arachni 1.0.6 → 1.1

data/components/plugins/defaults/meta/remedies/timing_attacks.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/plugins/defaults/meta/uniformity.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/plugins/email_notify.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -12,7 +12,7 @@ require 'pony'
 # of the scan over SMTP.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.1.3
+# @version 0.1.5
 class Arachni::Plugins::EmailNotify < Arachni::Plugin::Base
 
     def run
@@ -37,13 +37,21 @@ class Arachni::Plugins::EmailNotify < Arachni::Plugin::Base
                 user_name:            options[:username],
                 password:             options[:password],
                 authentication:       !options[:authentication].empty? ? options[:authentication].to_sym : nil,
-                domain:               'localhost.localdomain'
+                domain:               options[:domain]
             }
         }
 
-        if options[:report] != 'none'
+        if options[:report] == 'afr'
             opts[:attachments] = {
-                "report.#{options[:report]}" => framework.report_as( options[:report] )
+                'report.afr' => framework.report.to_afr
+            }
+        elsif options[:report] != 'none'
+            extension = framework.reporters[options[:report]].
+                outfile_option.default.split( '.', 2 ).last
+            framework.reporters.delete( options[:report] )
+
+            opts[:attachments] = {
+                "report.#{extension}" => framework.report_as( options[:report] )
             }
         end
 
@@ -59,7 +67,7 @@ class Arachni::Plugins::EmailNotify < Arachni::Plugin::Base
             name:        'E-mail notify',
             description: %q{Sends a notification (and optionally a report) over SMTP at the end of the scan.},
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.1.3',
+            version:     '0.1.5',
             options:     [
                 Options::String.new( :to,
                     required:    true,
@@ -94,15 +102,19 @@ class Arachni::Plugins::EmailNotify < Arachni::Plugin::Base
                     required:    true,
                     description: 'SMTP password.'
                 ),
+                Options::String.new( :domain,
+                    description: 'Domain.',
+                    default:     'localhost.localdomain'
+                ),
                 Options::MultipleChoice.new( :authentication,
-                    description:  'Authentication.',
-                    default:      'plain',
-                    choices: ['plain', 'login', 'cram_md5', '']
+                    description: 'Authentication.',
+                    default:     'plain',
+                    choices:     ['plain', 'login', 'cram_md5', '']
                 ),
                 Options::MultipleChoice.new( :report,
-                    description:  'Report type to send as an attachment.',
-                    default:      'txt',
-                    choices: ['txt', 'xml', 'html', 'json', 'yaml', 'marshal' 'none']
+                    description: 'Report format to send as an attachment.',
+                    default:     'txt',
+                    choices:     ['txt', 'xml', 'html', 'json', 'yaml', 'marshal', 'afr', 'none']
                 )
             ]
 

