arachni 1.1 → 1.2

data/spec/arachni/support/cache/least_recently_used_spec.rb

@@ -8,26 +8,18 @@ describe Arachni::Support::Cache::LeastRecentlyUsed do
 
         subject[:k]  = '1'
         subject[:k2] = '2'
+        subject[:k]
         subject[:k3] = '3'
         subject[:k4] = '4'
-        subject.size.should == 3
-
-        subject[:k4].should be_true
-        subject[:k3].should be_true
-        subject[:k2].should be_true
-        subject[:k].should be_nil
 
-        subject.clear
+        subject.size.should == 3
 
-        subject.max_size = 1
-        subject[:k]  = '1'
-        subject[:k2] = '3'
-        subject[:k3] = '4'
-        subject.size.should == 1
+        ap subject
 
+        subject[:k].should be_true
+        subject[:k4].should be_true
         subject[:k3].should be_true
         subject[:k2].should be_nil
-        subject[:k].should be_nil
     end
 
     describe '#[]=' do

data/spec/arachni/support/database/queue_spec.rb

@@ -167,6 +167,13 @@ describe Arachni::Support::Database::Queue do
         end
     end
 
+    describe '#free_buffer_size' do
+        it 'returns the size of the available buffer' do
+            (subject.max_buffer_size - 2).times { |i| subject << i }
+            subject.free_buffer_size.should == 2
+        end
+    end
+
     describe '#buffer_size' do
         it 'returns the size of the in-memory entries' do
             subject.buffer_size.should == 0

data/spec/arachni/support/mixins/observable_spec.rb

@@ -57,11 +57,25 @@ describe Arachni::Support::Mixins::Observable do
         end
     end
 
-    describe '#call_<event>' do
+    describe '#notify' do
         it 'returns nil' do
             subject.my_event { }
             subject.notify( :my_event ).should be_nil
         end
+
+        context 'when a callback raises an exception' do
+            it 'does not affect other callbacks' do
+                called = []
+
+                subject.my_event { called << 1 }
+                subject.my_event { called << 2; raise }
+                subject.my_event { called << 3 }
+
+                subject.notify( :my_event )
+
+                called.should == [1, 2, 3]
+            end
+        end
     end
 
     describe '#clear_observers' do

data/spec/arachni/trainer_spec.rb

@@ -99,9 +99,9 @@ describe Arachni::Trainer do
                 @framework.pages.size.should == 0
 
                 Arachni::HTTP::Client.request( @url + '/elems', train: true )
-                @framework.run
 
-                @framework.pages.size.should == 1
+                @trainer.should receive(:push)
+                @framework.run
             end
 
             context 'when a redirection leads to new elements' do

data/spec/components/checks/active/code_injection_timing_spec.rb

@@ -4,7 +4,7 @@ describe name_from_filename do
     include_examples 'check'
 
     def self.platforms
-        [:ruby, :php, :perl, :python, :jsp, :asp]
+        [:ruby, :php, :perl, :python, :java, :asp]
     end
 
     def self.elements

data/spec/components/checks/active/file_inclusion_spec.rb

@@ -4,7 +4,7 @@ describe name_from_filename do
     include_examples 'check'
 
     def self.platforms
-        [:unix, :windows, :tomcat, :php, :perl]
+        [:unix, :windows, :php, :perl, :java]
     end
 
     def self.elements
@@ -32,7 +32,7 @@ describe name_from_filename do
                 Element::JSON         => 96,
                 Element::XML          => 192
             },
-            tomcat:  {
+            java:    {
                 Element::Form         => 8,
                 Element::Link         => 8,
                 Element::Cookie       => 8,
@@ -44,11 +44,11 @@ describe name_from_filename do
             php:  {
                 Element::Form         => 120,
                 Element::Link         => 120,
-                Element::Cookie       => 120,
-                Element::Header       => 60,
+                Element::Cookie       => 112,
+                Element::Header       => 56,
                 Element::LinkTemplate => 60,
-                Element::JSON         => 120,
-                Element::XML          => 240
+                Element::JSON         => 112,
+                Element::XML          => 224
             },
             perl:  {
                 Element::Form         => 120,

