19
  1310. data/spec/modules/recon/grep/unencrypted_password_forms_spec.rb +0 -19
  1311. data/spec/modules/recon/htaccess_limit_spec.rb +0 -19
  1312. data/spec/modules/recon/http_put_spec.rb +0 -19
  1313. data/spec/modules/recon/interesting_responses_spec.rb +0 -30
  1314. data/spec/modules/recon/localstart_asp_spec.rb +0 -19
  1315. data/spec/modules/recon/webdav_spec.rb +0 -19
  1316. data/spec/modules/recon/x_forwarded_for_access_restriction_bypass_spec.rb +0 -19
  1317. data/spec/modules/recon/xst_spec.rb +0 -19
  1318. data/spec/path_extractors/scripts_spec.rb +0 -19
  1319. data/spec/plugins/autologin_spec.rb +0 -94
  1320. data/spec/plugins/autothrottle_spec.rb +0 -45
  1321. data/spec/plugins/content_types_spec.rb +0 -93
  1322. data/spec/plugins/cookie_collector_spec.rb +0 -49
  1323. data/spec/plugins/form_dicattack_spec.rb +0 -60
  1324. data/spec/plugins/healthmap_spec.rb +0 -40
  1325. data/spec/plugins/http_dicattack_spec.rb +0 -40
  1326. data/spec/plugins/meta/remedies/discovery_spec.rb +0 -21
  1327. data/spec/plugins/meta/remedies/timing_attacks_spec.rb +0 -34
  1328. data/spec/plugins/meta/uniformity_spec.rb +0 -83
  1329. data/spec/plugins/profiler_spec.rb +0 -82
  1330. data/spec/plugins/rescan_spec.rb +0 -26
  1331. data/spec/plugins/resolver_spec.rb +0 -16
  1332. data/spec/plugins/script_spec.rb +0 -12
  1333. data/spec/plugins/uncommon_headers_spec.rb +0 -64
  1334. data/spec/plugins/vector_feed_spec.rb +0 -167
  1335. data/spec/plugins/waf_detector_spec.rb +0 -41
  1336. data/spec/reports/afr_spec.rb +0 -13
  1337. data/spec/reports/ap_spec.rb +0 -9
  1338. data/spec/reports/html_spec.rb +0 -13
  1339. data/spec/reports/json_spec.rb +0 -17
  1340. data/spec/reports/marshal_spec.rb +0 -13
  1341. data/spec/reports/stdout_spec.rb +0 -9
  1342. data/spec/reports/txt_spec.rb +0 -8
  1343. data/spec/reports/xml_spec.rb +0 -13
  1344. data/spec/reports/yaml_spec.rb +0 -13
  1345. data/spec/support/fixtures/auditstore.afr +0 -76074
  1346. data/spec/support/fixtures/modules/test.rb +0 -58
  1347. data/spec/support/fixtures/modules/test2.rb +0 -46
  1348. data/spec/support/fixtures/modules/test3.rb +0 -46
  1349. data/spec/support/fixtures/plugins/spider_hook.rb +0 -50
  1350. data/spec/support/fixtures/reports/base_spec/plugin_formatters/with_formatters/foobar.rb +0 -21
  1351. data/spec/support/fixtures/reports/base_spec/with_formatters.rb +0 -23
  1352. data/spec/support/fixtures/reports/base_spec/with_outfile.rb +0 -24
  1353. data/spec/support/fixtures/reports/base_spec/without_outfile.rb +0 -20
  1354. data/spec/support/fixtures/reports/manager_spec/afr.rb +0 -21
  1355. data/spec/support/fixtures/reports/manager_spec/foo.rb +0 -26
  1356. data/spec/support/fixtures/rpcd_handlers/echo.rb +0 -68
  1357. data/spec/support/fixtures/run_mod/body.rb +0 -58
  1358. data/spec/support/fixtures/run_mod/cookies.rb +0 -58
  1359. data/spec/support/fixtures/run_mod/empty.rb +0 -58
  1360. data/spec/support/fixtures/run_mod/flch.rb +0 -63
  1361. data/spec/support/fixtures/run_mod/forms.rb +0 -58
  1362. data/spec/support/fixtures/run_mod/headers.rb +0 -58
  1363. data/spec/support/fixtures/run_mod/links.rb +0 -58
  1364. data/spec/support/fixtures/run_mod/nil.rb +0 -57
  1365. data/spec/support/fixtures/run_mod/path.rb +0 -58
  1366. data/spec/support/fixtures/run_mod/server.rb +0 -58
  1367. data/spec/support/fixtures/taint_module/taint.rb +0 -48
  1368. data/spec/support/fixtures/wait_module/wait.rb +0 -48
  1369. data/spec/support/logs/Dispatcher - 1332-56847.log +0 -9
  1370. data/spec/support/logs/Dispatcher - 1361-63434.log +0 -21
  1371. data/spec/support/logs/Dispatcher - 1545-55308.log +0 -9
  1372. data/spec/support/logs/Dispatcher - 1559-18938.log +0 -19
  1373. data/spec/support/logs/Dispatcher - 1568-25013.log +0 -17
  1374. data/spec/support/logs/Dispatcher - 1577-55689.log +0 -13
  1375. data/spec/support/logs/Dispatcher - 1586-18577.log +0 -9
  1376. data/spec/support/logs/Dispatcher - 1595-49353.log +0 -9
  1377. data/spec/support/logs/Dispatcher - 1604-27831.log +0 -11
  1378. data/spec/support/logs/Dispatcher - 1617-57444.log +0 -11
  1379. data/spec/support/logs/Dispatcher - 1631-28737.log +0 -11
  1380. data/spec/support/logs/Dispatcher - 1644-21815.log +0 -33
  1381. data/spec/support/logs/Dispatcher - 1738-53470.log +0 -21
  1382. data/spec/support/logs/Dispatcher - 1747-64173.log +0 -21
  1383. data/spec/support/logs/Dispatcher - 1756-11866.log +0 -23
  1384. data/spec/support/logs/Dispatcher - 1798-12175.log +0 -19
  1385. data/spec/support/logs/Dispatcher - 1807-22790.log +0 -17
  1386. data/spec/support/logs/Dispatcher - 1816-57823.log +0 -15
  1387. data/spec/support/logs/Dispatcher - 1831-64825.log +0 -11
  1388. data/spec/support/logs/Dispatcher - 1845-27623.log +0 -9
  1389. data/spec/support/logs/Dispatcher - 1854-26066.log +0 -9
  1390. data/spec/support/logs/Dispatcher - 1863-37486.log +0 -9
  1391. data/spec/support/logs/Dispatcher - 1874-22463.log +0 -9
  1392. data/spec/support/logs/Dispatcher - 1883-41263.log +0 -11
  1393. data/spec/support/logs/Dispatcher - 1900-53660.log +0 -9
  1394. data/spec/support/logs/Dispatcher - 1909-44423.log +0 -9
  1395. data/spec/support/logs/Dispatcher - 1921-58931.log +0 -9
  1396. data/spec/support/logs/Dispatcher - 1993-6448.log +0 -63
  1397. data/spec/support/logs/Dispatcher - 2002-19206.log +0 -43
  1398. data/spec/support/logs/Dispatcher - 2011-11852.log +0 -39
  1399. data/spec/support/logs/Dispatcher - 2020-65055.log +0 -34
  1400. data/spec/support/logs/Dispatcher - 2029-48445.log +0 -28
  1401. data/spec/support/logs/Dispatcher - 2038-55271.log +0 -21
  1402. data/spec/support/logs/Dispatcher - 2047-45722.log +0 -13
  1403. data/spec/support/logs/Dispatcher - 2057-48194.log +0 -9
  1404. data/spec/support/logs/Dispatcher - 2189-39843.log +0 -19
  1405. data/spec/support/logs/Dispatcher - 2199-15985.log +0 -21
  1406. data/spec/support/logs/Dispatcher - 2208-22080.log +0 -15
  1407. data/spec/support/logs/Dispatcher - 2221-37690.log +0 -19
  1408. data/spec/support/logs/Dispatcher - 2230-47867.log +0 -21
  1409. data/spec/support/logs/Dispatcher - 2239-27060.log +0 -15
  1410. data/spec/support/logs/Dispatcher - 2358-8967.log +0 -17
  1411. data/spec/support/logs/Dispatcher - 2367-27103.log +0 -21
  1412. data/spec/support/logs/Dispatcher - 2376-16287.log +0 -13
  1413. data/spec/support/logs/Dispatcher - 2389-9109.log +0 -19
  1414. data/spec/support/logs/Dispatcher - 2398-62926.log +0 -21
  1415. data/spec/support/logs/Dispatcher - 2407-48685.log +0 -15
  1416. data/spec/support/logs/Dispatcher - 2459-62480.log +0 -17
  1417. data/spec/support/logs/Dispatcher - 2470-57894.log +0 -21
  1418. data/spec/support/logs/Dispatcher - 2479-51883.log +0 -13
  1419. data/spec/support/logs/Dispatcher - 2493-36944.log +0 -17
  1420. data/spec/support/logs/Dispatcher - 2503-59143.log +0 -21
  1421. data/spec/support/logs/Dispatcher - 2513-33084.log +0 -13
  1422. data/spec/support/logs/Dispatcher - 25430-46306.log +0 -9
  1423. data/spec/support/logs/Dispatcher - 25457-10711.log +0 -23
  1424. data/spec/support/logs/Dispatcher - 25603-48892.log +0 -9
  1425. data/spec/support/logs/Dispatcher - 25613-24775.log +0 -19
  1426. data/spec/support/logs/Dispatcher - 25622-59684.log +0 -17
  1427. data/spec/support/logs/Dispatcher - 25631-23195.log +0 -13
  1428. data/spec/support/logs/Dispatcher - 25640-9810.log +0 -9
  1429. data/spec/support/logs/Dispatcher - 25649-52757.log +0 -9
  1430. data/spec/support/logs/Dispatcher - 25658-58550.log +0 -11
  1431. data/spec/support/logs/Dispatcher - 25671-30871.log +0 -11
  1432. data/spec/support/logs/Dispatcher - 25684-48620.log +0 -11
  1433. data/spec/support/logs/Dispatcher - 25697-18124.log +0 -37
  1434. data/spec/support/logs/Dispatcher - 25762-35321.log +0 -21
  1435. data/spec/support/logs/Dispatcher - 25771-64633.log +0 -21
  1436. data/spec/support/logs/Dispatcher - 25780-43558.log +0 -23
  1437. data/spec/support/logs/Dispatcher - 25821-43561.log +0 -19
  1438. data/spec/support/logs/Dispatcher - 25830-39112.log +0 -17
  1439. data/spec/support/logs/Dispatcher - 25839-44093.log +0 -15
  1440. data/spec/support/logs/Dispatcher - 25852-12057.log +0 -11
  1441. data/spec/support/logs/Dispatcher - 25866-49029.log +0 -9
  1442. data/spec/support/logs/Dispatcher - 25875-32179.log +0 -9
  1443. data/spec/support/logs/Dispatcher - 25884-62703.log +0 -9
  1444. data/spec/support/logs/Dispatcher - 25894-4228.log +0 -9
  1445. data/spec/support/logs/Dispatcher - 25903-6709.log +0 -11
  1446. data/spec/support/logs/Dispatcher - 25917-29651.log +0 -9
  1447. data/spec/support/logs/Dispatcher - 25926-12708.log +0 -9
  1448. data/spec/support/logs/Dispatcher - 25935-54092.log +0 -9
  1449. data/spec/support/logs/Dispatcher - 25990-26756.log +0 -63
  1450. data/spec/support/logs/Dispatcher - 25999-4016.log +0 -43
  1451. data/spec/support/logs/Dispatcher - 26008-52076.log +0 -39
  1452. data/spec/support/logs/Dispatcher - 26017-48497.log +0 -34
  1453. data/spec/support/logs/Dispatcher - 26026-28839.log +0 -28
  1454. data/spec/support/logs/Dispatcher - 26035-54215.log +0 -21
  1455. data/spec/support/logs/Dispatcher - 26044-27216.log +0 -13
  1456. data/spec/support/logs/Dispatcher - 26054-53464.log +0 -9
  1457. data/spec/support/logs/Dispatcher - 26163-65271.log +0 -19
  1458. data/spec/support/logs/Dispatcher - 26173-58105.log +0 -21
  1459. data/spec/support/logs/Dispatcher - 26182-40848.log +0 -15
  1460. data/spec/support/logs/Dispatcher - 26195-2855.log +0 -19
  1461. data/spec/support/logs/Dispatcher - 26204-35297.log +0 -21
  1462. data/spec/support/logs/Dispatcher - 26213-59588.log +0 -15
  1463. data/spec/support/logs/Dispatcher - 26333-40774.log +0 -17
  1464. data/spec/support/logs/Dispatcher - 26342-45541.log +0 -21
  1465. data/spec/support/logs/Dispatcher - 26351-3349.log +0 -13
  1466. data/spec/support/logs/Dispatcher - 26364-37456.log +0 -19
  1467. data/spec/support/logs/Dispatcher - 26373-37340.log +0 -21
  1468. data/spec/support/logs/Dispatcher - 26382-54864.log +0 -15
  1469. data/spec/support/logs/Dispatcher - 26434-3070.log +0 -17
  1470. data/spec/support/logs/Dispatcher - 26448-14295.log +0 -21
  1471. data/spec/support/logs/Dispatcher - 26474-30587.log +0 -13
  1472. data/spec/support/logs/Dispatcher - 26500-32529.log +0 -17
  1473. data/spec/support/logs/Dispatcher - 26509-16952.log +0 -21
  1474. data/spec/support/logs/Dispatcher - 26519-43332.log +0 -13
  1475. data/spec/support/logs/Dispatcher - 26750-61867.log +0 -19
  1476. data/spec/support/logs/Dispatcher - 26759-22532.log +0 -21
