arachni 1.0.6 → 1.1

data/components/plugins/proxy/template_scope.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/plugins/script.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/plugins/uncommon_headers.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -87,7 +87,14 @@ class Arachni::Plugins::UncommonHeaders < Arachni::Plugin::Base
     def self.info
         {
             name:        'Uncommon headers',
-            description: %q{Intercepts HTTP responses and logs uncommon headers.},
+            description: %q{
+Intercepts HTTP responses and logs uncommon headers.
+
+Common headers are:
+
+%s
+
+} % COMMON.to_a.map { |h| "* #{h}" }.join("\n"),
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
             version:     '0.1.3'
         }

data/components/plugins/vector_collector.rb

@@ -0,0 +1,73 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+# @version 0.1
+class Arachni::Plugins::VectorCollector < Arachni::Plugin::Base
+
+    def prepare
+        @vectors = {}
+    end
+
+    def suspend
+        @vectors
+    end
+
+    def restore( vectors )
+        @vectors = vectors
+    end
+
+    def run
+        framework.on_effective_page_audit do |page|
+            current_vectors = @vectors[page.dom.url] ||= {}
+
+            page.elements_within_scope.each do |element|
+                next if element.inputs.empty? ||
+                    current_vectors.include?( element.coverage_hash )
+
+                h = element.to_hash
+
+                # :inputs will be identical to :default_inputs since none of
+                # the elements will be mutations.
+                h.delete :default_inputs
+
+                h = h.my_stringify_keys(false)
+                h['method'] = h['method'].to_s if h['method']
+
+                current_vectors[element.coverage_hash] = h.my_stringify_keys(false)
+            end
+
+            @vectors.delete( page.dom.url ) if @vectors[page.dom.url].empty?
+        end
+
+        wait_while_framework_running
+    end
+
+    def clean_up
+        @vectors.each do |url, elements|
+            @vectors[url] = elements.values
+        end
+
+        register_results( @vectors )
+    end
+
+    def self.info
+        {
+            name:        'Vector collector',
+            description: %q{
+Analyzes each page and collects information about input vectors.
+
+**WARNING**: It will log thousands of results leading to a huge report, highly
+increased memory consumption and CPU usage.
+},
+            author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
+            version:     '0.1'
+        }
+    end
+
+end

data/components/plugins/vector_feed.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -16,12 +16,10 @@
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 class Arachni::Plugins::VectorFeed < Arachni::Plugin::Base
 
-    def prepare
+    def run
         framework_pause
         print_status 'System paused.'
-    end
 
-    def run
         # if the 'vectors' option is an array at this point then someone fed
         # them to us programmatically
         if !options[:vectors].is_a? Array
@@ -155,7 +153,7 @@ Can be used to perform extremely specialized/narrow audits on a per vector/eleme
 
 **Notes**:
 
-* To only audit the vectors in the feed you must set the 'link-count' limit to 0 to prevent crawling.
+* To only audit the vectors in the feed you must set the scope page-limit to `0` to prevent crawling.
 * Can handle multiple YAML documents.
 
 Example YAML file:

data/components/plugins/waf_detector.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -28,8 +28,6 @@ class Arachni::Plugins::WAFDetector < Arachni::Plugin::Base
     }
 
     def prepare
-        framework_pause
-
         @precision = options[:precision]
 
         bad = [
@@ -60,6 +58,8 @@ class Arachni::Plugins::WAFDetector < Arachni::Plugin::Base
     end
 
     def run
+        framework_pause
+
         print_status "Starting detection with a precision of #{@precision}."
 
         print_status 'Stage #1: Requesting original page.'

data/components/reporters/ap.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/components/reporters/html.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -19,13 +19,144 @@ require 'fileutils'
 # Creates an HTML report with scan results.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.4
+# @version 0.4.1
 class Arachni::Reporters::HTML < Arachni::Reporter::Base
 
     TEMPLATE_FILE = File.dirname( __FILE__ ) + '/html/default.erb'
     TEMPLATE_DIR  = File.dirname( TEMPLATE_FILE ) + '/' +
         File.basename( TEMPLATE_FILE, '.erb' ) + '/'
 