data/spec/components/checks/active/path_traversal_spec.rb

@@ -4,7 +4,7 @@ describe name_from_filename do
     include_examples 'check'
 
     def self.platforms
-        [:unix, :windows, :tomcat]
+        [:unix, :windows, :java]
     end
 
     def self.elements
@@ -32,7 +32,7 @@ describe name_from_filename do
                 Element::JSON         => 504,
                 Element::XML          => 672
             },
-            tomcat:  {
+            java:    {
                 Element::Form         => 8,
                 Element::Link         => 8,
                 Element::Cookie       => 8,

data/spec/components/checks/active/source_code_disclosure_spec.rb

@@ -4,7 +4,7 @@ describe name_from_filename do
     include_examples 'check'
 
     def self.platforms
-        [:php, :asp, :jsp]
+        [:php, :asp, :java]
     end
 
     def self.elements
@@ -17,7 +17,7 @@ describe name_from_filename do
             Element::Form         => 6,
             Element::Link         => 6,
             Element::Cookie       => 4,
-            Element::Header       => 3,
+            Element::Header       => 4,
             Element::LinkTemplate => 5,
             Element::JSON         => 6,
             Element::XML          => 16

data/spec/components/checks/active/unvalidated_redirect_spec.rb

@@ -10,12 +10,12 @@ describe name_from_filename do
 
     def issue_count_per_element
         {
-            Element::Form   => 16,
-            Element::Link   => 16,
-            Element::Cookie => 16,
-            Element::Header => 8,
-            Element::JSON   => 12,
-            Element::XML    => 24
+            Element::Form   => 5,
+            Element::Link   => 5,
+            Element::Cookie => 5,
+            Element::Header => 5,
+            Element::JSON   => 3,
+            Element::XML    => 6
         }
     end
 

data/spec/components/checks/active/xss_dom_inputs_spec.rb

@@ -9,7 +9,7 @@ describe name_from_filename do
 
     def issue_count_per_element
         {
-            Element::GenericDOM => 16
+            Element::GenericDOM => 9
         }
     end
 
@@ -20,13 +20,11 @@ describe name_from_filename do
     end
 
     easy_test do
-        issues.each do |issue|
-            issue.vector.type.should == :input
-        end
+        issues.select { |i| i.vector.type == :input }.size.should == 8
+        issues.select { |i| i.vector.type == :button }.size.should == 1
 
         Arachni::Browser::Javascript::EVENTS_PER_ELEMENT[:input].each do |event|
             find_issue( event ).vector.action.should end_with event.to_s
         end
-
     end
 end

data/spec/components/checks/active/xss_dom_script_context_spec.rb

@@ -12,7 +12,7 @@ describe name_from_filename do
         {
             Element::Form::DOM         => 2,
             Element::Link::DOM         => 2,
-            Element::Cookie::DOM       => 1,
+            Element::Cookie::DOM       => 2,
             Element::LinkTemplate::DOM => 2
         }
     end

data/spec/components/checks/active/xss_spec.rb

@@ -10,11 +10,11 @@ describe name_from_filename do
 
     def issue_count_per_element
         {
-            Element::Link         => 9,
-            Element::Form         => 6,
-            Element::Cookie       => 6,
-            Element::Header       => 5,
-            Element::LinkTemplate => 6
+            Element::Link         => 13,
+            Element::Form         => 12,
+            Element::Cookie       => 12,
+            Element::Header       => 11,
+            Element::LinkTemplate => 12
         }
     end
 

data/spec/components/checks/passive/common_admin_interfaces_spec.rb

@@ -0,0 +1,15 @@
+require 'spec_helper'
+
+describe name_from_filename do
+    include_examples 'check'
+
+    def self.elements
+        [ Element::Server ]
+    end
+
+    def issue_count
+        current_check.resources.count
+    end
+
+    easy_test
+end

data/spec/components/checks/passive/interesting_responses_spec.rb

@@ -7,7 +7,7 @@ describe name_from_filename do
         [ Element::Server ]
     end
 