  1477. data/spec/support/logs/Dispatcher - 26768-18231.log +0 -15
  1478. data/spec/support/logs/Dispatcher - 26792-41661.log +0 -21
  1479. data/spec/support/logs/Dispatcher - 26801-14384.log +0 -25
  1480. data/spec/support/logs/Dispatcher - 26810-2591.log +0 -15
  1481. data/spec/support/logs/Dispatcher - 26846-14591.log +0 -17
  1482. data/spec/support/logs/Dispatcher - 26855-15708.log +0 -21
  1483. data/spec/support/logs/Dispatcher - 26864-2062.log +0 -13
  1484. data/spec/support/logs/Dispatcher - 26877-14471.log +0 -21
  1485. data/spec/support/logs/Dispatcher - 26886-49795.log +0 -25
  1486. data/spec/support/logs/Dispatcher - 26895-21093.log +0 -15
  1487. data/spec/support/logs/Dispatcher - 26931-30049.log +0 -17
  1488. data/spec/support/logs/Dispatcher - 26940-34273.log +0 -21
  1489. data/spec/support/logs/Dispatcher - 26949-30040.log +0 -13
  1490. data/spec/support/logs/Dispatcher - 26962-8152.log +0 -17
  1491. data/spec/support/logs/Dispatcher - 26971-53062.log +0 -21
  1492. data/spec/support/logs/Dispatcher - 26980-7548.log +0 -13
  1493. data/spec/support/logs/Dispatcher - 2737-20989.log +0 -19
  1494. data/spec/support/logs/Dispatcher - 2746-5423.log +0 -21
  1495. data/spec/support/logs/Dispatcher - 2755-53393.log +0 -15
  1496. data/spec/support/logs/Dispatcher - 27615-41812.log +0 -19
  1497. data/spec/support/logs/Dispatcher - 27624-43683.log +0 -21
  1498. data/spec/support/logs/Dispatcher - 27633-11593.log +0 -15
  1499. data/spec/support/logs/Dispatcher - 27658-12186.log +0 -21
  1500. data/spec/support/logs/Dispatcher - 27667-15575.log +0 -25
  1501. data/spec/support/logs/Dispatcher - 27676-17207.log +0 -15
  1502. data/spec/support/logs/Dispatcher - 27712-2233.log +0 -17
  1503. data/spec/support/logs/Dispatcher - 27721-3842.log +0 -21
  1504. data/spec/support/logs/Dispatcher - 27730-22695.log +0 -13
  1505. data/spec/support/logs/Dispatcher - 27743-8364.log +0 -21
  1506. data/spec/support/logs/Dispatcher - 27752-6140.log +0 -25
  1507. data/spec/support/logs/Dispatcher - 27761-25015.log +0 -15
  1508. data/spec/support/logs/Dispatcher - 27797-9270.log +0 -17
  1509. data/spec/support/logs/Dispatcher - 2780-58168.log +0 -21
  1510. data/spec/support/logs/Dispatcher - 27806-48623.log +0 -21
  1511. data/spec/support/logs/Dispatcher - 27815-58778.log +0 -13
  1512. data/spec/support/logs/Dispatcher - 27828-29742.log +0 -17
  1513. data/spec/support/logs/Dispatcher - 27837-46211.log +0 -21
  1514. data/spec/support/logs/Dispatcher - 27846-16143.log +0 -13
  1515. data/spec/support/logs/Dispatcher - 2789-29375.log +0 -25
  1516. data/spec/support/logs/Dispatcher - 2798-10983.log +0 -15
  1517. data/spec/support/logs/Dispatcher - 2836-2354.log +0 -17
  1518. data/spec/support/logs/Dispatcher - 2845-65341.log +0 -21
  1519. data/spec/support/logs/Dispatcher - 2854-18936.log +0 -13
  1520. data/spec/support/logs/Dispatcher - 2867-51979.log +0 -21
  1521. data/spec/support/logs/Dispatcher - 2876-21086.log +0 -25
  1522. data/spec/support/logs/Dispatcher - 2887-17393.log +0 -15
  1523. data/spec/support/logs/Dispatcher - 2930-37394.log +0 -17
  1524. data/spec/support/logs/Dispatcher - 2943-46737.log +0 -21
  1525. data/spec/support/logs/Dispatcher - 2956-37866.log +0 -13
  1526. data/spec/support/logs/Dispatcher - 2976-21012.log +0 -17
  1527. data/spec/support/logs/Dispatcher - 2990-48082.log +0 -21
  1528. data/spec/support/logs/Dispatcher - 2999-16391.log +0 -13
  1529. data/spec/support/logs/Instance - 2204-45164.error.log +0 -356
  1530. data/spec/support/logs/Instance - 2475-49789.error.log +0 -356
  1531. data/spec/support/logs/Instance - 2509-39450.error.log +0 -455
  1532. data/spec/support/logs/Instance - 2533-5785.error.log +0 -354
  1533. data/spec/support/logs/Instance - 2539-42941.error.log +0 -356
  1534. data/spec/support/logs/Instance - 26178-57631.error.log +0 -324
  1535. data/spec/support/logs/Instance - 26458-60253.error.log +0 -326
  1536. data/spec/support/logs/Instance - 26514-44685.error.log +0 -423
  1537. data/spec/support/logs/Instance - 26538-43093.error.log +0 -322
  1538. data/spec/support/logs/Instance - 26544-52217.error.log +0 -328
  1539. data/spec/support/logs/Instance - 26682-37056.error.log +0 -345
  1540. data/spec/support/logs/Instance - 2669-56818.error.log +0 -354
  1541. data/spec/support/logs/Instance - 27547-3928.error.log +0 -309
  1542. data/spec/support/servers/arachni/element/capabilities/auditable/rdiff.rb +0 -162
  1543. data/spec/support/servers/arachni/element/capabilities/auditable/timeout.rb +0 -34
  1544. data/spec/support/servers/arachni/http.rb +0 -127
  1545. data/spec/support/servers/arachni/http_auth.rb +0 -9
  1546. data/spec/support/servers/arachni/module/auditor.rb +0 -136
  1547. data/spec/support/servers/arachni/rpc/server/framework_simple.rb +0 -30
  1548. data/spec/support/servers/arachni/spider.rb +0 -234
  1549. data/spec/support/servers/arachni/spider_https.rb +0 -58
  1550. data/spec/support/servers/modules/audit/code_injection.rb +0 -139
  1551. data/spec/support/servers/modules/audit/code_injection_timing.rb +0 -110
  1552. data/spec/support/servers/modules/audit/file_inclusion.rb +0 -202
  1553. data/spec/support/servers/modules/audit/ldapi.rb +0 -73
  1554. data/spec/support/servers/modules/audit/os_cmd_injection.rb +0 -140
  1555. data/spec/support/servers/modules/audit/os_cmd_injection_timing.rb +0 -103
  1556. data/spec/support/servers/modules/audit/path_traversal.rb +0 -197
  1557. data/spec/support/servers/modules/audit/response_splitting.rb +0 -114
  1558. data/spec/support/servers/modules/audit/session_fixation.rb +0 -87
  1559. data/spec/support/servers/modules/audit/source_code_disclosure.rb +0 -95
  1560. data/spec/support/servers/modules/audit/sqli.rb +0 -118
  1561. data/spec/support/servers/modules/audit/sqli_blind_timing.rb +0 -121
  1562. data/spec/support/servers/modules/audit/unvalidated_redirect.rb +0 -115
  1563. data/spec/support/servers/modules/audit/xpath.rb +0 -111
  1564. data/spec/support/servers/modules/audit/xss.rb +0 -152
  1565. data/spec/support/servers/modules/audit/xss_event.rb +0 -80
  1566. data/spec/support/servers/modules/audit/xss_script_tag.rb +0 -73
  1567. data/spec/support/servers/modules/module_server.rb +0 -14
  1568. data/spec/support/servers/modules/recon/backdoors.rb +0 -4
  1569. data/spec/support/servers/modules/recon/backup_files.rb +0 -28
  1570. data/spec/support/servers/modules/recon/common_directories.rb +0 -6
  1571. data/spec/support/servers/modules/recon/common_files.rb +0 -6
  1572. data/spec/support/servers/modules/recon/directory_listing.rb +0 -30
  1573. data/spec/support/servers/modules/recon/grep/emails.rb +0 -21
  1574. data/spec/support/servers/modules/recon/grep/insecure_cookies.rb +0 -21
  1575. data/spec/support/servers/modules/recon/grep/mixed_resource.rb +0 -83
  1576. data/spec/support/servers/modules/recon/grep/password_autocomplete.rb +0 -33
  1577. data/spec/support/servers/modules/recon/grep/unencrypted_password_forms.rb +0 -33
  1578. data/spec/support/servers/modules/recon/http_put.rb +0 -7
  1579. data/spec/support/servers/modules/recon/interesting_responses.rb +0 -5
  1580. data/spec/support/servers/modules/recon/webdav.rb +0 -25
  1581. data/spec/support/servers/modules/recon/x_forwarded_for_access_restriction_bypass.rb +0 -16
  1582. data/spec/support/servers/plugins/profiler.rb +0 -82
  1583. data/spec/support/servers/plugins/rescan.rb +0 -31
  1584. data/spec/support/shared/module.rb +0 -162
  1585. data/spec/support/shared/reports.rb +0 -47
@@ -0,0 +1,2368 @@
1
+ require 'spec_helper'
2
+
3
+ describe Arachni::Browser do
4
+
5
+ before( :all ) do
6
+ @url = Arachni::Utilities.normalize_url( web_server_url_for( :browser ) )
7
+ end
8
+
9
+ before( :each ) do
10
+ clear_hit_count
11
+ @browser = described_class.new
12
+ end
13
+
14
+ after( :each ) do
15
+ Arachni::Options.reset
16
+ Arachni::Framework.reset
17
+ @browser.shutdown
18
+ clear_hit_count
19
+ end
20
+
21
+ let(:subject) { @browser }
22
+ let(:ua) { Arachni::Options.http.user_agent }
23
+
24
+ def transitions_from_array( transitions )
25
+ transitions.map do |t|
26
+ element, event = t.first.to_a
27
+
28
+ options = {}
29
+ if element == :page && event == :load
30
+ options.merge!( url: @browser.watir.url, cookies: {} )
31
+ end
32
+
33
+ if element.is_a? Hash
34
+ element = described_class::ElementLocator.new( element )
35
+ end
36
+
37
+ Arachni::Page::DOM::Transition.new( element, event, options ).complete
38
+ end
39
+ end
40
+
41
+ def hit_count
42
+ Typhoeus::Request.get( "#{@url}/hit-count" ).body.to_i
43
+ end
44
+
45
+ def clear_hit_count
46
+ Typhoeus::Request.get( "#{@url}/clear-hit-count" )
47
+ end
48
+
49
+ it 'supports HTTPS' do
50
+ url = web_server_url_for( :browser_https )
51
+
52
+ @browser.start_capture
53
+ pages = @browser.load( url ).flush_pages
54
+
55
+ pages_should_have_form_with_input( pages, 'ajax-token' )
56
+ pages_should_have_form_with_input( pages, 'by-ajax' )
57
+ end
58
+
59
+ describe '.has_executable?' do
60
+ context 'when there is no executable browser' do
61
+ it 'returns false' do
62
+ Selenium::WebDriver::PhantomJS.stub(:path){ false }
63
+ described_class.has_executable?.should be_false
64
+ end
65
+ end
66
+
67
+ context 'when there is an executable browser' do
68
+ it 'returns true' do
69
+ Selenium::WebDriver::PhantomJS.stub(:path){ __FILE__ }
70
+ described_class.has_executable?.should be_true
71
+ end
72
+ end
73
+ end
74
+
75
+ describe '.executable' do
76
+ it 'returns the path to the browser executable' do
77
+ stub = __FILE__
78
+ Selenium::WebDriver::PhantomJS.stub(:path){ stub }
79
+ described_class.executable.should == stub
80
+ end
81
+ end
82
+
83
+ describe '#initialize' do
84
+ describe :concurrency do
85
+ it 'sets the HTTP request concurrency'
86
+ end
87
+
88
+ describe :width do
89
+ it 'sets the window width' do
90
+ @browser.shutdown
91
+
92
+ width = 100
93
+ @browser = described_class.new( width: width )
94
+ subject.javascript.run('return window.innerWidth').should == width
95
+ end
96
+
97
+ it 'defaults to 1600' do
98
+ subject.javascript.run('return window.innerWidth').should == 1600
99
+ end
100
+ end
101
+
102
+ describe :height do
103
+ it 'sets the window height' do
104
+ @browser.shutdown
105
+
106
+ height = 100
107
+ @browser = described_class.new( height: height )
108
+ subject.javascript.run('return window.innerHeight').should == height
109
+ end
110
+
111
+ it 'defaults to 1200' do
112
+ subject.javascript.run('return window.innerHeight').should == 1200
