arachni 1.0.6 → 1.1

data/spec/support/servers/checks/active/path_traversal.rb

@@ -1,3 +1,5 @@
+require 'nokogiri'
+require 'json'
 require 'sinatra'
 require 'sinatra/contrib'
 
@@ -101,11 +103,24 @@ def get_variations( system, str )
     file = str.gsub( /\.{2,}/, '' ).gsub( '\\', '/' ).gsub( /\/+/, '/' )
     file = "/#{file}" if file[0] != '/'
 
-    ap file
-
     OUT[FILE_TO_PLATFORM[file]] if system == FILE_TO_PLATFORM[file]
 end
 
+before do
+    request.body.rewind
+    begin
+        @json = JSON.parse( request.body.read )
+    rescue JSON::ParserError
+    end
+    request.body.rewind
+
+    begin
+        @xml = Nokogiri::XML( request.body.read )
+    rescue JSON::ParserError
+    end
+    request.body.rewind
+end
+
 OUT.keys.each do |system|
     system_str = system.to_s
 
@@ -116,6 +131,8 @@ OUT.keys.each do |system|
             <a href="/#{system_str}/cookie">Cookie</a>
             <a href="/#{system_str}/header">Header</a>
             <a href="/#{system_str}/link-template">Link template</a>
+            <a href="/#{system_str}/json">JSON</a>
+            <a href="/#{system}/xml">XML</a>
         EOHTML
     end
 
@@ -216,4 +233,139 @@ OUT.keys.each do |system|
         get_variations( system, env['HTTP_USER_AGENT'] )
     end
 
+    get "/#{system_str}/json" do
+        <<-EOHTML
+            <script type="application/javascript">
+                http_request = new XMLHttpRequest();
+                http_request.open( "POST", "/#{system_str}/json/straight", true);
+                http_request.send( '{"input": "#{default}"}' );
+
+                http_request = new XMLHttpRequest();
+                http_request.open( "POST", "/#{system_str}/json/with_null", true);
+                http_request.send( '{"input": "#{default}"}' );
+
+                http_request = new XMLHttpRequest();
+                http_request.open( "POST", "/#{system_str}/json/append", true);
+                http_request.send( '{"input": "#{default}"}' );
+            </script>
+        EOHTML
+    end
+
+    post "/#{system_str}/json/straight" do
+        return if !@json
+        return if @json['input'].start_with?( default )
+
+        get_variations( system, @json['input'] )
+    end
+
+    post "/#{system_str}/json/with_null" do
+        return if !@json
+        return if !@json['input'].include?( "\00." )
+
+        get_variations( system, @json['input'] )
+    end
+
+    post "/#{system_str}/json/append" do
+        return if !@json
+        return if !@json['input'].start_with?( default )
+
+        get_variations( system, @json['input'].split( default ).last )
+    end
+
+    get "/#{system}/xml" do
+        <<-EOHTML
+            <script type="application/javascript">
+                http_request = new XMLHttpRequest();
+                http_request.open( "POST", "/#{system}/xml/text/straight", true);
+                http_request.send( '<input>arachni_user</input>' );
+
+                http_request = new XMLHttpRequest();
+                http_request.open( "POST", "/#{system}/xml/text/append", true);
+                http_request.send( '<input>arachni_user</input>' );
+
+                http_request = new XMLHttpRequest();
+                http_request.open( "POST", "/#{system}/xml/text/with_null", true);
+                http_request.send( '<input>arachni_user</input>' );
+
+                http_request = new XMLHttpRequest();
+                http_request.open( "POST", "/#{system}/xml/attribute/straight", true);
+                http_request.send( '<input my-attribute="arachni_user">stuff</input>' );
+
+                http_request = new XMLHttpRequest();
+                http_request.open( "POST", "/#{system}/xml/attribute/with_null", true);
+                http_request.send( '<input my-attribute="arachni_user">stuff</input>' );
+
+                http_request = new XMLHttpRequest();
+                http_request.open( "POST", "/#{system}/xml/attribute/append", true);
+                http_request.send( '<input my-attribute="arachni_user">stuff</input>' );
+            </script>
+        EOHTML
+    end
+
+    post "/#{system}/xml/text/straight" do
+        return if !@xml
+
+        default = 'arachni_user'
+        input = @xml.css('input').first.content
+
+        return if input.start_with?( default )
+
+        get_variations( system, input )
+    end
+
+    post "/#{system}/xml/text/with_null" do
+        return if !@xml
+
+        default = 'arachni_user'
+        input = @xml.css('input').first.content
+
+        return if !input.include?( "\00." )
+
+        get_variations( system, input.split( default ).last )
+    end
+
+    post "/#{system}/xml/text/append" do
+        return if !@xml
+
+        default = 'arachni_user'
+        input = @xml.css('input').first.content
+
+        return if !input.start_with?( default )
+
+        get_variations( system, input.split( default ).last )
+    end
+
+    post "/#{system}/xml/attribute/straight" do
+        return if !@xml
+
+        default = 'arachni_user'
+        input = @xml.css('input').first['my-attribute']
+
+        return if input.start_with?( default )
+
+        get_variations( system, input )
+    end
+
+    post "/#{system}/xml/attribute/with_null" do
+        return if !@xml
+
+        default = 'arachni_user'
+        input = @xml.css('input').first['my-attribute']
+
+        return if !input.include?( "\00." )
+
+        get_variations( system, input.split( default ).last )
+    end
+
+    post "/#{system}/xml/attribute/append" do
+        return if !@xml
+
+        default = 'arachni_user'
+        input = @xml.css('input').first['my-attribute']
+
+        return if !input.start_with?( default )
+
+        get_variations( system, input.split( default ).last )
+    end
+
 end

