arachni 1.0.6 → 1.1

data/components/checks/active/rfi.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -8,12 +8,8 @@
 
 # Simple Remote File Inclusion (and tutorial) check.
 #
-# It audits links, forms and cookies and will give you a good idea
-# of how to write checks for Arachni.
-#
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-#
-# @version 0.3
+# @version 0.3.1
 #
 # @see http://cwe.mitre.org/data/definitions/94.html
 # @see http://projects.webappsec.org/Remote-File-Inclusion
@@ -108,9 +104,9 @@ the HTTP response body.
             #
             # If you want the check to run no-matter what, leave the array
             # empty or don't define it at all.
-            elements:    [ Element::Form, Element::Link, Element::Cookie, Element::Header ],
+            elements:    ELEMENTS_WITH_INPUTS - [Element::LinkTemplate],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.3',
+            version:     '0.3.1',
 
             issue:       {
                 name:        %q{Remote File Inclusion},

data/components/checks/active/session_fixation.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/checks/active/source_code_disclosure.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -11,8 +11,7 @@
 # source code.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-#
-# @version 0.2.1
+# @version 0.2.2
 #
 # @see http://cwe.mitre.org/data/definitions/540.html
 class Arachni::Checks::SourceCodeDisclosure < Arachni::Check::Base
@@ -91,8 +90,12 @@ class Arachni::Checks::SourceCodeDisclosure < Arachni::Check::Base
     end
 
     def prepare
+        candidate_paths  = page.paths
+        candidate_paths |= page.jsons.map(&:action)
+        candidate_paths |= page.xmls.map(&:action)
+
         # Let's look for fresh a payload -- i.e. an identifiable server-side resource.
-        page.paths.each do |path|
+        candidate_paths.each do |path|
             parsed_path = uri_parse( path )
             next if !self.class.supported_extensions.include?( parsed_path.resource_extension )
 
@@ -116,10 +119,9 @@ class Arachni::Checks::SourceCodeDisclosure < Arachni::Check::Base
 It tries to identify whether or not the web application can be forced to reveal
 source code.
 },
-            elements:    [ Element::Form, Element::Link, Element::Cookie,
-                           Element::Header, Element::LinkTemplate ],
+            elements:    ELEMENTS_WITH_INPUTS,
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.2.1',
+            version:     '0.2.2',
             platforms:   options[:regexp].keys,
 
             issue:       {

data/components/checks/active/sql_injection.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -9,14 +9,13 @@
 # SQL Injection check.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-#
-# @version 0.2.1
+# @version 0.2.2
 #
 # @see http://cwe.mitre.org/data/definitions/89.html
 # @see http://unixwiz.net/techtips/sql-injection.html
 # @see http://en.wikipedia.org/wiki/SQL_injection
 # @see http://www.securiteam.com/securityreviews/5DP0N1P76E.html
-# @see http://www.owasp.org/index.php/SQL_Injection
+# @see https://www.owasp.org/index.php/SQL_Injection
 class Arachni::Checks::SqlInjection < Arachni::Check::Base
 
     def self.error_patterns
@@ -48,7 +47,6 @@ class Arachni::Checks::SqlInjection < Arachni::Check::Base
             format:                    [Format::APPEND],
             regexp:                    error_patterns,
             ignore:                    ignore_patterns,
-            param_flip:                true,
             longest_word_optimization: true
         }
     end
@@ -63,10 +61,9 @@ class Arachni::Checks::SqlInjection < Arachni::Check::Base
             description: %q{
 SQL injection check, uses known SQL DB errors to identify vulnerabilities.
 },
-            elements:    [Element::Link, Element::Form, Element::Cookie,
-                          Element::Header, Element::LinkTemplate ],
+            elements:    ELEMENTS_WITH_INPUTS,
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.2.1',
+            version:     '0.2.2',
             platforms:   options[:regexp].keys,
 
             issue:       {
@@ -97,7 +94,7 @@ the request with a database related error.
                     'UnixWiz'    => 'http://unixwiz.net/techtips/sql-injection.html',
                     'Wikipedia'  => 'http://en.wikipedia.org/wiki/SQL_injection',
                     'SecuriTeam' => 'http://www.securiteam.com/securityreviews/5DP0N1P76E.html',
-                    'OWASP'      => 'http://www.owasp.org/index.php/SQL_Injection',
+                    'OWASP'      => 'https://www.owasp.org/index.php/SQL_Injection',
                     'WASC'       => 'http://projects.webappsec.org/w/page/13246963/SQL%20Injection',
                     'W3 Schools' => 'http://www.w3schools.com/sql/sql_injection.asp'
                 },