113
+ end
114
+ end
115
+
116
+ describe :store_pages do
117
+ describe 'default' do
118
+ it 'stores snapshot pages' do
119
+ @browser.shutdown
120
+ @browser = described_class.new
121
+ @browser.load( @url + '/explore' ).flush_pages.should be_any
122
+ end
123
+
124
+ it 'stores captured pages' do
125
+ @browser.shutdown
126
+ @browser = described_class.new
127
+ @browser.start_capture
128
+ @browser.load( @url + '/with-ajax' ).flush_pages.should be_any
129
+ end
130
+ end
131
+
132
+ describe true do
133
+ it 'stores snapshot pages' do
134
+ @browser.shutdown
135
+ @browser = described_class.new( store_pages: true )
136
+ @browser.load( @url + '/explore' ).trigger_events.flush_pages.should be_any
137
+ end
138
+
139
+ it 'stores captured pages' do
140
+ @browser.shutdown
141
+ @browser = described_class.new( store_pages: true )
142
+ @browser.start_capture
143
+ @browser.load( @url + '/with-ajax' ).flush_pages.should be_any
144
+ end
145
+ end
146
+
147
+ describe false do
148
+ it 'stores snapshot pages' do
149
+ @browser.shutdown
150
+ @browser = described_class.new( store_pages: false )
151
+ @browser.load( @url + '/explore' ).trigger_events.flush_pages.should be_empty
152
+ end
153
+
154
+ it 'stores captured pages' do
155
+ @browser.shutdown
156
+ @browser = described_class.new( store_pages: false )
157
+ @browser.start_capture
158
+ @browser.load( @url + '/with-ajax' ).flush_pages.should be_empty
159
+ end
160
+ end
161
+ end
162
+ end
163
+
164
+ describe '#source_with_line_numbers' do
165
+ it 'prefixes each source code line with a number' do
166
+ subject.load @url
167
+
168
+ lines = subject.source.lines.to_a
169
+
170
+ lines.should be_any
171
+ subject.source_with_line_numbers.lines.each.with_index do |l, i|
172
+ l.should == "#{i+1} - #{lines[i]}"
173
+ end
174
+ end
175
+ end
176
+
177
+ describe '#load_delay' do
178
+ it 'returns nil' do
179
+ subject.load @url
180
+ subject.load_delay.should be_nil
181
+ end
182
+
183
+ context 'when the page has JS timeouts' do
184
+ it 'returns the maximum time the browser should wait for the page based on Timeout' do
185
+ subject.load( "#{@url}load_delay" )
186
+ subject.load_delay.should == 2000
187
+ end
188
+ end
189
+ end
190
+
191
+ describe '#wait_for_timers' do
192
+ it 'returns' do
193
+ subject.load @url
194
+ subject.wait_for_timers.should be_nil
195
+ end
196
+
197
+ context 'when the page has JS timeouts' do
198
+ it 'waits for them to complete' do
199
+ subject.load( "#{@url}load_delay" )
200
+ seconds = subject.load_delay / 1000
201
+
202
+ time = Time.now
203
+ subject.wait_for_timers
204
+ (Time.now - time).should > seconds
205
+ end
206
+ end
207
+ end
208
+
209
+ describe '#capture_snapshot' do
210
+ let(:sink_url) do
211
+ "#{@url}script_sink?input=#{@browser.javascript.log_execution_flow_sink_stub(1)}"
212
+ end
213
+ let(:ajax_url) do
214
+ "#{@url}with-ajax"
215
+ end
216
+ let(:captured) { subject.capture_snapshot }
217
+
218
+ context 'when a snapshot has not been previously seen' do
219
+ before :each do
220
+ subject.load( @url + '/with-ajax', take_snapshot: false )
221
+ end
222
+
223
+ it 'calls #on_new_page callbacks' do
224
+ received = []
225
+ subject.on_new_page do |page|
226
+ received << page
227
+ end
228
+
229
+ captured.should == received
230
+ end
231
+
232
+ context '#store_pages?' do
233
+ context true do
234
+ subject { @browser.shutdown; @browser = described_class.new( store_pages: true )}
235
+
236
+ it 'stores it in #page_snapshots' do
237
+ captured = subject.capture_snapshot
238
+
239
+ subject.page_snapshots.should == captured
240
+ end
241
+
242
+ it 'returns it' do
243
+ captured.size.should == 1
244
+ captured.first.should == subject.to_page
245
+ end
246
+ end
247
+
248
+ context false do
249
+ subject { @browser.shutdown; @browser = described_class.new( store_pages: false ) }
250
+
251
+ it 'does not store it' do
252
+ subject.capture_snapshot
253
+
254
+ subject.page_snapshots.should be_empty
255
+ end
256
+
257
+ it 'returns an empty array' do
258
+ captured.should be_empty
259
+ end
260
+ end
261
+ end
262
+ end
263
+
264
+ context 'when a snapshot has already been seen' do
265
+ before :each do
266
+ subject.load( @url + '/with-ajax', take_snapshot: false )
267
+ end
268
+
269
+ it 'ignores it' do
270
+ subject.capture_snapshot.should be_any
271
+ subject.capture_snapshot.should be_empty
272
+ end
273
+ end
274
+
275
+ context 'when a snapshot has sink data' do
276
+ before :each do
277
+ subject.load sink_url, take_snapshot: false
278
+ end
279
+
280
+ it 'calls #on_new_page_with_sink callbacks' do
281
+ sinks = []
282
+ subject.on_new_page_with_sink do |page|
283
+ sinks << page.dom.execution_flow_sinks
284
+ end
285
+
286
+ subject.capture_snapshot
287
+
288
+ sinks.size.should == 1
289
+ end
290
+
291
+ context 'and has already been seen' do
292
+ it 'calls #on_new_page_with_sink callbacks' do
293
+ sinks = []
294
+ subject.on_new_page_with_sink do |page|
295
+ sinks << page.dom.execution_flow_sinks
296
+ end
297
+
298
+ subject.capture_snapshot
299
+ subject.capture_snapshot
300
+
301
+ sinks.size.should == 2
302
+ end
303
+ end
304
+
305
+ context '#store_pages?' do
306
+ context true do
307
+ subject { @browser.shutdown; @browser = described_class.new( store_pages: true )}
308
+
309
+ it 'stores it in #page_snapshots_with_sinks' do
310
+ subject.capture_snapshot
311
+ subject.page_snapshots_with_sinks.should be_any
312
+ end
313
+ end
314
+
315
+ context false do
316
+ subject { @browser.shutdown; @browser = described_class.new( store_pages: false )}
317
+
318
+ it 'does not store it in #page_snapshots_with_sinks' do
319
+ subject.capture_snapshot
320
+ subject.page_snapshots_with_sinks.should be_empty
321
+ end
322
+ end
323
+ end
324
+ end
325
+
326
+ context 'when a transition has been given' do
327
+ before :each do
328
+ subject.load( ajax_url, take_snapshot: false )
329
+ end
330
+
331
+ it 'pushes it to the existing transitions' do
332
+ transition = { stuff: :here }
333
+ captured = subject.capture_snapshot( stuff: :here )
334
+
335
+ captured.first.dom.transitions.should include transition
336
+ end
337
+ end
338
+
339
+ context 'when there are multiple windows open' do
340
+ before :each do
341
+ subject.load( ajax_url, take_snapshot: false )
342
+ end
343
+
344
+ it 'captures snapshots from all windows' do
345
+ subject.javascript.run( 'window.open()' )
346
+ subject.watir.windows.last.use
347
+ subject.load sink_url, take_snapshot: false
348
+
349
+ subject.capture_snapshot.map(&:url).sort.should ==
350
+ [ajax_url, sink_url].sort
351
+ end
352
+ end
353
+
354
+ context 'when an error occurs' do
355
+ it 'ignores it' do
356
+ subject.watir.stub(:windows) { raise }
357
+ subject.capture_snapshot( blah: :stuff ).should be_empty
358
+ end
359
+ end
360
+ end
361
+
362
+ describe '#flush_page_snapshots_with_sinks' do
363
+ it 'returns pages with data-flow sink data' do
364
+ @browser.load "#{@url}/lots_of_sinks?input=#{@browser.javascript.log_data_flow_sink_stub( function: { name: 'blah' } )}"
365
+ @browser.explore_and_flush
366
+ @browser.page_snapshots_with_sinks.map(&:dom).map(&:data_flow_sinks).should ==
367
+ @browser.flush_page_snapshots_with_sinks.map(&:dom).map(&:data_flow_sinks)
368
+ end
369
+
370
+ it 'returns pages with execution-flow sink data' do
371
+ @browser.load "#{@url}/lots_of_sinks?input=#{@browser.javascript.log_execution_flow_sink_stub( function: { name: 'blah' } )}"
372
+ @browser.explore_and_flush
373
+ @browser.page_snapshots_with_sinks.map(&:dom).map(&:execution_flow_sinks).should ==
374
+ @browser.flush_page_snapshots_with_sinks.map(&:dom).map(&:execution_flow_sinks)
375
+ end
376
+
377
+ it 'empties the data-flow sink page buffer' do
378
+ @browser.load "#{@url}/lots_of_sinks?input=#{@browser.javascript.log_data_flow_sink_stub( function: { name: 'blah' } )}"
379
+ @browser.explore_and_flush
380
+ @browser.flush_page_snapshots_with_sinks.map(&:dom).map(&:data_flow_sinks)
381
+ @browser.page_snapshots_with_sinks.should be_empty
382
+ end
383
+
384
+ it 'empties the execution-flow sink page buffer' do
385
+ @browser.load "#{@url}/lots_of_sinks?input=#{@browser.javascript.log_execution_flow_sink_stub( function: { name: 'blah' } )}"
386
+ @browser.explore_and_flush
387
+ @browser.flush_page_snapshots_with_sinks.map(&:dom).map(&:execution_flow_sinks)
388
+ @browser.page_snapshots_with_sinks.should be_empty
389
+ end
390
+ end
391
+
392
+ describe '#on_new_page_with_sink' do
393
+ it 'assigns blocks to handle each page with execution-flow sink data' do
394
+ @browser.load "#{@url}/lots_of_sinks?input=#{@browser.javascript.log_execution_flow_sink_stub( function: { name: 'blah' } )}"
395
+
396
+ sinks = []
397
+ @browser.on_new_page_with_sink do |page|
398
+ sinks << page.dom.execution_flow_sinks
399
+ end
400
+
401
+ @browser.explore_and_flush
402
+
403
+ sinks.size.should == 2
404
+ sinks.should == @browser.page_snapshots_with_sinks.map(&:dom).
405
+ map(&:execution_flow_sinks)
406
+ end
407
+
408
+ it 'assigns blocks to handle each page with data-flow sink data' do
409
+ @browser.load "#{@url}/lots_of_sinks?input=#{@browser.javascript.log_data_flow_sink_stub( function: { name: 'blah' } )}"
410
+
411
+ sinks = []
412
+ @browser.on_new_page_with_sink do |page|
413
+ sinks << page.dom.data_flow_sinks
414
+ end
415
+
416
+ @browser.explore_and_flush
417
+
418
+ sinks.size.should == 2
419
+ sinks.should == @browser.page_snapshots_with_sinks.map(&:dom).
420
+ map(&:data_flow_sinks)
421
+ end
422
+ end
423
+
424
+ describe '#on_fire_event' do
425
+ it 'gets called before each event is triggered' do
426
+ @browser.load "#{@url}/trigger_events"
427
+
428
+ calls = []
429
+ @browser.on_fire_event do |element, event|
430
+ calls << [element.opening_tag, event]
431
+ end
432
+
433
+ @browser.fire_event @browser.watir.div( id: 'my-div' ), :click
434
+ @browser.fire_event @browser.watir.div( id: 'my-div' ), :mouseover
435
+
436
+ calls.should == [
437
+ [ "<div id=\"my-div\" onclick=\"addForm();\">", :click ],
438
+ [ "<div id=\"my-div\" onclick=\"addForm();\">", :mouseover ]
439
+ ]
440
+ end
441
+ end
442
+
443
+ describe '#on_new_page' do
444
+ it 'is passed each snapshot' do
445
+ pages = []
446
+ @browser.on_new_page { |page| pages << page }
447
+
448
+ @browser.load( @url + '/explore' ).trigger_events.
449
+ page_snapshots.should == pages
450
+ end
451
+
452
+ it 'is passed each request capture' do
453
+ pages = []
454
+ @browser.on_new_page { |page| pages << page }
455
+ @browser.start_capture
456
+
457
+ # Last page will be the root snapshot so ignore it.
