arachni 1.0.6 → 1.1

data/components/reporters/plugin_formatters/html/waf_detector.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/plugin_formatters/stdout/autologin.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/plugin_formatters/stdout/content_types.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/plugin_formatters/stdout/cookie_collector.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/plugin_formatters/stdout/exec.rb

@@ -0,0 +1,26 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+class Arachni::Reporters::Stdout
+
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+class PluginFormatters::Exec < Arachni::Plugin::Formatter
+
+    def run
+        results.each do |stage, data|
+            print_status "#{stage}: #{data['executable']}"
+            print_info "Status:  #{data['status']}"
+            print_info "PID:     #{data['pid']}"
+            print_info "Runtime: #{data['runtime']}"
+            print_info "STDOUT:  #{data['stdout']}"
+            print_info "STDERR:  #{data['stderr']}"
+        end
+    end
+
+end
+end

data/components/reporters/plugin_formatters/stdout/form_dicattack.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/plugin_formatters/stdout/healthmap.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/plugin_formatters/stdout/http_dicattack.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/plugin_formatters/stdout/login_script.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/plugin_formatters/stdout/uncommon_headers.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/plugin_formatters/stdout/uniformity.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/plugin_formatters/stdout/vector_collector.rb

@@ -0,0 +1,40 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+class Arachni::Reporters::Stdout
+
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+class PluginFormatters::VectorCollector < Arachni::Plugin::Formatter
+
+    def run
+        results.each do |url, elements|
+            print_status url
+            print_status '-' * 80
+
+            elements.each do |element|
+                print_info "#{element['type']} pointing to #{element['action']}"
+
+                if (element['inputs'] || {}).any?
+                    element['inputs'].each do |name, value|
+                        print_info "    #{name.inspect} => #{value.inspect}"
+                    end
+                end
+
+                if element['source']
+                    print_info element['source']
+                end
+
+                print_line
+            end
+
+            print_line
+        end
+    end
+
+end
+end

data/components/reporters/plugin_formatters/stdout/waf_detector.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/plugin_formatters/xml/autologin.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/plugin_formatters/xml/content_types.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/plugin_formatters/xml/cookie_collector.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/plugin_formatters/xml/exec.rb

@@ -0,0 +1,26 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+class Arachni::Reporters::XML
+
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+class PluginFormatters::Exec < Arachni::Plugin::Formatter
+
+    def run( xml )
+        results.each do |stage, data|
+            xml.outcome {
+                xml.stage stage
+                data.each do |name, value|
+                    xml.send( name, value )
+                end
+            }
+        end
+    end
+
+end
+end

data/components/reporters/plugin_formatters/xml/form_dicattack.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/plugin_formatters/xml/healthmap.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/plugin_formatters/xml/http_dicattack.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/plugin_formatters/xml/login_script.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/plugin_formatters/xml/uncommon_headers.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/plugin_formatters/xml/uniformity.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/plugin_formatters/xml/vector_collector.rb

@@ -0,0 +1,44 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+class Arachni::Reporters::XML
+
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+class PluginFormatters::VectorCollector < Arachni::Plugin::Formatter
+
+    def run( xml )
+        results.each do |url, vectors|
+            vectors.each do |vector|
+                xml.vector {
+                    xml.class_ vector['class']
+                    xml.type vector['type']
+                    xml.url vector['url']
+                    xml.action vector['action']
+
+                    if vector['source']
+                        xml.source vector['source']
+                    end
+
+                    if vector['method']
+                        xml.method_ vector['method']
+                    end
+
+                    if vector['inputs']
+                        xml.inputs {
+                            vector['inputs'].each do |k, v|
+                                xml.input( name: k, value: v )
+                            end
+                        }
+                    end
+                }
+            end
+        end
+    end
+
+end
+end

data/components/reporters/plugin_formatters/xml/waf_detector.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/stdout.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/txt.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/xml.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -11,7 +11,7 @@ require 'nokogiri'
 # Creates an XML report of the audit.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.3
+# @version 0.3.3
 class Arachni::Reporters::XML < Arachni::Reporter::Base
 
