arachni 1.0.5 → 1.0.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (80) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +50 -0
  3. data/README.md +9 -2
  4. data/components/checks/active/code_injection.rb +5 -5
  5. data/components/checks/active/code_injection_timing.rb +3 -3
  6. data/components/checks/active/no_sql_injection_differential.rb +3 -2
  7. data/components/checks/active/os_cmd_injection.rb +11 -5
  8. data/components/checks/active/os_cmd_injection_timing.rb +11 -4
  9. data/components/checks/active/path_traversal.rb +2 -2
  10. data/components/checks/active/sql_injection.rb +1 -1
  11. data/components/checks/active/sql_injection/patterns/mssql +1 -0
  12. data/components/checks/active/sql_injection_differential.rb +3 -2
  13. data/components/checks/active/unvalidated_redirect.rb +3 -3
  14. data/components/checks/passive/common_directories/directories.txt +2 -0
  15. data/components/checks/passive/common_files/filenames.txt +1 -0
  16. data/lib/arachni/browser.rb +17 -1
  17. data/lib/arachni/check/auditor.rb +5 -2
  18. data/lib/arachni/check/base.rb +30 -5
  19. data/lib/arachni/element/capabilities/analyzable/differential.rb +2 -5
  20. data/lib/arachni/element/capabilities/auditable.rb +3 -1
  21. data/lib/arachni/element/capabilities/with_dom.rb +1 -0
  22. data/lib/arachni/element/capabilities/with_node.rb +1 -1
  23. data/lib/arachni/element/cookie.rb +2 -2
  24. data/lib/arachni/element/form.rb +1 -1
  25. data/lib/arachni/element/header.rb +2 -2
  26. data/lib/arachni/element/link_template.rb +1 -1
  27. data/lib/arachni/framework.rb +21 -1144
  28. data/lib/arachni/framework/parts/audit.rb +282 -0
  29. data/lib/arachni/framework/parts/browser.rb +132 -0
  30. data/lib/arachni/framework/parts/check.rb +86 -0
  31. data/lib/arachni/framework/parts/data.rb +158 -0
  32. data/lib/arachni/framework/parts/platform.rb +34 -0
  33. data/lib/arachni/framework/parts/plugin.rb +61 -0
  34. data/lib/arachni/framework/parts/report.rb +128 -0
  35. data/lib/arachni/framework/parts/scope.rb +40 -0
  36. data/lib/arachni/framework/parts/state.rb +457 -0
  37. data/lib/arachni/http/client.rb +33 -30
  38. data/lib/arachni/http/request.rb +6 -2
  39. data/lib/arachni/issue.rb +55 -1
  40. data/lib/arachni/platform/manager.rb +25 -21
  41. data/lib/arachni/state/framework.rb +7 -1
  42. data/lib/arachni/utilities.rb +10 -0
  43. data/lib/version +1 -1
  44. data/spec/arachni/browser_spec.rb +13 -0
  45. data/spec/arachni/check/auditor_spec.rb +1 -0
  46. data/spec/arachni/check/base_spec.rb +80 -0
  47. data/spec/arachni/element/cookie_spec.rb +2 -2
  48. data/spec/arachni/framework/parts/audit_spec.rb +391 -0
  49. data/spec/arachni/framework/parts/browser_spec.rb +26 -0
  50. data/spec/arachni/framework/parts/check_spec.rb +24 -0
  51. data/spec/arachni/framework/parts/data_spec.rb +187 -0
  52. data/spec/arachni/framework/parts/platform_spec.rb +62 -0
  53. data/spec/arachni/framework/parts/plugin_spec.rb +41 -0
  54. data/spec/arachni/framework/parts/report_spec.rb +66 -0
  55. data/spec/arachni/framework/parts/scope_spec.rb +86 -0
  56. data/spec/arachni/framework/parts/state_spec.rb +528 -0
  57. data/spec/arachni/framework_spec.rb +17 -1344
  58. data/spec/arachni/http/client_spec.rb +12 -7
  59. data/spec/arachni/issue_spec.rb +35 -0
  60. data/spec/arachni/platform/manager_spec.rb +2 -3
  61. data/spec/arachni/state/framework_spec.rb +15 -0
  62. data/spec/components/checks/active/code_injection_timing_spec.rb +5 -5
  63. data/spec/components/checks/active/no_sql_injection_differential_spec.rb +4 -0
  64. data/spec/components/checks/active/os_cmd_injection_spec.rb +20 -7
  65. data/spec/components/checks/active/os_cmd_injection_timing_spec.rb +5 -5
  66. data/spec/components/checks/active/sql_injection_differential_spec.rb +4 -0
  67. data/spec/components/checks/active/sql_injection_spec.rb +2 -3
  68. data/spec/support/servers/arachni/browser.rb +31 -0
  69. data/spec/support/servers/checks/active/code_injection.rb +1 -1
  70. data/spec/support/servers/checks/active/no_sql_injection_differential.rb +36 -34
  71. data/spec/support/servers/checks/active/os_cmd_injection.rb +6 -12
  72. data/spec/support/servers/checks/active/os_cmd_injection_timing.rb +9 -4
  73. data/spec/support/servers/checks/active/sql_injection.rb +1 -1
  74. data/spec/support/servers/checks/active/sql_injection_differential.rb +37 -34
  75. data/spec/support/shared/element/capabilities/with_node.rb +25 -0
  76. data/spec/support/shared/framework.rb +26 -0
  77. data/ui/cli/output.rb +2 -0
  78. data/ui/cli/rpc/server/dispatcher/option_parser.rb +1 -1
  79. metadata +32 -4
  80. data/components/checks/active/sql_injection/patterns/coldfusion +0 -1
@@ -17,45 +17,48 @@ def get_result( str )
17
17
  end
18
18
  end
19
19
 