458
+ @browser.load( @url + '/with-ajax' ).captured_pages.should == pages[0...2]
459
+ end
460
+ end
461
+
462
+ describe '#on_response' do
463
+ context 'when a response is preloaded' do
464
+ it 'is passed each response' do
465
+ responses = []
466
+ @browser.on_response { |response| responses << response }
467
+
468
+ @browser.preload Arachni::HTTP::Client.get( @url, mode: :sync )
469
+ @browser.goto @url
470
+
471
+ response = responses.first
472
+ response.should be_kind_of Arachni::HTTP::Response
473
+ response.url.should == @url
474
+ end
475
+ end
476
+
477
+ context 'when a response is cached' do
478
+ it 'is passed each response' do
479
+ responses = []
480
+ @browser.on_response { |response| responses << response }
481
+
482
+ @browser.cache Arachni::HTTP::Client.get( @url, mode: :sync )
483
+ @browser.goto @url
484
+
485
+ response = responses.first
486
+ response.should be_kind_of Arachni::HTTP::Response
487
+ response.url.should == @url
488
+ end
489
+ end
490
+
491
+ context 'when a request is performed by the browser' do
492
+ it 'is passed each response' do
493
+ responses = []
494
+ @browser.on_response { |response| responses << response }
495
+
496
+ @browser.goto @url
497
+
498
+ response = responses.first
499
+ response.should be_kind_of Arachni::HTTP::Response
500
+ response.url.should == @url
501
+ end
502
+ end
503
+ end
504
+
505
+ describe '#explore_and_flush' do
506
+ it 'handles deep DOM/page transitions' do
507
+ url = @url + '/deep-dom'
508
+ pages = @browser.load( url ).explore_and_flush
509
+
510
+ pages_should_have_form_with_input pages, 'by-ajax'
511
+
512
+ pages.map(&:dom).map(&:transitions).should == [
513
+ [
514
+ { :page => :load },
515
+ { "#{@url}deep-dom" => :request },
516
+ { "#{@url}level2" => :request }
517
+ ],
518
+ [
519
+ { :page => :load },
520
+ { "#{@url}deep-dom" => :request },
521
+ { "#{@url}level2" => :request },
522
+ {
523
+ {
524
+ tag_name: 'a',
525
+ attributes: {
526
+ 'onmouseover' => 'writeButton();',
527
+ 'href' => 'javascript:level3();'
528
+ }
529
+ } => :mouseover
530
+ }
531
+ ],
532
+ [
533
+ { :page => :load },
534
+ { "#{@url}deep-dom" => :request },
535
+ { "#{@url}level2" => :request },
536
+ {
537
+ {
538
+ tag_name: 'a',
539
+ attributes: {
540
+ 'onmouseover' => 'writeButton();',
541
+ 'href' => 'javascript:level3();'
542
+ }
543
+ } => :click
544
+ },
545
+ { "#{@url}level4" => :request }
546
+ ],
547
+ [
548
+ { :page => :load },
549
+ { "#{@url}deep-dom" => :request },
550
+ { "#{@url}level2" => :request },
551
+ {
552
+ {
553
+ tag_name: 'a',
554
+ attributes: {
555
+ 'onmouseover' => 'writeButton();',
556
+ 'href' => 'javascript:level3();'
557
+ }
558
+ } => :mouseover
559
+ },
560
+ {
561
+ {
562
+ tag_name: 'button',
563
+ attributes: {
564
+ 'onclick' => 'writeUserAgent();',
565
+ }
566
+ } => :click
567
+ }
568
+ ],
569
+ [
570
+ { :page => :load },
571
+ { "#{@url}deep-dom" => :request },
572
+ { "#{@url}level2" => :request },
573
+ {
574
+ {
575
+ tag_name: 'a',
576
+ attributes: {
577
+ 'onmouseover' => 'writeButton();',
578
+ 'href' => 'javascript:level3();'
579
+ }
580
+ } => :click
581
+ },
582
+ { "#{@url}level4" => :request },
583
+ {
584
+ {
585
+ tag_name: 'div',
586
+ attributes: {
587
+ 'onclick' => 'level6();',
588
+ 'id' => 'level5'
589
+ }
590
+ } => :click
591
+ },
592
+
593
+ { "#{@url}level6" => :request }
594
+ ]
595
+ ].map { |transitions| transitions_from_array( transitions ) }
596
+ end
597
+
598
+ context 'with a depth argument' do
599
+ it 'does not go past the given DOM depth' do
600
+ pages = @browser.load( @url + '/deep-dom' ).explore_and_flush(2)
601
+
602
+ pages.map(&:dom).map(&:transitions).should == [
603
+ [
604
+ { :page => :load },
605
+ { "#{@url}deep-dom" => :request },
606
+ { "#{@url}level2" => :request }
607
+ ],
608
+ [
609
+ { :page => :load },
610
+ { "#{@url}deep-dom" => :request },
611
+ { "#{@url}level2" => :request },
612
+ {
613
+ {
614
+ tag_name: 'a',
615
+ attributes: {
616
+ 'onmouseover' => 'writeButton();',
617
+ 'href' => 'javascript:level3();'
618
+ }
619
+ } => :mouseover
620
+ }
621
+ ],
622
+ [
623
+ { :page => :load },
624
+ { "#{@url}deep-dom" => :request },
625
+ { "#{@url}level2" => :request },
626
+ {
627
+ {
628
+ tag_name: 'a',
629
+ attributes: {
630
+ 'onmouseover' => 'writeButton();',
631
+ 'href' => 'javascript:level3();'
632
+ }
633
+ } => :click
634
+ },
635
+ { "#{@url}level4" => :request }
636
+ ]
637
+ ].map { |transitions| transitions_from_array( transitions ) }
638
+ end
639
+ end
640
+ end
641
+
642
+ describe '#page_snapshots_with_sinks' do
643
+ it 'returns execution-flow sink data' do
644
+ @browser.load "#{@url}/lots_of_sinks?input=#{@browser.javascript.log_execution_flow_sink_stub(1)}"
645
+ @browser.explore_and_flush
646
+
647
+ pages = @browser.page_snapshots_with_sinks
648
+ doms = pages.map(&:dom)
649
+
650
+ doms.size.should == 2
651
+
652
+ doms[0].transitions.should == transitions_from_array([
653
+ { page: :load },
654
+ { "#{@url}lots_of_sinks?input=#{@browser.javascript.log_execution_flow_sink_stub(1)}" => :request },
655
+ {
656
+ {
657
+ tag_name: 'a',
658
+ attributes: {
659
+ 'href' => '#',
660
+ 'onmouseover' => "onClick2('blah1', 'blah2', 'blah3');"
661
+ }
662
+ } => :mouseover
663
+ }
664
+ ])
665
+
666
+ doms[0].execution_flow_sinks.size.should == 2
667
+
668
+ entry = doms[0].execution_flow_sinks[0]
669
+ entry.data.should == [1]
670
+ entry.trace.size.should == 3
671
+
672
+ entry.trace[0].function.name.should == 'onClick'
673
+ entry.trace[0].function.source.should start_with 'function onClick'
674
+ @browser.source.split("\n")[entry.trace[0].line].should include 'log_execution_flow_sink(1)'
675
+ entry.trace[0].function.arguments.should == [1, 2]
676
+
677
+ entry.trace[1].function.name.should == 'onClick2'
678
+ entry.trace[1].function.source.should start_with 'function onClick2'
679
+ @browser.source.split("\n")[entry.trace[1].line].should include 'onClick'
680
+ entry.trace[1].function.arguments.should == %w(blah1 blah2 blah3)
681
+
682
+ entry.trace[2].function.name.should == 'onmouseover'
683
+ entry.trace[2].function.source.should start_with 'function onmouseover'
684
+
685
+ event = entry.trace[2].function.arguments.first
686
+
687
+ link = "<a href=\"#\" onmouseover=\"onClick2('blah1', 'blah2', 'blah3');\">Blah</a>"
688
+ event['target'].should == link
689
+ event['srcElement'].should == link
690
+ event['type'].should == 'mouseover'
691
+
692
+ entry = doms[0].execution_flow_sinks[1]
693
+ entry.data.should == [1]
694
+ entry.trace.size.should == 4
695
+
696
+ entry.trace[0].function.name.should == 'onClick3'
697
+ entry.trace[0].function.source.should start_with 'function onClick3'
698
+ @browser.source.split("\n")[entry.trace[0].line].should include 'log_execution_flow_sink(1)'
699
+ entry.trace[0].function.arguments.should be_empty
700
+
701
+ entry.trace[1].function.name.should == 'onClick'
702
+ entry.trace[1].function.source.should start_with 'function onClick'
703
+ @browser.source.split("\n")[entry.trace[1].line].should include 'onClick3'
704
+ entry.trace[1].function.arguments.should == [1, 2]
705
+
706
+ entry.trace[2].function.name.should == 'onClick2'
707
+ entry.trace[2].function.source.should start_with 'function onClick2'
708
+ @browser.source.split("\n")[entry.trace[2].line].should include 'onClick'
709
+ entry.trace[2].function.arguments.should == %w(blah1 blah2 blah3)
710
+
711
+ entry.trace[3].function.name.should == 'onmouseover'
712
+ entry.trace[3].function.source.should start_with 'function onmouseover'
713
+
714
+ event = entry.trace[3].function.arguments.first
715
+
716
+ link = "<a href=\"#\" onmouseover=\"onClick2('blah1', 'blah2', 'blah3');\">Blah</a>"
717
+ event['target'].should == link
718
+ event['srcElement'].should == link
719
+ event['type'].should == 'mouseover'
720
+
721
+ doms[1].transitions.should == transitions_from_array([
722
+ { page: :load },
723
+ { "#{@url}lots_of_sinks?input=#{@browser.javascript.log_execution_flow_sink_stub(1)}" => :request },
724
+ {
725
+ {
726
+ tag_name: 'form',
727
+ attributes: {
728
+ 'id' => 'my_form',
729
+ 'onsubmit' => "onClick('some-arg', 'arguments-arg', 'here-arg'); return false;"
730
+ }
731
+ } => :submit
732
+ }
733
+ ])
734
+
735
+ doms[1].execution_flow_sinks.size.should == 2
736
+
737
+ entry = doms[1].execution_flow_sinks[0]
738
+ entry.data.should == [1]
739
+ entry.trace.size.should == 2
740
+
741
+ entry.trace[0].function.name.should == 'onClick'
742
+ entry.trace[0].function.source.should start_with 'function onClick'
743
+ @browser.source.split("\n")[entry.trace[0].line].should include 'log_execution_flow_sink(1)'
744
+ entry.trace[0].function.arguments.should == %w(some-arg arguments-arg here-arg)
745
+
746
+ entry.trace[1].function.name.should == 'onsubmit'
747
+ entry.trace[1].function.source.should start_with 'function onsubmit'
748
+ @browser.source.split("\n")[entry.trace[1].line].should include 'onClick'
749
+
750
+ event = entry.trace[1].function.arguments.first
751
+
752
+ form = "<form id=\"my_form\" onsubmit=\"onClick('some-arg', 'arguments-arg', 'here-arg'); return false;\">\n </form>"
753
+ event['target'].should == form
754
+ event['srcElement'].should == form
755
+ event['type'].should == 'submit'
756
+
757
+ entry = doms[1].execution_flow_sinks[1]
758
+ entry.data.should == [1]
759
+ entry.trace.size.should == 3
760
+
761
+ entry.trace[0].function.name.should == 'onClick3'
762
+ entry.trace[0].function.source.should start_with 'function onClick3'
763
+ @browser.source.split("\n")[entry.trace[0].line].should include 'log_execution_flow_sink(1)'
764
+ entry.trace[0].function.arguments.should be_empty
765
+
766
+ entry.trace[1].function.name.should == 'onClick'
767
+ entry.trace[1].function.source.should start_with 'function onClick'
768
+ @browser.source.split("\n")[entry.trace[1].line].should include 'onClick3()'
769
+ entry.trace[1].function.arguments.should == %w(some-arg arguments-arg here-arg)
770
+
771
+ entry.trace[2].function.name.should == 'onsubmit'
772
+ entry.trace[2].function.source.should start_with 'function onsubmit'
773
+ @browser.source.split("\n")[entry.trace[2].line].should include 'onClick('
774
+
775
+ event = entry.trace[2].function.arguments.first
776
+
777
+ form = "<form id=\"my_form\" onsubmit=\"onClick('some-arg', 'arguments-arg', 'here-arg'); return false;\">\n </form>"
778
+ event['target'].should == form
779
+ event['srcElement'].should == form
780
+ event['type'].should == 'submit'
781
+ end
782
+
783
+ it 'returns data-flow sink data' do
784
+ @browser.load "#{@url}/lots_of_sinks?input=#{@browser.javascript.log_data_flow_sink_stub( function: 'blah' )}"
785
+ @browser.explore_and_flush
786
+
787
+ pages = @browser.page_snapshots_with_sinks
788
+ doms = pages.map(&:dom)
789
+
790
+ doms.size.should == 2
791
+
792
+ doms[0].data_flow_sinks.size.should == 2
793
+
794
+ entry = doms[0].data_flow_sinks[0]
795
+ entry.function.should == 'blah'
796
+ entry.trace.size.should == 3
797
+
798
+ entry.trace[0].function.name.should == 'onClick'
799
+ entry.trace[0].function.source.should start_with 'function onClick'
800
+ @browser.source.split("\n")[entry.trace[0].line].should include 'log_data_flow_sink('
801
+ entry.trace[0].function.arguments.should == [1, 2]
802
+
803
+ entry.trace[1].function.name.should == 'onClick2'
804
+ entry.trace[1].function.source.should start_with 'function onClick2'
805
+ @browser.source.split("\n")[entry.trace[1].line].should include 'onClick'
806
+ entry.trace[1].function.arguments.should == %w(blah1 blah2 blah3)
807
+
808
+ entry.trace[2].function.name.should == 'onmouseover'
809
+ entry.trace[2].function.source.should start_with 'function onmouseover'
810
+
811
+ event = entry.trace[2].function.arguments.first
812
+
813
+ link = "<a href=\"#\" onmouseover=\"onClick2('blah1', 'blah2', 'blah3');\">Blah</a>"
814
+ event['target'].should == link
815
+ event['srcElement'].should == link
816
+ event['type'].should == 'mouseover'
817
+
818
+ entry = doms[0].data_flow_sinks[1]
819
+ entry.function.should == 'blah'
820
+ entry.trace.size.should == 4
821
+
822
+ entry.trace[0].function.name.should == 'onClick3'
823
+ entry.trace[0].function.source.should start_with 'function onClick3'
824
+ @browser.source.split("\n")[entry.trace[0].line].should include 'log_data_flow_sink('
825
+ entry.trace[0].function.arguments.should be_empty
826
+
827
+ entry.trace[1].function.name.should == 'onClick'
828
+ entry.trace[1].function.source.should start_with 'function onClick'
829
+ @browser.source.split("\n")[entry.trace[1].line].should include 'onClick3'
830
+ entry.trace[1].function.arguments.should == [1, 2]
831
+
832
+ entry.trace[2].function.name.should == 'onClick2'
833
+ entry.trace[2].function.source.should start_with 'function onClick2'
834
+ @browser.source.split("\n")[entry.trace[2].line].should include 'onClick'