     LOCAL_SCHEMA  = File.dirname( __FILE__ ) + '/xml/schema.xsd'
@@ -44,6 +44,12 @@ class Arachni::Reporters::XML < Arachni::Reporter::Base
                             xml.remedy_code issue.remedy_code
                             xml.severity issue.severity
 
+                            xml.check {
+                                %w(name description author version shortname).each do |attr|
+                                    xml.send( attr, issue.check[attr.to_sym] )
+                                end
+                            }
+
                             if issue.cwe
                                 xml.cwe issue.cwe
                             end
@@ -63,8 +69,8 @@ class Arachni::Reporters::XML < Arachni::Reporter::Base
                                 xml.url vector.url
                                 xml.action vector.action
 
-                                if vector.respond_to? :html
-                                    xml.html vector.html
+                                if vector.respond_to? :source
+                                    xml.source vector.source
                                 end
 
                                 if issue.active?
@@ -101,9 +107,11 @@ class Arachni::Reporters::XML < Arachni::Reporter::Base
 
                                         xml.remarks {
                                             variation.remarks.each do |commenter, remarks|
-                                                xml.commenter commenter
                                                 remarks.each do |remark|
-                                                    xml.remark remark
+                                                    xml.remark {
+                                                        xml.commenter commenter
+                                                        xml.text_ remark
+                                                    }
                                                 end
                                             end
                                         }
@@ -125,7 +133,7 @@ class Arachni::Reporters::XML < Arachni::Reporter::Base
 
                 xml.plugins {
                     format_plugin_results( false ) do |name, formatter|
-                        xml.send( name ) {
+                        xml.send( "#{name}_" ) {
                             xml.name report.plugins[name][:name]
                             xml.description report.plugins[name][:description]
 
@@ -145,6 +153,7 @@ class Arachni::Reporters::XML < Arachni::Reporter::Base
             ap error
             has_errors = true
         end
+
         fail 'XML report could not be validated against the XSD.' if has_errors
 
         IO.binwrite( outfile, xml )
@@ -157,7 +166,7 @@ class Arachni::Reporters::XML < Arachni::Reporter::Base
             description:  %q{Exports the audit results as an XML (.xml) file.},
             content_type: 'text/xml',
             author:       'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:      '0.3',
+            version:      '0.3.3',
             options:      [ Options.outfile( '.xml' ), Options.skip_responses ]
         }
     end
@@ -226,7 +235,7 @@ class Arachni::Reporters::XML < Arachni::Reporter::Base
                         xml.transition {
                             xml.element transition.element
                             xml.event transition.event
-                            xml.time transition.time.round( 4 )
+                            xml.time transition.time.to_f.round( 4 )
                         }
                     end
                 }

data/components/reporters/xml/schema.xsd

@@ -33,9 +33,53 @@
             <xs:element name="uncommon_headers" type="plugin_uncommon_headers" maxOccurs="1"/>
             <xs:element name="uniformity" type="plugin_uniformity" maxOccurs="1"/>
             <xs:element name="waf_detector" type="plugin_waf_detector" maxOccurs="1"/>
+            <xs:element name="vector_collector" type="plugin_vector_collector" maxOccurs="1"/>
+            <xs:element name="exec" type="plugin_exec" maxOccurs="1"/>
         </xs:choice>
     </xs:complexType>
 
