arachni 1.1 → 1.2

data/lib/arachni/element/capabilities/analyzable/timeout.rb

@@ -60,6 +60,15 @@ module Analyzable
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 module Timeout
 
+    # Override user audit options that don't play nice with this technique.
+    TIMEOUT_OPTIONS =  {
+        skip_original:          true,
+        with_both_http_methods: false,
+        parameter_names:        false,
+        with_extra_parameter:   false,
+        extensively:            false
+    }
+
     class <<self
         def reset
 
@@ -322,34 +331,24 @@ module Timeout
     def timing_attack_probe( payloads, options, &block )
         fail ArgumentError, 'Missing block' if !block_given?
 
-        options                     = options.dup
+        options                     = options.merge( TIMEOUT_OPTIONS )
         options[:delay]             = options.delete(:timeout)
         options[:timeout_divider] ||= 1
         options[:add]             ||= 0
 
-        options.merge!(
-            # Don't submit the form with its original values, we don't want
-            # any interference during timing attacks.
-            skip_original:     true,
-
-            # Disable {Arachni::OptionGroups::Audit#cookies_extensively},
-            # there's little to be gained in this case and just causes interference.
-            extensively:       false,
+        # Intercept each element mutation prior to it being submitted and
+        # replace the '__TIME__' stub with the actual delay value.
+        options[:each_mutation] = proc do |mutation|
+            injected = mutation.affected_input_value
 
-            # Intercept each element mutation prior to it being submitted and
-            # replace the '__TIME__' stub with the actual delay value.
-            each_mutation:     proc do |mutation|
-                injected = mutation.affected_input_value
+            # Preserve the placeholder (__TIME__) payload because it's going to
+            # be needed for the verification phases...
+            mutation.audit_options[:timing_string] = injected
 
-                # Preserve the placeholder (__TIME__) payload because it's going to
-                # be needed for the verification phases...
-                mutation.audit_options[:timing_string] = injected
-
-                # ...but update it to use a real payload for this audit.
-                mutation.affected_input_value = injected.
-                    gsub( '__TIME__', payload_delay_from_options( options ) )
-            end
-        )
+            # ...but update it to use a real payload for this audit.
+            mutation.affected_input_value = injected.
+                gsub( '__TIME__', payload_delay_from_options( options ) )
+        end
 
         # Ignore response bodies to preserve bandwidth since we don't care
         # about them anyways.
@@ -441,7 +440,12 @@ module Timeout
         e = super
         return e if !@timing_attack_remark_data
 
-        e.timing_attack_remark_data = @timing_attack_remark_data.deep_clone
+        dupped_remark_data = {}
+        @timing_attack_remark_data.each do |k, v|
+            dupped_remark_data[k] = v.dup
+        end
+
+        e.timing_attack_remark_data = dupped_remark_data
         e
     end
 

data/lib/arachni/element/capabilities/auditable/dom.rb

@@ -35,6 +35,20 @@ module DOM
     # @!method with_browser( &block )
     def_delegator :auditor, :with_browser
 
+    def self.included( parent )
+        parent.extend ClassMethods
+    end
+
+    module ClassMethods
+        def encode( string )
+            string
+        end
+
+        def decode( string )
+            string
+        end
+    end
+
     def initialize( options )
         options = options.dup
         @parent = options.delete(:parent)
@@ -139,6 +153,14 @@ module DOM
         options
     end
 
+    def encode( string )
+        self.class.encode( string )
+    end
+
+    def decode( string )
+        self.class.decode( string )
+    end
+
     private
 
     def prepare_browser( browser, options )

data/lib/arachni/element/capabilities/inputtable.rb

@@ -37,6 +37,10 @@ module Capabilities::Inputtable
         end
     end
 
+    INPUTTABLE_CACHE = {
+        inputtable_id: Support::Cache::LeastRecentlyPushed.new( 1_000 )
+    }
+
     # Frozen version of {#inputs}, has all the original names and values.
     #
     # @return   [Hash]
@@ -223,7 +227,8 @@ module Capabilities::Inputtable
     # @return   [String]
     #   Uniquely identifies the {#inputs}.
     def inputtable_id
-        inputs.sort_by { |k,_| k }.to_s
+        INPUTTABLE_CACHE[:inputtable_id][@inputs] ||=
+            @inputs ? @inputs.sort_by { |k, _| k }.hash.to_s : ''
     end
 