835
+ entry.trace[2].function.arguments.should == %w(blah1 blah2 blah3)
836
+
837
+ entry.trace[3].function.name.should == 'onmouseover'
838
+ entry.trace[3].function.source.should start_with 'function onmouseover'
839
+
840
+ event = entry.trace[3].function.arguments.first
841
+
842
+ link = "<a href=\"#\" onmouseover=\"onClick2('blah1', 'blah2', 'blah3');\">Blah</a>"
843
+ event['target'].should == link
844
+ event['srcElement'].should == link
845
+ event['type'].should == 'mouseover'
846
+
847
+ doms[1].data_flow_sinks.size.should == 2
848
+
849
+ entry = doms[1].data_flow_sinks[0]
850
+ entry.function.should == 'blah'
851
+ entry.trace.size.should == 2
852
+
853
+ entry.trace[0].function.name.should == 'onClick'
854
+ entry.trace[0].function.source.should start_with 'function onClick'
855
+ @browser.source.split("\n")[entry.trace[0].line].should include 'log_data_flow_sink('
856
+ entry.trace[0].function.arguments.should == %w(some-arg arguments-arg here-arg)
857
+
858
+ entry.trace[1].function.name.should == 'onsubmit'
859
+ entry.trace[1].function.source.should start_with 'function onsubmit'
860
+ @browser.source.split("\n")[entry.trace[1].line].should include 'onClick'
861
+
862
+ event = entry.trace[1].function.arguments.first
863
+
864
+ form = "<form id=\"my_form\" onsubmit=\"onClick('some-arg', 'arguments-arg', 'here-arg'); return false;\">\n </form>"
865
+ event['target'].should == form
866
+ event['srcElement'].should == form
867
+ event['type'].should == 'submit'
868
+
869
+ entry = doms[1].data_flow_sinks[1]
870
+ entry.function.should == 'blah'
871
+ entry.trace.size.should == 3
872
+
873
+ entry.trace[0].function.name.should == 'onClick3'
874
+ entry.trace[0].function.source.should start_with 'function onClick3'
875
+ @browser.source.split("\n")[entry.trace[0].line].should include 'log_data_flow_sink('
876
+ entry.trace[0].function.arguments.should be_empty
877
+
878
+ entry.trace[1].function.name.should == 'onClick'
879
+ entry.trace[1].function.source.should start_with 'function onClick'
880
+ @browser.source.split("\n")[entry.trace[1].line].should include 'onClick3()'
881
+ entry.trace[1].function.arguments.should == %w(some-arg arguments-arg here-arg)
882
+
883
+ entry.trace[2].function.name.should == 'onsubmit'
884
+ entry.trace[2].function.source.should start_with 'function onsubmit'
885
+ @browser.source.split("\n")[entry.trace[2].line].should include 'onClick('
886
+
887
+ event = entry.trace[2].function.arguments.first
888
+
889
+ form = "<form id=\"my_form\" onsubmit=\"onClick('some-arg', 'arguments-arg', 'here-arg'); return false;\">\n </form>"
890
+ event['target'].should == form
891
+ event['srcElement'].should == form
892
+ event['type'].should == 'submit'
893
+ end
894
+
895
+ describe 'when store_pages: false' do
896
+ it 'does not store pages' do
897
+ @browser.shutdown
898
+ @browser = @browser.class.new( store_pages: false )
899
+
900
+ @browser.load "#{@url}/lots_of_sinks?input=#{@browser.javascript.log_execution_flow_sink_stub(1)}"
901
+ @browser.explore_and_flush
902
+ @browser.page_snapshots_with_sinks.should be_empty
903
+ end
904
+ end
905
+ end
906
+
907
+ describe '#response' do
908
+ it "returns the #{Arachni::HTTP::Response} for the loaded page" do
909
+ @browser.load @url
910
+
911
+ browser_response = @browser.response
912
+ browser_request = browser_response.request
913
+ raw_response = Arachni::HTTP::Client.get( @url, mode: :sync )
914
+ raw_request = raw_response.request
915
+
916
+ browser_response.url.should == raw_response.url
917
+
918
+ browser_sanitized_body =
919
+ Nokogiri::HTML(browser_response.body).css('body').to_s.gsub("\n", '')
920
+ raw_response_sanitized_body =
921
+ Nokogiri::HTML(raw_response.body).css('body').to_s.gsub("\n", '')
922
+
923
+ browser_sanitized_body.should == raw_response_sanitized_body
924
+
925
+ [:url, :method].each do |attribute|
926
+ browser_request.send(attribute).should == raw_request.send(attribute)
927
+ end
928
+ end
929
+
930
+ context "when the response takes more than #{Arachni::OptionGroups::HTTP}#request_timeout" do
931
+ it 'returns nil'
932
+ end
933
+
934
+ context 'when the resource is out-of-scope' do
935
+ it 'returns nil' do
936
+ Arachni::Options.url = @url
937
+ @browser.load 'http://google.com/'
938
+ @browser.response.should be_nil
939
+ end
940
+ end
941
+ end
942
+
943
+ describe '#to_page' do
944
+ it "converts the working window to an #{Arachni::Page}" do
945
+ ua = Arachni::Options.http.user_agent
946
+
947
+ @browser.load( @url )
948
+ page = @browser.to_page
949
+
950
+ page.should be_kind_of Arachni::Page
951
+
952
+ ua.should_not be_empty
953
+ page.response.body.should_not include( ua )
954
+ page.body.should include( ua )
955
+ end
956
+
957
+ it "assigns the proper #{Arachni::Page::DOM}#digest" do
958
+ @browser.load( @url )
959
+ @browser.to_page.dom.instance_variable_get(:@digest).should ==
960
+ '<HTML><HEAD><SCRIPT src=http://javascript.browser.arachni/' +
961
+ 'taint_tracer.js><SCRIPT><SCRIPT src=http://javascript.' +
962
+ 'browser.arachni/dom_monitor.js><SCRIPT><TITLE><BODY><DIV' +
963
+ '><SCRIPT type=text/javascript>'
964
+ end
965
+
966
+ it "assigns the proper #{Arachni::Page::DOM}#transitions" do
967
+ @browser.load( @url )
968
+ page = @browser.to_page
969
+
970
+ page.dom.transitions.should == transitions_from_array([
971
+ { page: :load },
972
+ { @url => :request }
973
+ ])
974
+ end
975
+
976
+ it "assigns the proper #{Arachni::Page::DOM}#skip_states" do
977
+ @browser.load( @url )
978
+ pages = @browser.load( @url + '/explore' ).trigger_events.
979
+ page_snapshots
980
+
981
+ page = pages.last
982
+ page.dom.skip_states.should be_subset @browser.skip_states
983
+ end
984
+
985
+ it "assigns the proper #{Arachni::Page::DOM} sink data" do
986
+ @browser.load "#{web_server_url_for( :taint_tracer )}/debug" <<
987
+ "?input=#{@browser.javascript.log_execution_flow_sink_stub(1)}"
988
+ @browser.watir.form.submit
989
+
990
+ page = @browser.to_page
991
+ sink_data = page.dom.execution_flow_sinks
992
+
993
+ first_entry = sink_data.first
994
+ sink_data.should == [first_entry]
995
+
996
+ first_entry.data.should == [1]
997
+ first_entry.trace.size.should == 2
998
+
999
+ first_entry.trace[0].function.name.should == 'onClick'
1000
+ first_entry.trace[0].function.source.should start_with 'function onClick'
1001
+ @browser.source.split("\n")[first_entry.trace[0].line].should include 'log_execution_flow_sink(1)'
1002
+ first_entry.trace[0].function.arguments.should == %w(some-arg arguments-arg here-arg)
1003
+
1004
+ first_entry.trace[1].function.name.should == 'onsubmit'
1005
+ first_entry.trace[1].function.source.should start_with 'function onsubmit'
1006
+ @browser.source.split("\n")[first_entry.trace[1].line].should include 'onClick('
1007
+ first_entry.trace[1].function.arguments.size.should == 1
1008
+
1009
+ event = first_entry.trace[1].function.arguments.first
1010
+
1011
+ form = "<form id=\"my_form\" onsubmit=\"onClick('some-arg', 'arguments-arg', 'here-arg'); return false;\">\n </form>"
1012
+ event['target'].should == form
1013
+ event['srcElement'].should == form
1014
+ event['type'].should == 'submit'
1015
+ end
1016
+
1017
+ context 'when the resource is out-of-scope' do
1018
+ it 'returns nil' do
1019
+ Arachni::Options.url = @url
1020
+ @browser.load 'http://google.com/'
1021
+ @browser.to_page.should be_nil
1022
+ end
1023
+ end
1024
+ end
1025
+
1026
+ describe '#fire_event' do
1027
+ let(:url) { "#{@url}/trigger_events" }
1028
+ before(:each) do
1029
+ @browser.load url
1030
+ end
1031
+
1032
+ it 'fires the given event' do
1033
+ @browser.fire_event @browser.watir.div( id: 'my-div' ), :click
1034
+ pages_should_have_form_with_input [@browser.to_page], 'by-ajax'
1035
+ end
1036
+
1037
+ it 'accepts events without the "on" prefix' do
1038
+ pages_should_not_have_form_with_input [@browser.to_page], 'by-ajax'
1039
+
1040
+ @browser.fire_event @browser.watir.div( id: 'my-div' ), :onclick
1041
+ pages_should_have_form_with_input [@browser.to_page], 'by-ajax'
1042
+
1043
+ @browser.fire_event @browser.watir.div( id: 'my-div' ), :click
1044
+ pages_should_have_form_with_input [@browser.to_page], 'by-ajax'
1045
+ end
1046
+
1047
+ it 'returns a playable transition' do
1048
+ transition = @browser.fire_event @browser.watir.div( id: 'my-div' ), :click
1049
+ pages_should_have_form_with_input [@browser.to_page], 'by-ajax'
1050
+
1051
+ @browser.load( url ).start_capture
1052
+ pages_should_not_have_form_with_input [@browser.to_page], 'by-ajax'
1053
+
1054
+ transition.play @browser
1055
+ pages_should_have_form_with_input [@browser.to_page], 'by-ajax'
1056
+ end
1057
+
1058
+ context 'when the element is not visible' do
1059
+ it 'returns nil' do
1060
+ element = @browser.watir.div( id: 'my-div' )
1061
+
1062
+ element.stub(:visible?) { false }
1063
+
1064
+ @browser.fire_event( element, :click ).should be_nil
1065
+ end
1066
+ end
1067
+
1068
+ context "when the element is an #{described_class::ElementLocator}" do
1069
+ context 'and could not be located' do
1070
+ it 'returns nil' do
1071
+ element = described_class::ElementLocator.new(
1072
+ tag_name: 'body',
1073
+ attributes: { 'id' => 'blahblah' }
1074
+ )
1075
+
1076
+ element.stub(:locate){ raise Selenium::WebDriver::Error::UnknownError }
1077
+ @browser.fire_event( element, :click ).should be_nil
1078
+
1079
+ element.stub(:locate){ raise Watir::Exception::UnknownObjectException }
1080
+ @browser.fire_event( element, :click ).should be_nil
1081
+ end
1082
+ end
1083
+ end
1084
+
1085
+ context 'when the element never appears' do
1086
+ it 'returns nil' do
1087
+ element = @browser.watir.div( id: 'my-div' )
1088
+
1089
+ element.stub(:exists?) { false }
1090
+
1091
+ @browser.fire_event( element, :click ).should be_nil
1092
+ end
1093
+ end
1094
+
1095
+ context 'when the trigger fails with' do
1096
+ let(:element) { @browser.watir.div( id: 'my-div' ) }
1097
+
1098
+ context Selenium::WebDriver::Error::UnknownError do
1099
+ it 'returns nil' do
1100
+ element.stub(:fire_event){ raise Selenium::WebDriver::Error::UnknownError }
1101
+ @browser.fire_event( element, :click ).should be_nil
1102
+ end
1103
+ end
1104
+
1105
+ context Watir::Exception::UnknownObjectException do
1106
+ it 'returns nil' do
1107
+ element.stub(:fire_event){ raise Watir::Exception::UnknownObjectException }
1108
+ @browser.fire_event( element, :click ).should be_nil
1109
+ end
1110
+ end
1111
+ end
1112
+
1113
+ context 'form' do
1114
+ context :submit do
1115
+ let(:url) { "#{@url}/fire_event/form/onsubmit" }
1116
+
1117
+ context 'when option' do
1118
+ describe :inputs do
1119
+ context 'is given' do
1120
+ let(:inputs) do
1121
+ {
1122
+ name: 'The Dude',
1123
+ email: 'the.dude@abides.com'
1124
+ }
1125
+ end
1126
+
1127
+ before(:each) do
1128
+ @browser.fire_event @browser.watir.form, :submit, inputs: inputs
1129
+ end
1130
+
1131
+ it 'fills in its inputs with the given values' do
1132
+ @browser.watir.div( id: 'container-name' ).text.should ==
1133
+ inputs[:name]
1134
+ @browser.watir.div( id: 'container-email' ).text.should ==
1135
+ inputs[:email]
1136
+ end
1137
+
1138
+ it 'returns a playable transition' do
1139
+ @browser.load url
1140
+
1141
+ transition = @browser.fire_event @browser.watir.form, :submit, inputs: inputs
1142
+
1143
+ @browser.load url
1144
+
1145
+ @browser.watir.div( id: 'container-name' ).text.should be_empty
1146
+ @browser.watir.div( id: 'container-email' ).text.should be_empty
1147
+
1148
+ transition.play @browser
1149
+
1150
+ @browser.watir.div( id: 'container-name' ).text.should ==
1151
+ inputs[:name]
1152
+ @browser.watir.div( id: 'container-email' ).text.should ==
1153
+ inputs[:email]
1154
+ end
1155
+
1156
+ context 'but has missing values' do
1157
+ let(:inputs) do
1158
+ { name: 'The Dude' }
1159
+ end
1160
+
1161
+ it 'leaves those empty' do
1162
+ @browser.watir.div( id: 'container-name' ).text.should ==
1163
+ inputs[:name]
1164
+ @browser.watir.div( id: 'container-email' ).text.should be_empty
1165
+ end
1166
+
1167
+ it 'returns a playable transition' do
1168
+ @browser.load url
1169
+ transition = @browser.fire_event @browser.watir.form, :submit, inputs: inputs
1170
+
1171
+ @browser.load url
1172
+
1173
+ @browser.watir.div( id: 'container-name' ).text.should be_empty
1174
+ @browser.watir.div( id: 'container-email' ).text.should be_empty
1175
+
1176
+ transition.play @browser
1177
+
1178
+ @browser.watir.div( id: 'container-name' ).text.should ==
1179
+ inputs[:name]
1180
+ @browser.watir.div( id: 'container-email' ).text.should be_empty
1181
+ end
1182
+ end
1183
+
1184
+ context 'and is empty' do
1185
+ let(:inputs) do
1186
+ {}
1187
+ end
1188
+
1189
+ it 'fills in empty values' do
1190
+ @browser.watir.div( id: 'container-name' ).text.should be_empty
1191
+ @browser.watir.div( id: 'container-email' ).text.should be_empty