-    it 'intercepts all HTTP responses and log ones with status codes other than 200 or 404' do
+    it 'logs HTTP responses with status codes other than 200 or 404' do
         run
         current_check.acceptable.each do |code|
             http.get( url + code.to_s )
@@ -20,4 +20,17 @@ describe name_from_filename do
         max_issues = current_check.max_issues
         issues.size.should == max_issues
     end
+
+    it 'skips HTTP responses which are out of scope' do
+        options.scope.exclude_path_patterns << /blah/
+
+        run
+
+        current_check.acceptable.each do |code|
+            http.get( url + 'blah/' + code.to_s )
+        end
+        http.run
+
+        issues.should be_empty
+    end
 end

data/spec/components/fingerprinters/frameworks/aspx_mvc_spec.rb

@@ -0,0 +1,31 @@
+require 'spec_helper'
+
+describe Arachni::Platform::Fingerprinters::ASPXMVC do
+    include_examples 'fingerprinter'
+
+    def platforms
+        [:asp, :aspx, :windows, :aspx_mvc]
+    end
+
+    context 'when there is a __requestverificationtoken cookie' do
+        it 'identifies it as ASP.NET MVC' do
+            check_platforms Arachni::Page.from_data(
+                url:     'http://stuff.com/blah',
+                cookies: [Arachni::Cookie.new(
+                              url:    'http://stuff.com/blah',
+                              inputs: { '__requestverificationtoken' => 'stuff' } )]
+
+            )
+        end
+    end
+
+    context 'when there is an X-AspNetMvc-Version header' do
+        it 'identifies it as ASP.NET MVC' do
+            check_platforms Arachni::Page.from_data(
+                url: 'http://stuff.com/blah',
+                response: { headers: { 'X-AspNetMvc-Version' => '2.0' } }
+            )
+        end
+    end
+
+end

data/spec/components/fingerprinters/frameworks/cakephp_spec.rb

@@ -0,0 +1,22 @@
+require 'spec_helper'
+
+describe Arachni::Platform::Fingerprinters::CakePHP do
+    include_examples 'fingerprinter'
+
+    def platforms
+        [:php, :cakephp]
+    end
+
+    context 'when there is a CAKEPHP cookie' do
+        it 'identifies it as CakePHP' do
+            check_platforms Arachni::Page.from_data(
+                url:     'http://stuff.com/blah',
+                cookies: [Arachni::Cookie.new(
+                              url: 'http://stuff.com/blah',
+                              inputs: { 'CAKEPHP' => 'stuff' } )]
+
+            )
+        end
+    end
+
+end

data/spec/components/fingerprinters/frameworks/cherrypy_spec.rb

@@ -0,0 +1,28 @@
+require 'spec_helper'
+
+describe Arachni::Platform::Fingerprinters::CherryPy do
+    include_examples 'fingerprinter'
+
+    def platforms
+        [:python, :cherrypy]
+    end
+
+    context 'when there is a Server header' do
+        it 'identifies it as CherryPy' do
+            check_platforms Arachni::Page.from_data(
+                url: 'http://stuff.com/blah',
+                response: { headers: { 'Server' => 'CherryPy/0.1' } }
+            )
+        end
+    end
+
+    context 'when there is an X-Powered-By header' do
+        it 'identifies it as CherryPy' do
+            check_platforms Arachni::Page.from_data(
+                url: 'http://stuff.com/blah',
+                response: { headers: { 'X-Powered-By' => 'CherryPy/0.1' } }
+            )
+        end
+    end
+
+end