data/components/checks/active/sql_injection_differential.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -18,7 +18,7 @@
 #
 # @see http://cwe.mitre.org/data/definitions/89.html
 # @see http://capec.mitre.org/data/definitions/7.html
-# @see http://www.owasp.org/index.php/Blind_SQL_Injection
+# @see https://www.owasp.org/index.php/Blind_SQL_Injection
 class Arachni::Checks::SqlInjectionDifferential < Arachni::Check::Base
 
     prefer :sql_injection
@@ -88,7 +88,7 @@ that if vulnerable, result in the responses for each injection being different.
 This is known as a blind SQL injection vulnerability.
 },
                 references:  {
-                    'OWASP'         => 'http://www.owasp.org/index.php/Blind_SQL_Injection',
+                    'OWASP'         => 'https://www.owasp.org/index.php/Blind_SQL_Injection',
                     'MITRE - CAPEC' => 'http://capec.mitre.org/data/definitions/7.html',
                     'WASC'          => 'http://projects.webappsec.org/w/page/13246963/SQL%20Injection',
                     'W3 Schools'    => 'http://www.w3schools.com/sql/sql_injection.asp'

data/components/checks/active/sql_injection_timing.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -9,12 +9,11 @@
 # Blind SQL Injection check using timing attacks.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-#
-# @version 0.3.2
+# @version 0.3.3
 #
 # @see http://cwe.mitre.org/data/definitions/89.html
 # @see http://capec.mitre.org/data/definitions/7.html
-# @see http://www.owasp.org/index.php/Blind_SQL_Injection
+# @see https://www.owasp.org/index.php/Blind_SQL_Injection
 class Arachni::Checks::SqlInjectionTiming < Arachni::Check::Base
 
     prefer :sql_injection, :sql_injection_differential
@@ -38,10 +37,9 @@ class Arachni::Checks::SqlInjectionTiming < Arachni::Check::Base
         {
             name:        'Blind SQL injection (timing attack)',
             description: %q{Blind SQL Injection check using timing attacks.},
-            elements:    [ Element::Form, Element::Link, Element::Cookie,
-                           Element::Header, Element::LinkTemplate ],
+            elements:    ELEMENTS_WITH_INPUTS,
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.3.2',
+            version:     '0.3.3',
             platforms:   payloads.keys,
 
             issue:       {
@@ -71,7 +69,7 @@ being sent by the server.
 This is known as a time-based blind SQL injection vulnerability.
 },
                 references:  {
-                    'OWASP'         => 'http://www.owasp.org/index.php/Blind_SQL_Injection',
+                    'OWASP'         => 'https://www.owasp.org/index.php/Blind_SQL_Injection',
                     'MITRE - CAPEC' => 'http://capec.mitre.org/data/definitions/7.html',
                     'WASC'          => 'http://projects.webappsec.org/w/page/13246963/SQL%20Injection',
                     'W3 Schools'    => 'http://www.w3schools.com/sql/sql_injection.asp'

data/components/checks/active/trainer.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -12,7 +12,7 @@
 # It also forces Arachni to train itself by analyzing the server responses.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1.3
+# @version 0.1.4
 class Arachni::Checks::Trainer < Arachni::Check::Base
 
     def run
@@ -21,7 +21,7 @@ class Arachni::Checks::Trainer < Arachni::Check::Base
         # wasting bandwidth.
         return if framework.page_limit_reached?
 
