arachni 1.0.6 → 1.1

data/spec/components/checks/active/sql_injection_timing_spec.rb

@@ -9,14 +9,38 @@ describe name_from_filename do
 
     def self.elements
         [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate ]
+          Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
-    def issue_count_per_platform
+    def issue_count_per_element_per_platform
         {
-            mysql: 16,
-            pgsql: 6,
-            mssql: 9
+            mysql: {
+                Element::Form         => 16,
+                Element::Link         => 16,
+                Element::Cookie       => 16,
+                Element::Header       => 16,
+                Element::LinkTemplate => 16,
+                Element::JSON         => 16,
+                Element::XML          => 32
+            },
+            pgsql: {
+                Element::Form         => 6,
+                Element::Link         => 6,
+                Element::Cookie       => 6,
+                Element::Header       => 6,
+                Element::LinkTemplate => 6,
+                Element::JSON         => 6,
+                Element::XML          => 12
+            },
+            mssql: {
+                Element::Form         => 9,
+                Element::Link         => 9,
+                Element::Cookie       => 9,
+                Element::Header       => 9,
+                Element::LinkTemplate => 9,
+                Element::JSON         => 9,
+                Element::XML          => 18
+            }
         }
     end
 

data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb

@@ -0,0 +1,19 @@
+require 'spec_helper'
+
+describe name_from_filename do
+    include_examples 'check'
+
+    def self.elements
+        [ Element::Form::DOM, Element::Link::DOM, Element::Cookie::DOM ]
+    end
+
+    def issue_count_per_element
+        {
+            Element::Form::DOM   => 3,
+            Element::Link::DOM   => 3,
+            Element::Cookie::DOM => 3
+        }
+    end
+
+    easy_test
+end

data/spec/components/checks/active/unvalidated_redirect_spec.rb

@@ -4,7 +4,8 @@ describe name_from_filename do
     include_examples 'check'
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
+          Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element
@@ -12,7 +13,9 @@ describe name_from_filename do
             Element::Form   => 16,
             Element::Link   => 16,
             Element::Cookie => 16,
-            Element::Header => 8
+            Element::Header => 8,
+            Element::JSON   => 12,
+            Element::XML    => 24
         }
     end
 

data/spec/components/checks/active/xpath_injection_spec.rb

@@ -5,11 +5,19 @@ describe name_from_filename do
 
     def self.elements
         [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate ]
+          Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
-    def issue_count
-        75
+    def issue_count_per_element
+        {
+            Element::Form         => 125,
+            Element::Link         => 125,
+            Element::Cookie       => 75,
+            Element::Header       => 75,
+            Element::LinkTemplate => 75,
+            Element::JSON         => 75,
+            Element::XML          => 150
+        }
     end
 
     easy_test

data/spec/components/checks/active/xss_dom_script_context_spec.rb

@@ -10,10 +10,10 @@ describe name_from_filename do
 
     def issue_count_per_element
         {
-            Element::Form::DOM         => 3,
-            Element::Link::DOM         => 3,
-            Element::Cookie::DOM       => 2,
-            Element::LinkTemplate::DOM => 3
+            Element::Form::DOM         => 2,
+            Element::Link::DOM         => 2,
+            Element::Cookie::DOM       => 1,
+            Element::LinkTemplate::DOM => 2
         }
     end
 

data/spec/components/checks/active/xss_script_context_spec.rb

@@ -10,11 +10,11 @@ describe name_from_filename do
 
     def issue_count_per_element
         {
-            Element::Form   => 14,
-            Element::Link   => 14,
-            Element::Cookie => 14,
-            Element::Header => 10,
-            Element::LinkTemplate => 1
+            Element::Form   => 16,
+            Element::Link   => 16,
+            Element::Cookie => 16,
+            Element::Header => 12,
+            Element::LinkTemplate => 3
         }
     end
 

data/spec/components/checks/active/xss_tag_spec.rb

@@ -8,7 +8,7 @@ describe name_from_filename do
     end
 
     def issue_count
-        3
+        5
     end
 
     easy_test

data/spec/components/checks/active/xxe_spec.rb

@@ -0,0 +1,19 @@
+require 'spec_helper'
+
+describe name_from_filename do
+    include_examples 'check'
+
+    def self.platforms
+        [:unix, :windows]
+    end
+
+    def self.elements
+        [ Element::XML ]
+    end
+
+    def issue_count
+        4
+    end
+
+    easy_test
+end