1192
+ end
1193
+
1194
+ it 'returns a playable transition' do
1195
+ @browser.load url
1196
+ transition = @browser.fire_event @browser.watir.form, :submit, inputs: inputs
1197
+
1198
+ @browser.load url
1199
+
1200
+ @browser.watir.div( id: 'container-name' ).text.should be_empty
1201
+ @browser.watir.div( id: 'container-email' ).text.should be_empty
1202
+
1203
+ transition.play @browser
1204
+
1205
+ @browser.watir.div( id: 'container-name' ).text.should be_empty
1206
+ @browser.watir.div( id: 'container-email' ).text.should be_empty
1207
+ end
1208
+ end
1209
+
1210
+ context 'and has disabled inputs' do
1211
+ let(:url) { "#{@url}/fire_event/form/disabled_inputs" }
1212
+
1213
+ it 'is skips those inputs' do
1214
+ @browser.watir.div( id: 'container-name' ).text.should ==
1215
+ inputs[:name]
1216
+ @browser.watir.div( id: 'container-email' ).text.should be_empty
1217
+ end
1218
+ end
1219
+ end
1220
+
1221
+ context 'is not given' do
1222
+ it 'fills in its inputs with sample values' do
1223
+ @browser.load url
1224
+ @browser.fire_event @browser.watir.form, :submit
1225
+
1226
+ @browser.watir.div( id: 'container-name' ).text.should ==
1227
+ Arachni::Options.input.value_for_name( 'name' )
1228
+ @browser.watir.div( id: 'container-email' ).text.should ==
1229
+ Arachni::Options.input.value_for_name( 'email' )
1230
+ end
1231
+
1232
+ it 'returns a playable transition' do
1233
+ @browser.load url
1234
+ transition = @browser.fire_event @browser.watir.form, :submit
1235
+
1236
+ @browser.load url
1237
+
1238
+ @browser.watir.div( id: 'container-name' ).text.should be_empty
1239
+ @browser.watir.div( id: 'container-email' ).text.should be_empty
1240
+
1241
+ transition.play @browser
1242
+
1243
+ @browser.watir.div( id: 'container-name' ).text.should ==
1244
+ Arachni::Options.input.value_for_name( 'name' )
1245
+ @browser.watir.div( id: 'container-email' ).text.should ==
1246
+ Arachni::Options.input.value_for_name( 'email' )
1247
+ end
1248
+
1249
+ context 'and has disabled inputs' do
1250
+ let(:url) { "#{@url}/fire_event/form/disabled_inputs" }
1251
+
1252
+ it 'is skips those inputs' do
1253
+ @browser.fire_event @browser.watir.form, :submit
1254
+
1255
+ @browser.watir.div( id: 'container-name' ).text.should ==
1256
+ Arachni::Options.input.value_for_name( 'name' )
1257
+ @browser.watir.div( id: 'container-email' ).text.should be_empty
1258
+ end
1259
+ end
1260
+ end
1261
+ end
1262
+ end
1263
+ end
1264
+
1265
+ context 'image button' do
1266
+ context :click do
1267
+ before( :each ) { @browser.start_capture }
1268
+ let(:url) { "#{@url}fire_event/form/image-input" }
1269
+
1270
+ it 'submits the form with x, y coordinates' do
1271
+ @browser.load( url )
1272
+ @browser.fire_event @browser.watir.input( type: 'image'), :click
1273
+
1274
+ pages_should_have_form_with_input @browser.captured_pages, 'myImageButton.x'
1275
+ pages_should_have_form_with_input @browser.captured_pages, 'myImageButton.y'
1276
+ end
1277
+
1278
+ it 'returns a playable transition' do
1279
+ @browser.load( url )
1280
+ transition = @browser.fire_event @browser.watir.input( type: 'image'), :click
1281
+
1282
+ captured_pages = @browser.flush_pages
1283
+ pages_should_have_form_with_input captured_pages, 'myImageButton.x'
1284
+ pages_should_have_form_with_input captured_pages, 'myImageButton.y'
1285
+ @browser.shutdown
1286
+
1287
+ @browser = described_class.new.start_capture
1288
+ @browser.load( url )
1289
+ @browser.flush_pages.size.should == 1
1290
+
1291
+ transition.play @browser
1292
+ captured_pages = @browser.flush_pages
1293
+ pages_should_have_form_with_input captured_pages, 'myImageButton.x'
1294
+ pages_should_have_form_with_input captured_pages, 'myImageButton.y'
1295
+ end
1296
+ end
1297
+ end
1298
+ end
1299
+
1300
+ context 'input' do
1301
+ described_class::Javascript::EVENTS_PER_ELEMENT[:input].each do |event|
1302
+ calculate_expectation = proc do |string|
1303
+ [:onkeypress, :onkeydown].include?( event ) ?
1304
+ string[0...-1] : string
1305
+ end
1306
+
1307
+ context event do
1308
+ let( :url ) { "#{@url}/fire_event/input/#{event}" }
1309
+
1310
+ context 'when option' do
1311
+ describe :inputs do
1312
+ context 'is given' do
1313
+ let(:value) do
1314
+ 'The Dude'
1315
+ end
1316
+
1317
+ before(:each) do
1318
+ @browser.fire_event @browser.watir.input, event, value: value
1319
+ end
1320
+
1321
+ it 'fills in its inputs with the given values' do
1322
+ @browser.watir.div( id: 'container' ).text.should ==
1323
+ calculate_expectation.call( value )
1324
+ end
1325
+
1326
+ it 'returns a playable transition' do
1327
+ @browser.load url
1328
+ transition = @browser.fire_event @browser.watir.input, event, value: value
1329
+
1330
+ @browser.load url
1331
+ @browser.watir.div( id: 'container' ).text.should be_empty
1332
+
1333
+ transition.play @browser
1334
+ @browser.watir.div( id: 'container' ).text.should ==
1335
+ calculate_expectation.call( value )
1336
+ end
1337
+
1338
+ context 'and is empty' do
1339
+ let(:value) do
1340
+ ''
1341
+ end
1342
+
1343
+ it 'fills in empty values' do
1344
+ @browser.watir.div( id: 'container' ).text.should be_empty
1345
+ end
1346
+
1347
+ it 'returns a playable transition' do
1348
+ @browser.load url
1349
+ transition = @browser.fire_event @browser.watir.input, event, value: value
1350
+
1351
+ @browser.load url
1352
+ @browser.watir.div( id: 'container' ).text.should be_empty
1353
+
1354
+ transition.play @browser
1355
+ @browser.watir.div( id: 'container' ).text.should be_empty
1356
+ end
1357
+ end
1358
+ end
1359
+
1360
+ context 'is not given' do
1361
+ it 'fills in a sample value' do
1362
+ @browser.fire_event @browser.watir.input, event
1363
+
1364
+ @browser.watir.div( id: 'container' ).text.should ==
1365
+ calculate_expectation.call( Arachni::Options.input.value_for_name( 'name' ) )
1366
+ end
1367
+
1368
+ it 'returns a playable transition' do
1369
+ @browser.load url
1370
+ transition = @browser.fire_event @browser.watir.input, event
1371
+
1372
+ @browser.load url
1373
+ @browser.watir.div( id: 'container' ).text.should be_empty
1374
+
1375
+ transition.play @browser
1376
+ @browser.watir.div( id: 'container' ).text.should ==
1377
+ calculate_expectation.call( Arachni::Options.input.value_for_name( 'name' ) )
1378
+ end
1379
+ end
1380
+ end
1381
+ end
1382
+ end
1383
+ end
1384
+ end
1385
+ end
1386
+
1387
+ describe '#each_element_with_events' do
1388
+ before :each do
1389
+ @browser.load url
1390
+ end
1391
+ let(:elements_with_events) do
1392
+ elements_with_events = []
1393
+ @browser.each_element_with_events do |*info|
1394
+ elements_with_events << info
1395
+ end
1396
+ elements_with_events
1397
+ end
1398
+
1399
+ let(:url) { @url + '/trigger_events' }
1400
+ it 'passes each element and event info to the block' do
1401
+ elements_with_events.should == [
1402
+ [
1403
+ described_class::ElementLocator.new(
1404
+ tag_name: 'body',
1405
+ attributes: { 'onmouseover' => 'makePOST();' }
1406
+ ),
1407
+ [[:onmouseover, 'makePOST();']]
1408
+ ],
1409
+ [
1410
+ described_class::ElementLocator.new(
1411
+ tag_name: 'div',
1412
+ attributes: { 'id' => 'my-div', 'onclick' => 'addForm();' }
1413
+ ),
1414
+ [[:onclick, 'addForm();']]
1415
+ ]
1416
+ ]
1417
+ end
1418
+
1419
+ context :a do
1420
+ context 'and the href is not empty' do
1421
+ context 'and it starts with javascript:' do
1422
+ let(:url) { @url + '/each_element_with_events/a/href/javascript' }
1423
+
1424
+ it 'includes the :click event' do
1425
+ elements_with_events.should == [
1426
+ [
1427
+ described_class::ElementLocator.new(
1428
+ tag_name: 'a',
1429
+ attributes: { 'href' => 'javascript:doStuff()' }
1430
+ ),
1431
+ [[:click, 'javascript:doStuff()']]
1432
+ ]
1433
+ ]
1434
+ end
1435
+ end
1436
+
1437
+ context 'and it does not start with javascript:' do
1438
+ let(:url) { @url + '/each_element_with_events/a/href/regular' }
1439
+
1440
+ it 'is ignored' do
1441
+ elements_with_events.should be_empty
1442
+ end
1443
+ end
1444
+
1445
+ context 'and is out of scope' do
1446
+ let(:url) { @url + '/each_element_with_events/a/href/out-of-scope' }
1447
+
1448
+ it 'is ignored' do
1449
+ elements_with_events.should be_empty
1450
+ end
1451
+ end
1452
+ end
1453
+ end
1454
+
1455
+ context :form do
1456
+ context :input do
1457
+ context 'of type "image"' do
1458
+ let(:url) { @url + '/each_element_with_events/form/input/image' }
1459
+
1460
+ it 'includes the :click event' do
1461
+ elements_with_events.should == [
1462
+ [
1463
+ described_class::ElementLocator.new(
1464
+ tag_name: 'input',
1465
+ attributes: {
1466
+ 'type' => 'image',
1467
+ 'name' => 'myImageButton',
1468
+ 'src' => '/__sinatra__/404.png'
1469
+ }
1470
+ ),
1471
+ [[:click, 'image']]
1472
+ ]
1473
+ ]
1474
+ end
1475
+ end
1476
+ end
1477
+
1478
+ context 'and the action is not empty' do
1479
+ context 'and it starts with javascript:' do
1480
+ let(:url) { @url + '/each_element_with_events/form/action/javascript' }
1481
+
1482
+ it 'includes the :submit event' do
1483
+ elements_with_events.should == [
1484
+ [
1485
+ described_class::ElementLocator.new(
1486
+ tag_name: 'form',
1487
+ attributes: {
1488
+ 'action' => 'javascript:doStuff()'
1489
+ }
1490
+ ),
1491
+ [[:submit, 'javascript:doStuff()']]
1492
+ ]
1493
+ ]
1494
+ end
1495
+ end
1496
+
1497
+ context 'and it does not start with javascript:' do
1498
+ let(:url) { @url + '/each_element_with_events/form/action/regular' }
1499
+
1500
+ it 'is ignored'do
1501
+ elements_with_events.should be_empty
1502
+ end
1503
+ end
1504
+
1505
+ context 'and is out of scope' do
1506
+ let(:url) { @url + '/each_element_with_events/form/action/out-of-scope' }
1507
+
1508
+ it 'is ignored'do
1509
+ elements_with_events.should be_empty
1510
+ end
1511
+ end
1512
+ end
1513
+ end
1514
+ end
1515
+
1516
+ describe '#trigger_event' do
1517
+ it 'triggers the given event on the given tag and captures snapshots' do
1518
+ @browser.load( @url + '/trigger_events' ).start_capture
1519
+
1520
+ locators = []
1521
+ @browser.watir.elements.each do |element|
1522
+ begin
1523
+ locators << described_class::ElementLocator.from_html( element.opening_tag )
1524
+ rescue
1525
+ end
1526
+ end
1527
+
1528
+ locators.each do |element|
1529
+ @browser.javascript.class.events.each do |e|
1530
+ begin
1531
+ @browser.trigger_event @browser.to_page, element, e
1532
+ rescue
1533
+ next
1534
+ end
1535
+ end
1536
+ end
1537
+
1538
+ pages_should_have_form_with_input @browser.page_snapshots, 'by-ajax'
1539
+ pages_should_have_form_with_input @browser.captured_pages, 'ajax-token'
1540
+ end
1541
+ end
1542
+
1543
+ describe '#trigger_events' do
1544
+ it 'waits for AJAX requests to complete' do
1545
+ @browser.load( @url + '/trigger_events-wait-for-ajax' ).start_capture.trigger_events
1546
+
1547
+ pages_should_have_form_with_input @browser.captured_pages, 'ajax-token'
1548
+ pages_should_have_form_with_input @browser.page_snapshots, 'by-ajax'
1549
+ end
1550
+
1551
+ it 'triggers all events on all elements' do
1552
+ @browser.load( @url + '/trigger_events' ).start_capture.trigger_events
1553
+
1554
+ pages_should_have_form_with_input @browser.page_snapshots, 'by-ajax'
1555
+ pages_should_have_form_with_input @browser.captured_pages, 'ajax-token'
1556
+ pages_should_have_form_with_input @browser.captured_pages, 'post-name'
1557
+ end
1558
+
1559
+ it 'assigns the proper page transitions' do
1560
+ pages = @browser.load( @url + '/explore' ).trigger_events.page_snapshots
1561
+ pages.map(&:dom).map(&:transitions).should == [
1562
+ [
1563
+ { :page => :load },
1564
+ { "#{@url}explore" => :request }
1565
+ ],
1566
+ [
1567
+ { :page => :load },
1568
+ { "#{@url}explore" => :request },
1569
+ {
1570
+ {
1571
+ tag_name: 'div',
1572
+ attributes: {
1573
+ 'id' => 'my-div',
1574
+ 'onclick' => 'addForm();'
1575
+ }
1576
+ } => :click
1577
+ },
1578
+ { "#{@url}get-ajax?ajax-token=my-token" => :request }
1579
+ ],
1580
+ [
1581
+ { :page => :load },
1582
+ { "#{@url}explore" => :request },
1583
+ {
1584
+ {
1585
+ tag_name: 'a',
1586
+ attributes: {
1587
+ 'href' => 'javascript:inHref();'
1588
+ }
1589
+ } => :click
1590
+ },
1591
+ { "#{@url}href-ajax" => :request },
1592
+ ]
1593
+ ].map { |transitions| transitions_from_array( transitions ) }
1594
+ end
1595
+
1596
+ it 'follows all javascript links' do
1597
+ @browser.load( @url + '/explore' ).start_capture.trigger_events
1598
+
1599
+ pages_should_have_form_with_input @browser.page_snapshots, 'by-ajax'
1600
+ pages_should_have_form_with_input @browser.page_snapshots, 'from-post-ajax'
1601
+ pages_should_have_form_with_input @browser.captured_pages, 'ajax-token'
1602
+ pages_should_have_form_with_input @browser.captured_pages, 'href-post-name'
1603
+ end
1604
+
1605
+ it 'captures pages from new windows' do
1606
+ pages = @browser.load( @url + '/explore-new-window' ).