data/spec/components/fingerprinters/frameworks/django_spec.rb

@@ -0,0 +1,37 @@
+require 'spec_helper'
+
+describe Arachni::Platform::Fingerprinters::Django do
+    include_examples 'fingerprinter'
+
+    def platforms
+        [:python, :django]
+    end
+
+    context 'when there is a Server header' do
+        it 'identifies it as Django' do
+            check_platforms Arachni::Page.from_data(
+                url: 'http://stuff.com/blah',
+                response: { headers: { 'Server' => 'WSGIServer/0.1mt Django/2.7.4' } }
+            )
+        end
+    end
+
+    context 'when there is an X-Powered-By header' do
+        it 'identifies it as Django' do
+            check_platforms Arachni::Page.from_data(
+                url: 'http://stuff.com/blah',
+                response: { headers: { 'X-Powered-By' => 'Django' } }
+            )
+        end
+    end
+
+    context 'when there are X-Django headers' do
+        it 'identifies it as Django' do
+            check_platforms Arachni::Page.from_data(
+                url: 'http://stuff.com/blah',
+                response: { headers: { 'X-Django-Stuff' => 'Blah' } }
+            )
+        end
+    end
+
+end

data/spec/components/fingerprinters/frameworks/jsf_spec.rb

@@ -0,0 +1,27 @@
+require 'spec_helper'
+
+describe Arachni::Platform::Fingerprinters::JSF do
+    include_examples 'fingerprinter'
+
+    def platforms
+        [:java, :jsf]
+    end
+
+    context 'when there is an X-Powered-By header with JSF' do
+        it 'identifies it as JSF' do
+            check_platforms Arachni::Page.from_data(
+                url:     'http://stuff.com/blah',
+                response: { headers:  { 'X-Powered-By' => 'JSF/2.1' } }
+            )
+        end
+    end
+
+    context 'when there is a javax.faces.Token query parameter' do
+        it 'identifies it as JSF' do
+            check_platforms Arachni::Page.from_data(
+                url: 'http://stuff.com/blah?javax.faces.Token=stuff'
+            )
+        end
+    end
+
+end

data/spec/components/fingerprinters/frameworks/rack_spec.rb

@@ -3,40 +3,37 @@ require 'spec_helper'
 describe Arachni::Platform::Fingerprinters::Rack do
     include_examples 'fingerprinter'
 
+    def platforms
+        [:ruby, :rack]
+    end
+
     context 'when there is a rack.session cookie' do
         it 'identifies it as Rack' do
-            page = Arachni::Page.from_data(
+            check_platforms Arachni::Page.from_data(
                 url:     'http://stuff.com/blah',
                 cookies: [Arachni::Cookie.new(
                               url:    'http://stuff.com/blah',
                               inputs: { 'rack.session' => 'stuff' } )]
 
             )
-            platforms_for( page ).should include :ruby
-            platforms_for( page ).should include :rack
         end
     end
 
-    context 'when there is a Server header' do
+    context 'when there is an X-Powered-By header' do
         it 'identifies it as Rack' do
-            page = Arachni::Page.from_data(
+            check_platforms Arachni::Page.from_data(
                 url: 'http://stuff.com/blah',
-                response: { headers: { 'Server' => 'mod_rack' } }
+                response: { headers: { 'X-Powered-By' => 'mod_rack' } }
             )
-            platforms_for( page ).should include :ruby
-            platforms_for( page ).should include :rack
         end
     end
 
-    context 'when there is an X-Powered-By header' do
+    context 'when there is an X-Rack-* header' do
         it 'identifies it as Rack' do
-            page = Arachni::Page.from_data(
+            check_platforms Arachni::Page.from_data(
                 url: 'http://stuff.com/blah',
-                response: { headers: { 'X-Powered-By' => 'mod_rack' } }
+                response: { headers: { 'X-Rack-Stuff' => 'Blah' } }
             )
-            platforms_for( page ).should include :ruby
-            platforms_for( page ).should include :rack
         end
     end
-
 end