+    OWASP_TOP_10_URL  = 'https://www.owasp.org/index.php/Top_10_2013-Top_10'
+    OWASP_TOP_10_DATA = {
+        'A1-Injection' => {
+            code:       'A1',
+            description: %q{
+Injection flaws, such as SQL, OS, and LDAP injection occur when untrusted data
+is sent to an interpreter as part of a command or query. The attacker’s hostile
+data can trick the interpreter into executing unintended commands or accessing
+data without proper authorization.
+},
+            url:         'https://www.owasp.org/index.php/Top_10_2013-A1-Injection',
+            checks:      [
+                :command_injection,
+                :command_injection_php_input_wrapper,
+                :command_injection_timing,
+                :ldap_injection,
+                :no_sql_injection,
+                :no_sql_injection_differential,
+                :os_cmd_injection,
+                :os_cmd_injection_timing,
+                :sql_injection,
+                :sql_injection_differential,
+                :sql_injection_timing,
+                :xpath_injection,
+                :xxe
+            ]
+        },
+        'A2-Broken Authentication and Session Management' => {
+            code:        'A2',
+            description: %q{
+Application functions related to authentication and session management are often
+not implemented correctly, allowing attackers to compromise passwords, keys, or
+session tokens, or to exploit other implementation flaws to assume other users’
+identities.
+},
+            url:         'https://www.owasp.org/index.php/Top_10_2013-A2-Broken_Authentication_and_Session_Management',
+            checks:      [
+                :session_fixation
+            ]
+        },
+        'A3-Cross-Site Scripting (XSS)' => {
+            code:        'A3',
+            description: %q{
+XSS flaws occur whenever an application takes untrusted data and sends it to a
+web browser without proper validation or escaping. XSS allows attackers to
+execute scripts in the victim’s browser which can hijack user sessions, deface
+web sites, or redirect the user to malicious sites.
+},
+            url:         'https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS)',
+            checks:      [
+                :xss,
+                :xss_dom,
+                :xss_dom_inputs,
+                :xss_dom_script_context,
+                :xss_event,
+                :xss_path,
+                :xss_script_context,
+                :xss_tag
+            ]
+        },
+        'A5-Security Misconfiguration' => {
+            code:        'A5',
+            description: %q{
+Good security requires having a secure configuration defined and deployed for
+the application, frameworks, application server, web server, database server,
+and platform. Secure settings should be defined, implemented, and maintained,
+as defaults are often insecure. Additionally, software should be kept up to date.
+},
+            url:         'https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration',
+            checks:      [
+                :cookie_set_for_parent_domain,
+                :hsts,
+                :insecure_cors_policy,
+                :htaccess_limit,
+                :http_put,
+                :insecure_client_access_policy,
+                :insecure_cross_Domain_policy_access,
+                :insecure_cross_Domain_policy_headers,
+                :origin_spood_access_restriction_bypass,
+                :xst
+            ]
+        },
+        'A6-Sensitive Data Exposure' => {
+            code:        'A6',
+            description: %q{
+Many web applications do not properly protect sensitive data, such as credit
+cards, tax IDs, and authentication credentials. Attackers may steal or modify
+such weakly protected data to conduct credit card fraud, identity theft, or other
+crimes. Sensitive data deserves extra protection such as encryption at rest or
+in transit, as well as special precautions when exchanged with the browser.
+},
+            url:         'https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure',
+            checks:      [
+                :backup_directories,
+                :backup_files,
+                :credit_card,
+                :cvs_svn_users,
+                :private_ip,
+                :ssn
+            ]
+        },
+        'A8-Sensitive Data Exposure' => {
+            code:        'A8',
+            description: %q{
+A CSRF attack forces a logged-on victim’s browser to send a forged HTTP request,
+including the victim’s session cookie and any other automatically included
+authentication information, to a vulnerable web application. This allows the
+attacker to force the victim’s browser to generate requests the vulnerable
+application thinks are legitimate requests from the victim.
+},
+            url:         'https://www.owasp.org/index.php/Top_10_2013-A8-Cross-Site_Request_Forgery_(CSRF)',
+            checks:      [
+                :csrf
+            ]
+        },
+        'A10-Unvalidated Redirects and Forwards' => {
+            code:        'A10',
+            description: %q{
+Web applications frequently redirect and forward users to other pages and websites,
+and use untrusted data to determine the destination pages. Without proper validation,
+attackers can redirect victims to phishing or malware sites, or use forwards to
+access unauthorized pages.
+},
+            url:         'https://www.owasp.org/index.php/Top_10_2013-A10-Unvalidated_Redirects_and_Forwards',
+            checks:      [
+                :unvalidated_redirect,
+                :unvalidated_redirect_dom
+            ]
+        }
+    }
+
     module TemplateUtilities
 