data/spec/support/servers/checks/active/response_splitting.rb

@@ -1,3 +1,5 @@
+require 'nokogiri'
+require 'json'
 require 'sinatra'
 require 'sinatra/contrib'
 
@@ -11,6 +13,21 @@ def get_variations( str )
     ''
 end
 
+before do
+    request.body.rewind
+    begin
+        @json = JSON.parse( request.body.read )
+    rescue JSON::ParserError
+    end
+    request.body.rewind
+
+    begin
+        @xml = Nokogiri::XML( request.body.read )
+    rescue JSON::ParserError
+    end
+    request.body.rewind
+end
+
 get '/' do
     <<-EOHTML
         <a href="/link?input=default">Link</a>
@@ -18,6 +35,8 @@ get '/' do
         <a href="/cookie">Cookie</a>
         <a href="/header">Header</a>
         <a href="/link-template">Link template</a>
+        <a href="/json">JSON</a>
+        <a href="/xml">XML</a>
     EOHTML
 end
 
@@ -136,3 +155,101 @@ get '/header/append' do
 
     get_variations( env['HTTP_USER_AGENT'].split( default ).last )
 end
+
+get "/json" do
+    <<-EOHTML
+        <script type="application/javascript">
+            http_request = new XMLHttpRequest();
+            http_request.open( "POST", "/json/straight", true);
+            http_request.send( '{"input": "arachni_user"}' );
+
+            http_request = new XMLHttpRequest();
+            http_request.open( "POST", "/json/append", true);
+            http_request.send( '{"input": "arachni_user"}' );
+        </script>
+    EOHTML
+end
+
+post "/json/straight" do
+    return if !@json
+
+    default = 'arachni_user'
+    return if @json['input'].start_with?( default )
+
+    get_variations( @json['input'] )
+end
+
+post "/json/append" do
+    return if !@json
+
+    default = 'arachni_user'
+    return if !@json['input'].start_with?( default )
+
+    get_variations( @json['input'].split( default ).last )
+end
+
+get "/xml" do
+    <<-EOHTML
+            <script type="application/javascript">
+                http_request = new XMLHttpRequest();
+                http_request.open( "POST", "/xml/text/straight", true);
+                http_request.send( '<input>arachni_user</input>' );
+
+                http_request = new XMLHttpRequest();
+                http_request.open( "POST", "/xml/text/append", true);
+                http_request.send( '<input>arachni_user</input>' );
+
+                http_request = new XMLHttpRequest();
+                http_request.open( "POST", "/xml/attribute/straight", true);
+                http_request.send( '<input my-attribute="arachni_user">stuff</input>' );
+
+                http_request = new XMLHttpRequest();
+                http_request.open( "POST", "/xml/attribute/append", true);
+                http_request.send( '<input my-attribute="arachni_user">stuff</input>' );
+            </script>
+    EOHTML
+end
+
+post "/xml/text/straight" do
+    return if !@xml
+
+    default = 'arachni_user'
+    input = @xml.css('input').first.content
+
+    return if input.start_with?( default )
+
+    get_variations( input )
+end
+
+post "/xml/text/append" do
+    return if !@xml
+
+    default = 'arachni_user'
+    input = @xml.css('input').first.content
+
+    return if !input.start_with?( default )
+
+    get_variations( input.split( default ).last )
+end
+
+post "/xml/attribute/straight" do
+    return if !@xml
+
+    default = 'arachni_user'
+    input = @xml.css('input').first['my-attribute']
+
+    return if input.start_with?( default )
+
+    get_variations( input )
+end
+
+post "/xml/attribute/append" do
+    return if !@xml
+
+    default = 'arachni_user'
+    input = @xml.css('input').first['my-attribute']
+
+    return if !input.start_with?( default )
+
+    get_variations( input.split( default ).last )
+end