+    <xs:complexType name="plugin_exec">
+        <xs:all>
+            <xs:element name="name" type="xs:string"/>
+            <xs:element name="description" type="xs:string"/>
+            <xs:element name="results" type="plugin_exec_results"/>
+        </xs:all>
+    </xs:complexType>
+
+    <xs:complexType name="plugin_exec_results">
+        <xs:sequence>
+            <xs:element name="outcome" minOccurs="0" maxOccurs="unbounded"
+                        type="plugin_exec_results_outcome"/>
+        </xs:sequence>
+    </xs:complexType>
+
+    <xs:complexType name="plugin_exec_results_outcome">
+        <xs:all>
+            <xs:element name="stage" minOccurs="0" type="xs:string"/>
+            <xs:element name="executable" minOccurs="0" type="xs:string"/>
+            <xs:element name="status" minOccurs="0" type="xs:integer"/>
+            <xs:element name="pid" minOccurs="0" type="xs:integer"/>
+            <xs:element name="runtime" minOccurs="0" type="xs:float"/>
+            <xs:element name="stdout" minOccurs="0" type="xs:string"/>
+            <xs:element name="stderr" minOccurs="0" type="xs:string"/>
+        </xs:all>
+    </xs:complexType>
+
+    <xs:complexType name="plugin_vector_collector">
+        <xs:all>
+            <xs:element name="name" type="xs:string"/>
+            <xs:element name="description" type="xs:string"/>
+            <xs:element name="results" type="plugin_vector_collector_results"/>
+        </xs:all>
+    </xs:complexType>
+
+    <xs:complexType name="plugin_vector_collector_results">
+        <xs:sequence>
+            <xs:element name="vector" minOccurs="0" maxOccurs="unbounded"
+                        type="vector"/>
+        </xs:sequence>
+    </xs:complexType>
+
     <xs:complexType name="plugin_waf_detector">
         <xs:all>
             <xs:element name="name" type="xs:string"/>
@@ -265,6 +309,20 @@
             <xs:element name="vector" type="vector"/>
             <xs:element name="digest" type="xs:integer"/>
             <xs:element name="variations" type="issuevariations"/>
+            <xs:element name="check" type="check"/>
+        </xs:all>
+    </xs:complexType>
+
+    <!--
+        Check information.
+    -->
+    <xs:complexType name="check">
+        <xs:all>
+            <xs:element name="name" type="xs:string"/>
+            <xs:element name="description" type="xs:string"/>
+            <xs:element name="author" type="xs:string"/>
+            <xs:element name="version" type="xs:string"/>
+            <xs:element name="shortname" type="xs:string"/>
         </xs:all>
     </xs:complexType>
 
@@ -304,10 +362,11 @@
             <xs:element name="url" type="xs:anyURI"/>
 
             <!--
-                HTML representation of the element according to the page
-                at "url".
+                Source representation of the element according to the page
+                at "url". This depends based on the type of element, can be HTML,
+                JSON, XML, whatever.
             -->
-            <xs:element name="html" type="xs:string" minOccurs="0"/>
+            <xs:element name="source" type="xs:string" minOccurs="0"/>
 
             <!--
                 Unlike "url", this is the location that will be requested
@@ -406,18 +465,22 @@
     </xs:complexType>
 
     <!--
-        System components can attach remarks on issues, usually to explain
-        why an issue has been flagged as untrusted.
+        System components can attach remarks on issues.
     -->
     <xs:complexType name="remarks">
         <xs:sequence>
-            <xs:element name="commenter" type="xs:string"
-                        minOccurs="0" maxOccurs="1"/>
-            <xs:element name="remark" type="xs:string"
+            <xs:element name="remark" type="remark"
                         minOccurs="0" maxOccurs="unbounded"/>
         </xs:sequence>
     </xs:complexType>
 
+    <xs:complexType name="remark">
+        <xs:all>
+            <xs:element name="commenter" type="xs:string"/>
+            <xs:element name="text" type="xs:string"/>
+        </xs:all>
+    </xs:complexType>
+
     <!--
         This is details on the state of the logged vector when
         an "issuevariation" was identified.
@@ -641,6 +704,8 @@
             <xs:enumeration value="Arachni::Element::LinkTemplate" />
             <xs:enumeration value="Arachni::Element::LinkTemplate::DOM"/>
             <xs:enumeration value="Arachni::Element::GenericDOM" />
+            <xs:enumeration value="Arachni::Element::JSON" />
+            <xs:enumeration value="Arachni::Element::XML" />
         </xs:restriction>
     </xs:simpleType>