         def base64_encode( string )
@@ -314,7 +445,7 @@ class Arachni::Reporters::HTML < Arachni::Reporter::Base
             description:  %q{Exports the audit results as a compressed HTML report.},
             content_type: 'application/zip',
             author:       'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:      '0.4',
+            version:      '0.4.1',
             options:      [
                 Options.outfile( '.html.zip' ),
                 Options.skip_responses
@@ -370,7 +501,9 @@ class Arachni::Reporters::HTML < Arachni::Reporter::Base
                 Element::Body.type   => 0,
                 Element::Path.type   => 0,
                 Element::Server.type => 0,
-                Element::GenericDOM.type => 0
+                Element::GenericDOM.type => 0,
+                Element::JSON.type       => 0,
+                Element::XML.type        => 0
             },
             verification:     {
                 'Yes' => 0,
@@ -444,17 +577,8 @@ class Arachni::Reporters::HTML < Arachni::Reporter::Base
             end
         end
 
-        # We use a multiplier for the severities because we need to adjust their
-        # y2 axis values to cover the max y axis.
-        severity_multiplier = (graph_data[:issues].values.max || 1) / Issue::Severity::ORDER.size
-        graph_data[:severity_index_for_issue].each do |name, index|
-            graph_data[:severity_index_for_issue][name] = severity_multiplier * index
-        end
-        graph_data[:severity_multiplier] = severity_multiplier
-
         graph_data[:issues_shortnames] = graph_data[:issues_shortnames].to_a
-
-        graph_data[:severity_regions] = graph_data[:severity_regions].values
+        graph_data[:severity_regions]  = graph_data[:severity_regions].values
 
         {
             graph_data:           graph_data,

data/components/reporters/html/default.erb

@@ -10,7 +10,7 @@
 
     <!--
         Design by Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-        Copyright (c) Arachni 2011-2014.
+        Copyright (c) Arachni 2011-2015.
      -->
 
     <% %w(js/lib/jquery.min.js js/lib/bootstrap.min.js js/lib/d3.min.js

data/components/reporters/html/default/configuration.erb

@@ -20,7 +20,7 @@
 <h3>
     <a
     id="configuration-general"
-    href="/#!/configuration/general"
+    href="#!/configuration/general"
     >
         General
     </a>
@@ -67,7 +67,7 @@
     <h3>
         <a
             id="configuration-<%= group %>"
-            href="/#!/configuration/<%= group %>"
+            href="#!/configuration/<%= group %>"
         >
             <%= key_to_words group %>
         </a>

data/components/reporters/html/default/issue/page.erb

@@ -11,7 +11,7 @@
 
             <p class="text-muted">
                 Transitions describe the steps required to restore the state
-                of the page, to the one it had when it was processes by the
+                of the page, to the one it had when it was processed by the
                 scanner, as a series of events.
 
                 In essence, each transition represents a user interaction.

data/components/reporters/html/default/issue/vector.erb

@@ -1,6 +1,6 @@
 <%=
-    if vector.respond_to?( :html ) && !vector.html.to_s.empty?
-        code_highlight( vector.html, :html, anchor_id: "#{id}-vector-source" )
+    if vector.respond_to?( :source ) && !vector.source.to_s.empty?
+        code_highlight( vector.source, :html, anchor_id: "#{id}-vector-source" )
     end
 %>
 

data/components/reporters/html/default/js/charts.js.erb

@@ -6,7 +6,10 @@ function index_to_severity( index ){
     return <%= graph_data[:severity_for_issue].to_json %>[index_to_shortname(index)];
 }
 
-jQuery(function ($) {
+function renderCharts() {
+    if( window.renderedCharts )
+    window.renderedCharts = true;
+
     c3.generate({
         bindto: '#chart-issues',
         data: {
@@ -60,10 +63,10 @@ jQuery(function ($) {
                 },
                 show: true,
                 type: 'category',
-                categories: <%= (1...(graph_data[:severities].size+1)).to_a.map { |i| i * graph_data[:severity_multiplier] }.to_json %>,
+                categories: [1, 2, 3, 4],
                 tick: {
                     format: function (d) {
-                        return <%= graph_data[:severities].keys.reverse.to_json %>[(d - <%= graph_data[:severity_multiplier] %>) / <%= graph_data[:severity_multiplier] %>]
+                        return ["Informational","Low","Medium","High"][d - 1]
                     }
                 }
             }
@@ -114,4 +117,4 @@ jQuery(function ($) {
         }
     });
 
-});
+}

data/components/reporters/html/default/js/helpers.js

@@ -88,6 +88,8 @@ function goTo( location ){
     if( !target.hasClass('tab-pane') ) {
         $('html,body').scrollTop( target.offset().top );
     }
+
+    if( location == 'summary/charts' ) renderCharts();
 }
 
 function goToLocation( location ){