data/components/plugins/exec.rb

@@ -0,0 +1,153 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+require 'open3'
+
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+# @version 0.1
+class Arachni::Plugins::Exec < Arachni::Plugin::Base
+
+    def prepare
+        parsed_url = Arachni::URI( framework.options.url )
+
+        @data          = {}
+        @substitutions = {
+            '__URL__'               => framework.options.url,
+            '__URL_SCHEME__'        => parsed_url.scheme,
+            '__URL_HOST__'          => parsed_url.host,
+            '__URL_PORT__'          => parsed_url.port || 80,
+            '__STAGE__'             => proc { @stage },
+            '__ISSUE_COUNT__'       => proc do
+                Arachni::Data.issues.size
+            end,
+            '__SITEMAP_SIZE__'      => proc do
+                framework.data.sitemap.size
+            end,
+            '__FRAMEWORK_RUNTIME__' => proc do
+                framework.statistics[:runtime]
+            end,
+            '__FRAMEWORK_STATUS__'  => proc do
+                framework.status
+            end
+        }
+
+        exec( :pre )
+    end
+
+    def run
+        exec( :during )
+    end
+
+    def clean_up
+        wait_while_framework_running
+        exec( :post )
+
+        register_results @data
+    end
+
+    def exec( stage )
+        return if !options[stage]
+
+        if defined?( Arachni::RPC::Server::Framework ) &&
+            framework.is_a?( Arachni::RPC::Server::Framework )
+            print_error 'Cannot be executed while running as an RPC server.'
+            return
+        end
+
+        @stage = stage
+
+        data = @data[stage.to_s] = {
+            'status'     => nil,
+            'pid'        => nil,
+            'executable' => nil,
+            'stdout'     => nil,
+            'stderr'     => nil,
+            'runtime'    => 0
+        }
+
+        executable          = options[stage.to_sym]
+        expanded_executable = format( executable )
+
+        print_status "Running #{stage} executable: #{expanded_executable}"
+
+        data['executable'] = expanded_executable
+
+        t = Time.now
+        data['stdout'], data['stderr'], status =
+            Open3.capture3( expanded_executable )
+
+        data['runtime'] = Time.now - t
+
+        data['status'] = status.exitstatus
+        data['pid']    = status.pid
+
+        print_info "Status: #{data['status']}"
+        print_info "PID:    #{data['pid']}"
+        print_info "STDOUT: #{data['stdout']}"
+        print_info "STDERR: #{data['stderr']}"
+    end
+
+    def format( string )
+        @substitutions.each do |variable, value|
+            next if !string.include?( variable )
+
+            value = value.call if value.respond_to? :call
+
+            string = string.gsub( variable, value.to_s )
+        end
+
+        string
+    end
+
+    def self.info
+        {
+            name:        'Exec',
+            description: %q{
+Calls external executables at different scan stages.
+
+The following variables can be used in the executable string:
+
+* `__URL__`: Target URL.
+* `__URL_SCHEME__`: URL scheme (http/https).
+* `__URL_HOST__`: URL host.
+* `__URL_PORT__`: URL port.
+* `__STAGE__`: Scan stage (pre/during/post).
+* `__ISSUE_COUNT__`: Amount of logged issues.
+* `__SITEMAP_SIZE__`: Amount of discovered pages.
+* `__FRAMEWORK_RUNTIME__`: Scan runtime.
+* `__FRAMEWORK_STATUS__`: Framework status.
+
+**Example:**
+
+The following:
+
+    echo "__URL__ __URL_SCHEME__ __URL_HOST__ __URL_PORT__ __STAGE__ __ISSUE_COUNT__ __SITEMAP_SIZE__ __FRAMEWORK_RUNTIME__ __FRAMEWORK_STATUS__"
+
+Will result in:
+
+    http://testfire.net/ http testfire.net 80 post 0 2 3.906482517 cleanup
+
+_Will not work over RPC._
+},
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
+            version:     '0.1',
+            options:     [
+                Options::String.new( :pre,
+                    description: 'Executable to be called prior to the scan.'
+                ),
+                Options::String.new( :during,
+                    description: 'Executable to be called in parallel to the scan.'
+                ),
+                Options::String.new( :post,
+                    description: 'Executable to be called after the scan.'
+                )
+            ]
+        }
+    end
+
+end

data/components/plugins/form_dicattack.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -11,9 +11,6 @@
 class Arachni::Plugins::FormDicattack < Arachni::Plugin::Base
 
     def prepare
-        framework_pause
-        print_info 'System paused.'
-
         @url = framework.options.url
 
         @users   = File.read( options[:username_list] ).split( "\n" )
@@ -28,6 +25,9 @@ class Arachni::Plugins::FormDicattack < Arachni::Plugin::Base
     end
 
     def run
+        framework_pause
+        print_info 'System paused.'
+
         form = session.find_login_form(
             url:    @url,
             inputs: [ @user_field, @passwd_field ]

data/components/plugins/headers_collector.rb

@@ -0,0 +1,102 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+class Arachni::Plugins::HeadersCollector < Arachni::Plugin::Base
+
+    is_distributable
+
+    def prepare
+        if options[:include]
+            @include_pattern = Regexp.new( options[:include] )
+        end
+
+        if options[:exclude]
+            @exclude_pattern = Regexp.new( options[:exclude] )
+        end
+
+        @headers_per_url = Hash.new do |h, url|
+            h[url] = {}
+        end
+    end
+
+    def restore( headers )
+        prepare
+        @headers_per_url.merge!( headers )
+    end
+
+    def suspend
+        @headers_per_url
+    end
+
+    def run
+        http.on_complete do |response|
+            next if response.scope.out?
+
+            headers = response.headers.select { |name, _| collect?( name.to_s.downcase ) }
+            next if headers.empty?
+
+            @headers_per_url[response.url].merge! headers
+        end
+
+        wait_while_framework_running
+
+        # The merge is here to remove the default hash Proc which cannot be
+        # serialized.
+        register_results( {}.merge( @headers_per_url ) )
+    end
+
+    def collect?( name )
+        return false if @exclude_pattern && @exclude_pattern =~ name
+
+        if @include_pattern
+            return @include_pattern =~ name
+        end
+
+        true
+    end
+
+    def self.merge( results )
+        merged = Hash.new do |h, url|
+            h[url] = {}
+        end
+
+        results.each do |headers_per_url|
+            headers_per_url.each do |url, headers|
+                merged[url].merge! headers
+            end
+        end
+
+        {}.merge( merged )
+    end
+
+    def self.info
+        {
+            name:        'Headers collector',
+            description: %q{
+Intercepts HTTP responses and logs headers whose name matches the specified criteria.
+
+**NOTE**:
+
+* Header names will be lower-case.
+* If no patterns have been provided, all response headers will be logged.
+},
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
+            version:     '0.1',
+            options:     [
+                Options::String.new( :include,
+                    description: 'Include headers whose name matches the pattern.'
+                ),
+                Options::String.new( :exclude,
+                    description: 'Exclude headers whose name matches the pattern.'
+                )
+            ]
+        }
+    end
+
+end