     def to_h
@@ -255,7 +260,6 @@ module Capabilities::Inputtable
             fail Error::InvalidData::Value,
                  "Invalid value for #{self.class}: #{value.inspect}"
         end
-
     end
 
     def copy_inputtable( other )

data/lib/arachni/element/capabilities/submittable.rb

@@ -74,7 +74,7 @@ module Capabilities::Submittable
 
         @auditor ||= options.delete( :auditor )
 
-        options[:performer] = self
+        options[:performer]      ||= self
         http_request( options, &block )
     end
 

data/lib/arachni/element/cookie.rb

@@ -26,6 +26,7 @@ class Cookie < Base
 
     # Generic element capabilities.
     include Arachni::Element::Capabilities::Analyzable
+    include Arachni::Element::Capabilities::WithSource
 
     # Cookie-specific overrides.
     include Capabilities::WithDOM
@@ -49,9 +50,6 @@ class Cookie < Base
         httponly:    false
     }
 
-    ENCODE_CHARACTERS      = ['+', ';', '%', "\0", "'", '&', '=', ' ', '"']
-    ENCODE_CHARACTERS_LIST = ENCODE_CHARACTERS.join
-
     attr_reader :data
 
     # @param    [Hash]  options
@@ -78,7 +76,7 @@ class Cookie < Base
         end
 
         @data.merge!( DEFAULT.merge( @data ) )
-        @data[:value] = decode( @data[:value].to_s )
+        @data[:value] = decode( @data[:value].to_s ) rescue @data[:value].to_s
 
         parsed_uri = uri_parse( action )
         if !@data[:path]
@@ -287,8 +285,8 @@ class Cookie < Base
         # @see .from_document
         # @see .from_headers
         def from_response( response )
-            ( from_document( response.url, response.body ) |
-                from_headers( response.url, response.headers ) )
+            from_document( response.url, response.body ) |
+                from_headers( response.url, response.headers )
         end
 
         # Extracts cookies from a document based on `Set-Cookie` `http-equiv`
@@ -302,21 +300,18 @@ class Cookie < Base
         #
         # @see .parse_set_cookie
         def from_document( url, document )
-            # optimizations in case there are no cookies in the doc,
-            # avoid parsing unless absolutely necessary!
             if !document.is_a?( Nokogiri::HTML::Document )
-                # get get the head in order to check if it has an http-equiv for set-cookie
-                head = document.to_s.match( /<head(.*)<\/head>/imx )
+                document = document.to_s
 
-                # if it does feed the head to the parser in order to extract the cookies
-                return [] if !head || !head.to_s.downcase.include?( 'set-cookie' )
+                return [] if !(document =~ /set-cookie/i )
 
-                document = Nokogiri::HTML( head.to_s )
+                document = Nokogiri::HTML( document )
             end
 
             Arachni::Utilities.exception_jail {
-                document.search( "//meta[@http-equiv]" ).map do |elem|
+                document.search( '//meta[@http-equiv]' ).map do |elem|
                     next if elem['http-equiv'].downcase != 'set-cookie'
+
                     from_set_cookie( url, elem['content'] )
                 end.flatten.compact
             } rescue []
@@ -358,9 +353,14 @@ class Cookie < Base
 
                 cookie_hash['path'] ||= '/'
                 cookie_hash['name']  = decode( cookie.name )
-                cookie_hash['value'] = decode( cookie.value )
 
-                new( { url: url }.merge( cookie_hash.my_symbolize_keys ) )
+                if too_big?( cookie.value )
+                    cookie_hash['value'] = ''
+                else
+                    cookie_hash['value'] = decode( cookie.value )
+                end
+
+                new( { url: url, source: str }.merge( cookie_hash.my_symbolize_keys ) )
             end.flatten.compact
         end
         alias :parse_set_cookie :from_set_cookie
@@ -376,27 +376,41 @@ class Cookie < Base
         # @return   [Array<Cookie>]
         def from_string( url, string )
             return [] if string.empty?
+
             string.split( ';' ).map do |cookie_pair|
+                cookie_pair.strip!
+
                 k, v = *cookie_pair.split( '=', 2 )
-                new( url: url, inputs: { decode( k.strip ) => decode( v.strip ) } )
+
+                v = '' if too_big?( v )
+
+                new(
+                    url:    url,
+                    source: cookie_pair,
+                    inputs: { decode( k ) => value_to_v0( v ) }
+                )
             end.flatten.compact
         end
 
