arachni 1.0.6 → 1.1

data/lib/arachni/element/form/capabilities/auditable.rb

@@ -0,0 +1,45 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+module Arachni::Element
+class Form
+module Capabilities
+
+# Extends {Arachni::Element::Capabilities::Auditable} with {Form}-specific
+# functionality.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+module Auditable
+    include Arachni::Element::Capabilities::Auditable
+
+    def audit_status_message
+        override = nil
+        if mutation_with_original_values?
+            override = 'original'
+        elsif mutation_with_sample_values?
+            override = 'sample'
+        end
+
+        if override
+            "Submitting form with #{override} values for #{inputs.keys.join(', ')}" <<
+                " at '#{@action}'."
+        else
+            super
+        end
+    end
+
+    # @param   (see Capabilities::Auditable#audit_id)
+    # @return  (see Capabilities::Auditable#audit_id)
+    def audit_id( payload = nil )
+        force_train? ? id : super( payload )
+    end
+
+end
+end
+end
+end

data/lib/arachni/element/form/capabilities/mutable.rb

@@ -0,0 +1,126 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+module Arachni::Element
+class Form
+module Capabilities
+
+# Extends {Arachni::Element::Capabilities::Mutable} with {Form}-specific
+# functionality.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+module Mutable
+    include Arachni::Element::Capabilities::Mutable
+
+    # @return   [Bool]
+    #   `true` if the element has not been mutated, `false` otherwise.
+    def mutation_with_original_values?
+        !!@mutation_with_original_values
+    end
+
+    def mutation_with_original_values
+        @mutation_with_original_values = true
+    end
+
+    # @return   [Bool]
+    #   `true` if the element has been populated with sample
+    #   ({Arachni::OptionGroups::Input.fill}) values, `false` otherwise.
+    #
+    # @see Arachni::OptionGroups::Input
+    def mutation_with_sample_values?
+        !!@mutation_with_sample_values
+    end
+
+    def mutation_with_sample_values
+        @mutation_with_sample_values = true
+    end
+
+    # Overrides {Arachni::Element::Mutable#each_mutation} adding support
+    # for mutations with:
+    #
+    # * Sample values (filled by {Arachni::OptionGroups::Input.fill}).
+    # * Original values.
+    # * Password fields requiring identical values (in order to pass
+    #   server-side validation)
+    #
+    # @param    [String]    payload
+    #   Payload to inject.
+    # @param    [Hash]      opts
+    #   Mutation options.
+    # @option   opts    [Bool]  :skip_original
+    #   Whether or not to skip adding a mutation holding original values and
+    #   sample values.
+    #
+    # @param (see Capabilities::Mutable#each_mutation)
+    # @return (see Capabilities::Mutable#each_mutation)
+    # @yield (see Capabilities::Mutable#each_mutation)
+    # @yieldparam (see Capabilities::Mutable#each_mutation)
+    #
+    # @see Capabilities::Mutable#each_mutation
+    # @see Arachni::OptionGroups::Input.fill
+    def each_mutation( payload, opts = {} )
+        opts = MUTATION_OPTIONS.merge( opts )
+
+        generated = Arachni::Support::LookUp::HashSet.new( hasher: :mutable_id )
+
+        # Completely remove fake inputs prior to mutation generation, they'll
+        # be restored at the end of this method.
+        pre_inputs = @inputs
+        @inputs    = @inputs.reject{ |name, _| fake_field?( name ) }
+
+        super( payload, opts ) do |elem|
+            elem.mirror_password_fields
+            yield elem if !generated.include?( elem )
+            generated << elem
+        end
+
+        return if opts[:skip_original]
+
+        elem = self.dup
+        elem.mutation_with_original_values
+        elem.affected_input_name = ORIGINAL_VALUES
+        yield elem if !generated.include?( elem )
+        generated << elem
+
+        # Default values, in case they reveal new resources.
+        if node
+            inputs.keys.each do |input|
+                next if field_type_for( input ) != :select
+
+                node.xpath( "select[@name=\"#{input}\"]" ).css('option').each do |option|
+                    try_input do
+                        elem = self.dup
+                        elem.mutation_with_original_values
+                        elem.affected_input_name  = input
+                        elem.affected_input_value = option['value'] || option.text
+                        yield elem if !generated.include?( elem )
+                        generated << elem
+                    end
+                end
+
+            end
+        end
+
+        try_input do
+            # Sample values, in case they reveal new resources.
+            elem = self.dup
+            elem.inputs = Arachni::Options.input.fill( inputs.dup )
+            elem.affected_input_name = SAMPLE_VALUES
+            elem.mutation_with_sample_values
+            yield elem if !generated.include?( elem )
+            generated << elem
+        end
+    ensure
+        @inputs = pre_inputs
+    end
+
+end
+end
+end
+end
+