-        audit( "_arachni_trainer_#{random_seed}", submit: { train: true }, param_flip: true ){}
+        audit( "_arachni_trainer_#{random_seed}", submit: { train: true } ){}
     end
 
     def self.info
@@ -33,7 +33,7 @@ It also forces Arachni to train itself by analyzing the server responses.
 },
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
             elements:    [ Element::Form, Element::Link, Element::Cookie, Element::Header ],
-            version:     '0.1.3'
+            version:     '0.1.4'
         }
     end
 

data/components/checks/active/unvalidated_redirect.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -12,8 +12,9 @@
 # header field to determine whether the attack was successful.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.2.1
-# @see http://www.owasp.org/index.php/Top_10_2010-A10-Unvalidated_Redirects_and_Forwards
+# @version 0.2.2
+#
+# @see https://www.owasp.org/index.php/Top_10_2010-A10-Unvalidated_Redirects_and_Forwards
 class Arachni::Checks::UnvalidatedRedirect < Arachni::Check::Base
 
     def self.payloads
@@ -65,9 +66,9 @@ class Arachni::Checks::UnvalidatedRedirect < Arachni::Check::Base
 Injects URLs and checks the `Location` HTTP response header field and/or browser
 URL to determine whether the attack was successful.
 },
-            elements:    [Element::Form, Element::Link, Element::Cookie, Element::Header],
+            elements:    ELEMENTS_WITH_INPUTS - [Element::LinkTemplate],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.2.1',
+            version:     '0.2.2',
 
             issue:       {
                 name:            %q{Unvalidated redirect},
@@ -88,7 +89,7 @@ Arachni has discovered that the server does not validate the parameter value pri
 to redirecting the client to the injected value.
 },
                 references:  {
-                    'OWASP Top 10 2010' => 'http://www.owasp.org/index.php/Top_10_2010-A10-Unvalidated_Redirects_and_Forwards'
+                    'OWASP Top 10 2010' => 'https://www.owasp.org/index.php/Top_10_2010-A10-Unvalidated_Redirects_and_Forwards'
                 },
                 tags:            %w(unvalidated redirect injection header location),
                 cwe:             819,

data/components/checks/active/unvalidated_redirect_dom.rb

@@ -0,0 +1,97 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+# Unvalidated redirect DOM check.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+# @version 0.1
+#
+# @see https://www.owasp.org/index.php/Top_10_2010-A10-Unvalidated_Redirects_and_Forwards
+class Arachni::Checks::UnvalidatedRedirectDOM < Arachni::Check::Base
+
+    def self.payloads
+        @payloads ||= [
+            'www.arachni-boogie-woogie.com',
+            'https://www.arachni-boogie-woogie.com',
+            'http://www.arachni-boogie-woogie.com'
+        ].map { |url| Arachni::URI( url ).to_s }
+    end
+
+    def self.payload?( url )
+        (@set_payloads ||= Set.new( payloads )).include? Arachni::URI( url ).to_s
+    end
+    def payload?( url )
+        self.class.payload? url
+    end
+
+    def self.options
+        @options ||= {
+            format:               [ Format::STRAIGHT ],
+            parameter_names:      false,
+            with_extra_parameter: false
+        }
+    end
+
+    def run
+        each_candidate_dom_element do |element|
+            element.audit( self.class.payloads, self.class.options, &method(:check_and_log) )
+        end
+    end
+
+    def check_and_log( page, element )
+        return if !payload? page.url
+        log vector: element, page: page
+    end
+
+    def self.info
+        {
+            name:        'Unvalidated DOM redirect',
+            description: %q{
+Injects URLs and checks the browser URL to determine whether the attack was successful.
+},
+            elements:    DOM_ELEMENTS_WITH_INPUTS - [Element::LinkTemplate::DOM],
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
+            version:     '0.1',
+
+            issue:       {
+                name:            %q{Unvalidated DOM redirect},
+                description:     %q{
+Web applications occasionally use DOM input values to store the address of the
+page to which the client will be redirected -- for example:
+`yoursite.com/#/?redirect=www.yoursite.com/404.asp`
+
+An unvalidated redirect occurs when the client is able to modify the affected
+parameter value and thus control the location of the redirection.
+For example, the following URL `yoursite.com/#/?redirect=www.anothersite.com`
+will redirect to `www.anothersite.com`.
+
+Cyber-criminals will abuse these vulnerabilities in social engineering attacks
+to get users to unknowingly visit malicious web sites.
+
+Arachni has discovered that the web page does not validate the parameter value prior
+to redirecting the client to the injected value.
+},
+                references:  {
+                    'OWASP Top 10 2010' => 'https://www.owasp.org/index.php/Top_10_2010-A10-Unvalidated_Redirects_and_Forwards'
+                },
+                tags:            %w(unvalidated redirect dom injection),
+                cwe:             819,
+                severity:        Severity::MEDIUM,
+                remedy_guidance: %q{
+The application should ensure that the supplied value for a redirect is permitted.
+This can be achieved by performing whitelisting on the parameter value.
+
+The whitelist should contain a list of pages or sites that the application is
+permitted to redirect users to. If the supplied value does not match any value
+in the whitelist then the server should redirect to a standard error page.
+}
+            }
+        }
+    end
+
+end