+        def value_to_v0( value )
+            return '' if !value
+
+            value.start_with?( '"' ) && value.end_with?( '"' ) ?
+                value[1...-1] : decode( value )
+        end
+
         # Encodes a {String}'s reserved characters in order to prepare it for
         # the `Cookie` header field.
         #
         # @example
         #    p Cookie.encode "+;%=\0 "
-        #    #=> "%2B%3B%25%3D%00+"
+        #    #=> "%2B%3B%25%3D%00%20"
         #
         # @param    [String]    str
         #
         # @return   [String]
         def encode( str )
-            str = str.to_s
-            return str if !ENCODE_CHARACTERS.find { |c| str.include? c }
-
-            ::URI.encode( str, ENCODE_CHARACTERS_LIST )
+            Arachni::HTTP::Request.encode( str )
         end
 
         # Decodes a {String} encoded for the `Cookie` header field.
@@ -409,7 +423,7 @@ class Cookie < Base
         #
         # @return   [String]
         def decode( str )
-            ::URI.decode( str.to_s.gsub('+', ' ' ) )
+            ::URI.decode_www_form_component str.to_s
         end
 
         def keep_for_set_cookie

data/lib/arachni/element/cookie/capabilities/mutable.rb

@@ -17,15 +17,15 @@ module Capabilities
 module Mutable
     include Arachni::Element::Capabilities::Mutable
 
-    # Overrides {Capabilities::Mutable#each_mutation} to handle cookie-specific
+    # Overrides {Arachni::Element::Capabilities::Mutable#each_mutation} to handle cookie-specific
     # limitations and the {Arachni::OptionGroups::Audit#cookies_extensively} option.
     #
-    # @param (see Capabilities::Mutable#each_mutation)
-    # @return (see Capabilities::Mutable#each_mutation)
-    # @yield (see Capabilities::Mutable#each_mutation)
-    # @yieldparam (see Capabilities::Mutable#each_mutation)
+    # @param (see Arachni::Element::Capabilities::Mutable#each_mutation)
+    # @return (see Arachni::Element::Capabilities::Mutable#each_mutation)
+    # @yield (see Arachni::Element::Capabilities::Mutable#each_mutation)
+    # @yieldparam (see Arachni::Element::Capabilities::Mutable#each_mutation)
     #
-    # @see Capabilities::Mutable#each_mutation
+    # @see Arachni::Element::Capabilities::Mutable#each_mutation
     def each_mutation( payload, options = {}, &block )
         options              = prepare_mutation_options( options )
         parameter_names      = options.delete( :parameter_names )

data/lib/arachni/element/cookie/dom.rb

@@ -42,14 +42,6 @@ class DOM < Base
         p.to_set_cookie
     end
 
-    def encode( *args )
-        Cookie.encode( *args )
-    end
-
-    def decode( *args )
-        Cookie.decode( *args )
-    end
-
     def type
         self.class.type
     end

data/lib/arachni/element/form.rb

@@ -262,7 +262,14 @@ class Form < Base
         #
         # @return   [Array<Form>]
         def from_document( url, document, ignore_scope = false )
-            document = Nokogiri::HTML( document.to_s ) if !document.is_a?( Nokogiri::HTML::Document )
+            if !document.is_a?( Nokogiri::HTML::Document )
+                document = document.to_s
+
+                return [] if !(document =~ /<\s*form/i)
+
+                document = Nokogiri::HTML( document )
+            end
+
             base_url = (document.search( '//base[@href]' )[0]['href'] rescue url)
             base_url = to_absolute( base_url, url )
 
