arachni 1.0.6 → 1.1

data/lib/arachni/component/options/multiple_choice.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/component/options/object.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/component/options/path.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/component/options/port.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/component/options/string.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/component/options/url.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/component/output.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/component/utilities.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/data.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/data/framework.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/data/framework/rpc.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/data/issues.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/data/plugins.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/data/session.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/base.rb

@@ -1,15 +1,14 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
     web site for more information on licensing and terms of use.
 =end
 
-module Arachni
-
 require 'nokogiri'
-require Options.paths.lib + 'nokogiri/xml/node'
+
+module Arachni
 
 module Element
 
@@ -153,6 +152,12 @@ class Base
         data.delete 'audit_options'
         data.delete 'scope'
         data['class'] = self.class.to_s
+
+        if data['initialization_options'].is_a? Hash
+            data['initialization_options'] =
+                data['initialization_options'].my_stringify_keys(false)
+        end
+
         data
     end
 
@@ -163,6 +168,7 @@ class Base
         data.each do |name, value|
             value = case name
                         when 'dom'
+                            next if !value
                             self::DOM.from_rpc_data( value )
 
                         when 'initialization_options'

data/lib/arachni/element/body.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -27,11 +27,6 @@ class Body < Base
     # @param    [Block] block
     #   Block to verify matches before logging, must return `true`/`false`.
     def match_and_log( patterns, &block )
-        elements = auditor.class.info[:elements]
-        elements = auditor.class::OPTIONS[:elements] if !elements || elements.empty?
-
-        return if !elements.include?( Body )
-
         [patterns].flatten.each do |pattern|
             auditor.page.body.scan( pattern ).flatten.uniq.compact.each do |proof|
                 next if block_given? && !block.call( proof )

data/lib/arachni/element/capabilities/analyzable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/capabilities/analyzable/differential.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -37,7 +37,9 @@ module Differential
 
         # Override global fuzzing settings and only use the default method of the
         # element under audit.
-        respect_method: true,
+        with_both_http_methods: false,
+        parameter_names:        false,
+        with_extra_parameter:   false,
 
         # Disable {Arachni::Options#audit_cookies_extensively}, there's little
         # to be gained in this case and just causes interference.
@@ -56,6 +58,8 @@ module Differential
         false:          '-1'
     }
 
+    attr_accessor :differential_analysis_options
+
     # Performs differential analysis and logs an issue should there be one.
     #
     #     opts = {
@@ -110,6 +114,7 @@ module Differential
             return false
         end
 
+        @differential_analysis_options = opts.dup
         opts = self.class::MUTATION_OPTIONS.merge( DIFFERENTIAL_OPTIONS.merge( opts ) )
 
         mutations_size = 0
@@ -153,6 +158,18 @@ module Differential
         true
     end
 
+    def dup
+        e = super
+        return e if !@differential_analysis_options
+
+        e.differential_analysis_options = @differential_analysis_options.dup
+        e
+    end
+
+    def to_rpc_data
+        super.tap { |data| data.delete 'differential_analysis_options' }
+    end
+
     private
 
     # Performs requests using the 'false' control seed and generates/stores
@@ -334,7 +351,7 @@ module Differential
         controls_verification = signatures.delete( :controls_verification )
         corrupted             = signatures.delete( :corrupted )
 
-        signatures.each do |_, data|
+        signatures.each do |pair_hash, data|
             data.each do |input, result|
                 next if !result[:response] || result[:corrupted] || corrupted[input]
 
@@ -358,11 +375,29 @@ module Differential
 
                 # Check to see if the `true` response we're analyzing
                 # is a custom 404 page.
-                http.custom_404?( result[:response] ) do |is_custom_404|
+                http.dynamic_404_handler._404?( result[:response] ) do |is_custom_404|
                     # If this is a custom 404 page bail out.
                     next if is_custom_404
-                    @auditor.log vector: result[:mutation],
-                                 response: result[:response]
+
+                    options = result[:mutation].differential_analysis_options
+                    pair    = options[:pairs].find { |pair| pair.hash == pair_hash }
+
+                    issue_data = {
+                        vector:   result[:mutation],
+                        response: result[:response]
+                    }
+
+                    if pair
+                        issue_data[:remarks] = {
+                            :differential_analysis => [
+                                "True expression: #{pair.keys.first}",
+                                "False expression: #{pair.values.first}",
+                                "Control false expression: #{options[:false]}"
+                            ]
+                        }
+                    end
+
+                    @auditor.log( issue_data )
                 end
             end
         end

data/lib/arachni/element/capabilities/analyzable/taint.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -161,7 +161,11 @@ module Taint
             return if !opts[:downcased_body].include?( longest_word_for_regexp( regexp ) )
         end
 
-        match_data = response.body.scan( regexp ).flatten.first.to_s
+        match_data = response.body.match( regexp )
+        return if !match_data
+
+        match_data = match_data[0].to_s
+
         return if match_data.to_s.empty? || ignore?( response, opts )
 
         @candidate_issues << {
@@ -194,6 +198,10 @@ module Taint
 
             # Grab an untainted response.
             submit do |response|
+                # Something has gone wrong, timed-out request or closed connection.
+                # If we can't verify the issue bail out...
+                next if response.code == 0
+
                 while (issue = @candidate_issues.pop)
                     # If the body of the control response matches the proof
                     # of the current issue don't bother, it'll be a coincidence

data/lib/arachni/element/capabilities/analyzable/timeout.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -77,7 +77,7 @@ module Timeout
             @candidates_phase_3    = []
             @phase_3_candidate_ids = Support::LookUp::HashSet.new( hasher: :timeout_id )
 