data/components/checks/active/xpath_injection.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -9,11 +9,11 @@
 # XPath Injection check.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1.4
+# @version 0.1.5
 #
 # @see http://cwe.mitre.org/data/definitions/91.html
-# @see http://www.owasp.org/index.php/XPATH_Injection
-# @see http://www.owasp.org/index.php/Testing_for_XPath_Injection_%28OWASP-DV-010%29
+# @see https://www.owasp.org/index.php/XPATH_Injection
+# @see https://www.owasp.org/index.php/Testing_for_XPath_Injection_%28OWASP-DV-010%29
 class Arachni::Checks::XpathInjection < Arachni::Check::Base
 
     def self.error_strings
@@ -37,10 +37,9 @@ class Arachni::Checks::XpathInjection < Arachni::Check::Base
         {
             name:        'XPath Injection',
             description: %q{XPath injection check},
-            elements:    [ Element::Form, Element::Link, Element::Cookie,
-                           Element::Header, Element::LinkTemplate ],
+            elements:    ELEMENTS_WITH_INPUTS,
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1.4',
+            version:     '0.1.5',
 
             issue:       {
                 name:            %q{XPath Injection},
@@ -64,7 +63,7 @@ Arachni injected special XPath query characters into the page and based on the
 responses from the server, has determined that the page is vulnerable to XPath injection.
 },
                 references:  {
-                    'OWASP' => 'http://www.owasp.org/index.php/XPATH_Injection',
+                    'OWASP' => 'https://www.owasp.org/index.php/XPATH_Injection',
                     'WASC' => 'http://projects.webappsec.org/w/page/13247005/XPath%20Injection'
                 },
                 tags:            %w(xpath database error injection regexp),

data/components/checks/active/xss.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -13,7 +13,7 @@
 # {BrowserCluster} for evaluation and {#trace_taint taint-tracing}.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.4
+# @version 0.4.1
 #
 # @see http://cwe.mitre.org/data/definitions/79.html
 # @see http://ha.ckers.org/xss.html
@@ -43,8 +43,7 @@ class Arachni::Checks::Xss < Arachni::Check::Base
 
     def self.options
         @options ||= {
-            format:     [Format::APPEND],
-            flip_param: true
+            format: [Format::APPEND],
         }
     end
 
@@ -55,10 +54,12 @@ class Arachni::Checks::Xss < Arachni::Check::Base
     end
 
     def check_and_log( response, element )
-        # if the body doesn't include the tag at all bail out early
-        return if !response.body.downcase.include?( self.class.tag )
-
-        print_info 'Response is tainted, looking for proof of vulnerability.'
+        # Bail out if the response is not tainted unless we're dealing with a Link.
+        # The other cases either don't matter or are covered by the xss_dom check.
+        if (self.class.elements - [Arachni::Link]).include?( element.class ) &&
+            !response.body.downcase.include?( self.class.tag )
+            return
+        end
 
         # See if we managed to successfully inject our element in the doc tree.
         if find_proof( response )
@@ -96,7 +97,7 @@ tainted responses to look for proof of vulnerability.
             elements:    [Element::Form, Element::Link, Element::Cookie,
                           Element::Header, Element::LinkTemplate],
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com> ',
-            version:     '0.4',
+            version:     '0.4.1',
 
             issue:       {
                 name:            %q{Cross-Site Scripting (XSS)},
@@ -121,7 +122,7 @@ HTML element content.
                     'ha.ckers' => 'http://ha.ckers.org/xss.html',
                     'Secunia'  => 'http://secunia.com/advisories/9716/',
                     'WASC' => 'http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting',
-                    'OWASP' => 'www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet'
+                    'OWASP' => 'https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet'
                 },
                 tags:            %w(xss regexp injection script),
                 cwe:             79,