1607
+ start_capture.trigger_events.flush_pages
1608
+
1609
+ pages_should_have_form_with_input pages, 'in-old-window'
1610
+ pages_should_have_form_with_input pages, 'in-new-window'
1611
+ end
1612
+
1613
+ context 'when submitting forms using an image input' do
1614
+ it 'includes x, y coordinates' do
1615
+ @browser.load( "#{@url}form-with-image-button" ).start_capture.trigger_events
1616
+ pages_should_have_form_with_input @browser.captured_pages, 'myImageButton.x'
1617
+ pages_should_have_form_with_input @browser.captured_pages, 'myImageButton.y'
1618
+ end
1619
+ end
1620
+
1621
+ it 'returns self' do
1622
+ @browser.load( @url + '/explore' ).trigger_events.should == @browser
1623
+ end
1624
+ end
1625
+
1626
+ describe '#source' do
1627
+ it 'returns the evaluated HTML source' do
1628
+ @browser.load @url
1629
+
1630
+ ua = Arachni::Options.http.user_agent
1631
+ ua.should_not be_empty
1632
+
1633
+ @browser.source.should include( ua )
1634
+ end
1635
+ end
1636
+
1637
+ describe '#watir' do
1638
+ it 'provides access to the Watir::Browser API' do
1639
+ @browser.watir.should be_kind_of Watir::Browser
1640
+ end
1641
+ end
1642
+
1643
+ describe '#selenium' do
1644
+ it 'provides access to the Selenium::WebDriver::Driver API' do
1645
+ @browser.selenium.should be_kind_of Selenium::WebDriver::Driver
1646
+ end
1647
+ end
1648
+
1649
+ describe '#goto' do
1650
+ it 'loads the given URL' do
1651
+ @browser.goto @url
1652
+
1653
+ ua = Arachni::Options.http.user_agent
1654
+ ua.should_not be_empty
1655
+
1656
+ @browser.source.should include( ua )
1657
+ end
1658
+
1659
+ it 'returns a playable transition' do
1660
+ transition = @browser.goto( @url )
1661
+
1662
+ @browser.shutdown
1663
+ @browser = described_class.new
1664
+
1665
+ transition.play( @browser )
1666
+ ua = Arachni::Options.http.user_agent
1667
+ ua.should_not be_empty
1668
+
1669
+ @browser.source.should include( ua )
1670
+ end
1671
+
1672
+ context 'when the page has JS timeouts' do
1673
+ it 'waits for them to complete' do
1674
+ time = Time.now
1675
+ subject.goto "#{@url}load_delay"
1676
+ waited = Time.now - time
1677
+
1678
+ waited.should >= subject.load_delay / 1000.0
1679
+ end
1680
+ end
1681
+
1682
+ context 'when there are outstanding HTTP requests' do
1683
+ it 'waits for them to complete' do
1684
+ sleep_time = 5
1685
+ time = Time.now
1686
+
1687
+ subject.goto "#{@url}/ajax_sleep?sleep=#{sleep_time}"
1688
+
1689
+ (Time.now - time).should >= sleep_time
1690
+ end
1691
+
1692
+ context "when requests takes more than #{Arachni::OptionGroups::HTTP}#request_timeout" do
1693
+ it 'returns false' do
1694
+ sleep_time = 5
1695
+ Arachni::Options.http.request_timeout = 1_000
1696
+
1697
+ Arachni::HTTP::ProxyServer.any_instance.stub(:has_connections?){ true }
1698
+
1699
+ time = Time.now
1700
+ subject.goto "#{@url}/ajax_sleep?sleep=#{sleep_time}"
1701
+
1702
+ (Time.now - time).should < sleep_time
1703
+ end
1704
+ end
1705
+ end
1706
+
1707
+ context "#{Arachni::OptionGroups::BrowserCluster}#ignore_images" do
1708
+ context true do
1709
+ it 'does not load images' do
1710
+ Arachni::Options.browser_cluster.ignore_images = true
1711
+ @browser.shutdown
1712
+ @browser = described_class.new
1713
+
1714
+ loaded_image = false
1715
+ @browser.on_response do |response|
1716
+ loaded_image ||= (response.parsed_url.resource_extension == 'png')
1717
+ end
1718
+
1719
+ @browser.load( "#{@url}form-with-image-button" )
1720
+
1721
+ loaded_image.should be_false
1722
+ end
1723
+ end
1724
+
1725
+ context false do
1726
+ it 'does not load images' do
1727
+ Arachni::Options.browser_cluster.ignore_images = false
1728
+ @browser.shutdown
1729
+ @browser = described_class.new
1730
+
1731
+ loaded_image = false
1732
+ @browser.on_response do |response|
1733
+ loaded_image ||= (response.parsed_url.resource_extension == 'png')
1734
+ end
1735
+
1736
+ @browser.load( "#{@url}form-with-image-button" )
1737
+
1738
+ loaded_image.should be_true
1739
+ end
1740
+ end
1741
+ end
1742
+
1743
+ context "with #{Arachni::OptionGroups::Scope}#exclude_path_patterns" do
1744
+ it 'respects scope restrictions' do
1745
+ pages = @browser.load( @url + '/explore' ).start_capture.trigger_events.page_snapshots
1746
+ pages_should_have_form_with_input pages, 'by-ajax'
1747
+
1748
+ @browser.shutdown
1749
+ @browser = described_class.new
1750
+
1751
+ Arachni::Options.scope.exclude_path_patterns << /ajax/
1752
+
1753
+ pages = @browser.load( @url + '/explore' ).start_capture.trigger_events.page_snapshots
1754
+ pages_should_not_have_form_with_input pages, 'by-ajax'
1755
+ end
1756
+ end
1757
+
1758
+ context "with #{Arachni::OptionGroups::Scope}#redundant_path_patterns" do
1759
+ it 'respects scope restrictions' do
1760
+ Arachni::Options.scope.redundant_path_patterns = { 'explore' => 3 }
1761
+
1762
+ @browser.load( @url + '/explore' ).response.code.should == 200
1763
+
1764
+ 2.times do
1765
+ @browser.load( @url + '/explore' ).response.code.should == 200
1766
+ end
1767
+
1768
+ @browser.load( @url + '/explore' ).response.code.should == 0
1769
+ end
1770
+ end
1771
+
1772
+ context "with #{Arachni::OptionGroups::Scope}#auto_redundant_paths has bee configured" do
1773
+ it 'respects scope restrictions' do
1774
+ Arachni::Options.scope.auto_redundant_paths = 3
1775
+
1776
+ @browser.load( @url + '/explore?test=1&test2=2' ).response.code.should == 200
1777
+
1778
+ 2.times do
1779
+ @browser.load( @url + '/explore?test=1&test2=2' ).response.code.should == 200
1780
+ end
1781
+
1782
+ @browser.load( @url + '/explore?test=1&test2=2' ).response.code.should == 0
1783
+ end
1784
+ end
1785
+
1786
+ describe :cookies do
1787
+ it 'loads the given cookies' do
1788
+ cookie = { 'myname' => 'myvalue' }
1789
+ @browser.goto @url, cookies: cookie
1790
+
1791
+ @browser.cookies.find { |c| c.name == cookie.keys.first }.inputs.should == cookie
1792
+ end
1793
+
1794
+ it 'includes them in the transition' do
1795
+ cookie = { 'myname' => 'myvalue' }
1796
+ transition = @browser.goto( @url, cookies: cookie )
1797
+
1798
+ transition.options[:cookies].should == cookie
1799
+ end
1800
+ end
1801
+
1802
+ describe :take_snapshot do
1803
+ describe true do
1804
+ it 'captures a snapshot of the loaded page' do
1805
+ @browser.goto @url, take_snapshot: true
1806
+ pages = @browser.page_snapshots
1807
+ pages.size.should == 1
1808
+
1809
+ pages.first.dom.transitions.should == transitions_from_array([
1810
+ { page: :load },
1811
+ { @url => :request }
1812
+ ])
1813
+ end
1814
+ end
1815
+
1816
+ describe false do
1817
+ it 'does not capture a snapshot of the loaded page' do
1818
+ @browser.goto @url, take_snapshot: false
1819
+ @browser.page_snapshots.should be_empty
1820
+ end
1821
+ end
1822
+
1823
+ describe 'default' do
1824
+ it 'captures a snapshot of the loaded page' do
1825
+ @browser.goto @url
1826
+ pages = @browser.page_snapshots
1827
+ pages.size.should == 1
1828
+
1829
+ pages.first.dom.transitions.should == transitions_from_array([
1830
+ { page: :load },
1831
+ { @url => :request }
1832
+ ])
1833
+ end
1834
+ end
1835
+ end
1836
+
1837
+ describe :update_transitions do
1838
+ describe true do
1839
+ it 'pushes the page load to the transitions' do
1840
+ t = @browser.goto( @url, update_transitions: true )
1841
+ @browser.to_page.dom.transitions.should include t
1842
+ end
1843
+ end
1844
+
1845
+ describe false do
1846
+ it 'does not push the page load to the transitions' do
1847
+ t = @browser.goto( @url, update_transitions: false )
1848
+ @browser.to_page.dom.transitions.should be_empty
1849
+ end
1850
+ end
1851
+
1852
+ describe 'default' do
1853
+ it 'pushes the page load to the transitions' do
1854
+ t = @browser.goto( @url )
1855
+ @browser.to_page.dom.transitions.should include t
1856
+ end
1857
+ end
1858
+ end
1859
+
1860
+ end
1861
+
1862
+ describe '#load' do
1863
+ it 'returns self' do
1864
+ @browser.load( @url ).should == @browser
1865
+ end
1866
+
1867
+ describe :cookies do
1868
+ it 'loads the given cookies' do
1869
+ cookie = { 'myname' => 'myvalue' }
1870
+ @browser.load @url, cookies: cookie
1871
+
1872
+ @browser.cookies.find { |c| c.name == cookie.keys.first }.inputs.should == cookie
1873
+ end
1874
+ end
1875
+
1876
+ describe :take_snapshot do
1877
+ describe true do
1878
+ it 'captures a snapshot of the loaded page' do
1879
+ @browser.load @url, take_snapshot: true
1880
+ pages = @browser.page_snapshots
1881
+ pages.size.should == 1
1882
+
1883
+ pages.first.dom.transitions.should == transitions_from_array([
1884
+ { page: :load },
1885
+ { @url => :request }
1886
+ ])
1887
+ end
1888
+ end
1889
+
1890
+ describe false do
1891
+ it 'does not capture a snapshot of the loaded page' do
1892
+ @browser.load @url, take_snapshot: false
1893
+ @browser.page_snapshots.should be_empty
1894
+ end
1895
+ end
1896
+
1897
+ describe 'default' do
1898
+ it 'captures a snapshot of the loaded page' do
1899
+ @browser.load @url
1900
+ pages = @browser.page_snapshots
1901
+ pages.size.should == 1
1902
+
1903
+ pages.first.dom.transitions.should == transitions_from_array([
1904
+ { page: :load },
1905
+ { @url => :request }
1906
+ ])
1907
+ end
1908
+ end
1909
+ end
1910
+
1911
+ context 'when given a' do
1912
+ describe String do
1913
+ it 'treats it as a URL' do
1914
+ hit_count.should == 0
1915
+
1916
+ @browser.load @url
1917
+ @browser.source.should include( ua )
1918
+ @browser.preloads.should_not include( @url )
1919
+
1920
+ hit_count.should == 1
1921
+ end
1922
+ end
1923
+
1924
+ describe Arachni::HTTP::Response do
1925
+ it 'loads it' do
1926
+ hit_count.should == 0
1927
+
1928
+ @browser.load Arachni::HTTP::Client.get( @url, mode: :sync )
1929
+ @browser.source.should include( ua )
1930
+ @browser.preloads.should_not include( @url )
1931
+
1932
+ hit_count.should == 1
1933
+ end
1934
+ end
1935
+
1936
+ describe Arachni::Page do
1937
+ it 'loads it' do
1938
+ hit_count.should == 0
1939
+
1940
+ @browser.load Arachni::HTTP::Client.get( @url, mode: :sync ).to_page
1941
+ @browser.source.should include( ua )
1942
+ @browser.preloads.should_not include( @url )
1943
+
1944
+ hit_count.should == 1
1945
+ end
1946
+
1947
+ it 'uses its #cookie_jar' do
1948
+ @browser.cookies.should be_empty
1949
+
1950
+ page = Arachni::Page.from_data(
1951
+ url: @url,
1952
+ cookie_jar: [
1953
+ Arachni::Cookie.new(
1954
+ url: @url,
1955
+ inputs: {
1956
+ 'my-name' => 'my-value'
1957
+ }
1958
+ )
1959
+ ]
1960
+ )
1961
+
1962
+ @browser.load( page )
1963
+ @browser.cookies.should == page.cookie_jar
1964
+ end
1965
+
1966
+ it 'replays its DOM#transitions' do
1967
+ @browser.load "#{@url}play-transitions"
1968
+ page = @browser.explore_and_flush.last
1969
+ page.body.should include ua
1970
+
1971
+ @browser.load page
1972
+ @browser.source.should include ua
1973
+
1974
+ page.dom.transitions.clear
1975
+ @browser.load page
1976
+ @browser.source.should_not include ua
1977
+ end
1978
+
1979
+ it 'loads its DOM#skip_states' do
1980
+ @browser.load( @url )
1981
+ pages = @browser.load( @url + '/explore' ).trigger_events.