20
- get '/' do
21
- <<-EOHTML
22
- <a href="/link?input=default">Link</a>
23
- <a href="/form">Form</a>
24
- <a href="/cookie">Cookie</a>
25
- <a href="/header">Header</a>
26
- EOHTML
27
- end
20
+ [:sql].each do |platform|
21
+ get "/#{platform}" do
22
+ <<-EOHTML
23
+ <a href="/#{platform}/link?input=default">Link</a>
24
+ <a href="/#{platform}/form">Form</a>
25
+ <a href="/#{platform}/cookie">Cookie</a>
26
+ <a href="/#{platform}/header">Header</a>
27
+ EOHTML
28
+ end
28
29
 
29
- get '/link' do
30
- <<-EOHTML
31
- <a href="/link/append?input=default">Link</a>
32
- EOHTML
33
- end
30
+ get "/#{platform}/link" do
31
+ <<-EOHTML
32
+ <a href="/#{platform}/link/append?input=default">Link</a>
33
+ EOHTML
34
+ end
34
35
 
35
- get '/link/append' do
36
- get_result( params['input'] )
37
- end
36
+ get "/#{platform}/link/append" do
37
+ get_result( params['input'] )
38
+ end
38
39
 
39
- get '/form' do
40
- <<-EOHTML
41
- <form action="/form/append">
42
- <input name='input' value='default' />
43
- </form>
44
- EOHTML
45
- end
40
+ get "/#{platform}/form" do
41
+ <<-EOHTML
42
+ <form action="/#{platform}/form/append">
43
+ <input name='input' value='default' />
44
+ </form>
45
+ EOHTML
46
+ end
46
47
 
47
- get '/form/append' do
48
- get_result( params['input'] )
49
- end
48
+ get "/#{platform}/form/append" do
49
+ get_result( params['input'] )
50
+ end
50
51
 
51
52
 
52
- get '/cookie' do
53
- <<-EOHTML
54
- <a href="/cookie/append">Cookie</a>
55
- EOHTML
56
- end
53
+ get "/#{platform}/cookie" do
54
+ <<-EOHTML
55
+ <a href="/#{platform}/cookie/append">Cookie</a>
56
+ EOHTML
57
+ end
57
58
 