data/components/plugins/http_dicattack.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -11,9 +11,6 @@
 class Arachni::Plugins::HTTPDicattack < Arachni::Plugin::Base
 
     def prepare
-        framework_pause
-        print_info 'System paused.'
-
         @url = framework.options.url.to_s
 
         @users   = File.read( options[:username_list] ).split( "\n" )
@@ -29,6 +26,9 @@ class Arachni::Plugins::HTTPDicattack < Arachni::Plugin::Base
             return
         end
 
+        framework_pause
+        print_info 'System paused.'
+
         url = uri_parse( @url )
 
         print_status 'Building the request queue...'

data/components/plugins/login_script.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -21,12 +21,12 @@ class Arachni::Plugins::LoginScript < Arachni::Plugin::Base
     def prepare
         script = IO.read( @options[:script] )
         @script = proc { |browser| eval script }
+    end
 
+    def run
         framework_pause
         print_info 'System paused.'
-    end
 
-    def run
         session.record_login_sequence do |browser|
             print_info 'Running the script.'
             @script.call browser ? browser.watir : nil
@@ -34,10 +34,9 @@ class Arachni::Plugins::LoginScript < Arachni::Plugin::Base
         end
 
         begin
-            session.login
+            session.login( true )
         rescue => e
             set_status :error
-            print_exception e
             return
         end
 

data/components/plugins/proxy.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -16,7 +16,7 @@ require 'ostruct'
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 #
-# @version 0.3.1
+# @version 0.3.2
 class Arachni::Plugins::Proxy < Arachni::Plugin::Base
 
     BASEDIR  = "#{File.dirname( __FILE__ )}/proxy/"
@@ -37,10 +37,6 @@ class Arachni::Plugins::Proxy < Arachni::Plugin::Base
     SESSION_TOKEN_COOKIE = 'arachni.proxy.session_token'
 
     def prepare
-        # don't let the framework run just yet
-        framework_pause
-        print_info 'System paused.'
-
         require_relative 'proxy/template_scope'
 
         @server = Arachni::HTTP::ProxyServer.new(
@@ -56,6 +52,9 @@ class Arachni::Plugins::Proxy < Arachni::Plugin::Base
     end
 
     def run
+        framework_pause
+        print_info 'System paused.'
+
         print_status "Listening on: http://#{@server[:BindAddress]}:#{@server[:Port]}"
 
         print_info "Control panel URL: #{url_for( :panel )}"
@@ -346,6 +345,8 @@ class Arachni::Plugins::Proxy < Arachni::Plugin::Base
         print_info " *  #{page.forms.size} forms"
         print_info " *  #{page.links.size} links"
         print_info " *  #{page.cookies.size} cookies"
+        print_info " *  #{page.jsons.size} JSON"
+        print_info " *  #{page.xmls.size} XML"
 
         @pages << page.dup
 
@@ -356,6 +357,17 @@ class Arachni::Plugins::Proxy < Arachni::Plugin::Base
     end
 
     def update_forms( page, request, response )
+
+        if (json = Arachni::Element::JSON.from_request( response.url, request ))
+            page.jsons |= [json]
+            return page
+        end
+
+        if (xml = Arachni::Element::XML.from_request( response.url, request ))
+            page.xmls |= [xml]
+            return page
+        end
+
         page.forms |= [Form.new(
             url:    response.url,
             action: response.url,
@@ -464,7 +476,7 @@ a way to restrict usage enough to avoid users unwittingly interfering with each
 others' sessions.
 },
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.3.1',
+            version:     '0.3.2',
             options:     [
                 Options::Port.new( :port,
                     description: 'Port to bind to.',