data/spec/components/checks/passive/grep/hsts_spec.rb

@@ -11,7 +11,15 @@ describe name_from_filename do
         1
     end
 
-    easy_test( false ) do
-        issues.first.page.url.should include 'vulnerable'
+    it 'logs hosts missing the header' do
+        options.url = "#{url}/vulnerable"
+        run
+        issues.should be_any
+    end
+
+    it 'logs hosts missing the header' do
+        options.url = "#{url}/safe"
+        run
+        issues.should be_empty
     end
 end

data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb

@@ -0,0 +1,25 @@
+require 'spec_helper'
+
+describe name_from_filename do
+    include_examples 'check'
+
+    def self.elements
+        [ Element::Server ]
+    end
+
+    def issue_count
+        1
+    end
+
+    it 'logs hosts with a wildcard Access-Control-Allow-Origin' do
+        options.url = "#{url}/vulnerable"
+        run
+        issues.should be_any
+    end
+
+    it 'does not log hosts without a wildcard Access-Control-Allow-Origin' do
+        options.url = "#{url}/safe"
+        run
+        issues.should be_empty
+    end
+end

data/spec/components/checks/passive/grep/x_frame_options_spec.rb

@@ -0,0 +1,25 @@
+require 'spec_helper'
+
+describe name_from_filename do
+    include_examples 'check'
+
+    def self.elements
+        [ Element::Server ]
+    end
+
+    def issue_count
+        1
+    end
+
+    it 'logs hosts missing the header' do
+        options.url = "#{url}/vulnerable"
+        run
+        issues.should be_any
+    end
+
+    it 'does not log hosts with the header' do
+        options.url = "#{url}/safe"
+        run
+        issues.should be_empty
+    end
+end

data/spec/components/checks/passive/insecure_client_access_policy_spec.rb

@@ -0,0 +1,15 @@
+require 'spec_helper'
+
+describe name_from_filename do
+    include_examples 'check'
+
+    def self.elements
+        [ Element::Server ]
+    end
+
+    def issue_count
+        1
+    end
+
+    easy_test
+end

data/spec/components/checks/passive/insecure_cross_domain_policy_access_spec.rb

@@ -0,0 +1,15 @@
+require 'spec_helper'
+
+describe name_from_filename do
+    include_examples 'check'
+
+    def self.elements
+        [ Element::Server ]
+    end
+
+    def issue_count
+        1
+    end
+
+    easy_test
+end

data/spec/components/checks/passive/insecure_cross_domain_policy_headers_spec.rb

@@ -0,0 +1,15 @@
+require 'spec_helper'
+
+describe name_from_filename do
+    include_examples 'check'
+
+    def self.elements
+        [ Element::Server ]
+    end
+
+    def issue_count
+        1
+    end
+
+    easy_test
+end

data/spec/components/plugins/exec_spec.rb

@@ -0,0 +1,56 @@
+require 'spec_helper'
+
+describe name_from_filename do
+    include_examples 'plugin'
+
+    it 'executes a Ruby script under the scope of the running plugin' do
+        options.url = web_server_url_for(:framework)
+
+        cmd = 'echo "__URL__ __URL_SCHEME__ __URL_HOST__ __URL_PORT__ __STAGE__ __ISSUE_COUNT__ __SITEMAP_SIZE__ __FRAMEWORK_STATUS__"'
+        options.plugins[component_name] = {
+            'pre'    => cmd,
+            'during' => cmd,
+            'post'   => cmd
+        }
+
+        run
+
+        parsed_url = Arachni::URI( options.url )
+        scheme = parsed_url.scheme
+        host   = parsed_url.host
+        port   = parsed_url.port
+
+        pre = actual_results['pre']
+        pre.delete('runtime').should be_kind_of Float
+        pre.delete('pid').should be_kind_of Integer
+
+        pre.should == {
+            "status"     => 0,
+            "executable" => "echo \"#{options.url} #{scheme} #{host} #{port} pre 0 0 preparing\"",
+            "stdout"     => "#{options.url} #{scheme} #{host} #{port} pre 0 0 preparing\n",
+            "stderr"     => ""
+        }
+
+        during = actual_results['during']
+        during.delete('runtime').should be_kind_of Float
+        during.delete('pid').should be_kind_of Integer
+
+        during.should == {
+            "status"     => 0,
+            "executable" => "echo \"#{options.url} #{scheme} #{host} #{port} during 0 0 preparing\"",
+            "stdout"     => "#{options.url} #{scheme} #{host} #{port} during 0 0 preparing\n",
+            "stderr"     => ""
+        }
+
+        post = actual_results['post']
+        post.delete('runtime').should be_kind_of Float
+        post.delete('pid').should be_kind_of Integer
+
+        post.should == {
+            "status"     => 0,
+            "executable" => "echo \"#{options.url} #{scheme} #{host} #{port} post 0 2 cleanup\"",
+            "stdout"     => "#{options.url} #{scheme} #{host} #{port} post 0 2 cleanup\n",
+            "stderr"     => ""
+        }
+    end
+end