58
- get '/cookie/append' do
59
- cookies['cookie'] ||= default
60
- get_result( cookies['cookie'] )
59
+ get "/#{platform}/cookie/append" do
60
+ cookies['cookie'] ||= default
61
+ get_result( cookies['cookie'] )
62
+ end
61
63
  end
64
+
@@ -14,6 +14,31 @@ shared_examples_for 'with_node' do |html|
14
14
  end
15
15
  end
16
16
 
17
+ describe '#html=' do
18
+ context 'when given' do
19
+ context String do
20
+ let(:string) { 'stuff' }
21
+
22
+ it 'recodes it' do
23
+ expect(string).to receive(:recode)
24
+ with_node.html = string
25
+ end
26
+
27
+ it 'sets the #html' do
28
+ with_node.html = string
29
+ with_node.html.should == string
30
+ end
31
+ end
32
+
33
+ context 'nil' do
34
+ it 'sets the #html' do
35
+ with_node.html = nil
36
+ with_node.html.should be_nil
37
+ end
38
+ end
39
+ end
40
+ end
41
+
17
42
  describe '#node' do
18
43
  it 'returns the set node' do
19
44
  node = with_node.node
@@ -0,0 +1,26 @@
1
+ shared_examples_for 'framework' do
2
+
3
+ before( :all ) do
4
+ @url = web_server_url_for( :auditor )
5
+ @f_url = web_server_url_for( :framework )
6
+
7
+ @options = Arachni::Options.instance
8
+ end
9
+
10
+ before( :each ) do
11
+ reset_options
12
+ @options.paths.reporters = fixtures_path + '/reporters/manager_spec/'
13
+ @options.paths.checks = fixtures_path + '/taint_check/'
14
+
15
+ @f = Arachni::Framework.new
16
+ @f.options.url = @url
17
+ end
18
+ after( :each ) do
19
+ File.delete( @snapshot ) rescue nil
20
+
21
+ @f.clean_up
22
+ @f.reset
23
+ end
24
+
25
+ subject { @f }
26
+ end
@@ -377,6 +377,8 @@ module Output
377
377
  else
378
378
  out.print "#{sign} #{str}\n"
379
379
  end
380
+
381
+ out.flush
380
382
  rescue
381
383
  end
382
384
  end
@@ -100,7 +100,7 @@ class OptionParser < UI::CLI::OptionParser
100
100
  end
101
101
 
102
102
  on( '--nickname NAME', 'Nickname for this Dispatcher.' ) do |name|
103
- options.dispatcher.node_name = name
103
+ options.dispatcher.node_nickname = name
104
104
  end
105
105
 