1982
+ page_snapshots
1983
+
1984
+ page = pages.last
1985
+ page.dom.skip_states.should be_subset @browser.skip_states
1986
+
1987
+ token = @browser.generate_token
1988
+
1989
+ dpage = page.dup
1990
+ dpage.dom.skip_states << token
1991
+
1992
+ @browser.load dpage
1993
+ @browser.skip_states.should include token
1994
+ end
1995
+
1996
+ end
1997
+
1998
+ describe 'other' do
1999
+ it 'raises Arachni::Browser::Error::Load' do
2000
+ expect { @browser.load [] }.to raise_error Arachni::Browser::Error::Load
2001
+ end
2002
+ end
2003
+ end
2004
+ end
2005
+
2006
+ describe '#preload' do
2007
+ it 'removes entries after they are used' do
2008
+ @browser.preload Arachni::HTTP::Client.get( @url, mode: :sync )
2009
+ clear_hit_count
2010
+
2011
+ hit_count.should == 0
2012
+
2013
+ @browser.load @url
2014
+ @browser.source.should include( ua )
2015
+ @browser.preloads.should_not include( @url )
2016
+
2017
+ hit_count.should == 0
2018
+
2019
+ 2.times do
2020
+ @browser.load @url
2021
+ @browser.source.should include( ua )
2022
+ end
2023
+
2024
+ @browser.preloads.should_not include( @url )
2025
+
2026
+ hit_count.should == 2
2027
+ end
2028
+
2029
+ it 'returns the URL of the resource' do
2030
+ response = Arachni::HTTP::Client.get( @url, mode: :sync )
2031
+ @browser.preload( response ).should == response.url
2032
+
2033
+ @browser.load response.url
2034
+ @browser.source.should include( ua )
2035
+ end
2036
+
2037
+ context 'when given a' do
2038
+ describe Arachni::HTTP::Response do
2039
+ it 'preloads it' do
2040
+ @browser.preload Arachni::HTTP::Client.get( @url, mode: :sync )
2041
+ clear_hit_count
2042
+
2043
+ hit_count.should == 0
2044
+
2045
+ @browser.load @url
2046
+ @browser.source.should include( ua )
2047
+ @browser.preloads.should_not include( @url )
2048
+
2049
+ hit_count.should == 0
2050
+ end
2051
+ end
2052
+
2053
+ describe Arachni::Page do
2054
+ it 'preloads it' do
2055
+ @browser.preload Arachni::Page.from_url( @url )
2056
+ clear_hit_count
2057
+
2058
+ hit_count.should == 0
2059
+
2060
+ @browser.load @url
2061
+ @browser.source.should include( ua )
2062
+ @browser.preloads.should_not include( @url )
2063
+
2064
+ hit_count.should == 0
2065
+ end
2066
+ end
2067
+
2068
+ describe 'other' do
2069
+ it 'raises Arachni::Browser::Error::Load' do
2070
+ expect { @browser.preload [] }.to raise_error Arachni::Browser::Error::Load
2071
+ end
2072
+ end
2073
+ end
2074
+ end
2075
+
2076
+ describe '#cache' do
2077
+ it 'keeps entries after they are used' do
2078
+ @browser.cache Arachni::HTTP::Client.get( @url, mode: :sync )
2079
+ clear_hit_count
2080
+
2081
+ hit_count.should == 0
2082
+
2083
+ @browser.load @url
2084
+ @browser.source.should include( ua )
2085
+ @browser.cache.should include( @url )
2086
+
2087
+ hit_count.should == 0
2088
+
2089
+ 2.times do
2090
+ @browser.load @url
2091
+ @browser.source.should include( ua )
2092
+ end
2093
+
2094
+ @browser.cache.should include( @url )
2095
+
2096
+ hit_count.should == 0
2097
+ end
2098
+
2099
+ it 'returns the URL of the resource' do
2100
+ response = Arachni::HTTP::Client.get( @url, mode: :sync )
2101
+ @browser.cache( response ).should == response.url
2102
+
2103
+ @browser.load response.url
2104
+ @browser.source.should include( ua )
2105
+ @browser.cache.should include( response.url )
2106
+ end
2107
+
2108
+ context 'when given a' do
2109
+ describe Arachni::HTTP::Response do
2110
+ it 'caches it' do
2111
+ @browser.cache Arachni::HTTP::Client.get( @url, mode: :sync )
2112
+ clear_hit_count
2113
+
2114
+ hit_count.should == 0
2115
+
2116
+ @browser.load @url
2117
+ @browser.source.should include( ua )
2118
+ @browser.cache.should include( @url )
2119
+
2120
+ hit_count.should == 0
2121
+ end
2122
+ end
2123
+
2124
+ describe Arachni::Page do
2125
+ it 'caches it' do
2126
+ @browser.cache Arachni::Page.from_url( @url )
2127
+ clear_hit_count
2128
+
2129
+ hit_count.should == 0
2130
+
2131
+ @browser.load @url
2132
+ @browser.source.should include( ua )
2133
+ @browser.cache.should include( @url )
2134
+
2135
+ hit_count.should == 0
2136
+ end
2137
+ end
2138
+
2139
+ describe 'other' do
2140
+ it 'raises Arachni::Browser::Error::Load' do
2141
+ expect { @browser.cache [] }.to raise_error Arachni::Browser::Error::Load
2142
+ end
2143
+ end
2144
+
2145
+ end
2146
+ end
2147
+
2148
+ describe '#start_capture' do
2149
+ before(:each) { @browser.start_capture }
2150
+
2151
+ it 'parses requests into elements of pages' do
2152
+ @browser.load @url + '/with-ajax'
2153
+
2154
+ pages = @browser.captured_pages
2155
+ pages.size.should == 2
2156
+
2157
+ page = pages.first
2158
+ page.forms.find { |form| form.inputs.include? 'ajax-token' }.should be_true
2159
+ end
2160
+
2161
+ context 'when an element has already been seen' do
2162
+ context 'by the browser' do
2163
+ it 'ignores it' do
2164
+ @browser.load @url + '/with-ajax'
2165
+ @browser.captured_pages.size.should == 2
2166
+ @browser.captured_pages.clear
2167
+
2168
+ @browser.load @url + '/with-ajax'
2169
+ @browser.captured_pages.should be_empty
2170
+ end
2171
+ end
2172
+
2173
+ context "by the #{Arachni::ElementFilter}" do
2174
+ it 'ignores it' do
2175
+ @browser.load @url + '/with-ajax'
2176
+ Arachni::ElementFilter.update_forms @browser.captured_pages.map(&:forms).flatten
2177
+ @browser.shutdown
2178
+
2179
+ @browser = described_class.new
2180
+ @browser.load @url + '/with-ajax'
2181
+ @browser.captured_pages.should be_empty
2182
+ end
2183
+ end
2184
+ end
2185
+
2186
+ context 'when a GET request is performed' do
2187
+ it "is added as an #{Arachni::Element::Form} to the page" do
2188
+ @browser.load @url + '/with-ajax'
2189
+
2190
+ pages = @browser.captured_pages
2191
+ pages.size.should == 2
2192
+
2193
+ page = pages.first
2194
+
2195
+ form = page.forms.find { |form| form.inputs.include? 'ajax-token' }
2196
+
2197
+ form.url.should == @url + 'with-ajax'
2198
+ form.action.should == @url + 'get-ajax'
2199
+ form.inputs.should == { 'ajax-token' => 'my-token' }
2200
+ form.method.should == :get
2201
+ end
2202
+ end
2203
+
2204
+ context 'when a POST request is performed' do
2205
+ it "is added as an #{Arachni::Element::Form} to the page" do
2206
+ @browser.load @url + '/with-ajax'
2207
+
2208
+ pages = @browser.captured_pages
2209
+ pages.size.should == 2
2210
+
2211
+ form = find_page_with_form_with_input( pages, 'post-name' ).
2212
+ forms.find { |form| form.inputs.include? 'post-name' }
2213
+
2214
+ form.url.should == @url + 'with-ajax'
2215
+ form.action.should == @url + 'post-ajax'
2216
+ form.inputs.should == { 'post-name' => 'post-value' }
2217
+ form.method.should == :post
2218
+ end
2219
+ end
2220
+ end
2221
+
2222
+ describe '#flush_pages' do
2223
+ it 'flushes the captured pages' do
2224
+ @browser.start_capture
2225
+ @browser.load @url + '/with-ajax'
2226
+
2227
+ pages = @browser.flush_pages
2228
+ pages.size.should == 3
2229
+ @browser.flush_pages.should be_empty
2230
+ end
2231
+ end
2232
+
2233
+ describe '#stop_capture' do
2234
+ it 'stops the page capture' do
2235
+ @browser.stop_capture
2236
+ @browser.capture?.should be_false
2237
+ end
2238
+ end
2239
+
2240
+ describe 'capture?' do
2241
+ it 'returns false' do
2242
+ @browser.start_capture
2243
+ @browser.stop_capture
2244
+ @browser.capture?.should be_false
2245
+ end
2246
+
2247
+ context 'when capturing pages' do
2248
+ it 'returns true' do
2249
+ @browser.start_capture
2250
+ @browser.capture?.should be_true
2251
+ end
2252
+ end
2253
+ context 'when not capturing pages' do
2254
+ it 'returns false' do
2255
+ @browser.start_capture
2256
+ @browser.stop_capture
2257
+ @browser.capture?.should be_false
2258
+ end
2259
+ end
2260
+ end
2261
+
2262
+ describe '#cookies' do
2263
+ it 'returns the browser cookies' do
2264
+ @browser.load @url
2265
+ @browser.cookies.size.should == 1
2266
+ cookie = @browser.cookies.first
2267
+
2268
+ cookie.should be_kind_of Arachni::Cookie
2269
+ cookie.name.should == 'This name should be updated; and properly escaped'
2270
+ cookie.value.should == 'This value should be updated; and properly escaped'
2271
+ end
2272
+ end
2273
+
2274
+ describe '#snapshot_id' do
2275
+ before(:each) { Arachni::Options.url = @url }
2276
+
2277
+ let(:empty_snapshot_id_url) { @url + '/snapshot_id/default' }
2278
+ let(:empty_snapshot_id) do
2279
+ @browser.load( empty_snapshot_id_url ).snapshot_id
2280
+ end
2281
+ let(:snapshot_id) do
2282
+ @browser.load( url ).snapshot_id
2283
+ end
2284
+
2285
+ let(:url) { @url + '/trigger_events' }
2286
+
2287
+ it 'returns a DOM digest' do
2288
+ snapshot_id.should == @browser.load( url ).snapshot_id
2289
+ end
2290
+
2291
+ context :a do
2292
+ context 'and the href is not empty' do
2293
+ context 'and it starts with javascript:' do
2294
+ let(:url) { @url + '/each_element_with_events/a/href/javascript' }
2295
+
2296
+ it 'takes it into account' do
2297
+ snapshot_id.should_not == empty_snapshot_id
2298
+ end
2299
+ end
2300
+
2301
+ context 'and it does not start with javascript:' do
2302
+ let(:url) { @url + '/each_element_with_events/a/href/regular' }
2303
+
2304
+ it 'takes it into account' do
2305
+ snapshot_id.should_not == empty_snapshot_id
2306
+ end
2307
+ end
2308
+
2309
+ context 'and is out of scope' do
2310
+ let(:url) { @url + '/each_element_with_events/a/href/out-of-scope' }
2311
+
2312
+ it 'is ignored' do
2313
+ snapshot_id.should == empty_snapshot_id
2314
+ end
2315
+ end
2316
+ end
2317
+
2318
+ context 'and the href is empty' do
2319
+ let(:url) { @url + '/each_element_with_events/a/href/empty' }
2320
+
2321
+ it 'takes it into account' do
2322
+ snapshot_id.should_not == empty_snapshot_id
2323
+ end
2324
+ end
2325
+ end
2326
+
2327
+ context :form do
2328
+ let(:empty_snapshot_id_url) { @url + '/snapshot_id/form/default' }
2329
+
2330
+ context :input do
2331
+ context 'of type "image"' do
2332
+ let(:url) { @url + '/each_element_with_events/form/input/image' }
2333
+
2334
+ it 'takes it into account' do
2335
+ snapshot_id.should_not == empty_snapshot_id
2336
+ end
2337
+ end
2338
+ end
2339
+
2340
+ context 'and the action is not empty' do
2341
+ context 'and it starts with javascript:' do
2342
+ let(:url) { @url + '/each_element_with_events/form/action/javascript' }
2343
+
2344
+ it 'takes it into account' do
2345
+ snapshot_id.should_not == empty_snapshot_id
2346
+ end
2347
+ end
2348
+
2349
+ context 'and it does not start with javascript:' do
2350
+ let(:url) { @url + '/each_element_with_events/form/action/regular' }
2351
+
2352
+ it 'takes it into account' do
2353
+ snapshot_id.should_not == empty_snapshot_id
2354
+ end
2355
+ end
2356
+
2357
+ context 'and is out of scope' do
2358
+ let(:url) { @url + '/each_element_with_events/form/action/out-of-scope' }
2359
+
2360
+ it 'is ignored'do
2361
+ snapshot_id.should == empty_snapshot_id
2362
+ end
2363
+ end
2364
+ end
2365
+ end
2366
+ end
2367
+
2368
+ end