data/spec/components/plugins/headers_collector_spec.rb

@@ -0,0 +1,126 @@
+require 'spec_helper'
+
+describe name_from_filename do
+    include_examples 'plugin'
+
+    before ( :all ) do
+        options.url = url
+    end
+
+    context 'when no patterns are given' do
+        it 'logs all headers' do
+            run
+
+            actual_results.should == {
+                url => {
+                    "Content-Type" => "text/html;charset=utf-8",
+                    "X-Xss-Protection" => "1; mode=block",
+                    "X-Content-Type-Options" => "nosniff",
+                    "X-Frame-Options" => "SAMEORIGIN",
+                    "Content-Length" => "54"
+                },
+                "#{url}1" => {
+                    "Content-Type" => "text/html;charset=utf-8",
+                    "Weird" => "Value",
+                    "X-Xss-Protection" => "1; mode=block",
+                    "X-Content-Type-Options" => "nosniff",
+                    "X-Frame-Options" => "SAMEORIGIN",
+                    "Content-Length" => "5"
+                },
+                "#{url}2" => {
+                    "Content-Type" => "text/html;charset=utf-8",
+                    "Weird2" => "Value2",
+                    "X-Xss-Protection" => "1; mode=block",
+                    "X-Content-Type-Options" => "nosniff",
+                    "X-Frame-Options" => "SAMEORIGIN",
+                    "Content-Length" => "6"
+                }
+            }
+        end
+    end
+
+    context 'when :include patterns are given' do
+        it 'only logs headers whose name matches the pattern' do
+            options.plugins[name_from_filename] = {
+                'include' => 'weird|frame'
+            }
+
+            run
+
+            actual_results.should == {
+                url => {
+                    "X-Frame-Options" => "SAMEORIGIN"
+                },
+                "#{url}1" => {
+                    "Weird" => "Value",
+                    "X-Frame-Options" => "SAMEORIGIN"
+                },
+                "#{url}2" => {
+                    "Weird2" => "Value2",
+                    "X-Frame-Options" => "SAMEORIGIN"
+                }
+            }
+        end
+    end
+
+    context 'when :exclude patterns are given' do
+        it 'only logs headers whose name matches the pattern' do
+            options.plugins[name_from_filename] = {
+                'exclude' => 'weird|frame'
+            }
+
+            run
+
+            actual_results.should == {
+                url => {
+                    "Content-Type" => "text/html;charset=utf-8",
+                    "X-Xss-Protection" => "1; mode=block",
+                    "X-Content-Type-Options" => "nosniff",
+                    "Content-Length" => "54"
+                },
+                "#{url}1" => {
+                    "Content-Type" => "text/html;charset=utf-8",
+                    "X-Xss-Protection" => "1; mode=block",
+                    "X-Content-Type-Options" => "nosniff",
+                    "Content-Length" => "5"
+                },
+                "#{url}2" => {
+                    "Content-Type" => "text/html;charset=utf-8",
+                    "X-Xss-Protection" => "1; mode=block",
+                    "X-Content-Type-Options" => "nosniff",
+                    "Content-Length" => "6"
+                }
+            }
+        end
+    end
+
+    describe '.merge' do
+        it 'merges the results of different instances' do
+            results = [
+                {
+                    "#{url}" => {
+                        'Name' => 'Value'
+                    },
+                },
+                {
+                    "#{url}" => {
+                        'Name2' => 'Value2'
+                    },
+                    "#{url}2" => {
+                        'Name22' => 'Value22'
+                    },
+                },
+            ]
+
+            framework.plugins[component_name].merge( results ).should == {
+                "#{url}" => {
+                    "Name" => "Value",
+                    "Name2" => "Value2"
+                },
+                "#{url}2" => {
+                    "Name22" => "Value22"
+                }
+            }
+        end
+    end
+end