data/spec/support/servers/checks/active/rfi.rb

@@ -1,3 +1,5 @@
+require 'nokogiri'
+require 'json'
 require 'sinatra'
 require 'sinatra/contrib'
 
@@ -10,12 +12,29 @@ def get_variations( str )
     open( str.split( "\0" ).first ) rescue nil
 end
 
+before do
+    request.body.rewind
+    begin
+        @json = JSON.parse( request.body.read )
+    rescue JSON::ParserError
+    end
+    request.body.rewind
+
+    begin
+        @xml = Nokogiri::XML( request.body.read )
+    rescue JSON::ParserError
+    end
+    request.body.rewind
+end
+
 get '/' do
     <<-EOHTML
         <a href="/link?input=default">Link</a>
         <a href="/form">Form</a>
         <a href="/cookie">Cookie</a>
         <a href="/header">Header</a>
+        <a href="/json">JSON</a>
+        <a href="/xml">XML</a>
     EOHTML
 end
 
@@ -111,3 +130,101 @@ get "/header/append" do
 
     get_variations( env['HTTP_USER_AGENT'].split( default ).last )
 end
+
+get "/json" do
+    <<-EOHTML
+        <script type="application/javascript">
+            http_request = new XMLHttpRequest();
+            http_request.open( "POST", "/json/straight", true);
+            http_request.send( '{"input": "arachni_user"}' );
+
+            http_request = new XMLHttpRequest();
+            http_request.open( "POST", "/json/append", true);
+            http_request.send( '{"input": "arachni_user"}' );
+        </script>
+    EOHTML
+end
+
+post "/json/straight" do
+    return if !@json
+
+    default = 'arachni_user'
+    return if @json['input'].start_with?( default )
+
+    get_variations( @json['input'] )
+end
+
+post "/json/append" do
+    return if !@json
+
+    default = 'arachni_user'
+    return if !@json['input'].start_with?( default )
+
+    get_variations( @json['input'].split( default ).last )
+end
+
+get "/xml" do
+    <<-EOHTML
+            <script type="application/javascript">
+                http_request = new XMLHttpRequest();
+                http_request.open( "POST", "/xml/text/straight", true);
+                http_request.send( '<input>arachni_user</input>' );
+
+                http_request = new XMLHttpRequest();
+                http_request.open( "POST", "/xml/text/append", true);
+                http_request.send( '<input>arachni_user</input>' );
+
+                http_request = new XMLHttpRequest();
+                http_request.open( "POST", "/xml/attribute/straight", true);
+                http_request.send( '<input my-attribute="arachni_user">stuff</input>' );
+
+                http_request = new XMLHttpRequest();
+                http_request.open( "POST", "/xml/attribute/append", true);
+                http_request.send( '<input my-attribute="arachni_user">stuff</input>' );
+            </script>
+    EOHTML
+end
+
+post "/xml/text/straight" do
+    return if !@xml
+
+    default = 'arachni_user'
+    input = @xml.css('input').first.content
+
+    return if input.start_with?( default )
+
+    get_variations( input )
+end
+
+post "/xml/text/append" do
+    return if !@xml
+
+    default = 'arachni_user'
+    input = @xml.css('input').first.content
+
+    return if !input.start_with?( default )
+
+    get_variations( input.split( default ).last )
+end
+
+post "/xml/attribute/straight" do
+    return if !@xml
+
+    default = 'arachni_user'
+    input = @xml.css('input').first['my-attribute']
+
+    return if input.start_with?( default )
+
+    get_variations( input )
+end
+
+post "/xml/attribute/append" do
+    return if !@xml
+
+    default = 'arachni_user'
+    input = @xml.css('input').first['my-attribute']
+
+    return if !input.start_with?( default )
+
+    get_variations( input.split( default ).last )
+end