data/lib/arachni/element/form/capabilities/submittable.rb

@@ -0,0 +1,36 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+module Arachni::Element
+class Form
+module Capabilities
+
+# Extends {Arachni::Element::Capabilities::Submittable} with {Form}-specific
+# functionality.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+module Submittable
+    include Arachni::Element::Capabilities::Submittable
+
+    # @param    (see Arachni::Element::Capabilities::Submittable#action=)
+    # @@return  (see Arachni::Element::Capabilities::Submittable#action=)
+    def action=( url )
+        if self.method == :get
+            rewritten   = uri_parse( url ).rewrite
+            self.inputs = rewritten.query_parameters.merge( self.inputs || {} )
+
+            super rewritten.without_query
+        else
+            super url
+        end
+    end
+
+end
+end
+end
+end

data/lib/arachni/element/form/capabilities/with_dom.rb

@@ -0,0 +1,32 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+module Arachni::Element
+class Form
+module Capabilities
+
+# Extends {Arachni::Element::Capabilities::WithDOM} with {Form}-specific
+# functionality.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+module WithDOM
+    include Arachni::Element::Capabilities::WithNode
+    include Arachni::Element::Capabilities::WithDOM
+
+    # @return   [DOM]
+    def dom
+        return @dom if @dom
+        return if !node || inputs.empty?
+        super
+    end
+
+end
+
+end
+end
+end

data/lib/arachni/element/form/dom.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -9,16 +9,21 @@
 module Arachni::Element
 class Form
 
-# Provides access to DOM operations for {Form forms}.
+# Extends {Arachni::Element::Capabilities::Auditable::DOM} with {Form}-specific
+# functionality.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 class DOM < Base
-    include Capabilities::Auditable::DOM
+    include Arachni::Element::Capabilities::WithNode
+    include Arachni::Element::Capabilities::Auditable::DOM
 
     def initialize( options )
         super
 
-        self.inputs     = (options[:inputs] || self.parent.inputs).dup
+        inputs = (options[:inputs] || self.parent.inputs).dup
+        @valid_input_names = inputs.keys.map(&:to_s)
+
+        self.inputs     = inputs
         @default_inputs = self.inputs.dup.freeze
     end
 
@@ -27,6 +32,10 @@ class DOM < Base
         browser.fire_event element, :submit, inputs: inputs.dup
     end
 
+    def valid_input_name?( name )
+        @valid_input_names.include? name.to_s
+    end
+
     def encode( *args )
         Form.encode( *args )
     end

data/lib/arachni/element/generic_dom.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -17,6 +17,7 @@ module Arachni::Element
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 class GenericDOM < Base
+    include Capabilities::WithSource
     include Capabilities::WithAuditor
 
     # @return   [Page::DOM::Transition]
@@ -31,6 +32,7 @@ class GenericDOM < Base
         @transition = options[:transition]
         fail 'Missing element locator.' if !@transition
 
+        self.source = element.to_s
         @initialization_options = options
     end
 
@@ -93,8 +95,8 @@ class GenericDOM < Base
     def to_rpc_data
         data = super
         data['initialization_options'] = data['initialization_options'].dup
-        data['initialization_options'][:transition] =
-            data['initialization_options'][:transition].to_rpc_data
+        data['initialization_options']['transition'] =
+            data['initialization_options']['transition'].to_rpc_data
         data
     end
 

data/lib/arachni/element/header.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -16,7 +16,9 @@ module Arachni::Element
 class Header < Base
     include Capabilities::Analyzable
 
-    INVALID_INPUT_DATA = [ "\0" ]
+    INVALID_INPUT_DATA     = [ "\0" ]
+    ENCODE_CHARACTERS      = ["\n", "\r"]
+    ENCODE_CHARACTERS_LIST = ENCODE_CHARACTERS.join
 
     def initialize( options )
         super( options )
@@ -39,21 +41,21 @@ class Header < Base
     # @yieldparam (see Capabilities::Mutable#each_mutation)
     #
     # @see Capabilities::Mutable#each_mutation
-    def each_mutation( payload, opts = {}, &block )
-        flip = opts.delete( :param_flip )
-        super( payload, opts, &block )
+    def each_mutation( payload, options = {}, &block )
+        parameter_names = options.delete( :parameter_names )
+        super( payload, options, &block )
 