@@ -305,16 +312,20 @@ class Form < Base
 
                     # Handle the easy stuff first...
                     if elem.name != 'select'
-                        options[:inputs][name]           = elem_attrs
+                        options[:inputs][name] = elem_attrs
 
                         if elem_attrs[:type] == :submit
                             multiple_choice_submits[name] ||= Set.new
-                            multiple_choice_submits[name] <<
-                                elem_attrs[:value]
+                            multiple_choice_submits[name] << elem_attrs[:value]
                         end
 
                         options[:inputs][name][:type]  ||= :text
                         options[:inputs][name][:value] ||= ''
+
+                        if too_big?( options[:inputs][name][:value] )
+                            options[:inputs][name][:value] = ''
+                        end
+
                         next
                     end
 
@@ -322,19 +333,22 @@ class Form < Base
                     if elem.children.css('option').any?
                         elem.children.css('option').each do |child|
                             h = attributes_to_hash( child.attributes )
-                            h[:type] = :select
+                            h[:type]    = :select
+                            h[:value] ||= child.text
+
+                            if too_big?( h[:value] )
+                                h[:value] = ''
+                            end
 
                             # Prefer the selected or first option.
                             if h[:selected]
-                                h[:value] ||= child.text
                                 options[:inputs][name] = h
                             else
-                                h[:value] ||= child.text
                                 options[:inputs][name] ||= h
                             end
                         end
 
-                        # The select has no options, use an empty string.
+                    # The select has no options, use an empty string.
                     else
                         options[:inputs][name] = {
                             type:  :select,
@@ -376,20 +390,20 @@ class Form < Base
         # Encodes a {String}'s reserved characters in order to prepare it
         # to be included in a request body.
         #
-        # @param    [String]    str
+        # @param    [String]    string
         #
         # @return   [String]
-        def encode( str )
-            ::URI.encode_www_form_component str.to_s
+        def encode( string )
+            Arachni::HTTP::Request.encode string
         end
 
         # Decodes a {String} encoded for an HTTP request's body.
         #
-        # @param    [String]    str
+        # @param    [String]    string
         #
         # @return   [String]
-        def decode( str )
-            ::URI.decode_www_form_component str.to_s
+        def decode( string )
+            ::URI.decode_www_form_component string.to_s
         end
 
     end

data/lib/arachni/element/form/capabilities/auditable.rb

@@ -33,8 +33,8 @@ module Auditable
         end
     end
 
-    # @param   (see Capabilities::Auditable#audit_id)
-    # @return  (see Capabilities::Auditable#audit_id)
+    # @param   (see Arachni::Element::Capabilities::Auditable#audit_id)
+    # @return  (see Arachni::Element::Capabilities::Auditable#audit_id)
     def audit_id( payload = nil )
         force_train? ? id : super( payload )
     end

data/lib/arachni/element/form/capabilities/mutable.rb

@@ -56,12 +56,12 @@ module Mutable
     #   Whether or not to skip adding a mutation holding original values and
     #   sample values.
     #
-    # @param (see Capabilities::Mutable#each_mutation)
-    # @return (see Capabilities::Mutable#each_mutation)
-    # @yield (see Capabilities::Mutable#each_mutation)
-    # @yieldparam (see Capabilities::Mutable#each_mutation)
+    # @param (see Arachni::Element::Capabilities::Mutable#each_mutation)
+    # @return (see Arachni::Element::Capabilities::Mutable#each_mutation)
+    # @yield (see Arachni::Element::Capabilities::Mutable#each_mutation)
+    # @yieldparam (see Arachni::Element::Capabilities::Mutable#each_mutation)
     #
-    # @see Capabilities::Mutable#each_mutation
+    # @see Arachni::Element::Capabilities::Mutable#each_mutation
     # @see Arachni::OptionGroups::Input.fill
     def each_mutation( payload, opts = {} )
         opts = MUTATION_OPTIONS.merge( opts )

data/lib/arachni/element/form/dom.rb

@@ -36,14 +36,6 @@ class DOM < Base
         @valid_input_names.include? name.to_s
     end
 
-    def encode( *args )
-        Form.encode( *args )
-    end
-
-    def decode( *args )
-        Form.decode( *args )
-    end
-
     def type
         self.class.type
     end