106
106
  separator ''
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: arachni
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.0.5
4
+ version: 1.0.6
5
5
  platform: ruby
6
6
  authors:
7
7
  - Tasos Laskos
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2014-11-13 00:00:00.000000000 Z
11
+ date: 2014-12-08 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: bundler
@@ -329,7 +329,6 @@ files:
329
329
  - components/checks/active/source_code_disclosure.rb
330
330
  - components/checks/active/sql_injection.rb
331
331
  - components/checks/active/sql_injection/patterns/access
332
- - components/checks/active/sql_injection/patterns/coldfusion
333
332
  - components/checks/active/sql_injection/patterns/db2
334
333
  - components/checks/active/sql_injection/patterns/emc
335
334
  - components/checks/active/sql_injection/patterns/firebird
@@ -645,6 +644,15 @@ files:
645
644
  - lib/arachni/error.rb
646
645
  - lib/arachni/ethon/easy.rb
647
646
  - lib/arachni/framework.rb
647
+ - lib/arachni/framework/parts/audit.rb
648
+ - lib/arachni/framework/parts/browser.rb
649
+ - lib/arachni/framework/parts/check.rb
650
+ - lib/arachni/framework/parts/data.rb
651
+ - lib/arachni/framework/parts/platform.rb
652
+ - lib/arachni/framework/parts/plugin.rb
653
+ - lib/arachni/framework/parts/report.rb
654
+ - lib/arachni/framework/parts/scope.rb
655
+ - lib/arachni/framework/parts/state.rb
648
656
  - lib/arachni/http.rb
649
657
  - lib/arachni/http/client.rb
650
658
  - lib/arachni/http/cookie_jar.rb
@@ -848,6 +856,15 @@ files:
848
856
  - spec/arachni/element/server_spec.rb
849
857
  - spec/arachni/element_filter_spec.rb
850
858
  - spec/arachni/error_spec.rb
859
+ - spec/arachni/framework/parts/audit_spec.rb
860
+ - spec/arachni/framework/parts/browser_spec.rb
861
+ - spec/arachni/framework/parts/check_spec.rb
862
+ - spec/arachni/framework/parts/data_spec.rb
863
+ - spec/arachni/framework/parts/platform_spec.rb
864
+ - spec/arachni/framework/parts/plugin_spec.rb
865
+ - spec/arachni/framework/parts/report_spec.rb
866
+ - spec/arachni/framework/parts/scope_spec.rb
867
+ - spec/arachni/framework/parts/state_spec.rb
851
868
  - spec/arachni/framework_spec.rb
852
869
  - spec/arachni/http/client_spec.rb
853
870
  - spec/arachni/http/cookie_jar_spec.rb
@@ -1295,6 +1312,7 @@ files:
1295
1312
  - spec/support/shared/element/capabilities/with_scope.rb
1296
1313
  - spec/support/shared/external/wavsep.rb
1297
1314
  - spec/support/shared/fingerprinter.rb
1315
+ - spec/support/shared/framework.rb
1298
1316
  - spec/support/shared/http/message.rb
1299
1317
  - spec/support/shared/option_group.rb
1300
1318
  - spec/support/shared/path_extractor.rb
@@ -1361,7 +1379,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
1361
1379
  version: '0'
1362
1380
  requirements: []
1363
1381
  rubyforge_project:
1364
- rubygems_version: 2.4.3
1382
+ rubygems_version: 2.4.4
1365
1383
  signing_key:
1366
1384
  specification_version: 4
1367
1385
  summary: Arachni is a feature-full, modular, high-performance Ruby framework aimed
@@ -1607,6 +1625,7 @@ test_files:
1607
1625
  - spec/support/shared/element/capabilities/auditable.rb
1608
1626
  - spec/support/shared/external/wavsep.rb
1609
1627
  - spec/support/shared/plugin.rb
1628
+ - spec/support/shared/framework.rb
1610
1629
  - spec/support/shared/reporter.rb
1611
1630
  - spec/support/shared/http/message.rb
1612
1631
  - spec/support/shared/path_extractor.rb
@@ -1840,6 +1859,15 @@ test_files:
1840
1859
  - spec/arachni/options_spec.rb
1841
1860
  - spec/arachni/trainer_spec.rb
1842
1861
  - spec/arachni/uri_spec.rb
1862
+ - spec/arachni/framework/parts/plugin_spec.rb
1863
+ - spec/arachni/framework/parts/browser_spec.rb
1864
+ - spec/arachni/framework/parts/scope_spec.rb
1865
+ - spec/arachni/framework/parts/report_spec.rb
1866
+ - spec/arachni/framework/parts/state_spec.rb
1867
+ - spec/arachni/framework/parts/platform_spec.rb
1868
+ - spec/arachni/framework/parts/check_spec.rb
1869
+ - spec/arachni/framework/parts/data_spec.rb
1870
+ - spec/arachni/framework/parts/audit_spec.rb
1843
1871
  - spec/arachni/browser_spec.rb
1844
1872
  - spec/arachni/snapshot_spec.rb
1845
1873
  - spec/arachni/typhoeus/hydra_spec.rb
@@ -1 +0,0 @@
1
- \[Macromedia\]\[SQLServer JDBC Driver\]