-            @logged = Support::LookUp::HashSet.new( hasher: :audit_id )
+            @logged = Support::LookUp::HashSet.new( hasher: :timeout_id )
 
             deduplicate
         end
@@ -177,8 +177,27 @@ module Timeout
 
                 @logged << elem
 
+                remarks = []
+
+                delays = elem.timing_attack_remark_data[:delays].
+                    map { |d| d / 1000.0 }
+                remarks << ('Delays (in seconds) used for each phase: ' <<
+                    delays.join(', '))
+
+                controls = elem.timing_attack_remark_data[:control_times]
+                remarks << ('Response times (in seconds) for control requests ' <<
+                    "prior to phases 2 & 3: #{controls.join(', ')}")
+
+                stabilizations = elem.timing_attack_remark_data[:stabilization_times]
+                remarks << ('Response times (in seconds) for stabilization ' <<
+                    "requests after each phase: #{stabilizations.join(', ')}")
+
                 elem.print_info '* Verification was successful.'
-                elem.auditor.log vector: elem, response: response
+                elem.auditor.log(
+                    vector:   elem,
+                    response: response,
+                    remarks:  { timing_attack: remarks }
+                )
             end
         end
 
@@ -197,6 +216,18 @@ module Timeout
 
     end
 
+    attr_accessor :timing_attack_remark_data
+
+    def initialize(*)
+        super
+
+        @timing_attack_remark_data = {
+            control_times:       [],
+            stabilization_times: [],
+            delays:              []
+        }
+    end
+
     # Performs timeout/time-delay analysis and logs an issue should there be one.
     #
     # @param  [String, Array<String>, Hash{Symbol => <String, Array<String>>}]  payloads
@@ -277,6 +308,8 @@ module Timeout
             print_bad "#{prepend}Max waiting time exceeded."
             false
         else
+            @timing_attack_remark_data[:stabilization_times] << response.time
+
             print_info "#{prepend}OK, got a response after #{response.time} seconds."
             true
         end
@@ -299,8 +332,8 @@ module Timeout
             # any interference during timing attacks.
             skip_original:     true,
 
-            # Disable {Arachni::OptionGroups::Audit#cookies_extensively}, there's little
-            # to be gained in this case and just causes interference.
+            # Disable {Arachni::OptionGroups::Audit#cookies_extensively},
+            # there's little to be gained in this case and just causes interference.
             extensively:       false,
 
             # Intercept each element mutation prior to it being submitted and
@@ -331,6 +364,8 @@ module Timeout
 
         audit( payloads, options ) do |response, mutation|
             next if !response.timed_out?
+
+            mutation.timing_attack_remark_data[:delays] << options[:delay]
             block.call( mutation, response )
         end
     end
@@ -376,7 +411,7 @@ module Timeout
         # doesn't time out by default.
         #
         # If it does, then there's no way for us to test it reliably.
-        if_timeout_control_check_ok timeout do
+        if_timeout_control_check_ok seed, timeout do
 
             # Update our candidate mutation's affected input with the new payload.
             self.affected_input_value = payload
@@ -392,6 +427,7 @@ module Timeout
                     next
                 end
 
+                @timing_attack_remark_data[:delays] << timeout
                 block.call( response )
 
                 ensure_responsiveness
@@ -401,17 +437,34 @@ module Timeout
         http.run
     end
 
+    def dup
+        e = super
+        return e if !@timing_attack_remark_data
+
+        e.timing_attack_remark_data = @timing_attack_remark_data.deep_clone
+        e
+    end
+
+    def to_rpc_data
+        super.tap { |data| data.delete 'timing_attack_remark_data' }
+    end
+
     private
 
-    def if_timeout_control_check_ok( timeout, &block )
+    def if_timeout_control_check_ok( seed, timeout, &block )
         print_info '* Performing control check.'
 
-        timeout_control.submit( response_max_size: 0, timeout: timeout ) do |control|
+        # Use a real payload with a delay of 0, this way we can avoid getting
+        # tricked by WAFs/IDS/IPS dropping packets.
+        self.affected_input_value = seed.sub( '__TIME__', '0' )
+        submit( response_max_size: 0, timeout: timeout ) do |control|
             if control.timed_out?
                 print_info '* Control check failed, aborting.'
                 next
             end
 
+            @timing_attack_remark_data[:control_times] << control.time
+
             print_info '* Control check was successful, progressing' <<
                            ' to verification.'
 

data/lib/arachni/element/capabilities/auditable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -326,7 +326,7 @@ module Auditable
 
         # Iterate over all fuzz variations and audit each one.
         each_mutation( payload, @audit_options ) do |elem|
-            if !Options.audit.vector?( elem.affected_input_name )
+            if !audit_input?( elem.affected_input_name )
                 print_info "Skipping audit of out of scope '#{elem.affected_input_name}' #{type} input vector."
                 next
             end
@@ -377,6 +377,13 @@ module Auditable
         true
     end
 
+    def audit_input?( path )
+        [path].flatten.each do |name|
+            return false if !Options.audit.vector?( name )
+        end
+        true
+    end
+
     # Checks whether or not an audit has been already performed.
     #
     # @param  [String]  elem_audit_id