-        return if !flip
+        return if !parameter_names
 
         if !valid_input_name_data?( payload )
             print_debug_level_2 'Payload not supported as input name by' <<
                                     " #{audit_id}: #{payload.inspect}"
             return
         end
-        
+
         elem = self.dup
-        elem.affected_input_name = 'Parameter flip'
-        elem.inputs = { payload => seed }
+        elem.affected_input_name = FUZZ_NAME
+        elem.inputs = { payload => FUZZ_NAME_VALUE }
         yield elem
     end
 
@@ -74,8 +76,11 @@ class Header < Base
     end
 
     class <<self
-        def encode( header )
-            ::URI.encode( header.to_s, "\r\n" )
+        def encode( str )
+            str = str.to_s
+            return str if !ENCODE_CHARACTERS.find { |c| str.include? c }
+
+            ::URI.encode( str, ENCODE_CHARACTERS_LIST )
         end
 
         def decode( header )

data/lib/arachni/element/json.rb

@@ -0,0 +1,145 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+require 'rack'
+require 'rack/typhoeus/middleware/params_decoder'
+require_relative 'base'
+
+module Arachni::Element
+
+# Represents an auditable JSON element
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+class JSON < Base
+    # Load and include all JSON-specific capability overrides.
+    lib = "#{File.dirname( __FILE__ )}/#{File.basename(__FILE__, '.rb')}/capabilities/**/*.rb"
+    Dir.glob( lib ).each { |f| require f }
+
+    # Generic element capabilities.
+    include Arachni::Element::Capabilities::Analyzable
+    include Arachni::Element::Capabilities::WithSource
+
+    # JSON-specific overrides.
+    include Capabilities::Inputtable
+    include Capabilities::Mutable
+
+    # @param    [Hash]    options
+    # @option   options [String]    :url
+    #   URL of the page which includes the link.
+    # @option   options [String]    :action
+    #   Link URL -- defaults to `:url`.
+    # @option   options [Hash]    :inputs
+    #   Query parameters as `name => value` pairs. If none have been provided
+    #   they will automatically be extracted from {#action}.
+    def initialize( options )
+        self.http_method = options[:method] || :post
+
+        super( options )
+
+        self.inputs = (self.inputs || {}).merge( options[:inputs] || {} )
+
+        if @source && self.inputs.empty?
+            self.inputs = JSON.load( self.source )
+        end
+
+        @default_inputs = self.inputs.dup.freeze
+    end
+
+    #   JSON formatted {#inputs}.
+    def to_json
+        @inputs.to_json
+    end
+
+    def to_h
+        super.merge( source: @source )
+    end
+
+    # @return   [Hash]
+    #   Simple representation of self in the form of `{ {#action} => {#inputs} }`.
+    def simple
+        { self.action => self.inputs }
+    end
+
+    # @param   (see .encode)
+    # @return  (see .encode)
+    #
+    # @see .encode
+    def encode( *args )
+        self.class.encode( *args )
+    end
+
+    # @param   (see .decode)
+    # @return  (see .decode)
+    #
+    # @see .decode
+    def decode( *args )
+        self.class.decode( *args )
+    end
+
+    def dup
+        super.tap { |e| e.inputs = @inputs.deep_clone }
+    end
+
+    class <<self
+
+        # No-op
+        def encode( v )
+            v
+        end
+
+        # No-op
+        def decode( v )
+            v
+        end
+
+        # Extracts JSON elements from an HTTP request.
+        #
+        # @param   [Arachni::HTTP::Request]    request
+        #
+        # @return   [JSON, nil]
+        def from_request( url, request )
+            return if !request.body.is_a?( String ) || request.body.empty?
+
+            data =  begin
+                ::JSON.load( request.body )
+            rescue ::JSON::ParserError
+            end
+
+            return if !data || data.empty?
+
+            new(
+                url:    url,
+                action: request.url,
+                method: request.method,
+                inputs: data,
+                source: request.body
+            )
+        end
+
+    end
+
+    private
+
+    def http_request( opts, &block )
+        opts = opts.dup
+        opts.delete :parameters
+        opts.merge!(
+            headers: {
+                'Content-Type' => 'application/json'
+            }
+        )
+
+        opts[:body]   = self.to_json
+        opts[:method] = self.http_method
+        http.request( self.action, opts, &block )
+    end
+
+end
+end
+
+Arachni::JSON = Arachni::Element::JSON